refactor: Use configuration-based approach for server bundle output path

- Set 'ssr-generated' as default value for server_bundle_output_path
- Remove hard-coded paths from try_private_server_locations
- Update handle_missing_manifest_entry to respect configuration
- Maintain backwards compatibility with 'generated/server-bundles' fallback
- Honor enforce_secure_server_bundles flag to prevent public fallbacks

Co-authored-by: Abanoub Ghadban <AbanoubGhadban@users.noreply.github.com>

Author: github-actions[bot]

lib/react_on_rails/configuration.rb

@@ -53,7 +53,7 @@ def self.configuration
       # Set to 0 to disable the timeout and wait indefinitely for component registration.
       component_registry_timeout: DEFAULT_COMPONENT_REGISTRY_TIMEOUT,
       generated_component_packs_loading_strategy: nil,
-      server_bundle_output_path: nil,
+      server_bundle_output_path: "ssr-generated",
       enforce_secure_server_bundles: false
     )
   end

lib/react_on_rails/utils.rb

@@ -117,23 +117,29 @@ def self.bundle_js_file_path(bundle_name)
 
     private_class_method def self.try_private_server_locations(bundle_name)
       config = ReactOnRails.configuration
-
-      # Build candidate locations, including configured output path
       root_path = Rails.root || "."
+
+      # Primary location from configuration (now defaults to "ssr-generated")
       candidates = [
-        File.join(root_path, "ssr-generated", bundle_name),
-        File.join(root_path, "generated", "server-bundles", bundle_name)
+        File.join(root_path, config.server_bundle_output_path, bundle_name)
       ]
 
-      # Add configured server_bundle_output_path if present
-      if config.server_bundle_output_path.present?
-        candidates << File.join(root_path, config.server_bundle_output_path, bundle_name)
-      end
+      # Add legacy fallback for backwards compatibility
+      candidates << File.join(root_path, "generated", "server-bundles", bundle_name)
 
       find_first_existing_path(candidates)
     end
 
     private_class_method def self.handle_missing_manifest_entry(bundle_name, is_server_bundle)
+      config = ReactOnRails.configuration
+      root_path = Rails.root || "."
+
+      # When enforcement is on for server bundles, only use private locations
+      if is_server_bundle && enforce_secure_server_bundles?
+        # Only try private locations, no public fallbacks
+        return File.expand_path(File.join(root_path, config.server_bundle_output_path, bundle_name))
+      end
+
       # When manifest lookup fails, try multiple fallback locations:
       # 1. Environment-specific path (e.g., public/webpack/test)
       # 2. Standard Shakapacker location (public/packs)
@@ -150,8 +156,8 @@ def self.bundle_js_file_path(bundle_name)
 
       # If none exist, return appropriate default based on bundle type
       if is_server_bundle
-        # For server bundles, prefer private location as final fallback
-        File.expand_path(File.join("ssr-generated", bundle_name))
+        # For server bundles, use configured private location as final fallback
+        File.expand_path(File.join(root_path, config.server_bundle_output_path, bundle_name))
       else
         # For client bundles, use environment-specific path (original behavior)
         File.expand_path(fallback_locations.first)

spec/react_on_rails/utils_spec.rb

@@ -185,7 +185,7 @@ def mock_dev_server_running
                 allow(ReactOnRails).to receive_message_chain("configuration.enforce_secure_server_bundles")
                   .and_return(false)
                 allow(ReactOnRails).to receive_message_chain("configuration.server_bundle_output_path")
-                  .and_return(nil)
+                  .and_return("ssr-generated")
               end
 
               it "tries secure locations first for server bundles" do
@@ -225,7 +225,7 @@ def mock_dev_server_running
                 allow(ReactOnRails).to receive_message_chain("configuration.enforce_secure_server_bundles")
                   .and_return(false)
                 allow(ReactOnRails).to receive_message_chain("configuration.server_bundle_output_path")
-                  .and_return(nil)
+                  .and_return("ssr-generated")
               end
 
               it "treats RSC bundles as server bundles and tries secure locations first" do