testimonials 0.7.10 → 0.8.0

data/app/views/testimonials/testimonials/index.html.erb

@@ -1,124 +1,126 @@
 <% content_for :body_class, 'tm-index' %>
 
-<div class="page-head">
-  <h1><%= t('testimonials.dashboard.title', default: 'Testimonials') %></h1>
-  <%# The shareable public form — drop this link into an email or DM. It lives
-      on the page, not in the nav, so it survives a host's admin_layout. %>
-  <% if Testimonials.config.public_collection %>
-    <a class="button share-link" href="<%= collection_url %>" target="_blank" rel="noopener"
-       title="<%= collection_url %>">
-      🔗 <%= t('testimonials.dashboard.collection_page', default: 'Ask for testimonials') %>
-    </a>
-  <% end %>
-</div>
+<%= render layout: 'testimonials/shared/dashboard' do %>
+  <div class="page-head">
+    <h1><%= t('testimonials.dashboard.title', default: 'Testimonials') %></h1>
+    <%# The shareable public form — drop this link into an email or DM. It lives
+        on the page, not in the nav, so it survives a host's admin_layout. %>
+    <% if Testimonials.config.public_collection %>
+      <a class="button share-link" href="<%= collection_url %>" target="_blank" rel="noopener"
+         title="<%= collection_url %>">
+        🔗 <%= t('testimonials.dashboard.collection_page', default: 'Ask for testimonials') %>
+      </a>
+    <% end %>
+  </div>
 
-<div class="dashboard-shell <%= 'has-selected' if @selected_testimonial %>">
-  <aside class="dashboard-sidebar" aria-label="<%= t('testimonials.dashboard.testimonials', default: 'Testimonials') %>">
-    <div class="tabs">
-      <% Testimonials::Testimonial::STATUSES.each do |status| %>
-        <%= link_to testimonials_path(status: status, kind: @kind, q: @query),
-                    class: ('active' if status == @status) do %>
-          <%= t("testimonials.statuses.#{status}", default: status.humanize) %>
-          <span class="count"><%= @counts.fetch(status, 0) %></span>
+  <div class="dashboard-shell <%= 'has-selected' if @selected_testimonial %>">
+    <aside class="dashboard-sidebar" aria-label="<%= t('testimonials.dashboard.testimonials', default: 'Testimonials') %>">
+      <div class="tabs">
+        <% Testimonials::Testimonial::STATUSES.each do |status| %>
+          <%= link_to testimonials_path(status: status, kind: @kind, q: @query),
+                      class: ('active' if status == @status) do %>
+            <%= t("testimonials.statuses.#{status}", default: status.humanize) %>
+            <span class="count"><%= @counts.fetch(status, 0) %></span>
+          <% end %>
         <% end %>
-      <% end %>
-    </div>
+      </div>
 
-    <form class="filters" method="get">
-      <input type="hidden" name="status" value="<%= @status %>">
-      <select name="kind" data-autosubmit="true">
-        <option value=""><%= t('testimonials.dashboard.all_kinds', default: 'All kinds') %></option>
-        <% Testimonials::Testimonial::KINDS.each do |kind| %>
-          <option value="<%= kind %>" <%= 'selected' if kind == @kind %>>
-            <%= t("testimonials.kinds.#{kind}", default: kind.humanize) %>
-          </option>
-        <% end %>
-      </select>
-      <input type="search" name="q" value="<%= @query %>"
-             placeholder="<%= t('testimonials.dashboard.search_placeholder', default: 'Search text, name, email…') %>"
-             aria-label="<%= t('testimonials.dashboard.search', default: 'Search') %>">
-      <button><%= t('testimonials.dashboard.search', default: 'Search') %></button>
-    </form>
+      <form class="filters" method="get">
+        <input type="hidden" name="status" value="<%= @status %>">
+        <select name="kind" data-autosubmit="true">
+          <option value=""><%= t('testimonials.dashboard.all_kinds', default: 'All kinds') %></option>
+          <% Testimonials::Testimonial::KINDS.each do |kind| %>
+            <option value="<%= kind %>" <%= 'selected' if kind == @kind %>>
+              <%= t("testimonials.kinds.#{kind}", default: kind.humanize) %>
+            </option>
+          <% end %>
+        </select>
+        <input type="search" name="q" value="<%= @query %>"
+               placeholder="<%= t('testimonials.dashboard.search_placeholder', default: 'Search text, name, email…') %>"
+               aria-label="<%= t('testimonials.dashboard.search', default: 'Search') %>">
+        <button><%= t('testimonials.dashboard.search', default: 'Search') %></button>
+      </form>
 
-    <div class="record-list">
-      <% if @testimonials.any? %>
-        <% @testimonials.each do |testimonial| %>
-          <%= link_to testimonials_path(status: @status, kind: @kind, q: @query, page: @page,
-                                        testimonial_id: testimonial.id),
-                      class: ['record-row testimonial-row',
-                              ('active' if @selected_testimonial&.id == testimonial.id)].compact do %>
-            <span class="record-main">
-              <span class="record-topline">
-                <% if testimonial.rating %>
-                  <span class="stars"><%= '★' * testimonial.rating %><span class="off"><%= '★' * (5 - testimonial.rating) %></span></span>
-                <% else %>
-                  <span class="badge locale"><%= t("testimonials.kinds.#{testimonial.kind}", default: testimonial.kind.humanize) %></span>
-                <% end %>
-                <span class="badge status-<%= testimonial.status %>">
-                  <%= t("testimonials.statuses.#{testimonial.status}", default: testimonial.status.humanize) %>
+      <div class="record-list">
+        <% if @testimonials.any? %>
+          <% @testimonials.each do |testimonial| %>
+            <%= link_to testimonials_path(status: @status, kind: @kind, q: @query, page: @page,
+                                          testimonial_id: testimonial.id),
+                        class: ['record-row testimonial-row',
+                                ('active' if @selected_testimonial&.id == testimonial.id)].compact do %>
+              <span class="record-main">
+                <span class="record-topline">
+                  <% if testimonial.rating %>
+                    <span class="stars"><%= '★' * testimonial.rating %><span class="off"><%= '★' * (5 - testimonial.rating) %></span></span>
+                  <% else %>
+                    <span class="badge locale"><%= t("testimonials.kinds.#{testimonial.kind}", default: testimonial.kind.humanize) %></span>
+                  <% end %>
+                  <span class="badge status-<%= testimonial.status %>">
+                    <%= t("testimonials.statuses.#{testimonial.status}", default: testimonial.status.humanize) %>
+                  </span>
+                  <span class="muted record-time" title="<%= testimonial.created_at %>">
+                    <%= time_ago_in_words(testimonial.created_at) %>
+                  </span>
                 </span>
-                <span class="muted record-time" title="<%= testimonial.created_at %>">
-                  <%= time_ago_in_words(testimonial.created_at) %>
+                <span class="record-copy">
+                  <% if testimonial.body.present? %>
+                    <%= truncate(testimonial.body, length: 120) %>
+                  <% else %>
+                    <em><%= t('testimonials.kinds.video', default: 'Video') %></em>
+                  <% end %>
+                </span>
+                <span class="muted record-meta">
+                  <span>#<%= testimonial.id %></span>
+                  <% if testimonial.display_name.present? %>
+                    <span><%= testimonial.display_name %></span>
+                  <% end %>
+                  <% if testimonial.title_company.present? %>
+                    <span><%= testimonial.title_company %></span>
+                  <% end %>
                 </span>
               </span>
-              <span class="record-copy">
-                <% if testimonial.body.present? %>
-                  <%= truncate(testimonial.body, length: 120) %>
-                <% else %>
-                  <em><%= t('testimonials.kinds.video', default: 'Video') %></em>
-                <% end %>
-              </span>
-              <span class="muted record-meta">
-                <span>#<%= testimonial.id %></span>
-                <% if testimonial.display_name.present? %>
-                  <span><%= testimonial.display_name %></span>
+              <span class="record-side">
+                <% if testimonial.video_attached? %>
+                  <span class="muted">🎥</span>
                 <% end %>
-                <% if testimonial.title_company.present? %>
-                  <span><%= testimonial.title_company %></span>
+                <% if testimonial.featured? %>
+                  <span class="muted">⭐</span>
                 <% end %>
+                <span class="muted"><%= testimonial.consent_given? ? '✓' : '—' %></span>
               </span>
-            </span>
-            <span class="record-side">
-              <% if testimonial.video_attached? %>
-                <span class="muted">🎥</span>
-              <% end %>
-              <% if testimonial.featured? %>
-                <span class="muted">⭐</span>
-              <% end %>
-              <span class="muted"><%= testimonial.consent_given? ? '✓' : '—' %></span>
-            </span>
+            <% end %>
           <% end %>
+        <% else %>
+          <div class="empty"><%= t('testimonials.dashboard.empty', default: 'Nothing here yet.') %></div>
         <% end %>
-      <% else %>
-        <div class="empty"><%= t('testimonials.dashboard.empty', default: 'Nothing here yet.') %></div>
-      <% end %>
-    </div>
-
-    <div class="pager">
-      <% if @page > 1 %>
-        <%= link_to t('testimonials.dashboard.newer', default: '← Newer'),
-                    testimonials_path(status: @status, kind: @kind, q: @query, page: @page - 1) %>
-      <% end %>
-      <% if @more %>
-        <%= link_to t('testimonials.dashboard.older', default: 'Older →'),
-                    testimonials_path(status: @status, kind: @kind, q: @query, page: @page + 1) %>
-      <% end %>
-    </div>
-  </aside>
+      </div>
 
-  <main class="dashboard-detail" aria-label="<%= t('testimonials.dashboard.current_testimonial', default: 'Current testimonial') %>">
-    <% if @selected_testimonial %>
-      <p class="mobile-back">
-        <%= link_to t('testimonials.dashboard.back', default: '← All testimonials'),
-                    testimonials_path(status: @status, kind: @kind, q: @query, page: @page) %>
-      </p>
-      <%= render 'testimonial_panel', testimonial: @selected_testimonial %>
-    <% else %>
-      <div class="empty-state">
-        <h2><%= t('testimonials.dashboard.select_testimonial', default: 'Select a testimonial') %></h2>
-        <p class="muted"><%= t('testimonials.dashboard.select_testimonial_hint',
-                               default: 'Open a review from the list to approve, feature, or tune the best line.') %></p>
+      <div class="pager">
+        <% if @page > 1 %>
+          <%= link_to t('testimonials.dashboard.newer', default: '← Newer'),
+                      testimonials_path(status: @status, kind: @kind, q: @query, page: @page - 1) %>
+        <% end %>
+        <% if @more %>
+          <%= link_to t('testimonials.dashboard.older', default: 'Older →'),
+                      testimonials_path(status: @status, kind: @kind, q: @query, page: @page + 1) %>
+        <% end %>
       </div>
-    <% end %>
-  </main>
-</div>
+    </aside>
+
+    <main class="dashboard-detail" aria-label="<%= t('testimonials.dashboard.current_testimonial', default: 'Current testimonial') %>">
+      <% if @selected_testimonial %>
+        <p class="mobile-back">
+          <%= link_to t('testimonials.dashboard.back', default: '← All testimonials'),
+                      testimonials_path(status: @status, kind: @kind, q: @query, page: @page) %>
+        </p>
+        <%= render 'testimonial_panel', testimonial: @selected_testimonial %>
+      <% else %>
+        <div class="empty-state">
+          <h2><%= t('testimonials.dashboard.select_testimonial', default: 'Select a testimonial') %></h2>
+          <p class="muted"><%= t('testimonials.dashboard.select_testimonial_hint',
+                                 default: 'Open a review from the list to approve, feature, or tune the best line.') %></p>
+        </div>
+      <% end %>
+    </main>
+  </div>
+<% end %>

data/app/views/testimonials/testimonials/show.html.erb

@@ -1,8 +1,10 @@
 <% content_for :body_class, 'tm-show' %>
 
-<div class="breadcrumb">
-  <%= link_to t('testimonials.dashboard.title', default: 'Testimonials'), root_path %>
-  / #<%= @testimonial.id %>
-</div>
+<%= render layout: 'testimonials/shared/dashboard' do %>
+  <div class="breadcrumb">
+    <%= link_to t('testimonials.dashboard.title', default: 'Testimonials'), root_path %>
+    / #<%= @testimonial.id %>
+  </div>
 
-<%= render 'testimonial_panel', testimonial: @testimonial %>
+  <%= render 'testimonial_panel', testimonial: @testimonial %>
+<% end %>

data/config/routes.rb

@@ -22,14 +22,27 @@ Testimonials::Engine.routes.draw do
   end
 
   # Media by testimonial id, gated (admin, author, or public_api + publishable).
-  get ':id/video', to: 'media#video', as: :testimonial_video, constraints: { id: /\d+/ }
-  get ':id/poster', to: 'media#poster', as: :testimonial_poster, constraints: { id: /\d+/ }
-  get ':id/avatar', to: 'media#avatar', as: :testimonial_avatar, constraints: { id: /\d+/ }
+  get ':id/video', to: 'media#video', as: :testimonial_video
+  get ':id/poster', to: 'media#poster', as: :testimonial_poster
+  get ':id/avatar', to: 'media#avatar', as: :testimonial_avatar
 
   # Flat, human URLs: the mount path IS the resource. /testimonials is the
   # dashboard, POST /testimonials the widget endpoint, /testimonials/2 a testimonial.
-  resources :testimonials, path: '', only: %i[create index show update destroy],
-                           constraints: { id: /\d+/ }
+  #
+  # No `id: /\d+/` constraint: it made these routes bigint-only, which forced
+  # the tables to be bigint too, which meant a uuid-keyed host could never
+  # attach a video or avatar (its active_storage_attachments.record_id is a
+  # uuid column). The constraint was never load-bearing — every fixed-name
+  # route above is declared first, so ordering already does the disambiguating,
+  # and an id that matches no record still 404s, just via RecordNotFound rather
+  # than a routing error.
+  #
+  # POST goes to SubmissionsController, not to this resource: the widget's write
+  # endpoint is public and the rest is staff-only, and only the staff half
+  # inherits config.base_controller_class. Sharing one controller would put a
+  # host's admin authentication in front of a member leaving a review.
+  post '', to: 'submissions#create', as: :submissions
+  resources :testimonials, path: '', only: %i[index show update destroy]
 
   root to: 'testimonials#index'
 end

data/lib/generators/testimonials/install/install_generator.rb

@@ -2,11 +2,13 @@
 
 require 'rails/generators'
 require 'rails/generators/active_record'
+require_relative '../migration_helpers'
 
 module Testimonials
   module Generators
     class InstallGenerator < Rails::Generators::Base
       include ActiveRecord::Generators::Migration
+      include MigrationHelpers
 
       source_root File.expand_path('templates', __dir__)
 
@@ -59,12 +61,6 @@ module Testimonials
             'widget — open it from your own button. Add it later with ' \
             '`bin/rails generate testimonials:prompt_events`.', :yellow
       end
-
-      private
-
-      def migration_version
-        "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
-      end
     end
   end
 end

data/lib/generators/testimonials/install/templates/create_testimonials_tables.rb.tt

@@ -2,7 +2,7 @@
 
 class CreateTestimonialsTables < ActiveRecord::Migration<%= migration_version %>
   def change
-    create_table :testimonials_testimonials do |t|
+    create_table :testimonials_testimonials<%= primary_key_type_option %> do |t|
       t.string :kind, null: false, default: 'text'
       t.text :body
       t.integer :rating
@@ -28,7 +28,7 @@ class CreateTestimonialsTables < ActiveRecord::Migration<%= migration_version %>
     add_index :testimonials_testimonials, %i[tenant status consent_given]
 <% unless options[:skip_nps] -%>
 
-    create_table :testimonials_nps_responses do |t|
+    create_table :testimonials_nps_responses<%= primary_key_type_option %> do |t|
       t.integer :score, null: false
       t.text :comment
       t.string :author_id
@@ -45,7 +45,7 @@ class CreateTestimonialsTables < ActiveRecord::Migration<%= migration_version %>
 <% end -%>
 <% unless options[:skip_prompt_events] -%>
 
-    create_table :testimonials_prompt_events do |t|
+    create_table :testimonials_prompt_events<%= primary_key_type_option %> do |t|
       t.string :kind, null: false
       t.string :action, null: false
       t.string :author_id

data/lib/generators/testimonials/install/templates/initializer.rb.tt

@@ -13,9 +13,17 @@ Testimonials.configure do |config|
   # only — override before deploying.
   # config.authorize_admin = ->(request) { request.env["warden"]&.user&.admin? }
   #
-  # Render the dashboard inside your app's admin layout. Default: the gem's
-  # standalone dashboard layout.
+  # Two ways to put the dashboard inside an admin you already have.
+  #
+  # The layout only — the gem's controllers, your shell:
   # config.admin_layout = "admin/application"
+  #
+  # Or the whole stack. Name the controller your own admin inherits from and
+  # the dashboard picks up its layout, helpers, authentication and any request
+  # context its before_actions set up. Only the dashboard inherits it; the
+  # widget's endpoints stay public, so this cannot ask a member leaving a
+  # review for a staff session.
+  # config.base_controller_class = "Admin::BaseController"
 
   # Attribute submissions to a user (optional). Return an object responding
   # to #id, or nil. Receives the request.

data/lib/generators/testimonials/migration_helpers.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module Testimonials
+  module Generators
+    # Shared bits every migration-writing generator needs.
+    module MigrationHelpers
+      private
+
+      def migration_version
+        "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
+      end
+
+      # Follow the host's own key type instead of forcing bigint. An app that
+      # keys its models with uuids sets this, and its
+      # `active_storage_attachments.record_id` is then a uuid column — bigint
+      # tables here could never take a video or avatar attachment, because a
+      # uuid foreign key has nowhere to point.
+      #
+      # Same lookup Rails' own Active Storage, Action Text and Action Mailbox
+      # migrations do, so a host that set it once gets consistent tables from
+      # all of them.
+      #
+      # Rendered as a `create_table` option rather than a bare value, because a
+      # template is expanded at generate time: emitting the method name would
+      # put `id: primary_key_type` in the migration, where nothing defines it.
+      # A host with no setting gets no option at all, so the migration reads
+      # exactly as it always did.
+      def primary_key_type_option
+        config = Rails.configuration.generators
+        type = config.options[config.orm][:primary_key_type]
+        type ? ", id: :#{type}" : ''
+      end
+    end
+  end
+end

data/lib/generators/testimonials/nps/nps_generator.rb

@@ -2,6 +2,7 @@
 
 require 'rails/generators'
 require 'rails/generators/active_record'
+require_relative '../migration_helpers'
 
 module Testimonials
   module Generators
@@ -12,6 +13,7 @@ module Testimonials
     #   bin/rails generate testimonials:nps && bin/rails db:migrate
     class NpsGenerator < Rails::Generators::Base
       include ActiveRecord::Generators::Migration
+      include MigrationHelpers
 
       source_root File.expand_path('templates', __dir__)
 
@@ -26,12 +28,6 @@ module Testimonials
         say "\nNPS table queued. Run `rails db:migrate`, then set", :green
         say 'config.nps = true in config/initializers/testimonials.rb to turn the flow on.'
       end
-
-      private
-
-      def migration_version
-        "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
-      end
     end
   end
 end

data/lib/generators/testimonials/nps/templates/create_testimonials_nps_responses.rb.tt

@@ -2,7 +2,7 @@
 
 class CreateTestimonialsNpsResponses < ActiveRecord::Migration<%= migration_version %>
   def change
-    create_table :testimonials_nps_responses do |t|
+    create_table :testimonials_nps_responses<%= primary_key_type_option %> do |t|
       t.integer :score, null: false
       t.text :comment
       t.string :author_id

data/lib/generators/testimonials/prompt_events/prompt_events_generator.rb

@@ -2,6 +2,7 @@
 
 require 'rails/generators'
 require 'rails/generators/active_record'
+require_relative '../migration_helpers'
 
 module Testimonials
   module Generators
@@ -13,6 +14,7 @@ module Testimonials
     #   bin/rails generate testimonials:prompt_events && bin/rails db:migrate
     class PromptEventsGenerator < Rails::Generators::Base
       include ActiveRecord::Generators::Migration
+      include MigrationHelpers
 
       source_root File.expand_path('templates', __dir__)
 
@@ -28,12 +30,6 @@ module Testimonials
         say 'config.prompt_events = true in config/initializers/testimonials.rb to let'
         say 'testimonial_prompt! auto-open the widget again.'
       end
-
-      private
-
-      def migration_version
-        "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
-      end
     end
   end
 end

data/lib/generators/testimonials/prompt_events/templates/create_testimonials_prompt_events.rb.tt

@@ -2,7 +2,7 @@
 
 class CreateTestimonialsPromptEvents < ActiveRecord::Migration<%= migration_version %>
   def change
-    create_table :testimonials_prompt_events do |t|
+    create_table :testimonials_prompt_events<%= primary_key_type_option %> do |t|
       t.string :kind, null: false
       t.string :action, null: false
       t.string :author_id

data/lib/generators/testimonials/tenant/tenant_generator.rb

@@ -2,6 +2,7 @@
 
 require 'rails/generators'
 require 'rails/generators/active_record'
+require_relative '../migration_helpers'
 
 module Testimonials
   module Generators
@@ -15,6 +16,7 @@ module Testimonials
     #   bin/rails generate testimonials:tenant && bin/rails db:migrate
     class TenantGenerator < Rails::Generators::Base
       include ActiveRecord::Generators::Migration
+      include MigrationHelpers
 
       source_root File.expand_path('templates', __dir__)
 
@@ -29,12 +31,6 @@ module Testimonials
         say "\ntenant column queued. Run `rails db:migrate`, then set", :green
         say 'config.tenant in config/initializers/testimonials.rb to scope per tenant.'
       end
-
-      private
-
-      def migration_version
-        "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
-      end
     end
   end
 end

data/lib/testimonials/configuration.rb

@@ -5,6 +5,10 @@ module Testimonials
   # works with zero configuration; the hooks below let an app decide who gets
   # prompted, who can triage, and how submissions are attributed.
   class Configuration
+    # The gem's own dashboard layout. Compared against, so DashboardController
+    # can tell "the host left this alone" from "the host chose this".
+    DEFAULT_ADMIN_LAYOUT = 'testimonials/application'
+
     # Shown in the widget ("Enjoying %{app}?") and interpolated into the
     # default questions. nil resolves to the Rails application name.
     attr_accessor :app_name
@@ -19,8 +23,26 @@ module Testimonials
 
     # Layout used by the built-in dashboard. Override this to render
     # Testimonials inside your app's admin shell, e.g. "admin/application".
+    # The lighter of the two ways to adopt a host's chrome; see
+    # base_controller_class for the other.
     attr_accessor :admin_layout
 
+    # The controller the DASHBOARD inherits from, as a String so it resolves
+    # lazily rather than at config time. Default: a plain
+    # 'ActionController::Base', where `authorize_admin` is the only gate.
+    #
+    # Name the controller your own admin already inherits from and the
+    # dashboard adopts that whole stack — layout, helpers, authentication, and
+    # any request context your before_actions set up (a `Current` attribute the
+    # layout reads, say). `admin_layout` covers only the layout, which leaves a
+    # host layout calling its own helpers to raise NameError under the engine's
+    # isolated namespace.
+    #
+    # Only the dashboard uses it. The widget's endpoints stay on the engine's
+    # own public controller, so an admin base controller here can never demand
+    # a staff session from a member leaving a review.
+    attr_accessor :base_controller_class
+
     # Resolve the current user for attribution (optional). Return an object
     # responding to #id, or nil. Receives the request.
     attr_accessor :current_user
@@ -117,7 +139,8 @@ module Testimonials
       @app_name = nil
       @enabled = ->(_request) { true }
       @authorize_admin = ->(_request) { Rails.env.development? }
-      @admin_layout = 'testimonials/application'
+      @admin_layout = DEFAULT_ADMIN_LAYOUT
+      @base_controller_class = 'ActionController::Base'
       @current_user = ->(_request) {}
       @tenant = ->(_request) {}
       @user_display = lambda { |user|