Giving Rails back to the app

A Nibble site is a Rails application. That sounds obvious, but until 0.18.0 Nibble was quietly holding on to a lot of that application: settings, paths and class names that belong to whoever runs the site.

The rule for this release: Nibble takes over no Rails default. Where it needs a setting, the installer writes it into the site's own file with a comment saying why, and the site is free to change it.

# Nibble: S3 once a bucket is named.
config.active_storage.service =
  ENV["AWS_BUCKET_NAME"].present? ? :amazon : :local

Paths that weren't ours

• Uploaded files were served from /assets, which is the asset pipeline's path. To make room, Nibble had moved the pipeline to /rails/assets. Now uploads live at /media and the pipeline gets /assets back.

• /up, the health check, is back in the site's own routes.rb, where rails new puts it.

• The Control Plane moved from /admin to /cp, and it's called the Control Plane everywhere now.

An endpoint that took uploads from anyone

Rails ships a direct-upload endpoint at /rails/active_storage/direct_uploads, and it accepts uploads from anyone. Nibble had been drawing its own authenticated route on the same path, which hid Rails' one. Handing the path back would have opened anonymous uploads to storage. So that path now answers 404, and the Control Plane uploads through a route of its own that checks who is uploading. Site forms never used it: they post files with the submission.

The constant that resolved to the wrong class

Nibble's Control Plane controllers moved under Nibble::Cp. Inside module Nibble, a bare Current.user stopped meaning what it said: Ruby looked in Nibble first and found Nibble::Current, a different class with no user. The fix wasn't a workaround. The two Current classes were merged into one, under Nibble's name.

Found by actually running the generator

The point of freeing names like User, Session and Current is that a site can run Rails' own bin/rails generate authentication for accounts of its own. So the install test now does exactly that on a freshly installed site. The first run failed: Rails' generator writes migrations called CreateUsers and CreateSessions, and Nibble had migrations with the same class names. Migration names have to be unique across every path. Nibble's are all prefixed now. I'd never have found that by reading code.