testimonials 0.7.10 → 0.8.1

data/app/controllers/testimonials/testimonials_controller.rb

@@ -1,24 +1,16 @@
 # frozen_string_literal: true
 
 module Testimonials
-  class TestimonialsController < ApplicationController
+  # The testimonial queue: triage, search, best lines. Staff only.
+  #
+  # POST to the mount path is SubmissionsController — the public write endpoint
+  # cannot share a controller with these, because this one inherits whatever the
+  # host set as base_controller_class.
+  class TestimonialsController < DashboardController
     PER_PAGE = 50
 
-    layout :testimonials_admin_layout, except: :create
-
-    # create is the public widget endpoint; everything else is the dashboard.
-    before_action :require_enabled, only: :create
-    before_action :require_admin, except: :create
     before_action :set_testimonial, only: %i[show update destroy]
 
-    # Throttle the public endpoint per IP so one user or bot can't flood the
-    # table (a submission may carry a video). Uses the rate limiter built
-    # into Rails 7.2+ (backed by Rails.cache); on Rails 7.1 this is a no-op.
-    # Tune or disable via config.rate_limit — read once at boot.
-    if respond_to?(:rate_limit) && Testimonials.config.rate_limit
-      rate_limit(**Testimonials.config.rate_limit, only: :create, with: -> { render_rate_limited })
-    end
-
     def index
       @status = Testimonial::STATUSES.include?(params[:status]) ? params[:status] : 'pending'
       @kind = Testimonial::KINDS.include?(params[:kind]) ? params[:kind] : nil
@@ -48,39 +40,12 @@ module Testimonials
       redirect_to root_path, status: :see_other
     end
 
-    def create
-      testimonial = build_testimonial
-
-      error = attach_video(testimonial) || attach_avatar(testimonial)
-      return render json: { errors: [error] }, status: :unprocessable_entity if error
-
-      if testimonial.save
-        # Purge only after a valid save, so a failed update can't strand a
-        # review with its video already gone.
-        if remove_video? && testimonial.video_attached?
-          testimonial.video_file.purge
-          testimonial.poster.purge if testimonial.poster_attached?
-        end
-        record_submission
-        notify_host(testimonial)
-        head :created
-      else
-        render json: { errors: testimonial.errors.full_messages }, status: :unprocessable_entity
-      end
-    end
-
     private
 
     def set_testimonial
       @testimonial = tenant_scope.find(params[:id])
     end
 
-    # Every dashboard query starts here, so an admin can only ever load,
-    # triage, or delete records in their own tenant — a cross-tenant id 404s.
-    def tenant_scope
-      Testimonial.for_tenant(current_tenant)
-    end
-
     def admin_params
       params.require(:testimonial).permit(:status, :featured, :best_line)
     end
@@ -97,130 +62,5 @@ module Testimonials
         q: pattern
       )
     end
-
-    # One review per signed-in user: a re-submission edits their existing
-    # review in place (the App Store model). The edit goes back through
-    # moderation, and the admin's best_line is cleared — it may no longer
-    # match the new wording. Guests have no reliable identity, so each guest
-    # submission stays a new record.
-    def build_testimonial
-      testimonial = existing_testimonial || Testimonial.new
-      testimonial.assign_attributes(testimonial_params)
-      if testimonial.persisted?
-        testimonial.status = 'pending'
-        testimonial.best_line = nil
-      end
-      testimonial.kind = wants_video?(testimonial) ? 'video' : 'text'
-      testimonial.source = 'widget' unless Testimonial::SOURCES.include?(testimonial.source)
-      testimonial.consent_text = Testimonials.consent_text_for(testimonial.consent_given?)
-      testimonial.locale = I18n.locale.to_s
-      testimonial.tenant = current_tenant
-      testimonial.user_agent = request.user_agent
-      attribute_author(testimonial)
-      testimonial
-    end
-
-    # One review per signed-in user, *per tenant*: the same person can leave a
-    # separate review in each tenant, but only one within any single tenant.
-    def existing_testimonial
-      return if current_author_id.blank?
-
-      tenant_scope.where(author_id: current_author_id.to_s).newest_first.first
-    end
-
-    # A fresh upload makes it a video review; on an edit without a new
-    # upload, an already-attached video stays — unless the user removed it.
-    def wants_video?(testimonial)
-      return true if params.dig(:testimonial, :video_file).present?
-
-      testimonial.video_attached? && !remove_video?
-    end
-
-    def remove_video?
-      params.dig(:testimonial, :remove_video).present? && params.dig(:testimonial, :video_file).blank?
-    end
-
-    def testimonial_params
-      params.require(:testimonial)
-            .permit(:body, :rating, :consent_given, :page_url, :source,
-                    :name, :email, :title_company)
-    end
-
-    # Signed-in users are attributed server-side — the widget never sends
-    # (and the endpoint never trusts) contact fields for them.
-    def attribute_author(testimonial)
-      author = current_author
-      return if author.nil?
-
-      testimonial.author_id = author.id.to_s if author.respond_to?(:id)
-      display = Testimonials.config.user_display.call(author) || {}
-      testimonial.name = display[:name].presence || testimonial.name
-      testimonial.email = display[:email].presence || testimonial.email
-      testimonial.title_company = display[:title_company].presence || testimonial.title_company
-    end
-
-    # Returns an error message, or nil when everything is fine.
-    def attach_video(testimonial)
-      file = params.dig(:testimonial, :video_file)
-      return nil if file.blank?
-      return error_label(:error_save) unless Testimonials.config.video_enabled?
-      return error_label(:error_video_too_large) if file.size > Testimonials.config.max_video_size
-      return error_label(:error_save) unless file.content_type.to_s.start_with?('video/', 'audio/')
-
-      testimonial.video_file.attach(file)
-      attach_poster(testimonial)
-      nil
-    end
-
-    # The poster rides with a new video upload. It's best-effort — a missing
-    # or malformed poster never blocks the testimonial. Attaching replaces any
-    # previous poster; a new video with no usable poster (e.g. an uploaded
-    # file, which we can't frame-grab) drops the stale one so it can't show a
-    # thumbnail from the wrong video.
-    def attach_poster(testimonial)
-      file = params.dig(:testimonial, :poster)
-      usable = file.present? && file.content_type.to_s.start_with?('image/') &&
-               file.size <= Testimonials.config.max_avatar_size
-
-      if usable
-        testimonial.poster.attach(file)
-      elsif testimonial.poster_attached?
-        testimonial.poster.purge
-      end
-    end
-
-    def attach_avatar(testimonial)
-      file = params.dig(:testimonial, :avatar)
-      return nil if file.blank?
-      return error_label(:error_save) unless Testimonials.config.avatars_enabled?
-      return error_label(:error_save) if file.size > Testimonials.config.max_avatar_size
-      return error_label(:error_save) unless file.content_type.to_s.start_with?('image/')
-
-      testimonial.avatar.attach(file)
-      nil
-    end
-
-    def record_submission
-      PromptEvent.record!(kind: 'testimonial', action: 'submitted', tenant: current_tenant,
-                          author_id: current_author_id, visitor_token: ensure_visitor_token)
-    end
-
-    # The host's hook must never turn a saved submission into a 500 — the
-    # testimonial is in the database; notification failures are the host's
-    # logs' problem.
-    def notify_host(record)
-      Testimonials.config.on_submit.call(record)
-    rescue StandardError => e
-      Rails.logger.error("testimonials: on_submit hook raised #{e.class}: #{e.message}")
-    end
-
-    def error_label(key)
-      defaults = {
-        error_save: 'Could not send. Please try again.',
-        error_video_too_large: 'The video is too large (max %{size} MB).'
-      }
-      I18n.t(key, scope: :testimonials, default: defaults[key],
-                  size: Testimonials.config.max_video_size / (1024 * 1024))
-    end
   end
 end

data/app/views/layouts/testimonials/application.html.erb

@@ -5,16 +5,13 @@
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <%= csrf_meta_tags %>
   <%= csp_meta_tag %>
-  <%# Same-origin script instead of inline handlers, so delete confirms and
-      the auto-submitting filter work under strict script-src CSPs. %>
-  <%= stylesheet_link_tag "#{dashboard_stylesheet_path}?v=#{Testimonials::Widget.dashboard_stylesheet_fingerprint}",
-                          'data-turbo-track': 'reload' %>
-  <%= javascript_include_tag "#{dashboard_script_path}?v=#{Testimonials::Widget.dashboard_fingerprint}",
-                             'data-turbo-track': 'reload', defer: true, nonce: true %>
+  <%# The dashboard's stylesheet and script are declared by the views
+      (testimonials/shared/_dashboard), not here, so they survive a host
+      replacing this layout via config.admin_layout. %>
 </head>
 <body class="<%= content_for?(:body_class) ? yield(:body_class) : '' %>">
-  <div class="container">
-    <div class="nav">
+  <div class="tml-page">
+    <div class="tml-nav">
       <%= link_to t('testimonials.dashboard.title', default: 'Testimonials'), root_path,
                   class: ('active' unless controller_name == 'nps_responses') %>
       <% if Testimonials.config.nps %>

data/app/views/testimonials/nps_responses/index.html.erb

@@ -1,169 +1,171 @@
 <% content_for :body_class, 'tm-nps-index' %>
 
-<div class="page-head">
-  <h1><%= t('testimonials.dashboard.nps', default: 'NPS') %></h1>
-  <%# The shareable NPS page, same idea as the testimonial one. config.nps is
-      already true here — the controller 404s otherwise — so only the public
-      switch is left to check. %>
-  <% if Testimonials.config.public_collection %>
-    <a class="button share-link" href="<%= nps_collection_url %>" target="_blank" rel="noopener"
-       title="<%= nps_collection_url %>">
-      🔗 <%= t('testimonials.dashboard.nps_page', default: 'Ask for NPS scores') %>
-    </a>
-  <% end %>
-</div>
+<%= render layout: 'testimonials/shared/dashboard' do %>
+  <div class="page-head">
+    <h1><%= t('testimonials.dashboard.nps', default: 'NPS') %></h1>
+    <%# The shareable NPS page, same idea as the testimonial one. config.nps is
+        already true here — the controller 404s otherwise — so only the public
+        switch is left to check. %>
+    <% if Testimonials.config.public_collection %>
+      <a class="button share-link" href="<%= nps_collection_url %>" target="_blank" rel="noopener"
+         title="<%= nps_collection_url %>">
+        🔗 <%= t('testimonials.dashboard.nps_page', default: 'Ask for NPS scores') %>
+      </a>
+    <% end %>
+  </div>
 
-<%# How the industry reads a score, so nobody has to go and google it. Range
-    labels are digits on purpose — no translation needed for "< 0". %>
-<% bands = [
-     { key: 'needs-work', range: '< 0',
-       name: t('testimonials.dashboard.nps_band_needs_work', default: 'Needs work'),
-       note: t('testimonials.dashboard.nps_guide_needs_work', default: 'More detractors than promoters.') },
-     { key: 'good', range: '0 – 29',
-       name: t('testimonials.dashboard.nps_band_good', default: 'Good'),
-       note: t('testimonials.dashboard.nps_guide_good', default: 'Where most companies land.') },
-     { key: 'great', range: '30 – 69',
-       name: t('testimonials.dashboard.nps_band_great', default: 'Great'),
-       note: t('testimonials.dashboard.nps_guide_great', default: 'Strong loyalty.') },
-     { key: 'excellent', range: '70 +',
-       name: t('testimonials.dashboard.nps_band_excellent', default: 'Excellent'),
-       note: t('testimonials.dashboard.nps_guide_excellent', default: 'World-class, and rare.') }
-   ] %>
-<% current = bands.find { |b| b[:key] == @band.to_s.tr('_', '-') } if @band %>
-<% if current
-     band_class = "badge nps-band-#{current[:key]}"
-     meter_label = "#{@score} — #{current[:name]} #{current[:note]}"
-   end %>
+  <%# How the industry reads a score, so nobody has to go and google it. Range
+      labels are digits on purpose — no translation needed for "< 0". %>
+  <% bands = [
+       { key: 'needs-work', range: '< 0',
+         name: t('testimonials.dashboard.nps_band_needs_work', default: 'Needs work'),
+         note: t('testimonials.dashboard.nps_guide_needs_work', default: 'More detractors than promoters.') },
+       { key: 'good', range: '0 – 29',
+         name: t('testimonials.dashboard.nps_band_good', default: 'Good'),
+         note: t('testimonials.dashboard.nps_guide_good', default: 'Where most companies land.') },
+       { key: 'great', range: '30 – 69',
+         name: t('testimonials.dashboard.nps_band_great', default: 'Great'),
+         note: t('testimonials.dashboard.nps_guide_great', default: 'Strong loyalty.') },
+       { key: 'excellent', range: '70 +',
+         name: t('testimonials.dashboard.nps_band_excellent', default: 'Excellent'),
+         note: t('testimonials.dashboard.nps_guide_excellent', default: 'World-class, and rare.') }
+     ] %>
+  <% current = bands.find { |b| b[:key] == @band.to_s.tr('_', '-') } if @band %>
+  <% if current
+       band_class = "badge nps-band-#{current[:key]}"
+       meter_label = "#{@score} — #{current[:name]} #{current[:note]}"
+     end %>
 
-<div class="stat-row">
-  <div class="stat stat-nps">
-    <div class="stat-headline">
-      <b><%= @score.nil? ? '—' : @score %></b>
+  <div class="stat-row">
+    <div class="stat stat-nps">
+      <div class="stat-headline">
+        <b><%= @score.nil? ? '—' : @score %></b>
+        <% if current %>
+          <span class="<%= band_class %>"><%= current[:name] %></span>
+        <% end %>
+      </div>
+      <span><%= t('testimonials.dashboard.nps_score', default: 'NPS score') %></span>
+      <%# Where this score sits on the −100..100 scale, so the number reads as
+          good or bad at a glance. Kept LTR: it is a number line, not prose. %>
       <% if current %>
-        <span class="<%= band_class %>"><%= current[:name] %></span>
+        <div class="nps-meter" role="img" aria-label="<%= meter_label %>">
+          <div class="nps-meter-track">
+            <i class="nps-seg nps-band-needs-work"></i><i class="nps-seg nps-band-good"></i>
+            <i class="nps-seg nps-band-great"></i><i class="nps-seg nps-band-excellent"></i>
+            <%# Position is data, not markup: dashboard.js places it, so a strict
+                style-src has no inline style to refuse. %>
+            <i class="nps-marker" data-nps-marker="<%= @score %>"></i>
+          </div>
+          <div class="nps-meter-ticks" aria-hidden="true">
+            <span class="tick-min">−100</span><span class="tick-zero">0</span>
+            <span class="tick-good">30</span><span class="tick-great">70</span>
+            <span class="tick-max">100</span>
+          </div>
+        </div>
+      <% end %>
+      <% if @total.positive? && @total < Testimonials::NpsResponse::THIN_SAMPLE %>
+        <p class="muted nps-sample"><%= t('testimonials.dashboard.nps_sample_note', count: @total,
+                                          default: 'Based on %{count} responses — too few to read much into.') %></p>
       <% end %>
     </div>
-    <span><%= t('testimonials.dashboard.nps_score', default: 'NPS score') %></span>
-    <%# Where this score sits on the −100..100 scale, so the number reads as
-        good or bad at a glance. Kept LTR: it is a number line, not prose. %>
-    <% if current %>
-      <div class="nps-meter" role="img" aria-label="<%= meter_label %>">
-        <div class="nps-meter-track">
-          <i class="nps-seg nps-band-needs-work"></i><i class="nps-seg nps-band-good"></i>
-          <i class="nps-seg nps-band-great"></i><i class="nps-seg nps-band-excellent"></i>
-          <%# Position is data, not markup: dashboard.js places it, so a strict
-              style-src has no inline style to refuse. %>
-          <i class="nps-marker" data-nps-marker="<%= @score %>"></i>
-        </div>
-        <div class="nps-meter-ticks" aria-hidden="true">
-          <span class="tick-min">−100</span><span class="tick-zero">0</span>
-          <span class="tick-good">30</span><span class="tick-great">70</span>
-          <span class="tick-max">100</span>
-        </div>
-      </div>
-    <% end %>
-    <% if @total.positive? && @total < Testimonials::NpsResponse::THIN_SAMPLE %>
-      <p class="muted nps-sample"><%= t('testimonials.dashboard.nps_sample_note', count: @total,
-                                        default: 'Based on %{count} responses — too few to read much into.') %></p>
-    <% end %>
-  </div>
-  <div class="stat">
-    <b><%= @promoters %></b>
-    <span><%= t('testimonials.dashboard.promoters', default: 'Promoters (9–10)') %></span>
-  </div>
-  <div class="stat">
-    <b><%= @passives %></b>
-    <span><%= t('testimonials.dashboard.passives', default: 'Passives (7–8)') %></span>
-  </div>
-  <div class="stat">
-    <b><%= @detractors %></b>
-    <span><%= t('testimonials.dashboard.detractors', default: 'Detractors (0–6)') %></span>
+    <div class="stat">
+      <b><%= @promoters %></b>
+      <span><%= t('testimonials.dashboard.promoters', default: 'Promoters (9–10)') %></span>
+    </div>
+    <div class="stat">
+      <b><%= @passives %></b>
+      <span><%= t('testimonials.dashboard.passives', default: 'Passives (7–8)') %></span>
+    </div>
+    <div class="stat">
+      <b><%= @detractors %></b>
+      <span><%= t('testimonials.dashboard.detractors', default: 'Detractors (0–6)') %></span>
+    </div>
   </div>
-</div>
 
-<%# The formula and the benchmarks, closed by default — there when someone
-    wonders whether their number is any good, out of the way the rest of the time. %>
-<details class="nps-guide">
-  <summary><%= t('testimonials.dashboard.nps_guide', default: 'How is this calculated, and what is a good score?') %></summary>
-  <div class="nps-guide-body">
-    <p><%= t('testimonials.dashboard.nps_guide_formula',
-             default: 'NPS = the % of promoters minus the % of detractors. Passives count in the total but on ' \
-                      'neither side, so they pull the score toward zero. The result runs from −100 to +100 — ' \
-                      'a score, not a percentage.') %></p>
-    <ul class="nps-bands">
-      <% bands.each do |band| %>
-        <% badge_class = "badge nps-band-#{band[:key]}" %>
-        <li>
-          <span class="<%= badge_class %>"><%= band[:name] %></span>
-          <b><%= band[:range] %></b>
-          <span class="muted"><%= band[:note] %></span>
-        </li>
-      <% end %>
-    </ul>
-    <p class="muted"><%= t('testimonials.dashboard.nps_guide_caveat',
-                           default: 'Benchmarks move with the industry — software often sits near 40, airlines ' \
-                                    'and internet providers near 0. The trend over time tells you more than any ' \
-                                    'single number, and the comments tell you more than the score.') %></p>
-  </div>
-</details>
+  <%# The formula and the benchmarks, closed by default — there when someone
+      wonders whether their number is any good, out of the way the rest of the time. %>
+  <details class="nps-guide">
+    <summary><%= t('testimonials.dashboard.nps_guide', default: 'How is this calculated, and what is a good score?') %></summary>
+    <div class="nps-guide-body">
+      <p><%= t('testimonials.dashboard.nps_guide_formula',
+               default: 'NPS = the % of promoters minus the % of detractors. Passives count in the total but on ' \
+                        'neither side, so they pull the score toward zero. The result runs from −100 to +100 — ' \
+                        'a score, not a percentage.') %></p>
+      <ul class="nps-bands">
+        <% bands.each do |band| %>
+          <% badge_class = "badge nps-band-#{band[:key]}" %>
+          <li>
+            <span class="<%= badge_class %>"><%= band[:name] %></span>
+            <b><%= band[:range] %></b>
+            <span class="muted"><%= band[:note] %></span>
+          </li>
+        <% end %>
+      </ul>
+      <p class="muted"><%= t('testimonials.dashboard.nps_guide_caveat',
+                             default: 'Benchmarks move with the industry — software often sits near 40, airlines ' \
+                                      'and internet providers near 0. The trend over time tells you more than any ' \
+                                      'single number, and the comments tell you more than the score.') %></p>
+    </div>
+  </details>
 
-<div class="dashboard-shell <%= 'has-selected' if @selected_response %>">
-  <aside class="dashboard-sidebar" aria-label="<%= t('testimonials.dashboard.nps_responses', default: 'NPS responses') %>">
-    <div class="record-list">
-      <% if @responses.any? %>
-        <% @responses.each do |response| %>
-          <%= link_to nps_responses_path(page: @page, response_id: response.id),
-                      class: ['record-row nps-row', ('active' if @selected_response&.id == response.id)].compact do %>
-            <span class="record-main">
-              <span class="record-topline">
-                <span class="badge nps-<%= response.promoter? ? 'promoter' : (response.detractor? ? 'detractor' : 'passive') %>">
-                  <%= response.score %>
+  <div class="dashboard-shell <%= 'has-selected' if @selected_response %>">
+    <aside class="dashboard-sidebar" aria-label="<%= t('testimonials.dashboard.nps_responses', default: 'NPS responses') %>">
+      <div class="record-list">
+        <% if @responses.any? %>
+          <% @responses.each do |response| %>
+            <%= link_to nps_responses_path(page: @page, response_id: response.id),
+                        class: ['record-row nps-row', ('active' if @selected_response&.id == response.id)].compact do %>
+              <span class="record-main">
+                <span class="record-topline">
+                  <span class="badge nps-<%= response.promoter? ? 'promoter' : (response.detractor? ? 'detractor' : 'passive') %>">
+                    <%= response.score %>
+                  </span>
+                  <span class="muted record-time" title="<%= response.created_at %>">
+                    <%= time_ago_in_words(response.created_at) %>
+                  </span>
                 </span>
-                <span class="muted record-time" title="<%= response.created_at %>">
-                  <%= time_ago_in_words(response.created_at) %>
+                <span class="record-copy"><%= response.comment.presence || t('testimonials.dashboard.no_comment', default: 'No comment') %></span>
+                <span class="muted record-meta">
+                  <span>#<%= response.id %></span>
+                  <% if response.name.present? || response.author_id.present? %>
+                    <span><%= response.name.presence || "##{response.author_id}" %></span>
+                  <% end %>
+                  <% if response.email.present? %>
+                    <span><%= response.email %></span>
+                  <% end %>
                 </span>
               </span>
-              <span class="record-copy"><%= response.comment.presence || t('testimonials.dashboard.no_comment', default: 'No comment') %></span>
-              <span class="muted record-meta">
-                <span>#<%= response.id %></span>
-                <% if response.name.present? || response.author_id.present? %>
-                  <span><%= response.name.presence || "##{response.author_id}" %></span>
-                <% end %>
-                <% if response.email.present? %>
-                  <span><%= response.email %></span>
-                <% end %>
-              </span>
-            </span>
+            <% end %>
           <% end %>
+        <% else %>
+          <div class="empty"><%= t('testimonials.dashboard.empty', default: 'Nothing here yet.') %></div>
         <% end %>
-      <% else %>
-        <div class="empty"><%= t('testimonials.dashboard.empty', default: 'Nothing here yet.') %></div>
-      <% end %>
-    </div>
-
-    <div class="pager">
-      <% if @page > 1 %>
-        <%= link_to t('testimonials.dashboard.newer', default: '← Newer'), nps_responses_path(page: @page - 1) %>
-      <% end %>
-      <% if @more %>
-        <%= link_to t('testimonials.dashboard.older', default: 'Older →'), nps_responses_path(page: @page + 1) %>
-      <% end %>
-    </div>
-  </aside>
+      </div>
 
-  <main class="dashboard-detail" aria-label="<%= t('testimonials.dashboard.current_nps_response', default: 'Current NPS response') %>">
-    <% if @selected_response %>
-      <p class="mobile-back">
-        <%= link_to t('testimonials.dashboard.back_to_nps', default: '← All responses'),
-                    nps_responses_path(page: @page) %>
-      </p>
-      <%= render 'response_panel', response: @selected_response %>
-    <% else %>
-      <div class="empty-state">
-        <h2><%= t('testimonials.dashboard.select_response', default: 'Select a response') %></h2>
-        <p class="muted"><%= t('testimonials.dashboard.select_response_hint',
-                               default: 'Open a score from the list to review the comment and source details.') %></p>
+      <div class="pager">
+        <% if @page > 1 %>
+          <%= link_to t('testimonials.dashboard.newer', default: '← Newer'), nps_responses_path(page: @page - 1) %>
+        <% end %>
+        <% if @more %>
+          <%= link_to t('testimonials.dashboard.older', default: 'Older →'), nps_responses_path(page: @page + 1) %>
+        <% end %>
       </div>
-    <% end %>
-  </main>
-</div>
+    </aside>
+
+    <main class="dashboard-detail" aria-label="<%= t('testimonials.dashboard.current_nps_response', default: 'Current NPS response') %>">
+      <% if @selected_response %>
+        <p class="mobile-back">
+          <%= link_to t('testimonials.dashboard.back_to_nps', default: '← All responses'),
+                      nps_responses_path(page: @page) %>
+        </p>
+        <%= render 'response_panel', response: @selected_response %>
+      <% else %>
+        <div class="empty-state">
+          <h2><%= t('testimonials.dashboard.select_response', default: 'Select a response') %></h2>
+          <p class="muted"><%= t('testimonials.dashboard.select_response_hint',
+                                 default: 'Open a score from the list to review the comment and source details.') %></p>
+        </div>
+      <% end %>
+    </main>
+  </div>
+<% end %>

data/app/views/testimonials/nps_responses/show.html.erb

@@ -1,8 +1,10 @@
 <% content_for :body_class, 'tm-show' %>
 
-<div class="breadcrumb">
-  <%= link_to t('testimonials.dashboard.nps', default: 'NPS'), nps_responses_path %>
-  / #<%= @response.id %>
-</div>
+<%= render layout: 'testimonials/shared/dashboard' do %>
+  <div class="breadcrumb">
+    <%= link_to t('testimonials.dashboard.nps', default: 'NPS'), nps_responses_path %>
+    / #<%= @response.id %>
+  </div>
 
-<%= render 'response_panel', response: @response %>
+  <%= render 'response_panel', response: @response %>
+<% end %>

data/app/views/testimonials/shared/_dashboard.html.erb

@@ -0,0 +1,18 @@
+<%# The dashboard's own shell, rendered by the views rather than the layout.
+    That is deliberate: `config.admin_layout` lets a host replace the layout, and
+    assets declared in a layout the host replaces simply vanish — the dashboard
+    then renders unstyled with its delete confirmations and auto-submitting
+    filter dead. Declaring them here means every layout works, host or gem, and
+    a host has nothing to wire up.
+
+    The `tml-dashboard` wrapper is what scopes dashboard.css (see the comment at
+    the top of that file), so it has to enclose the content, not precede it. %>
+<%= stylesheet_link_tag "#{dashboard_stylesheet_path}?v=#{Testimonials::Widget.dashboard_stylesheet_fingerprint}",
+                        'data-turbo-track': 'reload' %>
+<%# Same-origin script instead of inline handlers, so delete confirms and the
+    auto-submitting filter work under strict script-src CSPs. %>
+<%= javascript_include_tag "#{dashboard_script_path}?v=#{Testimonials::Widget.dashboard_fingerprint}",
+                           'data-turbo-track': 'reload', defer: true, nonce: true %>
+<div class="tml-dashboard">
+  <%= yield %>
+</div>