turbo_chat 0.1.15 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 62e1eb06f88659efb5df1cc8a72f33e669b2a969dd734abc8a977aa4331fe925
-  data.tar.gz: 5c40f2095d91a51a69cafd0086553ceab8ecf69894696bc8de2f86498170e52a
+  metadata.gz: c3fc14508fac1357a1da08a00d2cd3b905271a1fd5a18dc0ccc71e8f6a8572c7
+  data.tar.gz: dc7b1fb742ebe03541e5ab140c312d1b2ed6f27efeb0cfbd3adca266bd9f7b28
 SHA512:
-  metadata.gz: a0ebcdf8245e4c726f65071d9da1bb673cbef17ae2327c0e3708e86097bedf90a51a9deaef21b9e28b19aef5552f0071b164a21e571a0e332834775dab54db78
-  data.tar.gz: 7e9ede1f0c631f03642b8c9da45a5ec4a15b0880edc85ae3f6ea51b2aa4aaf59e25d91786b2ab3e9a30e4c4ea890c47deee143910978ebcb74793d20cfa203ed
+  metadata.gz: a452a6b3ba2b13ab03382150ca9f5780b13994781011a764f54a518939a095a46dec586319b9853f5e03bc4b7b0e70fc62af9749935540fcc5525534c2c910c6
+  data.tar.gz: be545c2e1dc54a1df52fa83e8785ab36ea48c138ce40338c12ebd122e5311d771c861688b1347fe3f3b1f77c646c5f1fa7e1207fd482293c5ef89858a6b39cc4

data/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 All notable changes to `turbo_chat` will be documented in this file.
 
+## [0.2.0] - 2026-03-02
+
+### Added
+- Membership lookup cache (`Chat#membership_lookup`) for efficient per-message role resolution, eliminating N+1 queries when rendering participant roles in message lists.
+- Memoized `actor_membership` in Permission to avoid redundant database queries within a single request.
+
+### Changed
+- Narrowed broad `rescue StandardError` clauses to specific exception types (`NoMethodError`, `TypeError`) across controllers, helpers, models, and permission modules for better error visibility during development.
+- Removed duplicated `containerBottomPadding` function from `realtime.js`; now imports the shared version from `shared.js`.
+
 ## [0.1.15] - 2026-02-28
 
 ### Added

data/README.md

@@ -149,6 +149,10 @@ end
 
 Flat aliases (for example `config.max_message_length`) still work for backward compatibility.
 
+### Rate Limiting
+
+TurboChat does not include built-in rate limiting. For production deployments, add request throttling for message creation in your host application using middleware such as [rack-attack](https://github.com/rack/rack-attack).
+
 ## Message Ingest API
 
 Post messages as a specific participant, including external sources like WhatsApp:
@@ -368,6 +372,12 @@ bin/rails turbo_chat:install:migrations
 bin/rails db:migrate
 ```
 
+## Known Limitations
+
+- **Stream subscriptions after member removal.** Turbo Stream subscriptions persist until the page is reloaded. A removed member may continue to see new messages until they navigate away. This is not a security issue because stream names are cryptographically signed, but it can be surprising.
+- **Blocked word filtering.** Word-boundary matching can be bypassed with Unicode homoglyphs, zero-width characters, or leetspeak substitutions. Treat it as a first line of defense, not a guarantee.
+- **Invitable participants cap.** The invite picker returns at most 100 non-member participants. Applications with larger user bases should provide a custom search endpoint.
+
 ## Dependencies
 
 - Ruby `>= 3.1`

data/app/assets/javascripts/turbo_chat/realtime.js

@@ -15,6 +15,7 @@
   var parseMentionOptions = namespace.parseMentionOptions;
   var setupMentionAutocomplete = namespace.setupMentionAutocomplete;
   var scrollLastMessageIntoView = namespace.scrollLastMessageIntoView;
+  var containerBottomPadding = namespace.containerBottomPadding;
 
   function hideOwnSignals(container) {
     if (!container) {
@@ -41,20 +42,6 @@
     });
   }
 
-  function containerBottomPadding(container) {
-    if (!container || typeof window === "undefined") {
-      return 0;
-    }
-
-    var cssPadding = window.getComputedStyle(container).paddingBottom;
-    var parsedPadding = parseFloat(cssPadding);
-    if (isNaN(parsedPadding) || parsedPadding <= 0) {
-      return 0;
-    }
-
-    return parsedPadding;
-  }
-
   function visibleSignalNode(container) {
     if (!container) {
       return null;

data/app/assets/javascripts/turbo_chat/shared.js

@@ -524,6 +524,7 @@
   namespace.emptyMentionAutocomplete = emptyMentionAutocomplete;
   namespace.setupMentionAutocomplete = setupMentionAutocomplete;
   namespace.scrollLastMessageIntoView = scrollLastMessageIntoView;
+  namespace.containerBottomPadding = containerBottomPadding;
   namespace.signalOverlayOffset = signalOverlayOffset;
   namespace.prefersReducedMotion = prefersReducedMotion;
   namespace.scrollMessageIntoView = scrollMessageIntoView;

data/app/controllers/turbo_chat/application_controller.rb

@@ -68,7 +68,7 @@ module TurboChat
       configuration = TurboChat.configuration
       value = configuration.respond_to?(:disable_input) ? configuration.disable_input : false
       ActiveModel::Type::Boolean.new.cast(value)
-    rescue StandardError
+    rescue NoMethodError, TypeError
       false
     end
   end

data/app/controllers/turbo_chat/chat_memberships_controller.rb

@@ -77,7 +77,7 @@ module TurboChat
       return false if actor_rank.nil?
 
       definition[:rank].to_i <= actor_rank
-    rescue StandardError
+    rescue NoMethodError, TypeError
       false
     end
 

data/app/controllers/turbo_chat/chat_messages_controller.rb

@@ -149,7 +149,7 @@ module TurboChat
       configuration = TurboChat.configuration
       value = configuration.respond_to?(method_name) ? configuration.public_send(method_name) : default
       ActiveModel::Type::Boolean.new.cast(value)
-    rescue StandardError
+    rescue NoMethodError, TypeError
       default
     end
   end

data/app/controllers/turbo_chat/chats_controller/event_payload_support.rb

@@ -16,7 +16,7 @@ module TurboChat
           chatTitle: symbolized_payload[:chatTitle].presence || symbolized_payload[:chat_title].presence,
           chatMembershipId: symbolized_payload[:chatMembershipId].presence || symbolized_payload[:chat_membership_id].presence
         }.compact
-      rescue StandardError
+      rescue NoMethodError, TypeError
         nil
       end
 
@@ -37,7 +37,7 @@ module TurboChat
           chatTitle: symbolized_payload[:chatTitle].presence || symbolized_payload[:chat_title].presence,
           chatMembershipId: symbolized_payload[:chatMembershipId].presence || symbolized_payload[:chat_membership_id].presence
         }.compact
-      rescue StandardError
+      rescue NoMethodError, TypeError
         nil
       end
 

data/app/controllers/turbo_chat/chats_controller/invitation_support.rb

@@ -11,7 +11,7 @@ module TurboChat
 
         current_member_ids = @chat.chat_memberships.where(removed_at: nil, participant_type: participant_type).pluck(:participant_id)
         participant_class.where.not(id: current_member_ids).order(id: :asc).limit(100).to_a
-      rescue StandardError
+      rescue NoMethodError, TypeError
         []
       end
 

data/app/controllers/turbo_chat/chats_controller.rb

@@ -101,7 +101,7 @@ module TurboChat
       configuration = TurboChat.configuration
       value = configuration.respond_to?(:show_members) ? configuration.show_members : true
       ActiveModel::Type::Boolean.new.cast(value)
-    rescue StandardError
+    rescue NoMethodError, TypeError
       true
     end
 

data/app/helpers/turbo_chat/application_helper/config_support.rb

@@ -118,7 +118,7 @@ module TurboChat
         return default unless configuration.respond_to?(method_name)
 
         configuration.public_send(method_name)
-      rescue StandardError
+      rescue NoMethodError, TypeError
         default
       end
 

data/app/helpers/turbo_chat/application_helper/mention_support/permission_support.rb

@@ -11,7 +11,7 @@ module TurboChat
           return nil if participant.nil?
 
           TurboChat.configuration.permission_adapter.new(participant, chat)
-        rescue StandardError
+        rescue NoMethodError, TypeError, ArgumentError
           nil
         end
 
@@ -19,7 +19,7 @@ module TurboChat
           return true unless permission.respond_to?(method_name)
 
           permission.public_send(method_name)
-        rescue StandardError
+        rescue NoMethodError, TypeError
           false
         end
       end

data/app/helpers/turbo_chat/application_helper/message_rendering.rb

@@ -27,6 +27,8 @@ module TurboChat
 
       def render_chat_message_body(chat_message)
         body = chat_message.body.to_s
+        # html_safe is safe here: decorate_plain_message_text guarantees the body
+        # is html_escaped before any markup injection (see method comment above).
         return content_tag(:p, decorate_plain_message_text(body).html_safe, class: "chat-body") unless TurboChat.configuration.render_message_html
 
         sanitized_html = sanitize(
@@ -103,6 +105,13 @@ module TurboChat
         "##{red}#{green}#{blue}#{alpha_hex}".downcase
       end
 
+      # Safety: builds an HTML-safe string via a strict pipeline order:
+      #   1. ERB::Util.html_escape escapes ALL user content first
+      #   2. Emoji aliases and mention highlights inject only controlled markup
+      #   3. Newlines are converted to <br> tags
+      # The result is safe to mark as html_safe because no raw user content
+      # reaches the output unescaped. Any change to this pipeline MUST
+      # preserve html_escape as the first step.
       def decorate_plain_message_text(body)
         formatted = ERB::Util.html_escape(body.to_s)
         formatted = apply_emoji_aliases(formatted) if TurboChat.configuration.enable_emoji_aliases

data/app/helpers/turbo_chat/application_helper/participant_support.rb

@@ -57,7 +57,7 @@ module TurboChat
         return false if permission.respond_to?(:can_post_message?) && !permission.can_post_message?
 
         own_chat_message?(chat_message, participant: participant)
-      rescue StandardError
+      rescue NoMethodError, TypeError
         false
       end
 
@@ -67,7 +67,7 @@ module TurboChat
         return nil unless respond_to?(:current_chat_participant, true)
 
         current_chat_participant
-      rescue StandardError
+      rescue NoMethodError, TypeError
         nil
       end
 

data/app/models/turbo_chat/chat.rb

@@ -65,6 +65,10 @@ module TurboChat
       relation.ordered.preload(:participant)
     end
 
+    def membership_lookup
+      @membership_lookup ||= chat_memberships.active.index_by { |m| [m.participant_type, m.participant_id] }
+    end
+
     def last_message_at
       chat_messages.message.maximum(:created_at)
     end

data/app/models/turbo_chat/chat_message/blocked_words_moderation.rb

@@ -57,7 +57,7 @@ module TurboChat
         return [] unless configuration.respond_to?(:effective_blocked_words)
 
         Array(configuration.effective_blocked_words)
-      rescue StandardError
+      rescue NoMethodError, TypeError
         []
       end
 
@@ -66,7 +66,7 @@ module TurboChat
         return "reject" unless configuration.respond_to?(:effective_blocked_words_action)
 
         configuration.effective_blocked_words_action.to_s
-      rescue StandardError
+      rescue NoMethodError, TypeError
         "reject"
       end
 
@@ -92,7 +92,7 @@ module TurboChat
         return false unless configuration.respond_to?(:emit_blocked_words_events)
 
         ActiveModel::Type::Boolean.new.cast(configuration.emit_blocked_words_events)
-      rescue StandardError
+      rescue NoMethodError, TypeError
         false
       end
 

data/app/models/turbo_chat/chat_message/broadcasting.rb

@@ -80,7 +80,7 @@ module TurboChat
         value = configuration.respond_to?(:message_insert_position) ? configuration.message_insert_position : "append_end"
         normalized = value.to_s.strip.downcase
         %w[append_start start prepend].include?(normalized)
-      rescue StandardError
+      rescue NoMethodError, TypeError
         false
       end
     end

data/app/models/turbo_chat/chat_message/formatting.rb

@@ -46,7 +46,11 @@ module TurboChat
       def participant_membership
         return @participant_membership if instance_variable_defined?(:@participant_membership)
 
-        @participant_membership = chat.chat_memberships.active.find_by(participant: participant)
+        @participant_membership = if chat.respond_to?(:membership_lookup) && chat.instance_variable_defined?(:@membership_lookup)
+                                    chat.membership_lookup[[participant_type, participant_id]]
+                                  else
+                                    chat.chat_memberships.active.find_by(participant: participant)
+                                  end
       end
 
       def formatted_time_for(timestamp)

data/app/models/turbo_chat/chat_message/mention_validation.rb

@@ -36,7 +36,7 @@ module TurboChat
         return nil unless adapter.respond_to?(:new)
 
         adapter.new(participant, chat)
-      rescue StandardError
+      rescue NoMethodError, TypeError, ArgumentError
         nil
       end
 
@@ -53,7 +53,7 @@ module TurboChat
         else
           permission_gate_allowed?(permission, :can_mention_members?)
         end
-      rescue StandardError
+      rescue NoMethodError, TypeError
         false
       end
 

data/app/models/turbo_chat/chat_message.rb

@@ -98,7 +98,7 @@ module TurboChat
         return true unless configuration.respond_to?(:system_messages)
 
         ActiveModel::Type::Boolean.new.cast(configuration.system_messages)
-      rescue StandardError
+      rescue NoMethodError, TypeError
         true
       end
 

data/db/migrate/20260302000015_add_kind_index_to_turbo_chat_chat_messages.rb

@@ -0,0 +1,6 @@
+class AddKindIndexToTurboChatChatMessages < ActiveRecord::Migration[7.0]
+  def change
+    add_index :turbo_chat_chat_messages, %i[chat_id kind created_at],
+              name: "index_turbo_chat_messages_on_chat_kind_created"
+  end
+end

data/lib/turbo_chat/messages.rb

@@ -125,7 +125,7 @@ module TurboChat
       adapter.new(participant, chat)
     rescue AuthorizationError
       raise
-    rescue StandardError => error
+    rescue NoMethodError, TypeError, ArgumentError => error
       raise AuthorizationError, "Unable to authorize message posting: #{error.message}"
     end
     private_class_method :permission_for

data/lib/turbo_chat/moderation/support.rb

@@ -50,7 +50,7 @@ module TurboChat::Moderation
       return false unless config.respond_to?(:emit_moderation_events)
 
       ActiveModel::Type::Boolean.new.cast(config.emit_moderation_events)
-    rescue StandardError
+    rescue NoMethodError, TypeError
       false
     end
 

data/lib/turbo_chat/permission/support.rb

@@ -36,10 +36,11 @@ class TurboChat::Permission
     def target_role_rank(target_membership) = target_membership&.effective_role_rank || -1
 
     def actor_membership
-      return nil unless chat_present?
-      return nil unless participant_present?
+      return @actor_membership if defined?(@actor_membership)
 
-      chat.chat_memberships.active.find_by(participant: participant)
+      @actor_membership = if chat_present? && participant_present?
+                            chat.chat_memberships.active.find_by(participant: participant)
+                          end
     end
 
     def participant_present? = !participant.nil?

data/lib/turbo_chat/permission.rb

@@ -73,7 +73,7 @@ class TurboChat::Permission
     configuration = TurboChat.configuration
     value = configuration.respond_to?(:disable_input) ? configuration.disable_input : false
     ActiveModel::Type::Boolean.new.cast(value)
-  rescue StandardError
+  rescue NoMethodError, TypeError
     false
   end
 end

data/lib/turbo_chat/version.rb

@@ -1,3 +1,3 @@
 module TurboChat
-  VERSION = "0.1.15"
+  VERSION = "0.2.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: turbo_chat
 version: !ruby/object:Gem::Version
-  version: 0.1.15
+  version: 0.2.0
 platform: ruby
 authors:
 - Alexander Haumer
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-02-28 00:00:00.000000000 Z
+date: 2026-03-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -113,6 +113,7 @@ files:
 - db/migrate/20260218000012_add_custom_role_key_to_chat_memberships.rb
 - db/migrate/20260218000013_add_invitation_accepted_to_turbo_chat_chat_memberships.rb
 - db/migrate/20260223000014_add_source_fields_to_turbo_chat_chat_messages.rb
+- db/migrate/20260302000015_add_kind_index_to_turbo_chat_chat_messages.rb
 - lib/generators/turbo_chat/install/install_generator.rb
 - lib/generators/turbo_chat/install/templates/turbo_chat.rb
 - lib/tasks/turbo_chat_tasks.rake