Add private_output_path configuration for SSR bundles (#592)

justin808 · web-flow · commit 34a14419d78e · 2025-09-27T12:37:37.000-10:00
Introduces a new configuration option for managing server-side rendering (SSR) bundle outputs separately from public assets. This feature enables better organization and security for server-only bundles that should not be publicly accessible.

Key improvements:
- Add private_output_path configuration option to shakapacker.yml
- Implement Configuration#private_output_path method with nil-safe handling
- Default value set to 'ssr-generated' for consistent behavior
- Gracefully returns nil when configuration is not set

Configuration changes:
- New optional setting: private_output_path in shakapacker.yml
- Defaults to 'ssr-generated' directory relative to Rails root
- Can be set to nil to disable the feature

Implementation details:
- Method safely handles nil values to prevent join errors
- Follows existing configuration pattern for consistency
- Includes comprehensive test coverage

Impact on existing installations:
- No breaking changes - feature is opt-in with sensible defaults
- Existing installations without SSR are unaffected
- New installations get the default 'ssr-generated' path configured

Use cases:
- Server-side rendering bundles that shouldn't be served publicly
- Separation of public and private webpack outputs
- Better security isolation for server-only JavaScript bundles
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -11,6 +11,7 @@ Changes since the last non-beta release.
 
 ### Added
 - Rspack support as an alternative assets bundler to webpack. Configure `assets_bundler: 'rspack'` in `shakapacker.yml` to use Rspack's faster Rust-based bundling with webpack-compatible APIs, built-in SWC loader, and CSS extraction. Automatic assets bundler detection in `bin/shakapacker` with fallback support for webpack configurations.
+- Add `private_output_path` configuration option for server-side rendering bundles. This allows specifying a separate output directory for private server bundles that shouldn't be served publicly. [PR 592](https://github.com/shakacode/shakapacker/pull/592) by [justin808](https://github.com/justin808).
 
 ### Changed
 - Configuration option renamed from `bundler` to `assets_bundler` to avoid confusion with Ruby's Bundler gem manager. The old `bundler` option is deprecated but still supported with a warning (not a breaking change).
@@ -21,7 +22,7 @@ Changes since the last non-beta release.
   - Note: Default imports (`import styles from '...'`) will no longer work as css-loader with `namedExport: true` doesn't generate a default export
   - See the [CSS Modules Export Mode documentation](./docs/css-modules-export-mode.md) for detailed migration instructions and override options
 
-## [v8.4.0] - September 8, 2025
+## [v9.0.0.beta.2] - September 25, 2025
 ### Added
 
 * Support for subresource integrity. [PR 570](https://github.com/shakacode/shakapacker/pull/570) by [panagiotisplytas](https://github.com/panagiotisplytas)
diff --git a/README.md b/README.md
@@ -931,6 +931,15 @@ source_path: frontend # packs are the files in frontend/
 public_output_path: assets/packs # outputs to => public/assets/packs
 ```
 
+For server-side rendering (SSR) scenarios where you need to generate bundles that should not be served publicly, you can use the `private_output_path` configuration:
+
+```yml
+# config/shakapacker.yml
+private_output_path: ssr-generated # outputs to => ssr-generated/
+```
+
+This is particularly useful when working with libraries like React on Rails where server bundles need to be kept separate from client bundles.
+
 Similarly, you can also control and configure `webpack-dev-server` settings from `config/shakapacker.yml` file:
 
 ```yml
diff --git a/lib/install/config/shakapacker.yml b/lib/install/config/shakapacker.yml
@@ -29,6 +29,12 @@ default: &default
   # Location for manifest.json, defaults to {public_output_path}/manifest.json if unset
   # manifest_path: public/packs/manifest.json
 
+  # Location for private output, defaults to ssr-generated
+  # This setting is for generating bundles that are only used in server-side rendering
+  # and should not be served publicly (alternative to public_output_path)
+  # Output path for private server-side bundles (e.g., for SSR)
+  private_output_path: ssr-generated
+
   # Additional paths webpack should look up modules
   # ['app/assets', 'engine/foo/app/assets']
   additional_paths: []
diff --git a/lib/shakapacker/configuration.rb b/lib/shakapacker/configuration.rb
@@ -68,6 +68,12 @@ def public_path
     root_path.join(fetch(:public_root_path))
   end
 
+  def private_output_path
+    private_path = fetch(:private_output_path)
+    return nil unless private_path
+    root_path.join(private_path)
+  end
+
   def public_output_path
     public_path.join(fetch(:public_output_path))
   end
diff --git a/spec/shakapacker/configuration_spec.rb b/spec/shakapacker/configuration_spec.rb
@@ -54,6 +54,12 @@
       expect(config.cache_path.to_s).to eq cache_path
     end
 
+    it "#private_output_path returns correct path" do
+      private_output_path = File.expand_path File.join(File.dirname(__FILE__), "./test_app/ssr-generated").to_s
+
+      expect(config.private_output_path.to_s).to eq private_output_path
+    end
+
     it "#additional_paths returns correct path" do
       expect(config.additional_paths).to eq ["app/assets", "/etc/yarn", "some.config.js", "app/elm"]
     end
