who_rendered 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 4713dd45c79efc90221e9f481db8474311cc4e7b5a8a7cbed88815625931b07b
+  data.tar.gz: 452bc6faa52f8b2661b068ca3163be94e4c17b83572745ebad691aa21e642baf
+SHA512:
+  metadata.gz: e20409b47a114845dd17c509718e566e8fa43cc42d60c75e60c048578ae945e6be012b77664cd19178c3054cd34825ae6c955e80ecdbde04dbbccebcf5bac4bd
+  data.tar.gz: 0c60f0421f81feafa2732d1d6fa62168cba635cd8ed153886d70d5033b9192799e1325bfde3611d2f950ac510bb05b0fe54b77315b245104b90a31cb0d85a42f

data/CHANGELOG.md

@@ -0,0 +1,10 @@
+# Changelog
+
+## 0.1.0 (2026-09-11)
+
+- Initial release. Adds `Rendered by: <file>:<line>` to the `Completed` log line, naming the
+  `render`, `head`, or `redirect_to` call site that produced the response.
+- Tested against Rails 7.1, 7.2, 8.0, 8.1 and `main`, with no version branching.
+- Installs on `ActionController::Instrumentation` rather than on `ActionController::Base` and
+  `ActionController::API`, so a gem that rebinds `append_info_to_payload` — lograge's
+  `custom_payload` does — cannot end up as its own `super`.

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Stephen Crosby
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,146 @@
+# who_rendered
+
+Find out who called render. Adds the file and line that produced a Rails response to the
+`Completed` log line — so an unexplained 403 names its own source.
+
+## Before
+
+```
+Processing by Admin::ReportsController#index as HTML
+Filter chain halted as :require_admin rendered or redirected
+Completed 403 Forbidden in 3ms (Views: 0.0ms | ActiveRecord: 0.5ms)
+```
+
+## After
+
+```
+Processing by Admin::ReportsController#index as HTML
+Filter chain halted as :require_admin rendered or redirected
+Completed 403 Forbidden in 3ms (Views: 0.0ms | ActiveRecord: 0.5ms | Rendered by: app/controllers/concerns/admin_gate.rb:14:in 'require_admin')
+```
+
+## Install
+
+```ruby
+# Gemfile
+gem "who_rendered", group: :development
+```
+
+No configuration is required. By default the gem is active in development and test, and adds
+no log lines of its own — only the `Rendered by:` text on the `Completed` line Rails already
+prints.
+
+## Configuration
+
+```ruby
+# config/initializers/who_rendered.rb
+WhoRendered.configure do |config|
+  config.enabled = Rails.env.local?  # default
+  config.frames  = 1                 # default
+  config.capture = :always           # default
+  config.logger  = nil               # default: Rails.logger
+end
+```
+
+| Setting   | Default            | Meaning                                                                                |
+| --------- | ------------------ | -------------------------------------------------------------------------------------- |
+| `enabled` | `Rails.env.local?` | When false, every hook becomes a pass-through.                                          |
+| `frames`  | `1`                | Frames to report. `1` is the `Completed` line only; more adds `↳ from` lines after it.   |
+| `capture` | `:always`          | `:non_2xx` skips the stack walk on successful responses.                                |
+| `logger`  | `nil`              | Used for the `↳ from` lines only.                                                       |
+
+## When the render comes from a dependency
+
+If the response was produced entirely inside a gem — a `before_action` from an included
+module, a gem's `rescue_from` handler — there is no application frame to report. The gem
+names the dependency instead of going quiet:
+
+```
+Completed 401 Unauthorized in 2ms (Rendered by: devise-4.9.4/lib/devise/controllers/helpers.rb:99:in 'authenticate_user!')
+```
+
+## Wrapper helpers and `frames`
+
+If your renders go through a helper, the innermost application frame is that helper — the
+same line for every 403 in the app. Set `frames` above 1 so the helper cannot hide its
+caller:
+
+```ruby
+WhoRendered.configure { |config| config.frames = 3 }
+```
+
+```
+Completed 403 Forbidden in 3ms (Views: 0.0ms | Rendered by: app/controllers/application_controller.rb:88:in 'render_403')
+  ↳ from app/controllers/concerns/admin_gate.rb:14:in 'require_admin'
+  ↳ from app/controllers/admin/reports_controller.rb:3:in 'index'
+```
+
+## What it does not report
+
+Requests where the application never called `render` — the `def show; end` case, where Rails
+renders the template for you. There is no decision to attribute, and `Processing by
+PostsController#show` already tells you where to look.
+
+## How it works
+
+A prepended module wraps `render`, `head`, and `redirect_to`, calls `super`, and records the
+call stack. At the end of the action, the documented hook `append_info_to_payload` adds the
+frames to the `process_action.action_controller` payload, and an override of
+`ActionController::Base.log_process_action` appends the `Rendered by:` text to the `Completed`
+line — the same pair of hooks Active Record uses to add `ActiveRecord: 1.2ms` to that line.
+
+The `Completed` line's text is handed between those two hooks out of band rather than through
+the payload, since the payload `log_process_action` receives is not always the one
+`append_info_to_payload` wrote to. That is what keeps the feature working on every supported
+version without a version check.
+
+The gem also subscribes to `start_processing.action_controller` to empty that hand-off slot at
+the top of every instrumented request, which is what stops one request's attribution from
+reaching the next. Unsubscribing that event *by name* — the usual recipe for silencing the
+`Processing by` line — removes every listener for it, including this one. The write hook clears
+the slot too, so almost nothing changes if that happens; misattribution needs both the missing
+subscription *and* a controller whose own `append_info_to_payload` does not call `super`.
+
+Payload keys, for anyone subscribing to `process_action.action_controller` directly:
+
+| Key                     | Type                                             |
+| ----------------------- | ------------------------------------------------ |
+| `:render_source`        | `String`                                         |
+| `:render_source_frames` | `Array<String>` (only when `frames > 1`)         |
+| `:render_method`        | `Symbol` — `:render`, `:head`, or `:redirect_to` |
+
+If the gem hits an internal error it logs one warning and disables itself for the rest of the
+process. It never raises into a request.
+
+## Limitations
+
+- **Structured events do not carry the data on Rails 8.1+.**
+  `ActionController::StructuredEventSubscriber#additions_for` is a hardcoded
+  `payload.slice(:view_runtime, :db_runtime, :queries_count, :cached_queries_count)`, so
+  custom keys are dropped from the `action_controller.request_completed` structured event.
+  `ActiveSupport::Notifications` subscribers are unaffected; they receive every key. The text
+  log is unaffected too, because the `Rendered by:` text does not travel through a payload at
+  all. Making the slice extensible is a small upstream change worth proposing separately.
+- **lograge replaces the `Completed` line, so you have to bridge the payload yourself.**
+  lograge calls `remove_existing_log_subscriptions`, which unsubscribes
+  `ActionController::LogSubscriber` — a lograge app has no `Completed` line at all, and the
+  `Rendered by:` text has nowhere to go. `payload[:render_source]` is still there, so pass it
+  through:
+
+  ```ruby
+  config.lograge.custom_options = lambda do |event|
+    { rendered_by: event.payload[:render_source] }.compact
+  end
+  ```
+
+- **Overlaps with `verbose_redirect_logs` on Rails 8.1+.** Both may report a redirect's
+  origin. The gem does not suppress the Rails feature; the two disagree usefully, since Rails
+  prints nothing when the redirect comes from a gem.
+
+## Requirements
+
+Rails 7.1 or newer, Ruby 3.1 or newer.
+
+## License
+
+MIT.

data/lib/who_rendered/call_site.rb

@@ -0,0 +1,108 @@
+# frozen_string_literal: true
+
+module WhoRendered
+  # Selects the frames worth reporting from a raw call stack.
+  #
+  # Deliberately free of any Rails dependency: every root it needs is injected,
+  # so the whole tier ladder is testable without booting anything.
+  class CallSite
+    # Rails renders from here when the action did not call render itself.
+    IMPLICIT_RENDER_BASENAMES = ["implicit_render.rb", "basic_implicit_render.rb"].freeze
+
+    # Anchored and greedy on purpose. The rubygems layout nests a "gems"
+    # directory inside another (.../gems/3.4.0/gems/devise-4.9.4/...), so only
+    # the rightmost match names the gem. Bundler's git layout
+    # (.../bundler/gems/pundit-abc1234/...) falls out of the same pattern.
+    GEM_PATH = %r{\A.*/gems/([^/]+)/(.+)\z}
+
+    # Application subdirectories that are not really application code.
+    EXCLUDED_APP_PREFIXES = ["vendor/", "bin/"].freeze
+
+    # One reportable stack frame, formatted for humans.
+    class Frame
+      def initialize(location, display_path)
+        @location = location
+        @display_path = display_path
+      end
+
+      def to_s
+        label = @location.label
+        base = "#{@display_path}:#{@location.lineno}"
+        label.nil? || label.empty? ? base : "#{base}:in '#{label}'"
+      end
+    end
+
+    def initialize(app_root:, framework_roots:, own_root:)
+      @app_root = normalize(app_root)
+      @own_root = normalize(own_root)
+      @framework_roots = Array(framework_roots).filter_map { |root| normalize(root) }
+    end
+
+    # True when Rails, not the application, called render.
+    def implicit_render?(location)
+      path = path_for(location)
+      return false unless path
+
+      IMPLICIT_RENDER_BASENAMES.include?(File.basename(path)) && framework?(path)
+    end
+
+    def frames(locations, limit: 1)
+      candidates = locations.reject { |location| own?(path_for(location)) }
+      return [] if candidates.empty?
+
+      app = candidates.select { |location| app?(path_for(location)) }
+      return build(app, limit) if app.any?
+
+      external = candidates.reject { |location| framework?(path_for(location)) }
+      return build(external, limit) if external.any?
+
+      build(candidates, limit)
+    end
+
+    private
+      def build(locations, limit)
+        locations.first(limit).map { |location| Frame.new(location, display_path(path_for(location))) }
+      end
+
+      def display_path(path)
+        return "?" unless path
+        return path.delete_prefix(@app_root) if @app_root && path.start_with?(@app_root)
+
+        match = GEM_PATH.match(path)
+        match ? "#{match[1]}/#{match[2]}" : path
+      end
+
+      def app?(path)
+        return false unless path && @app_root && path.start_with?(@app_root)
+
+        relative = path.delete_prefix(@app_root)
+        EXCLUDED_APP_PREFIXES.none? { |prefix| relative.start_with?(prefix) }
+      end
+
+      def framework?(path)
+        return false unless path
+
+        @framework_roots.any? { |root| path.start_with?(root) }
+      end
+
+      def own?(path)
+        return false unless path && @own_root
+
+        path.start_with?(@own_root)
+      end
+
+      def path_for(location)
+        return nil unless location
+
+        location.absolute_path || location.path
+      end
+
+      # Trailing separator so start_with? cannot match a sibling directory
+      # whose name merely begins with the root's name.
+      def normalize(root)
+        return nil if root.nil? || root.to_s.empty?
+
+        File.join(File.expand_path(root.to_s), "")
+      end
+  end
+end

data/lib/who_rendered/configuration.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+module WhoRendered
+  # User-facing settings. See README for the meaning of each.
+  class Configuration
+    CAPTURE_MODES = [:always, :non_2xx].freeze
+
+    # nil means "decide from the Rails environment when asked".
+    attr_accessor :enabled
+    attr_reader :logger, :frames, :capture
+
+    def initialize
+      @enabled = nil
+      @frames = 1
+      @capture = :always
+      @logger = nil
+    end
+
+    def enabled?
+      return !!@enabled unless @enabled.nil?
+
+      !!(defined?(::Rails.env) && ::Rails.env.local?)
+    end
+
+    def logger=(value)
+      unless value.nil? || (value.respond_to?(:warn) && value.respond_to?(:info))
+        raise ArgumentError, "logger must be nil or respond to :warn and :info, got #{value.inspect}"
+      end
+
+      @logger = value
+    end
+
+    def frames=(value)
+      unless value.is_a?(Integer)
+        raise ArgumentError, "frames must be an Integer, got #{value.inspect}"
+      end
+
+      raise ArgumentError, "frames must be >= 1, got #{value}" if value < 1
+
+      @frames = value
+    end
+
+    def capture=(value)
+      unless CAPTURE_MODES.include?(value)
+        raise ArgumentError, "capture must be :always or :non_2xx, got #{value.inspect}"
+      end
+
+      @capture = value
+    end
+  end
+end

data/lib/who_rendered/controller_hooks.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+module WhoRendered
+  # Captures the call site of a response-producing method. Capture only: this
+  # module never logs, formats, or decides what to print.
+  #
+  # Each wrapper calls super first and inspects state afterwards, so the gem
+  # never has to parse Rails' render arguments — the part of that API most
+  # likely to change between versions. Bare `super` forwards the original
+  # arguments verbatim, keywords included.
+  module ControllerHooks
+    def render(*args, **kwargs, &block)
+      result = super
+      __who_rendered_note(:render, caller_locations(1)) if __who_rendered_capture?
+      result
+    end
+
+    def head(*args, **kwargs, &block)
+      result = super
+      __who_rendered_note(:head, caller_locations(1)) if __who_rendered_capture?
+      result
+    end
+
+    def redirect_to(*args, **kwargs, &block)
+      result = super
+      __who_rendered_note(:redirect_to, caller_locations(1)) if __who_rendered_capture?
+      result
+    end
+
+    def __who_rendered_data # :nodoc:
+      defined?(@__who_rendered) ? @__who_rendered : nil
+    end
+
+    private
+      # Cheap pre-check, so the stack is only walked when the result will be
+      # used. Returns nil on an internal error, which reads as false.
+      def __who_rendered_capture?
+        WhoRendered.safely do
+          next false unless WhoRendered.active?
+          next false if __who_rendered_data
+          next true if WhoRendered.config.capture == :always
+
+          status = response&.status
+          !status || !(200..299).cover?(status)
+        end
+      end
+
+      def __who_rendered_note(method_name, locations)
+        WhoRendered.safely do
+          next if locations.nil? || locations.empty?
+          next if WhoRendered.call_site.implicit_render?(locations.first)
+
+          frames = WhoRendered.call_site.frames(locations, limit: WhoRendered.config.frames)
+          next if frames.empty?
+
+          @__who_rendered = { method: method_name, frames: frames.map(&:to_s) }
+        end
+      end
+  end
+end

data/lib/who_rendered/log_subscriber.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+require "active_support/log_subscriber"
+
+module WhoRendered
+  # Emits the frames that cannot fit on the Completed line. Only active when
+  # config.frames > 1, since that is the only way more than one frame reaches
+  # the payload.
+  class LogSubscriber < ActiveSupport::LogSubscriber
+    def process_action(event)
+      WhoRendered.safely do
+        frames = event.payload[:render_source_frames]
+        next if frames.nil? || frames.size < 2
+
+        target = WhoRendered.config.logger || logger
+        next unless target
+
+        frames.drop(1).each { |frame| target.info("  ↳ from #{frame}") }
+      end
+    end
+  end
+end

data/lib/who_rendered/payload.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+module WhoRendered
+  # Publishes the captured call site: to the process_action payload for anyone
+  # subscribing to it, and to the Completed line through
+  # ActionController::Base.log_process_action — the same hook ActiveRecord uses
+  # to add "ActiveRecord: 1.2ms" to that line.
+  module Payload
+    # The Completed line's text travels out of band rather than through the
+    # payload, because the payload log_process_action receives is not always the
+    # one append_info_to_payload wrote to. On Rails main the Completed line is
+    # built from the structured event, whose additions are a hardcoded
+    # payload.slice, so a custom payload key is dropped before
+    # log_process_action runs. A fiber-local is written and read in the same
+    # fiber — the log subscriber is invoked synchronously inside process_action
+    # on every supported version — and depends on no Rails internals.
+    KEY = :__who_rendered_source # :nodoc:
+
+    # Cleared at the start of every instrumented request, from
+    # start_processing.action_controller.
+    #
+    # The read cannot be what clears it. Rails 7.1's BroadcastLogger#info hands
+    # the same block to each of its sinks with no memoization, and Rails builds
+    # the Completed line inside that block, so log_process_action runs once per
+    # sink. A destructive read would put the attribution in the first sink only —
+    # under `rails server` on 7.1 that means the log file has it and the terminal
+    # does not.
+    #
+    # Nor can clearing on write be enough. Payload is prepended to
+    # ActionController::Base, so a controller's own append_info_to_payload sits
+    # ahead of ours; one that omits super stops ours from running at all, leaving
+    # the previous request's value to be reported against this one.
+    #
+    # Clearing at the request boundary answers both, and needs neither a logger
+    # nor cooperation from the application: start_processing is emitted from
+    # ActionController::Instrumentation#process_action on every supported version,
+    # immediately before the action runs and always in the same fiber that will
+    # later read the value. ActionController::Live matters here — it copies the
+    # parent thread's fiber-locals into the streaming thread, so the child starts
+    # out holding a stale value, and this clear is what removes it.
+    def self.clear_source
+      Thread.current[KEY] = nil
+    end
+
+    module ClassMethods
+      def log_process_action(payload)
+        messages = super
+
+        WhoRendered.safely do
+          source = Thread.current[KEY]
+          messages << "Rendered by: #{source}" if source
+        end
+
+        messages
+      end
+    end
+
+    private
+      # Private to match ActionController::Instrumentation.
+      def append_info_to_payload(payload)
+        super
+
+        WhoRendered.safely do
+          # Redundant with the boundary clear for any request that reaches here,
+          # and kept anyway: unsubscribing "start_processing.action_controller" by
+          # name — the usual recipe for silencing the "Processing by" line — drops
+          # every listener for that event, ours included. Two independent guards,
+          # because the cost of the last one failing is naming the wrong file.
+          Thread.current[KEY] = nil
+
+          data = __who_rendered_data
+          next unless data
+
+          source = data[:frames].first
+
+          payload[:render_source] = source
+          payload[:render_source_frames] = data[:frames] if data[:frames].size > 1
+          payload[:render_method] = data[:method]
+
+          Thread.current[KEY] = source
+        end
+      end
+  end
+end

data/lib/who_rendered/railtie.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+require "rails/railtie"
+require "who_rendered/controller_hooks"
+require "who_rendered/payload"
+require "who_rendered/log_subscriber"
+
+module WhoRendered
+  class Railtie < ::Rails::Railtie
+    config.who_rendered = WhoRendered.config
+
+    initializer "who_rendered.install" do
+      ActiveSupport.on_load(:action_controller_base) do
+        prepend WhoRendered::ControllerHooks
+
+        # ActionController::LogSubscriber calls this literally as
+        # ActionController::Base.log_process_action, even for API controllers,
+        # so Base is the only place it needs installing.
+        singleton_class.prepend WhoRendered::Payload::ClassMethods
+      end
+
+      ActiveSupport.on_load(:action_controller_api) do
+        prepend WhoRendered::ControllerHooks
+      end
+
+      # Payload goes onto ActionController::Instrumentation, where
+      # append_info_to_payload is actually defined, rather than onto Base and API.
+      # Instrumentation is in the ancestors of both, so one prepend covers them —
+      # but the reason it must not be Base is compatibility, not brevity.
+      #
+      # lograge's custom_payload support does
+      # `m = Klass.instance_method(:append_info_to_payload)` and then
+      # `define_method(:append_info_to_payload) { m.bind(self).call(...) }` on
+      # ActionController::Base. Prepended to Base, Payload is the topmost owner, so
+      # that captures Payload itself and redefines the method Payload's super then
+      # resolves to: unbounded mutual recursion, SystemStackError on every request,
+      # and WhoRendered.safely cannot catch it because SystemStackError is not a
+      # StandardError.
+      #
+      # Prepended to Instrumentation, Payload sits below Base in the ancestors, so a
+      # method defined directly on Base wins dispatch and Payload's super continues
+      # downward into Instrumentation. The cycle cannot form, in either installation
+      # order.
+      #
+      # This relies on a prepend to a module propagating into the classes that already
+      # include it, since Base has usually included Instrumentation by the time this
+      # runs. ThirdPartyPayloadHookTest asserts Payload really is in the ancestors of
+      # both Base and API, so a Ruby where that does not hold fails loudly.
+      ActiveSupport.on_load(:action_controller, run_once: true) do
+        ActionController::Instrumentation.prepend WhoRendered::Payload
+      end
+
+      # Plain Notifications rather than the gem's LogSubscriber, because
+      # ActiveSupport::LogSubscriber#call skips the event when it has no logger,
+      # and this clear must not depend on logging at all. See
+      # WhoRendered::Payload.clear_source for why it happens here.
+      ActiveSupport::Notifications.subscribe("start_processing.action_controller") do
+        WhoRendered.safely { WhoRendered::Payload.clear_source }
+      end
+
+      # ActionController requires and attaches its own LogSubscriber from the top
+      # of both action_controller/base.rb and action_controller/api.rb, and runs
+      # the :action_controller load hook at the end of those files. Subscribing
+      # from that hook therefore puts us after ActionController::LogSubscriber, so
+      # these lines print after the Completed line. Attaching in the initializer
+      # body instead would subscribe us first, because ActionController::Base has
+      # not been loaded at that point. run_once keeps an app that loads both Base
+      # and API from attaching twice.
+      ActiveSupport.on_load(:action_controller, run_once: true) do
+        WhoRendered::LogSubscriber.attach_to :action_controller
+      end
+    end
+  end
+end

data/lib/who_rendered/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module WhoRendered
+  VERSION = "0.1.0"
+end

data/lib/who_rendered.rb

@@ -0,0 +1,90 @@
+# frozen_string_literal: true
+
+require "who_rendered/version"
+require "who_rendered/configuration"
+require "who_rendered/call_site"
+
+module WhoRendered
+  # Rails components whose frames are never the answer to "who rendered?".
+  FRAMEWORK_GEMS = ["actionpack", "actionview", "activesupport", "railties"].freeze
+
+  class << self
+    def config
+      @config ||= Configuration.new
+    end
+
+    def configure
+      yield config
+      config
+    end
+
+    def reset!
+      @config = nil
+      @disabled = false
+      @call_site = nil
+    end
+
+    def active?
+      !disabled? && config.enabled?
+    end
+
+    def disabled?
+      !!@disabled
+    end
+
+    # Runs the gem's own work. An internal bug must never reach the application,
+    # so any StandardError takes the gem out of service for the rest of the
+    # process instead of raising into a request.
+    def safely
+      yield
+    rescue StandardError => error
+      # The inner rescue ensures the gem is disabled even if warning fails.
+      begin
+        disable!(error)
+      rescue StandardError
+        @disabled = true
+      end
+      nil
+    end
+
+    # Warning once is best-effort under concurrency: two threads faulting at the
+    # same instant can both pass the guard and both warn. Harmless under MRI, and
+    # not worth a mutex in the render path.
+    def disable!(error)
+      return if disabled?
+
+      @disabled = true
+      warn_about(error)
+    end
+
+    def call_site
+      @call_site ||= CallSite.new(
+        app_root: app_root,
+        framework_roots: framework_roots,
+        own_root: __dir__
+      )
+    end
+
+    private
+      def app_root
+        defined?(::Rails.root) && ::Rails.root ? ::Rails.root.to_s : nil
+      end
+
+      # Resolved through loaded specs rather than a path pattern, so this is
+      # still correct when Rails is a path: or git: dependency.
+      def framework_roots
+        FRAMEWORK_GEMS.filter_map { |name| Gem.loaded_specs[name]&.full_gem_path }
+      end
+
+      def warn_about(error)
+        message = "who_rendered disabled for this process after an internal error: " \
+                  "#{error.class}: #{error.message}"
+        logger = config.logger
+        logger ||= ::Rails.logger if defined?(::Rails.logger)
+
+        logger ? logger.warn(message) : Kernel.warn(message)
+      end
+  end
+end
+
+require "who_rendered/railtie" if defined?(::Rails::Railtie)

metadata

@@ -0,0 +1,80 @@
+--- !ruby/object:Gem::Specification
+name: who_rendered
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Stephen Crosby
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: actionpack
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.1'
+- !ruby/object:Gem::Dependency
+  name: railties
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.1'
+description: Adds the file and line that produced a Rails response to the Completed
+  log line, so an unexplained 403 names its own source.
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- LICENSE
+- README.md
+- lib/who_rendered.rb
+- lib/who_rendered/call_site.rb
+- lib/who_rendered/configuration.rb
+- lib/who_rendered/controller_hooks.rb
+- lib/who_rendered/log_subscriber.rb
+- lib/who_rendered/payload.rb
+- lib/who_rendered/railtie.rb
+- lib/who_rendered/version.rb
+homepage: https://github.com/stevecrozz/who_rendered
+licenses:
+- MIT
+metadata:
+  source_code_uri: https://github.com/stevecrozz/who_rendered
+  changelog_uri: https://github.com/stevecrozz/who_rendered/blob/main/CHANGELOG.md
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.1'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.6.9
+specification_version: 4
+summary: Find out who called render.
+test_files: []