activeadmin-command_palette 0.1.6

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 509b73ad390b1fe9b43d2cb712f41afbccdd52af79a47ab7ab65121bd93d82ef
+  data.tar.gz: d897245191a9056ff09d22cba322831a7ec2f8808ad2a44a2dea305dc205ba75
+SHA512:
+  metadata.gz: a74e1279e40fe8a1030fb2473b0d0b9af28f868a36147c946c0fb116cd6599fdaddecd5f3db0e869ff1b167c251c909980ad5f15ddc70b0ea206c28bdbe4ba47
+  data.tar.gz: 0d49f774e833e14eab01da3f44fae9cfc6644149a2179a1e45cbcfafa4e4b49051e5c32baf9c993a4e6d7985f2929a4444ae1b179f0a3b7f77ed25b2840b3406

data/CHANGELOG.md

@@ -0,0 +1,51 @@
+# CHANGELOG
+
+## Unreleased
+
+## 0.1.6
+
+- Publish as `activeadmin-command_palette` so Bundler requires `activeadmin/command_palette` by default; yank mistaken `activeadmin-command-palette` 0.1.6.
+- Require ActiveAdmin 4.0.0.beta23 or newer.
+- Keep kind labels on result rows as plain text instead of filled chips inside the panel.
+- Send finder queries in CSRF-protected request bodies and combine multi-kind search into one bounded request.
+- Refuse executable navigation URLs and cross-origin mutating actions.
+- Announce asynchronous search states to assistive technology and preserve fragments in prefilled create links.
+- Run JavaScript behavior tests in CI and release checks; reject releases from a dirty Git worktree.
+- Finder options may include `detail` and `keywords`; `subtitle` maps to `detail`.
+- Navigate crumbs become keywords; local filter matches label, detail, kind, and keywords with substring or fuzzy subsequence.
+- Longer query prefixes win; results show a detail line and kind section headers; Enter activates the only remaining item when nothing is highlighted.
+
+## 0.1.5
+
+- Rename the gem to `activeadmin-command_palette` so Bundler loads `activeadmin/command_palette` by default.
+
+## 0.1.4
+
+- Resource DSL: `command_palette` in `ActiveAdmin.register` with `find_by`, `actions`, `create`, and `member`.
+- `reload!` compiles resource registrations into actions and finders via optional `default_finder`.
+- Run `reload!` from ActiveAdmin `after_load` (not bare `to_prepare`) so compile sees loaded resources.
+- Action `if:` (boolean or view-context callable) omits the action from the request payload when false.
+
+## 0.1.3
+
+- Allow `put` with confirm; interpolate `%{record_param}` / `%{resource}` in `url` and `query`.
+- Support explicit empty `path_args` for member actions that open collection routes with query.
+
+## 0.1.2
+
+- Contextual actions: `scope`, `when`, `resource`, `verb`, `params`, `help`, `finder_kind`.
+- Allow `delete` with confirm; submit via POST `_method=delete`.
+- Emit page `context` for member/collection gating; include view actions without a URL.
+- Client: filter by context, view enters kind find, create merges optional query params and shows help.
+
+## 0.1.1
+
+- Clear selection during debounce, abort stale fetches, and show loading, error, and sign-in states instead of empty matches.
+- Require non-empty `confirm` for POST actions; allow only `get` and `post`.
+- Keep recent items in `sessionStorage` for navigate/action destinations only.
+- Expose combobox/`aria-activedescendant` state on the palette input.
+
+## 0.1.0
+
+- Initial local package: Cmd+K palette shell, menu catalog, allow-listed actions, host finder protocol, and JSON options endpoint.
+- Locale files for English, Finnish, and Swedish.

data/CODE_OF_CONDUCT.md

@@ -0,0 +1,26 @@
+# Code of Conduct
+
+## Pledge
+
+Participation is a harassment-free experience. Treat each other with respect. Keep private context private.
+
+## Expected behavior
+
+- Engage with genuine curiosity. Admit uncertainty.
+- Own every line you submit, including generated code.
+- Correct errors politely.
+- Use language that welcomes people and respects identity and privacy.
+
+## Unacceptable behavior
+
+- Harassment, trolling, or insulting comments, public or private.
+- Using jargon or volume, including automated spam, to silence others.
+- Sharing others' data or personal context without permission.
+
+## Automation
+
+You remain responsible for bugs, security holes, and bias in generated artifacts you submit.
+
+## Enforcement
+
+Report abusive or harassing behavior to contact@kiskolabs.com. Reports are reviewed and investigated.

data/CONTRIBUTING.md

@@ -0,0 +1,23 @@
+# Contributing Guidelines
+
+## Automation authorship
+
+You may use AI and automation tools. You remain the author of every line you submit: review, debug, and understand the change.
+
+Keep pull requests small enough to review. Annotate non-obvious logic.
+
+Never send project secrets or private context to public models.
+
+## How to contribute
+
+### Reporting issues
+
+Verify the facts before filing. Use issue templates for goals, constraints, and reproduction steps.
+
+### Pull requests
+
+Keep one pull request to one goal. Explain why the change is needed. Run smoke tests and regression checks locally before opening the request.
+
+### Review
+
+Reviewers will ask about approach and trade-offs. Treat suggested changes as part of the work.

data/GOVERNANCE.md

@@ -0,0 +1,25 @@
+# Project Governance
+
+## Roles
+
+### Contributors
+
+Anyone who submits code, documentation, or participates in discussions. Contributors take ownership of problems they identify and follow the project's quality standards.
+
+### Maintainers
+
+Maintainers:
+
+1. Set scope and architectural direction.
+2. Review contributions (human or automated) against security and logic standards.
+3. Decide when the community is divided.
+
+## Decision making
+
+### Lazy consensus
+
+For routine changes, a proposal that draws no objection within two weeks is approved.
+
+### Maintainer approval
+
+Major architectural changes, high-risk automation integrations, or changes that affect business logic need explicit maintainer approval. A change must solve a real problem.

data/LICENSE.md

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 amkisko
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,152 @@
+# activeadmin-command_palette
+
+[![Gem Version](https://badge.fury.io/rb/activeadmin-command_palette.svg)](https://badge.fury.io/rb/activeadmin-command_palette) [![Test Status](https://github.com/amkisko/activeadmin-command_palette.rb/actions/workflows/test.yml/badge.svg)](https://github.com/amkisko/activeadmin-command_palette.rb/actions/workflows/test.yml) [![codecov](https://codecov.io/gh/amkisko/activeadmin-command_palette.rb/graph/badge.svg)](https://app.codecov.io/github/amkisko/activeadmin-command_palette.rb)
+
+Cmd+K / Ctrl+K command palette for ActiveAdmin 4.
+
+Provides menu navigation, an allow-listed action catalog, and host-registered record finders. The gem does not know your domain models.
+
+## Requirements
+
+- Ruby 3.4+ (CI matrix: Ruby 3.4 and 4.0)
+- Rails 7.2+ (Rails 7.2 and 8.1 tested in CI)
+- ActiveAdmin 4.0.0.beta23+ (Tailwind CSS v4 host build)
+- importmap-rails
+
+## Install
+
+Add the gem to your Gemfile:
+
+```ruby
+gem "activeadmin-command_palette"
+```
+
+Mount the engine inside your authenticated admin area:
+
+```ruby
+authenticate :user do
+  mount ActiveAdmin::CommandPalette::Engine => "/admin/command_palette", as: "active_admin_command_palette"
+end
+```
+
+Wire the layout body controller and data attributes, render the palette partial, and add a header button that calls `show`.
+
+Register finders and actions in an initializer or with the resource DSL.
+
+Built-in UI locales: English (`en`), Finnish (`fi`), Swedish (`sv`).
+
+## Configuration
+
+Prefer resource-level registration in `ActiveAdmin.register`:
+
+```ruby
+ActiveAdmin.register User do
+  command_palette do
+    kind "user"
+    noun "user"
+    label_method :name_or_email
+    find_by :email, :nickname, :name
+    order :name
+    actions :view, :create, :edit, :destroy
+    create help: "Create user — optional email=", params: [
+      {name: "email", required: false, query_key: "user[email]"}
+    ]
+    member "Open in chat",
+      path: :admin_chat_path,
+      path_args: [],
+      query: {context_selector: "user:%{record_param}"},
+      if: -> { feature_enabled? }
+  end
+end
+```
+
+Host initializer keeps auth, prefixes, global shortcuts, and a `default_finder` that receives each resource registration:
+
+```ruby
+ActiveAdmin::CommandPalette.configure do |config|
+  config.register_prefix "@", kind: "user"
+  config.search_kind_limit = 20
+  config.default_finder = lambda { |registration:, query:, helpers:, user:, limit:|
+    # return Array of { id:, kind:, label:, url:, detail?, keywords? }
+  }
+  config.actions = [
+    {id: "open-jobs", label: "Open jobs", url: "/admin/good_job"}
+  ]
+  config.authorize_with = ->(controller) { controller.current_user.present? }
+end
+```
+
+`reload!` (run from ActiveAdmin `after_load`) merges resource DSL actions/finders with the global `actions` list.
+
+Action fields: `scope` (`global` / `collection` / `member`), `when` (`any` / `index` / `show` / `new` / `edit`), `resource`, `verb` (`view` / `create` / `edit` / `destroy` / …), `params`, `help`, `finder_kind`, `query`, `if` (boolean or callable evaluated in the view on each request), optional `detail` / `keywords`. The layout emits a page `context` value used to gate member and collection actions.
+
+Finder rows may include optional `detail` (second line under the label; `subtitle` is accepted as an alias) and `keywords` (extra client match strings). Longer registered prefixes win when several share a start (for example `@team` before `@`).
+
+### Host finder recipe
+
+Apply host authorization before returning rows. Prefer this match order when building SQL: exact primary key, then exact unique columns from `find_by`, then prefix match, then `ILIKE` / `LIKE`, then `limit`. Put a stable person-facing name in `label` and email, identifier, or id in `detail` when that helps operators disambiguate.
+
+Mount the engine inside your authenticated admin boundary and set `authorize_with` so the JSON options endpoint stays closed to unsigned or unauthorized callers.
+
+### Related surfaces
+
+Palette finders are a separate contract from admin GraphQL endpoints, ActiveAdmin controller finders, and form autocomplete. A host `default_finder` may use any backend; the palette still speaks the finder protocol above.
+
+## Limits
+
+- Minimum query length: 2 (configurable)
+- Maximum options per kind: 20 (configurable)
+- Maximum finder kinds in a combined search: 20 (configurable)
+- Client debounce: 200ms
+- The client sends finder queries as CSRF-protected JSON `POST` requests; `GET` remains available for existing integrations
+- Finder responses use `Cache-Control: no-store`, and the engine filters `q` from Rails parameter logs
+- Action methods are allow-listed to `get`, `post`, `put`, and `delete`
+- `POST`, `PUT`, and `DELETE` registrations require non-empty `confirm` text; the client also refuses those methods without confirmation
+- Member actions may set `path_args: []` and a `query` hash with `%{record_param}` placeholders
+- Recent items use `sessionStorage` and store only static navigate/action GET destinations (not member actions)
+- Local navigate and action filter matches label, detail, kind, and keywords (substring or character subsequence)
+
+## Development
+
+```bash
+bundle install
+bundle exec appraisal install
+make lint
+make test
+```
+
+`make lint` runs Biome (`npx @biomejs/biome@2.3.8`, same version as Trunk) on JavaScript under `app/assets`, plus RuboCop and RBS. `make test` also runs the JavaScript behavior suite. See `spec/README.md` for focused runs and coverage notes.
+
+Release:
+
+```bash
+make release
+```
+
+## Design RFCs
+
+Numbered design documents for the public contract live in [`rfcs/`](rfcs/README.md). Shipped features are specified in RFC 0003 through RFC 0006. Finder detail and bounded POST search are proposed in RFC 0007 and RFC 0008. Process rules are RFC 0001.
+
+## Links
+
+- [GitHub](https://github.com/amkisko/activeadmin-command_palette.rb)
+- [GitLab](https://gitlab.com/amkisko/activeadmin-command_palette.rb)
+- [RubyGems](https://rubygems.org/gems/activeadmin-command_palette)
+- [libraries.io](https://libraries.io/rubygems/activeadmin-command_palette)
+- [Deps.dev](https://deps.dev/rubygems/activeadmin-command_palette)
+- [SonarCloud](https://sonarcloud.io/project/overview?id=amkisko_activeadmin-command_palette.rb)
+- [Snyk](https://snyk.io/test/github/amkisko/activeadmin-command_palette.rb)
+- [Codecov](https://app.codecov.io/github/amkisko/activeadmin-command_palette.rb)
+- [OpenSSF Scorecard](https://scorecard.dev/viewer/?uri=github.com/amkisko/activeadmin-command_palette.rb)
+
+## License
+
+The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).
+
+## Sponsors
+
+Sponsored by [Kisko Labs](https://www.kiskolabs.com).
+
+<a href="https://www.kiskolabs.com">
+  <img src="kisko.svg" width="200" alt="Sponsored by Kisko Labs" />
+</a>

data/SECURITY.md

@@ -0,0 +1,25 @@
+# SECURITY
+
+## Reporting a Vulnerability
+
+Email security details to: security@kiskolabs.com
+
+Send the report only to that address. Include description, steps to reproduce, potential impact, and a suggested fix when you have one.
+
+### Response Timeline
+
+- We will acknowledge receipt of your report.
+- We will provide an initial assessment.
+- We will keep you informed of our progress and resolution timeline.
+
+### Disclosure Policy
+
+- We will work with you to understand and resolve the issue.
+- We will credit you for the discovery unless you prefer to remain anonymous.
+- We will publish a security advisory after the vulnerability is patched.
+- We will coordinate public disclosure with you.
+
+## Automation Security
+
+- Keep production credentials, API keys, and personal data out of prompts sent to third-party models or automation services.
+- Verify automated dependencies.

data/activeadmin-command_palette.gemspec

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+require_relative "lib/activeadmin/command_palette/version"
+
+Gem::Specification.new do |spec|
+  spec.name = "activeadmin-command_palette"
+  spec.version = ActiveAdmin::CommandPalette::VERSION
+  spec.authors = ["Andrei Makarov"]
+  spec.email = ["contact@kiskolabs.com"]
+
+  spec.summary = "Cmd+K command palette for ActiveAdmin 4"
+  spec.description = "Keyboard command palette for ActiveAdmin 4: menu navigation, registered actions, and host-defined record finders."
+  spec.license = "MIT"
+  spec.platform = Gem::Platform::RUBY
+  spec.required_ruby_version = ">= 3.4"
+
+  repository_url = "https://github.com/amkisko/activeadmin-command_palette.rb"
+
+  spec.homepage = repository_url
+  spec.metadata = {
+    "homepage_uri" => repository_url,
+    "source_code_uri" => "#{repository_url}/tree/main",
+    "changelog_uri" => "#{repository_url}/blob/main/CHANGELOG.md",
+    "bug_tracker_uri" => "#{repository_url}/issues",
+    "documentation_uri" => "#{repository_url}#readme",
+    "rubygems_mfa_required" => "true"
+  }
+
+  spec.files = Dir.chdir(__dir__) do
+    %w[
+      CHANGELOG.md
+      CODE_OF_CONDUCT.md
+      CONTRIBUTING.md
+      GOVERNANCE.md
+      LICENSE.md
+      README.md
+      SECURITY.md
+      activeadmin-command_palette.gemspec
+    ].select { |path| File.file?(path) } +
+      Dir["{app,config,lib,sig}/**/*"]
+  end
+
+  spec.require_paths = ["lib"]
+
+  spec.add_dependency "activeadmin", ">= 4.0.0.beta23", "< 5"
+  spec.add_dependency "importmap-rails"
+  spec.add_dependency "rails", ">= 7.2"
+
+  spec.add_development_dependency "appraisal", "~> 2"
+  spec.add_development_dependency "bundler", ">= 2"
+  spec.add_development_dependency "bundler-audit", "~> 0.9"
+  spec.add_development_dependency "factory_bot", "~> 6"
+  spec.add_development_dependency "polyrun", ">= 2.2.0"
+  spec.add_development_dependency "prosopite", "~> 2.0"
+  spec.add_development_dependency "rake", "~> 13"
+  spec.add_development_dependency "rbs", "~> 4"
+  spec.add_development_dependency "rspec", "~> 3"
+  spec.add_development_dependency "rspec-rails", ">= 6"
+  spec.add_development_dependency "rubocop-rails", "~> 2.34"
+  spec.add_development_dependency "rubocop-rspec", "~> 3.8"
+  spec.add_development_dependency "rubocop-thread_safety", "~> 0.7"
+  spec.add_development_dependency "sqlite3", ">= 2.9.6"
+  spec.add_development_dependency "standard", "~> 1.52"
+  spec.add_development_dependency "standard-custom", "~> 1.0"
+  spec.add_development_dependency "standard-performance", "~> 1.8"
+  spec.add_development_dependency "standard-rails", "~> 1.5"
+  spec.add_development_dependency "standard-rspec", "~> 0.3"
+end