active_scaffold 4.3.1 → 4.4.0

data/config/locales/ru.yml

@@ -20,7 +20,7 @@ ru:
     begins_with: Начинается с
     between: В интервале
     cancel: Отмена
-    cant_destroy_record: Запись %{record} не может быть удалена
+    cant_destroy_record: Запись %{record} не может быть удалена.
     changes: Изменения
     check_all: Выбрать все
     click_to_edit: Нажмите для редактирования
@@ -62,9 +62,9 @@ ru:
       template:
         body: 'Проблемы возникли со следующими полями:'
         header:
-          one: '%{model}: сохранение не удалось из-за %{count} ошибки'
-          few: '%{model}: сохранение не удалось из-за %{count} ошибок'
-          many: '%{model}: сохранение не удалось из-за %{count} ошибок'
+          one: '%{model}: сохранение не удалось из-за %{count} ошибки.'
+          few: '%{model}: сохранение не удалось из-за %{count} ошибок.'
+          many: '%{model}: сохранение не удалось из-за %{count} ошибок.'
     export: Экспорт
     'false': Нет
     filtered: "(Найденное)"
@@ -96,7 +96,7 @@ ru:
     next_month: В следующем месяце
     next_week: На следующей неделе
     next_year: В следующем году
-    no_authorization_for_action: Нет прав на выполнение действия "%{action}"
+    no_authorization_for_action: Нет прав на выполнение действия "%{action}".
     no_color: Без цвета
     no_entries: Нет записей
     no_group: Без группы
@@ -114,7 +114,7 @@ ru:
     previous: Предыдущее
     print: Печать
     range: Интервал
-    record_not_saved: Запись  не может быть сохранена из-за неизвестной ошибки
+    record_not_saved: Запись не может быть сохранена из-за неизвестной ошибки.
     records_marked:
       one: Отмечена 1 запись
       few: Отмечено %{count} записи
@@ -147,10 +147,11 @@ ru:
     update_model: "%{model}: обновить запись"
     updated_model: "%{model}: запись обновлена"
     version_inconsistency: Эта запись была обновлена с того момента, как вы 
-      начали ее редактировать
+      начали ее редактировать.
     weeks: недель
     years: лет
     yesterday: Вчера
+    already_added_model: '%{model} has already been added.'
   date:
     formats:
       month: '%B'

data/config/locales/ta.yml

@@ -20,7 +20,7 @@ ta:
     begins_with: 'உடன் தொடங்குகிறது'
     between: 'இடையில்'
     cancel: 'ரத்துசெய்'
-    cant_destroy_record: "%{record} அழிக்க முடியாது"
+    cant_destroy_record: "%{record} அழிக்க முடியாது."
     changes: 'மாற்றங்கள்'
     check_all: 'அனைத்தையும் சரிபார்க்கவும்'
     click_to_edit: 'திருத்த சொடுக்கு செய்யவும்'
@@ -38,8 +38,8 @@ ta:
     customize: 'தனிப்பயனாக்கு'
     date_picker_options:
       firstDay: '0'
-      isRTL: 'பொய்'
-      showMonthAfterYear: 'பொய்'
+      isRTL: 'false'
+      showMonthAfterYear: 'false'
       weekHeader: 'Wk'
     datetime_picker_options:
       closeText: 'மூடு'
@@ -63,7 +63,7 @@ ta:
         body: 'பின்வரும் துறைகளில் சிக்கல்கள் உள்ளன:'
         header:
           one: 1 பிழை இந்த %{model} சேமிக்கப்படுவதைத் தடுக்கிறது.
-          other: '%{count} பிழைகள் இந்த %{model} சேமிக்கப்படுவதைத் தடுக்கின்றன'
+          other: '%{count} பிழைகள் இந்த %{model} சேமிக்கப்படுவதைத் தடுக்கின்றன.'
     export: 'ஏற்றுமதி'
     'false': 'பொய்'
     filtered: "(வடிகட்டப்பட்டது)"
@@ -92,7 +92,7 @@ ta:
     next_month: 'அடுத்த மாதம்'
     next_week: 'அடுத்த வாரம்'
     next_year: 'அடுத்த வருடம்'
-    no_authorization_for_action: 'செயலுக்கு ஏற்பு இல்லை %{action}'
+    no_authorization_for_action: 'செயலுக்கு ஏற்பு இல்லை %{action}.'
     no_color: 'நிறம் இல்லை'
     no_entries: 'உள்ளீடுகள் இல்லை'
     no_group: 'குழு இல்லை'
@@ -110,7 +110,7 @@ ta:
     previous: 'முந்தைய'
     print: 'அச்சிடுக'
     range: 'வீச்சு'
-    record_not_saved: 'அறியப்படாத பிழைக்கான பதிவைச் சேமிப்பதில் தோல்வி'
+    record_not_saved: 'அறியப்படாத பிழைக்கான பதிவைச் சேமிப்பதில் தோல்வி.'
     records_marked:
       one: 1 குறிக்கப்பட்டது %{model}
       other: '%{count} %{model} எனக் குறிக்கப்பட்டது'
@@ -146,6 +146,7 @@ ta:
     weeks: 'வாரங்கள்'
     years: 'ஆண்டுகள்'
     yesterday: 'நேற்று'
+    already_added_model: '%{model} has already been added.'
   date:
     formats:
       month: "%B"

data/config/locales/zh_Hans.yml

@@ -20,7 +20,7 @@ zh_Hans:
     begins_with: 以……开始
     between: 介于……之间
     cancel: 取消
-    cant_destroy_record: '%{record}不能被删除'
+    cant_destroy_record: '%{record}不能被删除。'
     changes: 变更记录
     check_all: 全选
     click_to_edit: 点击以编辑
@@ -30,7 +30,7 @@ zh_Hans:
     config_list_model: 为%{model}配置列
     contains: 包含
     create: 创建
-    create_another: 新建 %{model}
+    create_another: 新建另一 %{model}
     create_apply: 创建并继续
     create_model: 创建 %{model}
     create_new: 新建
@@ -62,15 +62,15 @@ zh_Hans:
       template:
         body: 以下字段存在问题：
         header:
-          other: '%{count} 个错误阻止了这个 %{model} 被保存'
-    export: Export
-    'false': 'False'
+          other: '%{count} 个错误阻止了该 %{model} 的保存。'
+    export: 导出
+    'false': '假'
     filtered: (Filtered)
     found: 发现了
     future: Future
     group_by: Group by
     grouped_by: Grouped by %{column}
-    hide: (Hide)
+    hide: (隐藏)
     hours: Hours
     human_conditions:
       association: '%{column} = %{value}'
@@ -81,9 +81,9 @@ zh_Hans:
     loading: Loading…
     logical_search: Logical Search
     mark_all_records: Mark all
-    maximum: Maximum
-    minimum: Minimum
-    minutes: Minutes
+    maximum: 最大值
+    minimum: 最小值
+    minutes: 分钟
     months: 月
     nested_for_model: '%{nested_model} for %{parent_model}'
     nested_of_model: '%{nested_model} of %{parent_model}'
@@ -92,8 +92,8 @@ zh_Hans:
     next_week: Next Week
     next_year: Next Year
     no_authorization_for_action: No Authorization for action %{action}
-    no_color: No color
-    no_entries: No Entries
+    no_color: 无颜色
+    no_entries: 无条目
     no_group: No group
     no_options: no options
     'null': 'Null'
@@ -104,8 +104,8 @@ zh_Hans:
     pdf: PDF
     prev_month: Last Month
     prev_week: Last Week
-    prev_year: Last Year
-    previous: Previous
+    prev_year: 去年
+    previous: 上一个
     print: Print
     range: Range
     record_not_saved: Failed to save record cause of an unknown error
@@ -144,6 +144,7 @@ zh_Hans:
     years: Years
     yesterday: Yesterday
     not_null: Not Null
+    already_added_model: '%{model} has already been added.'
   date:
     formats:
       month: '%B'

data/lib/active_scaffold/actions/common_search.rb

@@ -35,20 +35,7 @@ module ActiveScaffold::Actions
       end
 
       def set_outer_joins_for_search(columns) # rubocop:disable Naming/AccessorMethodName
-        references = []
-        outer_joins = []
-        columns.each do |column|
-          next if column.search_joins.blank?
-
-          if column.includes.present? && list_columns.include?(column)
-            references << (column.search_joins & column.includes)
-            outer_joins << (column.search_joins - column.includes)
-          else
-            outer_joins << column.search_joins
-          end
-        end
-        active_scaffold_references.concat references.flatten.uniq.compact
-        active_scaffold_outer_joins.concat outer_joins.flatten.uniq.compact
+        active_scaffold_outer_joins.concat columns.flat_map(&:search_joins).uniq
       end
 
       def store_search_params_into_session

data/lib/active_scaffold/actions/core.rb

@@ -366,34 +366,29 @@ module ActiveScaffold::Actions
       active_scaffold_config.model
     end
 
-    # Builds search conditions by search params for column names. This allows urls like "contacts/list?company_id=5".
+    # Builds search conditions from query parameters whose names match columns.
+    # For example, `contacts/list?company_id=5` matches records with company_id 5.
+    # Append `!` to a column name to negate the condition, as in `company_id!=5`.
+    # A value containing exactly one `..` defines a range for supported column types, for example
+    # `created_at=2025-01-01..2025-12-31`. A missing range endpoint creates an infinite range,
+    # such as `created_at=..2025-12-31` or `created_at=2025-01-01..`.
+    # Array parameters use the `column[]=value` syntax, for example `company_id[]=5&company_id[]=10`.
+    # Negation may also be combined with ranges or arrays, using `not_between` or `not_in`.
     def conditions_from_params
       @conditions_from_params ||= begin
         conditions = [{}]
-        supporting_range = %i[date datetime integer decimal float bigint]
         params.except(:controller, :action, :page, :sort, :sort_direction, :format, :id).each do |key, value|
-          distinct = true if key.match?(/!$/)
+          distinct = key.match?(/!$/)
           column = active_scaffold_config._columns_hash[key.to_s[0..(distinct ? -2 : -1)]]
           next unless column
 
           key = column.name.to_sym
-          not_string = %i[string text].exclude?(column.type)
           next if active_scaffold_constraints[key]
           next if nested? && nested.param_name == key
 
-          range = supporting_range.include?(column.type) && value.is_a?(String) && value.scan('..').size == 1
-          value = value.split('..') if range
-          value =
-            if value.is_a?(Array)
-              value.map { |v| v == '' && not_string ? nil : ActiveScaffold::Core.column_type_cast(v, column) }
-            elsif value == '' && (not_string || column.null)
-              ActiveScaffold::Core.column_type_cast(column.default, column)
-            else
-              ActiveScaffold::Core.column_type_cast(value, column)
-            end
-          value = Range.new(*value) if range
+          value = condition_value_from_param(value, column, active_scaffold_config.model)
           if distinct
-            conditions << active_scaffold_config.model.arel_table[key].not_eq(value)
+            conditions << distinct_condition(key, value)
           else
             conditions[0][key] = value
           end
@@ -402,6 +397,46 @@ module ActiveScaffold::Actions
       end
     end
 
+    def distinct_condition(key, value)
+      attribute = active_scaffold_config.model.arel_table[key]
+      case value
+      when Array
+        attribute.not_in(value)
+      when Range
+        attribute.not_between(value)
+      else
+        attribute.not_eq(value)
+      end
+    end
+
+    def condition_value_from_param(value, column, model)
+      range = range_from_param(value, column)
+      value = range.captures if range
+      not_string = %i[string text].exclude?(column.type)
+      value =
+        if value.is_a?(Array)
+          value.map { |item| conditional_cast_for_column(item, column, not_string, model) }
+        elsif value == '' && (not_string || column.null)
+          ActiveScaffold::Core.column_type_cast(column.default, column, model)
+        else
+          ActiveScaffold::Core.column_type_cast(value, column, model)
+        end
+      range ? Range.new(*value) : value
+    end
+
+    def conditional_cast_for_column(value, column, not_string, model)
+      return if value == '' && not_string
+
+      ActiveScaffold::Core.column_type_cast(value, column, model)
+    end
+
+    def range_from_param(value, column)
+      supporting_range = %i[date datetime timestamp timestamptz integer decimal float bigint]
+      return unless supporting_range.include?(column.type) && value.is_a?(String) && value.scan('..').size == 1
+
+      value.match(/\A(.*)\.\.(.*)\z/)
+    end
+
     def empty_model
       relation = beginning_of_chain
       if nested? && nested.plural_association? && nested.match_model?(active_scaffold_config.model)
@@ -437,6 +472,10 @@ module ActiveScaffold::Actions
     end
 
     def get_row(crud_type_or_security_options = :read)
+      get_record(crud_type_or_security_options)
+    end
+
+    def get_record(crud_type_or_security_options = :read)
       klass = filtered_query
       klass = klass.preload(active_scaffold_preload) unless active_scaffold_config.mongoid?
       @record = find_if_allowed(params[:id], crud_type_or_security_options, klass)

data/lib/active_scaffold/actions/field_search.rb

@@ -110,8 +110,8 @@ module ActiveScaffold::Actions
       end
 
       def grouped_columns_calculations
-        @grouped_columns_calculations ||= list_columns[1..].each_with_object({}) do |c, h|
-          h[c.name] = calculation_for_group_search(c)
+        @grouped_columns_calculations ||= list_columns[1..].to_h do |c|
+          [c.name, calculation_for_group_search(c)]
         end
       end
 

data/lib/active_scaffold/actions/list.rb

@@ -172,11 +172,13 @@ module ActiveScaffold::Actions
     end
 
     def count_query_for_column(column, records)
-      if count_on_association_class?(column)
-        count_query_on_association_class(column, records)
-      else
-        count_query_with_join(column, records)
-      end
+      query =
+        if count_on_association_class?(column)
+          count_query_on_association_class(column, records)
+        else
+          count_query_with_join(column, records)
+        end
+      query.unscope(:order)
     end
 
     def count_query_on_association_class(column, records)
@@ -207,8 +209,8 @@ module ActiveScaffold::Actions
       end
       group = {_id: "$#{column.association.foreign_key}", count: {'$sum' => 1}}
       query = column.association.klass.collection.aggregate([{'$match' => matches}, {'$group' => group}])
-      query.each_with_object({}) do |row, hash|
-        hash[row['_id']] = row['count']
+      query.to_h do |row|
+        [row['_id'], row['count']]
       end
     end
 
@@ -281,24 +283,44 @@ module ActiveScaffold::Actions
       active_scaffold_config.list.refresh_with_header = true
 
       active_scaffold_config.list.filters.inject(query) do |q, filter|
-        next q unless filter.security_method.nil? || send(filter.security_method)
-
         default_option = filter[filter.default_option]
-        apply_filter q, params[filter.name] ? filter[params[filter.name]] : default_option, default_option
+        filter_option = params[filter.name] ? filter[params[filter.name]] : default_option
+        unless filter_allowed?(filter)
+          track_filter filter_option, default_option, :disallowed if params.key?(filter.name)
+          next q
+        end
+
+        apply_filter q, filter_option, default_option
       end
     end
 
+    def filter_allowed?(filter)
+      !filter.security_method_set? || send(filter.security_method)
+    end
+
     def apply_filter(query, filter_option, default_option)
-      return query if filter_option.nil? || (filter_option.security_method_set? && !send(filter_option.security_method))
+      if filter_option.nil? || !filter_allowed?(filter_option)
+        track_filter filter_option, default_option, filter_option ? :disallowed : :unknown
+        return query
+      end
 
-      @applied_filters ||= []
-      @applied_filters << filter_option unless filter_option == default_option
+      track_filter filter_option, default_option, :applied
       case filter_option.conditions
       when Proc then instance_exec query, &filter_option.conditions
       else query.where(filter_option.conditions)
       end
     end
 
+    def track_filter(filter_option, default_option, status)
+      @filter_states ||= {}
+      @filter_states[default_option.filter_name] = {
+        option: filter_option,
+        status: status,
+        default: filter_option == default_option,
+        requested: params.key?(default_option.filter_name)
+      }
+    end
+
     def scoped_query
       @scoped_query ||= begin
         do_search if respond_to? :do_search, true

data/lib/active_scaffold/actions/nested.rb

@@ -179,7 +179,9 @@ module ActiveScaffold::Actions::Nested
 
     def add_existing_respond_to_html
       if successful?
-        flash[:info] = as_(:created_model, model: ERB::Util.h(@record.to_label))
+        unless @association_already_exists
+          flash[:info] = as_(:created_model, model: ERB::Util.h(@record.to_label))
+        end
         return_to_main
       else
         render action: 'add_existing_form'
@@ -250,12 +252,34 @@ module ActiveScaffold::Actions::Nested
     def do_add_existing
       parent_record = nested_parent_record(:update)
       @record = active_scaffold_config.model.find(params[:associated_id])
-      if parent_record && @record
-        self.successful = false unless parent_record.send(nested.association.name) << @record
-        parent_record.save if successful?
-      else
-        false
-      end
+      return false unless parent_record && @record
+
+      association = parent_record.send(nested.association.name)
+      added = add_existing_to_association(association)
+      return true if @association_already_exists
+
+      self.successful = false unless added
+      parent_record.save if successful?
+    end
+
+    def add_existing_to_association(association)
+      return association_already_exists if association.include?(@record)
+
+      association << @record
+    rescue ActiveRecord::RecordNotUnique
+      # Handles concurrent submissions. Only suppress the exception when the
+      # requested association now exists; otherwise it was a different
+      # uniqueness violation.
+      association.reset
+      raise unless association.include?(@record)
+
+      association_already_exists
+    end
+
+    def association_already_exists
+      @association_already_exists = true
+      self.successful = true
+      flash[:warning] = as_(:already_added_model, model: ERB::Util.h(@record.to_label))
     end
 
     def do_destroy_existing

data/lib/active_scaffold/actions/show.rb

@@ -48,7 +48,7 @@ module ActiveScaffold::Actions
     # May be overridden to customize show routine
     def do_show
       set_includes_for_columns(:show) if active_scaffold_config.actions.include? :list
-      get_row
+      get_record
     end
 
     # The default security delegates to ActiveRecordPermissions.

data/lib/active_scaffold/active_record_permissions.rb

@@ -119,7 +119,7 @@ module ActiveScaffold
           key = "#{options[:crud_type]}##{options[:column]}##{options[:action]}"
           if is_a? Class
             self.class_security_methods ||= {}
-            self.class_security_methods[key] ||= authorized_for_methods(options)
+            class_security_methods[key] ||= authorized_for_methods(options)
           else
             self.class.instance_security_methods ||= {}
             self.class.instance_security_methods[key] ||= authorized_for_methods(options)

data/lib/active_scaffold/attribute_params.rb

@@ -267,7 +267,8 @@ module ActiveScaffold
       elsif klass.authorized_for?(crud_type: :create)
         association = parent_column.association
         record = klass.new
-        if association.reverse_association&.belongs_to? && (association.collection? || current.nil?)
+        if association.reverse_association&.belongs_to? && association.singular? && current.nil?
+          # assign belongs_to on the new record, for has_one associations
           record.send(:"#{parent_column.association.reverse}=", parent_record)
         end
         record

data/lib/active_scaffold/bridges/date_picker/helper.rb

@@ -32,6 +32,13 @@ module ActiveScaffold::Bridges
         end.join
       end
 
+      def self.date_options_by_locale
+        I18n.available_locales.filter_map do |locale|
+          locale_date_options = date_options(locale)
+          [locale.to_s, locale_date_options] if locale_date_options
+        end.to_h
+      end
+
       def self.date_options(locale)
         date_picker_options = {
           closeText:       as_(:close),
@@ -76,6 +83,13 @@ module ActiveScaffold::Bridges
         end.join
       end
 
+      def self.datetime_options_by_locale
+        I18n.available_locales.filter_map do |locale|
+          locale_datetime_options = datetime_options(locale)
+          [locale.to_s, locale_datetime_options] if locale_datetime_options
+        end.to_h
+      end
+
       def self.datetime_options(locale)
         rails_time_format = I18n.translate! 'time.formats.picker', locale: locale, default: '%a, %d %b %Y %H:%M:%S'
         datetime_picker_options = {

data/lib/active_scaffold/bridges/date_picker.rb

@@ -30,5 +30,15 @@ module ActiveScaffold::Bridges
   }
 });\n"
     end
+
+    # Data-only equivalent of .localization, consumed directly by load.js without eval,
+    # so it works under a CSP that disallows 'unsafe-eval'.
+    def self.localization_data
+      {
+        locale: ::I18n.locale.to_s,
+        datepickerRegional: Helper.date_options_by_locale,
+        timepickerRegional: Helper.datetime_options_by_locale
+      }
+    end
   end
 end

data/lib/active_scaffold/config/list.rb

@@ -33,6 +33,7 @@ module ActiveScaffold::Config
       @messages_above_header = self.class.messages_above_header
       @auto_select_columns = self.class.auto_select_columns
       @refresh_with_header = self.class.refresh_with_header
+      @local_sorting = self.class.local_sorting
       @calculate_etag = self.class.calculate_etag
     end
 
@@ -42,6 +43,10 @@ module ActiveScaffold::Config
     cattr_accessor :refresh_with_header, instance_accessor: false
     @@refresh_with_header = false
 
+    # enable sorting locally in the browser, when there is only one page
+    cattr_accessor :local_sorting, instance_accessor: false
+    @@local_sorting = false
+
     # how many records to show per page
     cattr_accessor :per_page, instance_accessor: false
     @@per_page = 15
@@ -134,6 +139,9 @@ module ActiveScaffold::Config
     # include list header on refresh
     attr_accessor :refresh_with_header
 
+    # enable sorting locally in the browser, when there is only one page
+    attr_accessor :local_sorting
+
     # how many rows to show at once
     attr_accessor :per_page
 
@@ -265,7 +273,8 @@ module ActiveScaffold::Config
       user_attr :page_links_inner_window, :page_links_outer_window, :refresh_with_header, :empty_field_text,
                 :association_join_text, :messages_above_header, :wrap_tag, :auto_select_columns, :calculate_etag,
                 :no_entries_message, :filtered_message, :show_search_reset, :always_show_create, :always_show_search,
-                :hide_nested_column, :pagination, :auto_pagination, :filter_human_message, :show_filter_reset
+                :hide_nested_column, :pagination, :auto_pagination, :filter_human_message, :show_filter_reset,
+                :local_sorting
 
       def initialize(conf, storage, params)
         super(conf, storage, params, :list)

data/lib/active_scaffold/core.rb

@@ -260,11 +260,11 @@ module ActiveScaffold
       raise ActiveScaffold::ControllerNotFound, "Could not find #{error_message.join(' or ')}", caller
     end
 
-    def self.column_type_cast(value, column)
+    def self.column_type_cast(value, column, model)
       if defined?(ActiveRecord) && column.is_a?(ActiveRecord::ConnectionAdapters::Column)
-        active_record_column_type_cast(value, column)
+        active_record_column_type_cast(value, column, model)
       elsif defined?(ActiveModel) && column.is_a?(ActiveModel::Attribute)
-        active_record_column_type_cast(value, column.type)
+        active_record_column_type_cast(value, column.type, model)
       elsif defined?(Mongoid) && column.is_a?(Mongoid::Fields::Standard)
         mongoid_column_type_cast(value, column)
       else
@@ -278,10 +278,13 @@ module ActiveScaffold
       column.type.evolve value
     end
 
-    def self.active_record_column_type_cast(value, column_or_type)
-      return Time.zone.at(value.to_i) if %i[time datetime].include?(column_or_type.type) && value =~ /\A\d+\z/
+    def self.active_record_column_type_cast(value, column_or_type, model)
+      return Time.zone.at(value.to_i) if %i[time datetime timestamp timestamptz].include?(column_or_type.type) && value =~ /\A\d+\z/
 
-      cast_type = column_or_type.is_a?(ActiveRecord::ConnectionAdapters::Column) ? ActiveRecord::Type.lookup(column_or_type.type) : column_or_type
+      cast_type = column_or_type
+      if cast_type.is_a?(ActiveRecord::ConnectionAdapters::Column)
+        cast_type = model.type_for_attribute(column_or_type.name)
+      end
       cast_type ? cast_type.cast(value) : value
     end
   end

data/lib/active_scaffold/data_structures/action_columns.rb

@@ -64,6 +64,8 @@ module ActiveScaffold::DataStructures
           end
           @set = merged
         end
+      else
+        raise ArgumentError, "invalid layout mode: #{value.inspect}"
       end
       @layout = value
     end