yrby-rails 0.6.1 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ce4164de6e9497a1f6236581facfc1ca47bf33951fc32a977078016dd52a42d2
-  data.tar.gz: 1353f914370ba5b0142ece86d1ab38960d0a92c07c63b1e5320b8fe155350ce6
+  metadata.gz: 397e3f48e611d521d0afa26ddca292826276406b1fd04fb2bcfd09858a73081d
+  data.tar.gz: 51e88f6856f8a2859d18823e87ff2d5cd901e678e8b7a618ff7b2b0308d80c1d
 SHA512:
-  metadata.gz: f5e63dfbc35fd3969cd9effcb26d92f05cfa7f29efb302c7c71ecba11f51bc25b686e99ded9e979cd2c4d382069e4a8c10625a622c389f3e4b0ae3131f959ab7
-  data.tar.gz: 120215f5109ec37e77371a59318bb9fded69fbe79338f0a50cf1b6810a784b191bfc8696400369e0ec97e01752f7fc77b0fd74fb85ae220fc2f294d67c26a6c4
+  metadata.gz: 3299b4149a6dea79105be6bf69e643c8079029ac751bb50f68ce4b8d49ce570541b184f5b601215214d92b7848694a8b9a9a685eaf593f885378cbc8454e0a18
+  data.tar.gz: 4490087a7702972c2e447abcb2f4afff938d72e77704eb7cfc04d5a5272bc6e5248d22a883b193b3840db0aa5c3e602e6a0c50b57fb1d3169839e7530a764ff4

data/CHANGELOG-rails.md

@@ -5,6 +5,118 @@ documented here. The
 format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 this project aims to follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [0.7.0] - 2026-10-01
+
+### Added
+
+- `Y::DocumentChannel.authorize_document { |record, name| ... }` runs the
+  application's permission check when a client subscribes, on top of the
+  signed grant. The block runs in channel context. If it denies access, the
+  channel rejects that subscription without opening a stream or serving
+  state, and other subscriptions on the connection keep working. Without a
+  block, a valid signed grant is enough.
+
+  The check runs once per subscription, so a permission you revoke
+  mid-session takes effect the next time that client subscribes.
+- `record.collaborative_document(name)` returns a bound
+  `Y::Collaborative::Attribute`, which both application code and the shipped
+  channel use to read and write the document. `y_doc` builds a native
+  `Y::Doc`, and `load_state`, `append`, and `key` all use the same storage
+  class. `key` and `load_state` don't create a row, but the first `append`
+  does. Use `.document_row` for the built-in row operations.
+- `Y::Document.key_for(record, name)` returns the conventional key without
+  creating a document row.
+- `collaborative_sgid(name, expires_in:)` and
+  `collaborative_document_tag(record, name, expires_in:, refresh:)` let you
+  set the grant lifetime, which used to be GlobalID's default with no way to
+  shorten it. `refresh:` is a URL the element fetches when a subscription is
+  rejected. That action re-runs the app's authorization and renders
+  `{ grant: ... }`, and the client resubscribes the same session with the new
+  grant. The client fetches the URL once per rejection and does not poll.
+
+- `Y::DocumentChannel` ships in the gem, so apps don't need to write a
+  channel. Clients subscribe with the signed grant the page rendered
+  (`{ grant:, name: }`). The channel finds the record from the grant, loads
+  the document, and stores changes in `Y::Document`. It rejects grants that
+  are missing, tampered with, for the wrong attribute, or for a destroyed
+  record.
+
+- `collaborative_document_tag(record, name, **options)` is available in
+  Action View through the engine. It renders the mount element with the
+  signed grant, the attribute name, and the channel name as data attributes.
+  Anyone holding the grant can open the document, the same as with a
+  `turbo_stream_from` stream name, so only render the tag on pages where the
+  user is allowed to edit the record.
+
+- Channels get `Y::Document` storage by default. Declare `on_load` and
+  `on_change` if you want a different store. Outside a yrby-rails app there
+  is still no default, and subscribing raises until both hooks are declared.
+
+- `has_collaborative_document :name, encrypted: true` declares which storage
+  class backs an attribute, and `Y::DocumentChannel` uses that class. Every
+  load and append for an encrypted attribute goes through
+  `Y::EncryptedDocument`, so the bytes are ciphertext at rest and the plain
+  classes can't read them. The model decides whether an attribute is
+  encrypted, and a page or client can't change that. Undeclared attributes use
+  plain `Y::Document`.
+
+- `Y::Collaborative` adds signed tokens for record-backed documents, and the
+  engine includes it into ActiveRecord::Base. A page creates a token with
+  `record.collaborative_sgid(:body)`, and the channel finds the record with
+  `Y::Collaborative.locate(params[:grant], :body)`. The token is a signed
+  GlobalID scoped to one attribute, so a token for one field can't open
+  another. This is the standard way to implement `authorized?` for
+  record-backed documents. lexxy-realtime already uses this flow, and now it
+  ships in yrby-rails.
+
+### Changed
+
+- **Breaking:** channels reject every subscription until they define
+  `authorized?(key)`. `sync_subscribed` now calls it before opening a stream
+  or serving state, and the default returns `false`. Add the method to every
+  channel that includes `Y::ActionCable`:
+
+  ```ruby
+  private
+
+  def authorized?(key)
+    current_user&.can_edit?(key)
+  end
+  ```
+
+  Return `true` for public documents. If the default is what rejected a
+  subscription, the log message says so.
+
+- `yrby:install` now creates only the storage migration, since the gem ships
+  `Y::DocumentChannel`. Pass `--channel` to also generate an application
+  channel for custom authorization or room-keyed documents. That channel
+  rejects every subscription until you implement `authorized?`.
+
+### Fixed
+
+- Document elements now attach editors to sessions that exist independently
+  of any editor, so pending edits survive navigation under their original
+  grant and rejected deliveries can still be recovered. Turbo previews are
+  inert, and cached HTML contains no CRDT bytes.
+- When an attribute morphs, the element releases the old editor binding and
+  acquires the new document. It doesn't move pending edits or authorization
+  over to the new document.
+
+- Default storage now supplies the loader and recorder together, and
+  declaring only one custom hook raises before subscribing or acknowledging
+  an update. Previously, reads and writes silently went to different stores.
+
+- Signed grants work even when the host app doesn't load Active Job.
+
+- The `yrby:tables` migration template caps `y_documents.state` at
+  `1.gigabyte - 1` instead of `4.gigabytes - 1`. Postgres raises
+  `ArgumentError` for binary limits above 1 GB - 1, so `db:migrate` on a
+  fresh Postgres app failed. MySQL maps both values to `longblob`, and
+  SQLite ignores limits, so nothing changes there. Apps that already
+  migrated are unaffected.
+
 ## [0.6.1] - 2026-08-11
 
 ### Fixed