turbo_desktop-rails 0.1.1 → 0.2.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d6f899e2fab9c576ab27546066a9b1b28d38a7ec488b0ead48b3d42c2586007d
-  data.tar.gz: 16d18b4814b4fbc97355affe91a24b147e6fec059e818065234c39516cbaa784
+  metadata.gz: 70be4836df6cf6ff273081949ad0ee0c42bf155357525f73467d47000d18dfe0
+  data.tar.gz: 67f724b78eb69afa13d18bcf7844c0e63d56c2a6b9fdd3738f0e7a7466c72135
 SHA512:
-  metadata.gz: ae547aa2c461c50bb2b920d581c02219ea0a981b3a2d7720a4c00b6b6f234172234913319fda4e22ab47bbf5aa6eaf0376286c0f4ffc984fb8d66ed33bb82587
-  data.tar.gz: 5ed76a338f38a62c6f850aa76def83eaf88226ba16eb69ba7b690a62db7e0c2a4f0e9a9484b2b050d0c557b1e5f2b0b0fa2686cc36f2ae2f9fffb16ddcb7c1d5
+  metadata.gz: 6b136e03d0f7d1b15abfc88b322139abbfd5575f5a3ac6e0353b38223773b083eb9dbc3d7eb139811b9b2a92cbff40fc3dede0e577e3eeef6ba942f747f78968
+  data.tar.gz: 4c536312a7cfe78b51897f70a8117f3fa134dca8be0759add4ec65280af2d7326974cd7b8398fc78eabd21e280d97f26862f162a92d294f5075b09242ef45ade

data/CHANGELOG.md

@@ -1,5 +1,39 @@
 # Changelog
 
+## 0.2.3 (2026-09-27)
+
+### Fixed
+
+- The Dev Inspector now loads in apps with forgery protection on, which is
+  every app that uses `load_defaults`. Its modules are fetched with `import()`,
+  a plain GET for JavaScript, which Rails refused with a 422 as a cross-origin
+  script embed. The inspector's controller serves a fixed list of public,
+  static files and no longer takes part in that check.
+
+### Changed
+
+- The README shows the Gemfile line pinned (`"~> 0.2"`), states Ruby >= 3.2 to
+  match the gemspec, and quotes a current User-Agent.
+
+## 0.2.2 (2026-09-27)
+
+Version aligned with the desktop shell's 0.2.2 release. The CLI now scaffolds
+new apps with `gem "turbo_desktop-rails", "~> 0.2"`; it previously wrote
+`"~> 0.1"`, which resolved to 0.1.1. First 0.2.x version published to RubyGems.
+No gem-side API changes.
+
+## 0.2.1 (2026-07-29)
+
+Version aligned with the desktop shell's 0.2.1 release, which fixes bridge
+events (shell/sudo output streaming, drag & drop, component onReceive) never
+reaching pages loaded from the app server. No gem-side API changes.
+
+## 0.2.0 (2026-07-29)
+
+Version aligned with the desktop shell's 0.2.0 release (server auto-start,
+Windows support, cross-platform sudo, drag & drop, file associations,
+clipboard, launch-at-login). No gem-side API changes.
+
 ## 0.1.1 (2026-07-27)
 
 ### Added

data/README.md

@@ -9,7 +9,7 @@ This gem gives your Rails app awareness of the Turbo Desktop shell, exactly like
 Add to your Gemfile:
 
 ```ruby
-gem "turbo_desktop-rails"
+gem "turbo_desktop-rails", "~> 0.2"
 ```
 
 Then run:
@@ -23,7 +23,7 @@ rails generate turbo_desktop:install
 
 ### Detection
 
-The gem detects Turbo Desktop requests via the User-Agent header (`Turbo Desktop/0.0.1 (macOS; aarch64)`).
+The gem detects Turbo Desktop requests via the User-Agent header (`Turbo Desktop/0.2.3 (macOS; aarch64)`).
 
 ```ruby
 # In controllers
@@ -56,6 +56,33 @@ turbo_desktop_arch      # => "aarch64", "x86_64", or nil
     ) %>
 ```
 
+### Desktop-only templates
+
+Requests from the desktop app are marked with a Rails variant, so a whole
+template can be written for it rather than branching inside a shared one:
+
+```
+app/views/orders/show.html.erb           # everyone
+app/views/orders/show.html+desktop.erb   # the desktop app
+```
+
+Layouts work the same way — `app/views/layouts/application.html+desktop.erb`.
+Rails falls back to the plain template wherever no variant exists, so this costs
+nothing until you add one.
+
+The block helpers above are still the right tool for a button or a nav bar. Reach
+for a variant when the whole page differs.
+
+Rename it, or turn it off, in the initializer:
+
+```ruby
+TurboDesktop.configure do |config|
+  config.variant = :desktop   # nil leaves variants alone
+end
+```
+
+It is added to any variants you have already set rather than replacing them.
+
 ### Path Configuration
 
 The gem mounts a path configuration endpoint at `/turbo-desktop/path-configuration.json`:
@@ -76,7 +103,7 @@ end
 
 ## Requirements
 
-- Ruby >= 3.1.0
+- Ruby >= 3.2
 - Rails >= 7.0
 - turbo-rails >= 1.0
 

data/app/controllers/turbo_desktop/inspector_assets_controller.rb

@@ -10,6 +10,12 @@ module TurboDesktop
   # path traversal). Enabled implicitly by mounting the engine; the meta-tag
   # helper points the shell at these URLs.
   class InspectorAssetsController < ActionController::Base
+    # These are public, static modules fetched by import(), which is a plain
+    # GET for JavaScript. Rails reads that as a cross-origin <script> embed and
+    # refuses it with a 422. Nothing here depends on the session or carries
+    # per-user data, so there is nothing for that check to protect.
+    skip_forgery_protection
+
     ASSET_ROOT = TurboDesktop::Engine.root.join("lib/turbo_desktop/inspector_assets").freeze
 
     # Relative paths (as requested by the browser) → allowed. Anything else 404s.

data/lib/generators/turbo_desktop/install/templates/initializer.rb.tt

@@ -17,6 +17,17 @@ TurboDesktop.configure do |config|
   # presentation. Enable it in development only:
   config.inspector_enabled = Rails.env.development?
 
+  # Requests from the desktop app are marked with a Rails variant, so you can
+  # write a whole template for it instead of branching inside a shared one:
+  #
+  #   app/views/orders/show.html.erb           # everyone
+  #   app/views/orders/show.html+desktop.erb   # the desktop app
+  #
+  # Layouts work the same way (layouts/application.html+desktop.erb), and Rails
+  # falls back to the plain template wherever no variant exists. Rename it, or
+  # set it to nil to leave variants alone.
+  # config.variant = :desktop
+
   config.path_configuration = {
     settings: {
       screenshots_enabled: false

data/lib/turbo_desktop/configuration.rb

@@ -1,11 +1,15 @@
 module TurboDesktop
   class Configuration
-    attr_accessor :path_configuration, :user_agent_pattern, :inspector_enabled, :inspector_mount_path
+    attr_accessor :path_configuration, :user_agent_pattern, :inspector_enabled,
+                  :inspector_mount_path, :variant
 
     def initialize
       @path_configuration = default_path_configuration
       @user_agent_pattern = /Turbo Desktop/
       @inspector_enabled = false
+      # Rails variant set on requests from the desktop app, so views can be
+      # written as show.html+desktop.erb. Set to nil to leave variants alone.
+      @variant = :desktop
       # Where the engine is mounted; the inspector meta tag advertises assets
       # under this prefix. Override if you mount the engine elsewhere.
       @inspector_mount_path = "/turbo-desktop"

data/lib/turbo_desktop/detection.rb

@@ -11,6 +11,23 @@ module TurboDesktop
 
     included do
       helper_method :turbo_desktop_app?, :turbo_desktop_platform, :turbo_desktop_arch
+
+      before_action :set_turbo_desktop_variant
+    end
+
+    # The variant list a request should end up with, or nil to leave it alone.
+    #
+    # Kept separate from the controller so the decision can be exercised on its
+    # own. Adds to whatever variants are already set rather than replacing them:
+    # an app may well be using variants for something else.
+    def self.variant_for(current:, desktop:, configured:)
+      return nil if configured.blank? || !desktop
+
+      current = Array(current).map(&:to_sym)
+      configured = configured.to_sym
+      return nil if current.include?(configured)
+
+      current + [ configured ]
     end
 
     # Returns true if the request is from a Turbo Desktop app.
@@ -31,6 +48,27 @@ module TurboDesktop
       end
     end
 
+    # Mark desktop requests with a Rails variant, so a whole template can be
+    # written for the desktop app instead of branching inside a shared one:
+    #
+    #   app/views/orders/show.html.erb           # everyone
+    #   app/views/orders/show.html+desktop.erb   # the desktop app
+    #
+    # Layouts pick it up too — layouts/application.html+desktop.erb. Rails falls
+    # back to the plain template wherever no variant exists, so this costs
+    # nothing until you add one.
+    #
+    # Set config.variant to nil to turn it off.
+    def set_turbo_desktop_variant
+      variant = TurboDesktop::Detection.variant_for(
+        current: request.variant,
+        desktop: turbo_desktop_app?,
+        configured: TurboDesktop.configuration.variant
+      )
+
+      request.variant = variant if variant
+    end
+
     # Returns the architecture: "aarch64", "x86_64", or nil.
     def turbo_desktop_arch
       return nil unless turbo_desktop_app?

data/lib/turbo_desktop/version.rb

@@ -1,3 +1,3 @@
 module TurboDesktop
-  VERSION = "0.1.1"
+  VERSION = "0.2.3"
 end

data/lib/turbo_desktop/view_helpers.rb

@@ -26,12 +26,20 @@ module TurboDesktop
       end
     end
 
+    # Attribute name fragments we are willing to build a data-* attribute from.
+    # Values are escaped by the tag helpers, but names are interpolated, so they
+    # are restricted rather than escaped.
+    BRIDGE_NAME_PATTERN = /\A[a-zA-Z0-9_-]+\z/
+
     # Renders a bridge component data attribute.
     #
     #   <%= tag.button "Export", **turbo_desktop_bridge("menu-item", title: "Export PDF", shortcut: "Cmd+E") %>
     def turbo_desktop_bridge(component, **options)
-      attrs = { "data-turbo-desktop-bridge" => component }
+      validate_bridge_name!(component, "component")
+
+      attrs = { "data-turbo-desktop-bridge" => component.to_s }
       options.each do |key, value|
+        validate_bridge_name!(key, "option name")
         attrs["data-turbo-desktop-bridge-#{key}"] = value.to_s
       end
       attrs
@@ -73,5 +81,15 @@ module TurboDesktop
     def turbo_desktop_inspector_url
       "#{TurboDesktop.configuration.inspector_mount_path.chomp("/")}/inspector.js"
     end
+
+    private
+
+    def validate_bridge_name!(name, label)
+      return if name.to_s.match?(BRIDGE_NAME_PATTERN)
+
+      raise ArgumentError,
+            "turbo_desktop_bridge #{label} #{name.inspect} may only contain " \
+            "letters, numbers, hyphens and underscores"
+    end
   end
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: turbo_desktop-rails
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.2.3
 platform: ruby
 authors:
-- RaiderHQ
+- aguspe
 bindir: bin
 cert_chain: []
-date: 1980-01-02 00:00:00.000000000 Z
+date: 2026-09-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -80,14 +80,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 3.3.0
+      version: 3.2.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.6
+rubygems_version: 3.6.2
 specification_version: 4
 summary: Turbo Native for Desktop — Rails integration
 test_files: []