
Security News
OWASP 2025 Top 10 Adds Software Supply Chain Failures, Ranked Top Community Concern
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.
spotlight-frontend
Advanced tools
|
| Release Notes | Design Documents
Spotlight is open source software that enables librarians, curators, and other content experts to easily build feature-rich websites that showcase collections and objects from a digital repository, uploaded items, or a combination of the two. Spotlight is a plug-in for Blacklight, an open source, Ruby on Rails Engine that provides a basic discovery interface for searching an Apache Solr index.
In addition to the information found below, you can read more about what Spotlight is, our motivations for creating it, and how to configure it in the wiki pages. You might also want to take a look at our demo videos, especially the tour of a completed Spotlight exhibit and the walkthrough of building an exhibit with Spotlight.
If you have questions or are interested in contributing, please reach out to the Spotlight Community
The following installation instructions are for setting up a new instance of Spotlight. To set up an environment for Spotlight development, see Developing Spotlight.
To bootstrap a new Rails application using importmap-rails:
$ SKIP_TRANSLATION=1 rails new app-name -m https://raw.githubusercontent.com/projectblacklight/spotlight/main/template.rb -a propshaft --css bootstrap
or using jsbundling-rails with esbuild:
$ SKIP_TRANSLATION=1 rails new app-name -m https://raw.githubusercontent.com/projectblacklight/spotlight/main/template.rb -a propshaft -j esbuild --css bootstrap
or from an existing Rails application:
$ SKIP_TRANSLATION=1 rails app:template LOCATION=https://raw.githubusercontent.com/projectblacklight/spotlight/main/template.rb
During this process you will be prompted to enter an initial administrator email and password (this is a super-admin that can administer any exhibit in the installation). If you choose not to create one, the first user will be given administrative privileges.
Change directories to your new application:
$ cd app-name
Run the database migrations:
$ SKIP_TRANSLATION=1 rake db:migrate
Start Solr (possibly using solr_wrapper in development or testing):
$ solr_wrapper
and the Rails development server:
$ bin/dev
Go to http://localhost:3000 in your browser.
Spotlight introduces functionality that depends on being able to send emails to exhibit curators and contacts. Be sure to configure your application's environments appropriately (see the Rails Guide for Action Mailer Configuration).
See the Spotlight wiki for more detailed information on configuring Spotlight.
Spotlight ships with i18n-tasks to help manage translations. To run a translation health check:
bundle exec i18n-tasks health
See developer-facing instructions for enabling translation on the wiki.
The JavaScript is built by npm from sources in app/javascript into a bundle
in app/assets/javascripts/spotlight/spotlight.js. This file should not be edited
by hand as any changes would be overwritten. When any of the JavaScript
components in the gem are changed, this bundle should be rebuilt with the
following steps:
npm install to download dependenciesnpm run prepare to build the bundleYou only need to update package.json and prepare/publish the JavaScript package for npm if there are changes to the JavaScript.
version.rb and package.json to set the new versionnpm run prepare to build the JavaScript bundlenpm i --package-lock-only to update the version in package-lock.jsongit commit -am "Bump version to X.X.X"bundle exec rake releasenpm publish to push the JavaScript package to https://npmjs.org/package/spotlight-frontendSee Updating the JavaScript bundle above for more details.
main branch is for development of the upcoming 5.0 release.4.x series is on the release-4.x branch for backports of features and bug fixes..internal_test_app/.rake spotlight:server and rake ci tasks use engine_cart and Solr automatically, but you can refer to engine_cart and solr_wrapper documentation to work with these tools outside of those rake tasks.cd into it.bundle install.Note: if your system is confused by conflicting gem versions, you may need to add "bundle exec" to the beginning of each command below, e.g. bundle exec rake engine_cart:generate. This ensures that the command is run in the context of bundler's gem version management.
After following one of the instructions below, visit http://localhost:3000. A Solr instance will be running on port 8983. When using importmap (the default configuration), JavaScript changes in development should not require bundling or a server restart.
The following rake task will build a Spotlight-based application, start Solr with solr_wrapper, and run the built-in rails server. In the process, you will be prompted to create an admin user and password.
rake spotlight:server
Alternatively, you can use individual commands to start Solr separately and set everything else up.
solr_wrapper # Run in separate tab
rake engine_cart:generate
rake spotlight:fixtures
cd .internal_test_app
bin/rails spotlight:initialize
bin/dev
The following will run Solr in Docker and then use individual commands to set up a running development server.
docker compose up -d
rake engine_cart:generate
rake spotlight:fixtures
cd .internal_test_app
rake spotlight:seed_admin_user
bin/dev
The following rake task will build a Spotlight-based application, start Solr, run the tests, and then shut down Solr when the tests are finished. Solr should not be running already when you run this.
rake
If you're using Solr on Docker, run docker compose up -d to start Solr if you haven't already. Once you have Solr running (either on Docker or with solr_wrapper), run the tests using the following commands:
rake engine_cart:generate
rake spotlight:fixtures
cd .internal_test_app && rake spec:prepare && cd - # not needed if you ran the dev server
rspec
Using rspec directly allows you to run individual test files / lines.
The spec:prepare task generates css assets for use by the tests. You can delete these assets with rake assets:clobber.
Once you are set up, you can also run rubocop to enforce consistent coding style.
Start Solr with solr_wrapper:
solr_wrapper
Reset Solr using solr_wrapper to a pristine state (e.g. remove Solr docs, core, etc.):
solr_wrapper clean
Note: Sometimes solr doesn't shut down properly. You can check by seeing if solr is running:
ps -eaf | grep solr
Add fixture data to Solr:
rake spotlight:fixtures
Delete an existing solr index:
rails c
> Blacklight.default_index.connection.delete_by_query "*:*"
> Blacklight.default_index.connection.commit
Build the test app:
rake engine_cart:generate
From ./internal_test_app, create the initial admin user:
With default credientials
rake spotlight:seed_admin_user
With user-provided credientials
bin/rails spotlight:initialize
From ./internal_test_app, start Rails to run the test app:
bin/dev
From the project root, delete the test app (if you want to regenerate from scratch):
$ rake engine_cart:clean
See Contributing to Spotlight for general information about participation in the Spotlight community.
FAQs
Exhibits plugin for blacklight
We found that spotlight-frontend demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.