super_settings 2.5.0 → 2.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5417df66afb91b92e9142075a083883d6884a5f148858b43738cafb4bbe5aea3
-  data.tar.gz: 7156046f2de10818424ff1997a1aea922ea5c67ebea1c0fe2ce8ffbb5f8a9746
+  metadata.gz: 290e32e0c4e0a4512fa7e4192a91fd9e654d1500a28bae270c8f21ec9c1a8478
+  data.tar.gz: 11ff70806b5849faae35e1d05f226af696f40a0f60334880fe0944d7770d48c1
 SHA512:
-  metadata.gz: a8fd1761f7cf0eeee7b30d06ea1dc7b766dde492c3b8786fb549469ee76e1d81321696ea1d8bef1a272896be6992ab5af598cf521e4c91090602f5fe809de146
-  data.tar.gz: fc346701a55ad717e806d234780df064aebe15d981e1e5da65c4d435bcb6b8b13d6b5ac240d654e827e167ebd083dbb8e4319831bb7aa09aba94b44ac27b8f7f
+  metadata.gz: 912971873912df17a2ff9eb3c2462356161fb19ee7bb2c127264f12b59cfff2282ad1084eb62c3e62ec91afed8a49de22ad3fc0cb30a40d2982e230a951765dc
+  data.tar.gz: b843b3b01bbd4ab7e8a91328c20134379bb6f5a218d7bef0a34f0b3868aed9b7f41746b1cbb3949e76f3b22290fd44be7ec0e4a1af360057e7235bb2ac0f4fc7

data/CHANGELOG.md

@@ -4,6 +4,43 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 2.6.1
+
+### Security
+
+- Fixed a stored cross-site scripting (XSS) vulnerability where a setting key was interpolated into the history pagination links in the web UI without HTML escaping. A user with write access could craft a key that executed JavaScript in another user's browser.
+
+### Fixed
+
+- Fixed `Setting.save!` raising a `NoMethodError` in non-Rails applications that relied on the implicit ActiveRecord storage default. The transaction now resolves the storage class through the public accessor instead of the uninitialized instance variable.
+- Fixed `LocalCache#to_h` returning only the first element of `array` type settings. It now returns the full array value.
+- Fixed `Setting#save!` always updating the `updated_at` timestamp (and triggering a write) even when nothing had changed, which caused unnecessary cache invalidation across processes.
+- Fixed a race condition in `LocalCache` where a value read on a cache miss could overwrite a fresher value written by a concurrent refresh.
+- Fixed `LocalCache#refresh` never picking up newly added settings if the cache had been loaded while the data store was empty.
+- Fixed `LocalCache` returning mutable array values for settings added by a cache refresh or a cache miss. All cached values are now frozen so callers cannot mutate the shared cache.
+- Fixed the web UI history view failing to render when a history record has no timestamp.
+- Fixed a duplicate-key race in `ActiveRecordStorage#save!` that raised an unhandled `ActiveRecord::RecordNotUnique` when the same key was created concurrently. The conflict is now retried and merged.
+- Fixed a bulk update against `HttpStorage` silently reporting success when the remote API rejected the changes. `bulk_update` now returns `false` and `save!` raises a `SuperSettings::Setting::PersistenceError` in this case so storage failures can be distinguished from validation errors. The storage failure message is reported in the `errors` payload so the web UI and API clients are told why the update failed.
+- Fixed thread-safety issues in the cached S3 and MongoDB clients that could expose a stale client or permanently cache a `nil` client after a transient connection failure.
+- Fixed `MongoDBStorage.find_by_key` returning records that reported `persisted?` as `false`.
+- Fixed the escaping of `SuperSettings.authentication_url` when injected into the inline web UI JavaScript. URLs containing single quotes previously produced corrupted or invalid JavaScript.
+- Fixed the Rack application returning 404 for all routes when mounted under a path (e.g. via `map` or Rails `mount`) without repeating the mount path in the constructor.
+- Fixed `HttpClient` corrupting base URLs that include a query string when appending the trailing path separator.
+- Fixed `HttpClient` retrying non-idempotent POST requests after a connection error, which could apply an update twice. The retry of a GET request now discards the failed connection instead of reusing it.
+- Fixed the `/settings/updated_since` endpoint returning a 500 (or a misleading empty success) when the `time` parameter was missing or unparseable. It now returns a 400 Bad Request.
+- Fixed the web UI POST endpoint returning a 500 for malformed JSON request bodies instead of a 400 Bad Request. The endpoint now also returns a 400 Bad Request when the `settings` parameter is missing or is not an array of hashes.
+- Fixed an authenticated but unauthorized user being redirected to the login page (a potential redirect loop) instead of receiving a 403 Forbidden.
+- Fixed the Rails layout helper using the raw dark mode selector instead of the resolved value, which could render a page with mismatched light/dark styling.
+- Fixed `Coerce.boolean` returning `true` for a whitespace-only string.
+- Fixed the Rails engine eagerly loading `ActiveJob::Base` during initialization.
+- Added a missing `require "time"` so `Time.parse` based coercion works in non-Rails applications.
+
+## 2.6.0
+
+### Added
+
+- Added `SuperSettings::Application#dark_mode_selector` configuration option that allows you to specify a CSS selector that sets dark mode when it matches an element in the page. This is an alternative to using the `color_scheme` option and allows for more flexible control of when dark mode is enabled.
+
 ## 2.5.0
 
 ### Added

data/README.md

@@ -308,6 +308,13 @@ SuperSettings.configure do |config|
   # Set the color scheme to use for the Web UI. Options are :light (default), :dark, or :system.
   config.controller.color_scheme = :dark
 
+  # Set a CSS selector for enabling dark mode. When the selector matches an element on the page,
+  # dark mode styles will be applied. A theme toggle button will also be rendered in the header
+  # allowing users to switch between light and dark modes (persisted via localStorage).
+  # This is an alternative to the color_scheme option. If neither color_scheme nor dark_mode_selector
+  # is set, it defaults to "[data-theme=dark]" which enables the toggle automatically.
+  config.controller.dark_mode_selector = "[data-theme=dark]"
+
   # Add additional code to the controller. In this case we are adding code to ensure only
   # admins can access the functionality and changing the layout to use one defined by the application.
   config.controller.enhance do
@@ -461,15 +468,9 @@ This will work out of the box with the defaults for the storage engines when run
 
 - `REDIS_URL` - `redis://localhost:6379/0`
 - `REST_API_URL` - `http://localhost:3000/settings` (this is the default URL for the Rails application)
-- `S3_URL` - `s3://accesskey:secretkey@region-1/settings/settings.json` (the S3 endpoint will be set to `http://localhost:9000`)
+- `S3_URL` - `s3://accesskey:secretkey@region-1/settings/settings.json` (the S3 endpoint will be set to `http://localhost:24456`)
 - `MONGODB_URL` - `mongodb://localhost:27017/super_settings`
 
-Finally, you can run the application in dark mode by setting the `COLOR_SCHEME` environment variable.
-
-```bash
-COLOR_SCHEME=dark bundle exec rackup
-```
-
 ## License
 
 The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).

data/VERSION

@@ -1 +1 @@
-2.5.0
+2.6.1

data/app/helpers/super_settings/settings_helper.rb

@@ -29,6 +29,7 @@ module SuperSettings
       application_dir = File.expand_path(File.join("..", "..", "..", "lib", "super_settings", "application"), __dir__)
       erb = ERB.new(File.read(File.join(application_dir, "layout_vars.css.erb")))
       color_scheme = SuperSettings.configuration.controller.color_scheme
+      dark_mode_selector = SuperSettings.configuration.controller.resolved_dark_mode_selector
       erb.result(binding).html_safe
     end
   end

data/lib/super_settings/application/helper.rb

@@ -56,7 +56,7 @@ module SuperSettings
           window.__superSettingsI18n = #{translations_json};
           #{File.read(File.join(__dir__, "scripts.js"))}
           #{File.read(File.join(__dir__, "api.js"))}
-          #{"SuperSettingsAPI.authenticationUrl = '#{SuperSettings.authentication_url.gsub("'", "\\'")}';" if SuperSettings.authentication_url}
+          #{"SuperSettingsAPI.authenticationUrl = #{SuperSettings.authentication_url.to_s.to_json.gsub("</", "<\\/")};" if SuperSettings.authentication_url}
           #{SuperSettings.web_ui_javascript}
         </script>
       HTML
@@ -222,6 +222,14 @@ module SuperSettings
       @color_scheme if defined?(@color_scheme)
     end
 
+    # A CSS selector that sets dark mode when it matches an element in the page.
+    # This is an alternative to using the color_scheme option.
+    #
+    # @return [String, nil]
+    def dark_mode_selector
+      @dark_mode_selector if defined?(@dark_mode_selector)
+    end
+
     # Whether the application is in read-only mode.
     #
     # @return [Boolean]

data/lib/super_settings/application/layout.html.erb

@@ -8,6 +8,18 @@
     <meta name="format-detection" content="telephone=no email=no date=no address=no">
     <meta name="robots" content="noindex, nofollow">
     <meta name="referrer" content="no-referrer-when-downgrade">
+    <% if dark_mode_selector %>
+    <script>
+      (function() {
+        try {
+          if (localStorage.getItem("super_settings_theme") === "dark") {
+            document.documentElement.setAttribute("data-theme", "dark");
+          }
+        } catch (e) {
+        }
+      })();
+    </script>
+    <% end %>
     <%= layout_style_tag %>
     <%= add_to_head %>
   </head>
@@ -16,6 +28,24 @@
     <header class="super-settings-page-header">
       <div class="super-settings-page-header-inner">
         <%= application_header %>
+        <% if dark_mode_selector %>
+        <button type="button" class="super-settings-theme-toggle" id="super-settings-theme-toggle" aria-label="Toggle dark mode">
+          <svg class="super-settings-theme-icon super-settings-theme-icon-sun" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round">
+            <circle cx="12" cy="12" r="4"></circle>
+            <path d="M12 2v2"></path>
+            <path d="M12 20v2"></path>
+            <path d="m4.93 4.93 1.41 1.41"></path>
+            <path d="m17.66 17.66 1.41 1.41"></path>
+            <path d="M2 12h2"></path>
+            <path d="M20 12h2"></path>
+            <path d="m6.34 17.66-1.41 1.41"></path>
+            <path d="m19.07 4.93-1.41 1.41"></path>
+          </svg>
+          <svg class="super-settings-theme-icon super-settings-theme-icon-moon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round">
+            <path d="M12 3a6 6 0 0 0 9 9 9 9 0 1 1-9-9Z"></path>
+          </svg>
+        </button>
+        <% end %>
       </div>
     </header>
 
@@ -72,5 +102,31 @@
         </details>
       </footer>
     <% end %>
+    <% if dark_mode_selector %>
+    <script>
+      (function() {
+        var toggle = document.getElementById("super-settings-theme-toggle");
+        if (!toggle) return;
+
+        var html = document.documentElement;
+        toggle.addEventListener("click", function() {
+          var isDark = html.getAttribute("data-theme") === "dark";
+          if (isDark) {
+            html.removeAttribute("data-theme");
+            try {
+              localStorage.removeItem("super_settings_theme");
+            } catch (e) {
+            }
+          } else {
+            html.setAttribute("data-theme", "dark");
+            try {
+              localStorage.setItem("super_settings_theme", "dark");
+            } catch (e) {
+            }
+          }
+        });
+      })();
+    </script>
+    <% end %>
   </body>
 </html>

data/lib/super_settings/application/layout_styles.css

@@ -112,6 +112,43 @@ a:visited {
   justify-content: flex-end;
 }
 
+.super-settings-theme-toggle {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  width: 36px;
+  height: 36px;
+  border: 1px solid transparent;
+  border-radius: 8px;
+  background: transparent;
+  color: #9ca3af;
+  cursor: pointer;
+  flex-shrink: 0;
+  transition: color 0.2s, border-color 0.2s;
+}
+
+.super-settings-theme-toggle:hover {
+  color: var(--link-color);
+  border-color: var(--link-color);
+}
+
+.super-settings-theme-icon {
+  width: 18px;
+  height: 18px;
+}
+
+.super-settings-theme-icon-moon {
+  display: none;
+}
+
+[data-theme="dark"] .super-settings-theme-icon-sun {
+  display: none;
+}
+
+[data-theme="dark"] .super-settings-theme-icon-moon {
+  display: block;
+}
+
 /* ══════════════════════════════════════════
    LANGUAGE MENU (in footer)
    ══════════════════════════════════════════ */

data/lib/super_settings/application/layout_vars.css.erb

@@ -13,7 +13,11 @@
 <% end %>
 <% if color_scheme == :system || color_scheme == :dark %>
   :root {
-    --text-color: #e5e7eb;
+<% elsif dark_mode_selector %>
+  :root<%= dark_mode_selector %> {
+<% end %>
+<% if color_scheme == :system || color_scheme == :dark || dark_mode_selector %>
+    --text-color: #eef0f8;
     --background-color: #1a1d23;
     --header-background-color: #21252b;
     --link-color: #2dd4bf;

data/lib/super_settings/application/scripts.js

@@ -413,8 +413,13 @@
     const historyItems = parent.querySelector(".super-settings-history-items");
     let itemsHTML = "";
     payload.histories.forEach(function(history) {
-      const date = new Date(Date.parse(history.created_at));
-      const dateString = dateFormatter().format(date);
+      let dateString = "";
+      if (history.created_at) {
+        const timestamp = Date.parse(history.created_at);
+        if (!isNaN(timestamp)) {
+          dateString = dateFormatter().format(new Date(timestamp));
+        }
+      }
       const value = (history.deleted ? '<em class="super-settings-text-danger">' + escapeHTML(t("history.deleted")) + '</em>' : escapeHTML(history.value));
       itemsHTML += `<div class="super-settings-history-item">
         <div class="super-settings-history-time">${escapeHTML(dateString)}</div>
@@ -427,10 +432,10 @@
     if (payload.previous_page_params || payload.next_page_params) {
       let paginationHTML = `<div class="super-settings-align-center">`;
       if (payload.previous_page_params) {
-        paginationHTML += `<div style="float:left;"><a href="#" class="js-show-history" title="${escapeHTML(t("history.newer"))}" data-offset="${payload.previous_page_params.offset}" data-limit="${payload.previous_page_params.limit}" data-key="${payload.previous_page_params.key}")>&#8592; ${escapeHTML(t("history.newer"))}</a></div>`;
+        paginationHTML += `<div style="float:left;"><a href="#" class="js-show-history" title="${escapeHTML(t("history.newer"))}" data-offset="${payload.previous_page_params.offset}" data-limit="${payload.previous_page_params.limit}" data-key="${escapeHTML(payload.previous_page_params.key)}">&#8592; ${escapeHTML(t("history.newer"))}</a></div>`;
       }
       if (payload.next_page_params) {
-        paginationHTML += `<div style="float:right;"><a href="#" class="js-show-history" title="${escapeHTML(t("history.older"))}" data-offset="${payload.next_page_params.offset}" data-limit="${payload.next_page_params.limit}" data-key="${payload.next_page_params.key}")>${escapeHTML(t("history.older"))} &#8594;</a></div>`;
+        paginationHTML += `<div style="float:right;"><a href="#" class="js-show-history" title="${escapeHTML(t("history.older"))}" data-offset="${payload.next_page_params.offset}" data-limit="${payload.next_page_params.limit}" data-key="${escapeHTML(payload.next_page_params.key)}">${escapeHTML(t("history.older"))} &#8594;</a></div>`;
       }
       paginationHTML += '<div style="clear:both;"></div>';
       parent.querySelector(".super-settings-history-container").insertAdjacentHTML("afterend", paginationHTML);

data/lib/super_settings/application/style_vars.css.erb

@@ -71,8 +71,10 @@
 
 <% if color_scheme == :system %>
   @media (prefers-color-scheme: dark) {
+<% elsif dark_mode_selector %>
+  <%= dark_mode_selector %> {
 <% end %>
-<% if color_scheme == :system || color_scheme == :dark %>
+<% if color_scheme == :system || color_scheme == :dark || dark_mode_selector %>
   .super-settings {
     /* Canvas */
     --bg-page: #1a1d23;
@@ -128,6 +130,6 @@
     --icon-disabled-color: #4b5563;
   }
 <% end %>
-<% if color_scheme == :system %>
+<% if color_scheme == :system || dark_mode_selector %>
   }
 <% end %>

data/lib/super_settings/application.rb

@@ -8,14 +8,16 @@ module SuperSettings
     include Helper
 
     # @param layout [String, Symbol] path to an ERB template to use as the layout around the application UI. You can
-    #                                pass the symbol +:default+ to use the default layout that ships with the gem.
+    #   pass the symbol +:default+ to use the default layout that ships with the gem.
     # @param add_to_head [String] HTML code to add to the <head> element on the page.
     # @param api_base_url [String] the base URL for the REST API.
     # @param color_scheme [Symbol] whether to use dark mode for the application UI. If +nil+, the user's system
-    #                              preference will be used.
+    #   preference will be used.
+    # @param dark_mode_selector [String] a CSS selector that sets dark mode when it matches an element in the page.
+    #   This is an alternative to using the color_scheme option.
     # @param read_only [Boolean] whether to render the application in read-only mode (edit controls hidden).
     # @param locale [String] the locale code for translations (default: "en").
-    def initialize(layout: nil, add_to_head: nil, api_base_url: nil, color_scheme: nil, read_only: false, locale: nil)
+    def initialize(layout: nil, add_to_head: nil, api_base_url: nil, color_scheme: nil, dark_mode_selector: nil, read_only: false, locale: nil)
       if layout
         layout = File.expand_path(File.join("application", "layout.html.erb"), __dir__) if layout == :default
         @layout = ERB.new(File.read(layout)) if layout
@@ -27,6 +29,7 @@ module SuperSettings
 
       @api_base_url = api_base_url
       @color_scheme = color_scheme&.to_sym
+      @dark_mode_selector = dark_mode_selector
       @read_only = !!read_only
       @locale = locale || SuperSettings::MiniI18n::DEFAULT_LOCALE
     end
@@ -42,20 +45,12 @@ module SuperSettings
       html
     end
 
-    # Render the edit form HTML for a single setting.
-    #
-    # @return [String] the rendered HTML
-    def render_edit
-      template = ERB.new(File.read(File.expand_path(File.join("application", "edit.html.erb"), __dir__)))
-      html = template.result(binding)
-      html = render_layout { html } if @layout
-      html = html.html_safe if html.respond_to?(:html_safe)
-      html
-    end
-
     private
 
-    def render_layout
+    # The block is not called directly here; it is yielded to from the `<%= yield %>` call
+    # in the layout template which is evaluated with this method's binding. The block argument
+    # must be declared so that Ruby doesn't warn that the block may be ignored.
+    def render_layout(&block)
       @layout&.result(binding)
     end
   end

data/lib/super_settings/coerce.rb

@@ -21,13 +21,10 @@ module SuperSettings
       # @param value [Object]
       # @return [Boolean]
       def boolean(value)
-        if value == false
-          false
-        elsif blank?(value)
-          nil
-        else
-          !FALSE_VALUES.include?(value.to_s.downcase)
-        end
+        return false if value == false
+        return nil if blank?(value)
+
+        !FALSE_VALUES.include?(value.to_s.downcase)
       end
 
       # Cast a value to a Time object.

data/lib/super_settings/configuration.rb

@@ -12,6 +12,8 @@ module SuperSettings
 
     # Configuration for the controller.
     class Controller
+      VALID_COLOR_SCHEMES = [:light, :dark, :system].freeze
+
       # @api private
       attr_reader :enhancement
 
@@ -25,12 +27,13 @@ module SuperSettings
       def initialize
         @superclass = nil
         @web_ui_enabled = true
-        @color_scheme = false
+        @color_scheme = nil
         @changed_by_block = nil
         @enhancement = nil
         @application_name = nil
         @application_logo = nil
         @application_link = nil
+        @dark_mode_selector = nil
       end
 
       def superclass
@@ -41,10 +44,10 @@ module SuperSettings
         end
       end
 
-      # Optinal name of the application displayed in the view.
+      # Optional name of the application displayed in the view.
       attr_accessor :application_name
 
-      # Optional mage URL for the application logo.
+      # Optional image URL for the application logo.
       attr_accessor :application_logo
 
       # Optional URL for a link back to the rest of the application.
@@ -69,11 +72,30 @@ module SuperSettings
       end
 
       # Set dark mode for the web UI. Possible values are :light, :dark, or :system.
-      # The default value is :light.
+      # When the value is not set (or is invalid), theme selection is left dynamic.
       attr_writer :color_scheme
 
+      # Return the configured color scheme.
+      #
+      # @return [Symbol, nil]
       def color_scheme
-        (@color_scheme ||= :light).to_sym
+        scheme = @color_scheme&.to_sym
+        VALID_COLOR_SCHEMES.include?(scheme) ? scheme : nil
+      end
+
+      # Set a CSS selector that sets dark mode. This is an alternative to using the color_scheme
+      # option and can be used if you have a custom implementation for dark mode in your application.
+      # Dark mode will be enabled in the settings web UI when the selector matches an element in the page.
+      attr_accessor :dark_mode_selector
+
+      # Return the selector used to enable dark mode from host page state.
+      #
+      # @return [String, nil]
+      def resolved_dark_mode_selector
+        return @dark_mode_selector if @dark_mode_selector
+        return "[data-theme=dark]" if color_scheme.nil?
+
+        nil
       end
 
       # Enhance the controller. You can define methods or call controller class methods like
@@ -184,21 +206,28 @@ module SuperSettings
       @model = Model.new
       @controller = Controller.new
       @deferred_configs = []
+      @called = false
     end
 
     # Defer the execution of a block that will be yielded to with the config object. This
     # is needed in a Rails environment during initialization so that all the frameworks can
-    # load before loading the settings.
+    # load before loading the settings. If the deferred configuration has already been run
+    # (i.e. the application has finished initializing), the block is called immediately.
     #
     # @api private
     def defer(&block)
-      @deferred_configs << block
+      if @called
+        block.call(self)
+      else
+        @deferred_configs << block
+      end
     end
 
     # Call the block deferred during initialization.
     #
     # @api private
     def call
+      @called = true
       while (block = @deferred_configs.shift)
         block&.call(self)
       end

data/lib/super_settings/controller_actions.rb

@@ -19,8 +19,13 @@ module SuperSettings
 
     # Render the HTML application for managing settings.
     def root
-      html = SuperSettings::Application.new(read_only: super_settings_read_only?, locale: I18n.locale).render
-      render html: html.html_safe, layout: true
+      application = SuperSettings::Application.new(
+        read_only: super_settings_read_only?,
+        locale: I18n.locale,
+        color_scheme: SuperSettings.configuration.controller.color_scheme,
+        dark_mode_selector: SuperSettings.configuration.controller.resolved_dark_mode_selector
+      )
+      render html: application.render.html_safe, layout: true
     end
 
     # API endpoint for getting active settings. See SuperSettings::RestAPI for details.
@@ -70,7 +75,12 @@ module SuperSettings
 
     # API endpoint for getting settings that have changed since specified time. See SuperSettings::RestAPI for details.
     def updated_since
-      render json: SuperSettings::RestAPI.updated_since(params[:time])
+      result = SuperSettings::RestAPI.updated_since(params[:time])
+      if result
+        render json: result
+      else
+        render json: {error: "Invalid time parameter"}, status: 400
+      end
     end
 
     # API endpoint for checking if the user is authorized to edit settings.

data/lib/super_settings/engine.rb

@@ -10,8 +10,8 @@ module SuperSettings
     initializer("SuperSettings") do
       Rails.configuration.middleware.unshift(SuperSettings::Context::RackMiddleware)
 
-      if defined?(ActiveJob::Base.around_perform)
-        ActiveJob::Base.around_perform do |job, block|
+      ActiveSupport.on_load(:active_job) do
+        around_perform do |job, block|
           SuperSettings.context(&block)
         end
       end

data/lib/super_settings/http_client.rb

@@ -27,8 +27,8 @@ module SuperSettings
     end
 
     def initialize(base_url, headers: nil, params: nil, timeout: nil, user: nil, password: nil)
-      base_url = "#{base_url}/" unless base_url.end_with?("/")
       @base_uri = URI(base_url)
+      @base_uri.path = "#{@base_uri.path}/" unless @base_uri.path.end_with?("/")
       @base_uri.query = query_string(params) if params
       @headers = headers ? DEFAULT_HEADERS.merge(headers) : DEFAULT_HEADERS
       @timeout = timeout || DEFAULT_TIMEOUT
@@ -53,34 +53,35 @@ module SuperSettings
 
     def send_request(request)
       set_headers(request)
-      response_payload = nil
       attempts = 0
 
-      with_connection do |http|
-        http.start unless http.started?
-        response = http.request(request)
-
-        begin
-          response.value # raises exception unless response is a success
-          response_payload = JSON.parse(response.body)
-        rescue Net::ProtocolError
-          if [404, 410].include?(response.code.to_i)
-            raise NotFoundError.new("#{response.code} #{response.message}")
-          elsif response.code.to_i == 422
-            raise InvalidRecordError.new("#{response.code} #{response.message}", errors: JSON.parse(response.body)["errors"])
-          else
-            raise Error.new("#{response.code} #{response.message}")
+      begin
+        with_connection do |http|
+          http.start unless http.started?
+          response = http.request(request)
+
+          begin
+            response.value # raises exception unless response is a success
+            JSON.parse(response.body)
+          rescue Net::ProtocolError
+            if [404, 410].include?(response.code.to_i)
+              raise NotFoundError.new("#{response.code} #{response.message}")
+            elsif response.code.to_i == 422
+              raise InvalidRecordError.new("#{response.code} #{response.message}", errors: JSON.parse(response.body)["errors"])
+            else
+              raise Error.new("#{response.code} #{response.message}")
+            end
+          rescue JSON::JSONError => e
+            raise Error.new(e.message)
           end
-        rescue JSON::JSONError => e
-          raise Error.new(e.message)
         end
-      rescue IOError, Errno::ECONNRESET => connection_error
+      rescue IOError, Errno::ECONNRESET, Errno::EPIPE => connection_error
+        # Only retry idempotent requests; a POST may have already been processed by
+        # the server before the connection failed.
         attempts += 1
-        retry if attempts <= 1
+        retry if attempts <= 1 && request.is_a?(Net::HTTP::Get)
         raise connection_error
       end
-
-      response_payload
     end
 
     def with_connection(&block)