alchemy_cms 8.3.11 → 8.4.0

data/app/views/kaminari/alchemy/_first_page.html.erb

@@ -4,7 +4,6 @@
     current_page:  a page object for the currently displayed page
     num_pages:     total number of pages
     per_page:      number of items to fetch per page
-    remote:        data-remote
 -%>
 <% if current_page.first? %>
   <span class="first-page disabled">
@@ -12,7 +11,7 @@
   </span>
 <% else %>
   <sl-tooltip content="<%= Alchemy.t(:first, scope: 'pagination') %>" placement="top-start">
-    <%= link_to url, remote: remote, class: 'first-page' do %>
+    <%= link_to url, class: 'first-page' do %>
       <%= render_icon("skip-left") %>
     <% end %>
   </sl-tooltip>

data/app/views/kaminari/alchemy/_gap.html.erb

@@ -3,6 +3,5 @@
     current_page:  a page object for the currently displayed page
     num_pages:     total number of pages
     per_page:      number of items to fetch per page
-    remote:        data-remote
 -%>
 <span class="page gap"><%= render_icon(:more) %></span>

data/app/views/kaminari/alchemy/_last_page.html.erb

@@ -4,7 +4,6 @@
     current_page:  a page object for the currently displayed page
     num_pages:     total number of pages
     per_page:      number of items to fetch per page
-    remote:        data-remote
 -%>
 <% if current_page.last? %>
   <span class="last-page disabled">
@@ -12,7 +11,7 @@
   </span>
 <% else %>
   <sl-tooltip content="<%= Alchemy.t(:last, scope: 'pagination') %>" placement="top-end">
-    <%= link_to url, remote: remote, class: 'last-page' do %>
+    <%= link_to url, class: 'last-page' do %>
       <%= render_icon("skip-right") %>
     <% end %>
   </sl-tooltip>

data/app/views/kaminari/alchemy/_next_page.html.erb

@@ -4,7 +4,6 @@
     current_page:  a page object for the currently displayed page
     num_pages:     total number of pages
     per_page:      number of items to fetch per page
-    remote:        data-remote
 -%>
 <% if current_page.last? -%>
   <span class="next_page disabled">
@@ -12,7 +11,7 @@
   </span>
 <% else -%>
   <sl-tooltip content="<%= Alchemy.t(:next_page, scope: 'pagination') %>" placement="top-end">
-    <%= link_to url, rel: 'next', remote: remote, class: 'next_page' do %>
+    <%= link_to url, rel: 'next', class: 'next_page' do %>
       <%= render_icon("arrow-right-s") %>
     <% end %>
   </sl-tooltip>

data/app/views/kaminari/alchemy/_page.html.erb

@@ -5,10 +5,9 @@
     current_page:  a page object for the currently displayed page
     num_pages:     total number of pages
     per_page:      number of items to fetch per page
-    remote:        data-remote
 -%>
 <% if page.current? -%>
 <span class="page current"><%= page -%></span>
 <% else -%>
-<%= link_to page, url, opts = {remote: remote, rel: page.next? ? 'next' : page.prev? ? 'prev' : nil, class: 'page'} -%>
+<%= link_to page, url, opts = {rel: page.next? ? 'next' : page.prev? ? 'prev' : nil, class: 'page'} -%>
 <% end -%>

data/app/views/kaminari/alchemy/_paginator.html.erb

@@ -3,7 +3,6 @@
     current_page:  a page object for the currently displayed page
     total_pages:   total number of pages
     per_page:      number of items to fetch per page
-    remote:        data-remote
     paginator:     the paginator that renders the pagination tags inside
 -%>
 <div class="pagination">

data/app/views/kaminari/alchemy/_prev_page.html.erb

@@ -4,7 +4,6 @@
     current_page:  a page object for the currently displayed page
     num_pages:     total number of pages
     per_page:      number of items to fetch per page
-    remote:        data-remote
 -%>
 <% if current_page.first? -%>
   <span class="previous_page disabled">
@@ -12,7 +11,7 @@
   </span>
 <% else -%>
   <sl-tooltip class="pagination-label" content="<%= Alchemy.t(:previous_page, scope: 'pagination') %>" placement="top-start">
-    <%= link_to url, rel: 'prev', remote: remote, class: 'previous_page' do %>
+    <%= link_to url, rel: 'prev', class: 'previous_page' do %>
       <%= render_icon("arrow-left-s") %>
     <% end %>
   </sl-tooltip>

data/app/views/layouts/alchemy/admin/dialog.html.erb

@@ -0,0 +1,3 @@
+<%= turbo_frame_tag Alchemy::Admin::DIALOG_FRAME_ID do %>
+  <%= yield %>
+<% end %>

data/app/views/layouts/alchemy/admin.html.erb

@@ -8,6 +8,7 @@
     <link rel="shortcut icon" href="<%= asset_path('alchemy/favicon.ico') %>">
     <link rel="preload" href="<%= asset_path("alchemy/icons-sprite.svg") %>" as="image" type="<%= Mime::Type.lookup_by_extension(:svg) %>" crossorigin>
     <%= csrf_meta_tag %>
+    <%= csp_meta_tag %>
     <meta name="robots" content="noindex">
     <meta name="turbo-prefetch" content="false">
     <meta name="turbo-cache-control" content="no-cache">
@@ -18,21 +19,19 @@
       <%= stylesheet_link_tag(stylesheet, 'data-turbo-track' => true) %>
     <% end %>
     <%= yield :stylesheets %>
-    <script>
+    <%= tag.script(nonce: content_security_policy_nonce) do %>
       // Global Alchemy JavaScript object.
       var Alchemy = {};
-      // Store regular expression for external link url matching.
-      Alchemy.link_url_regexp = <%= link_url_regexp.inspect %>;
       // JS translations
       <%= alchemy_admin_js_translations %>
-    </script>
+    <% end %>
     <%= render 'alchemy/admin/tinymce/setup' %>
     <%= render 'alchemy/admin/partials/routes' %>
     <%= javascript_importmap_tags("alchemy_admin", importmap: Alchemy.importmap) %>
     <% Alchemy.config.admin_js_imports.each do |path| %>
-      <script type="module">
+      <%= tag.script(type: "module", nonce: content_security_policy_nonce) do %>
         import "<%= path %>"
-      </script>
+      <% end %>
     <% end %>
     <%= yield :javascript_includes %>
   </head>

data/config/brakeman.ignore

@@ -55,7 +55,29 @@
         79
       ],
       "note": ""
+    },
+    {
+      "warning_type": "Format Validation",
+      "warning_code": 30,
+      "fingerprint": "c9db7cc83a6210bf4a715ce9f9ffabca1145d51db9fc1ca1e45d965e7151751b",
+      "check_name": "ValidationRegex",
+      "message": "Insufficient validation for `url` using `/\\A(\\/|\\D[a-z+\\d.-]+:)/`. Use `\\A` and `\\z` as anchors",
+      "file": "app/models/alchemy/node.rb",
+      "line": 99,
+      "link": "https://brakemanscanner.org/docs/warning_types/format_validation/",
+      "code": ":url, { :format => ({ :with => /\\A(\\/|\\D[a-z+\\d.-]+:)/ }), :unless => (lambda do\n url.nil?\n end) }",
+      "render_path": null,
+      "location": {
+        "type": "model",
+        "model": "Alchemy::Node"
+      },
+      "user_input": null,
+      "confidence": "High",
+      "cwe_id": [
+        777
+      ],
+      "note": "VALID_URL_REGEX deliberately only checks the url prefix (a path or a scheme). It is anchored with \\A, so the multiline bypass does not apply, and executable schemes are rejected by Alchemy::SafeUrlValidator."
     }
   ],
-  "brakeman_version": "7.1.2"
+  "brakeman_version": "8.1.0"
 }

data/config/importmap.rb

@@ -2,15 +2,11 @@ pin "@ungap/custom-elements", to: "ungap-custom-elements.min.js", preload: true
 pin "clipboard", to: "clipboard.min.js", preload: true
 pin "cropperjs", to: "cropperjs.min.js", preload: true
 pin "flatpickr", to: "flatpickr.min.js", preload: true # @4.6.13
-pin "handlebars", to: "handlebars.min.js", preload: true # @4.7.8
-pin "jquery", to: "jquery.min.js", preload: true
 pin "keymaster", to: "keymaster.min.js", preload: true
-pin "select2", to: "select2.min.js", preload: true
 pin "sortablejs", to: "sortable.min.js", preload: true # @1.15.1
 pin "@floating-ui/dom", to: "floating-ui.min.js", preload: true
 pin "@hotwired/turbo-rails", to: "turbo.min.js", preload: true
 pin "shoelace", to: "shoelace.min.js", preload: true
-pin "@rails/ujs", to: "rails-ujs.min.js", preload: true # @7.1.2
 pin "tinymce", to: "tinymce.min.js", preload: true
 pin "tom-select", to: "tom-select.min.js", preload: true
 
@@ -27,8 +23,14 @@ pin "alchemy_admin/components/tinymce"
 pin "alchemy_admin/components/remote_select"
 pin "alchemy_admin/components/select"
 pin "alchemy_admin/i18n"
-pin "alchemy_admin/image_cropper", to: "alchemy/alchemy_admin.min.js"
-pin "alchemy_admin/image_overlay", to: "alchemy/alchemy_admin.min.js"
-pin "alchemy_admin/picture_selector", to: "alchemy/alchemy_admin.min.js"
-pin "alchemy_admin/node_tree", to: "alchemy/alchemy_admin.min.js"
+# Dependencies of the standalone components above. The admin bundle inlines
+# these, but the source files import them by name, so importing a component on
+# its own fails without pins of their own.
+pin "alchemy_admin/components/icon"
+pin "alchemy_admin/growler"
+pin "alchemy_admin/utils/ajax"
+pin "alchemy_admin/utils/dom_helpers"
+pin "alchemy_admin/utils/json_script"
+pin "alchemy_admin/utils/tom_select"
+pin "tom-select/utils", to: "tom-select.min.js"
 pin "alchemy_admin/utils/events", to: "alchemy/alchemy_admin.min.js"

data/config/initializers/dragonfly.rb

@@ -1,24 +1,28 @@
 # frozen_string_literal: true
 
-require "alchemy/dragonfly/processors/crop_resize"
-require "alchemy/dragonfly/processors/auto_orient"
-require "alchemy/dragonfly/processors/thumbnail"
+# Dragonfly is only needed for the legacy dragonfly storage adapter
+# and needs to be added to the app's Gemfile.
+if defined?(::Dragonfly)
+  require "alchemy/dragonfly/processors/crop_resize"
+  require "alchemy/dragonfly/processors/auto_orient"
+  require "alchemy/dragonfly/processors/thumbnail"
 
-# Logger
-Dragonfly.logger = Rails.logger
+  # Logger
+  Dragonfly.logger = Rails.logger
 
-# Add model functionality
-if defined?(ActiveRecord::Base)
-  ActiveRecord::Base.extend Dragonfly::Model
-  ActiveRecord::Base.extend Dragonfly::Model::Validations
-end
+  # Add model functionality
+  if defined?(ActiveRecord::Base)
+    ActiveRecord::Base.extend Dragonfly::Model
+    ActiveRecord::Base.extend Dragonfly::Model::Validations
+  end
 
-# Dragonfly 1.4.0 only allows `quality` as argument to `encode`
-Dragonfly::ImageMagick::Processors::Encode::WHITELISTED_ARGS << "flatten"
-Dragonfly::ImageMagick::Processors::Encode::WHITELISTED_ARGS << "background"
+  # Dragonfly 1.4.0 only allows `quality` as argument to `encode`
+  Dragonfly::ImageMagick::Processors::Encode::WHITELISTED_ARGS << "flatten"
+  Dragonfly::ImageMagick::Processors::Encode::WHITELISTED_ARGS << "background"
 
-Rails.application.config.after_initialize do
-  Dragonfly.app(:alchemy_pictures).add_processor(:crop_resize, Alchemy::Dragonfly::Processors::CropResize.new)
-  Dragonfly.app(:alchemy_pictures).add_processor(:auto_orient, Alchemy::Dragonfly::Processors::AutoOrient.new)
-  Dragonfly.app(:alchemy_pictures).add_processor(:thumbnail, Alchemy::Dragonfly::Processors::Thumbnail.new)
+  Rails.application.config.after_initialize do
+    Dragonfly.app(:alchemy_pictures).add_processor(:crop_resize, Alchemy::Dragonfly::Processors::CropResize.new)
+    Dragonfly.app(:alchemy_pictures).add_processor(:auto_orient, Alchemy::Dragonfly::Processors::AutoOrient.new)
+    Dragonfly.app(:alchemy_pictures).add_processor(:thumbnail, Alchemy::Dragonfly::Processors::Thumbnail.new)
+  end
 end

data/config/locales/alchemy.en.yml

@@ -79,9 +79,13 @@ en:
       application/x-rar: RAR Archive
       application/x-shockwave-flash: Flash Movie
       application/zip: ZIP Archive
+      audio/aac: AAC Audio
+      audio/flac: FLAC Audio
       audio/mp4: MPEG-4 Audio
       audio/mpeg: MP3 Audio
+      audio/ogg: Ogg Audio
       audio/wav: WAV Audio
+      audio/webm: WebM Audio
       audio/x-wav: WAV Audio
       image/avif: AVIF Image
       image/gif: GIF Image
@@ -95,6 +99,7 @@ en:
       text/x-vcard: vCard
       video/mp4: MPEG-4 Video
       video/mpeg: MPEG Video
+      video/ogg: Ogg Video
       video/quicktime: Quicktime Video
       video/webm: WebM Video
       video/x-flv: Flash Video
@@ -236,6 +241,9 @@ en:
             published: "published"
           user_counts:
             online: "online"
+          news_reader:
+            widget_title: "News"
+            no_news: "no news"
       elements:
         toolbar:
           hide: Hide
@@ -364,6 +372,7 @@ en:
     "Site successfully updated": "Website successfully updated."
     "Size": "Size"
     "Successfully deleted element": "Successfully deleted %{element}"
+    updated_ingredient: "Successfully updated %{ingredient}"
     "Tags": "Tags"
     "This page is locked": "This page is currently locked by %{name}"
     "Title": "Title"
@@ -491,8 +500,11 @@ en:
         "Leave the page": "Leave the page"
         "Open upload form": "Open upload form"
         "Select all pictures": "Select all pictures"
+      resources: Resources
+      resource_links:
+        guidelines: "Guidelines"
+        homepage: "Homepage"
     hide_element_content: "Hide this elements content."
-    homepage_does_not_exist: "This language has no homepage yet"
     dashboard: "Dashboard"
     image_alt_tag: "Alt-tag"
     image_caption: "Caption"
@@ -509,6 +521,9 @@ en:
     language_pages_copied: "Language tree successfully copied."
     left: "left"
     legacy_url_info_text: "A link is a redirect from an old URL to the current URL of this page. This redirect happens with a <a href='https://support.google.com/webmasters/answer/93633' target='_blank'>301 status code</a>."
+    license: "License"
+    licenses:
+      BSD-3-Clause: "BSD-3-Clause"
     link_image: "Link this image."
     link_overlay_tab_label:
       anchor: "Anchor"
@@ -550,14 +565,33 @@ en:
     "no users": "no users"
     no_default_language_found: "No default language found."
     no_element_given: "No element given."
-    no_files_in_archive: "You do not have any files in your archive."
-    no_images_in_archive: "You don't have any images in your archive."
     no_more_elements_to_add: "No more elements available."
     no_resource_found:
-      default: "No %{resource} found. Please add your first one below."
-      alchemy/language: "<h2>Your website does not have any languages yet.</h2><p>You need at least one language to work with. Please create one below.</p>"
-      alchemy/node: "<h2>You do not have any menus yet.</h2><p>With menus your users can navigate your website. You can have multiple menus on your website. How many depends on your website template.</p><p>Please chose which menu you want to create first.</p>"
-      alchemy/site: "<h2>You do not have any websites yet.</h2><p>In order to serve requests you need to create a website first.</p><p>This form has been filled with sensible defaults that work in most cases.</p>"
+      default: |
+        <h2>You have no %{resource} yet.</h2>
+      alchemy/attachment: |
+        <h2>You do not have any files in your archive yet.</h2>
+        <p>Use the button below or drag files into this window to upload your first file.</p>
+      alchemy/language: |
+        <h2>Your website does not have any languages yet.</h2>
+        <p>You need at least one language to work with. Please create one below.</p>
+      alchemy/node: |
+        <h2>You do not have any menus yet.</h2>
+        <p>With menus your users can navigate your website. You can have multiple menus on your website. How many depends on your website template.</p>
+        <p>Please chose which menu you want to create first.</p>
+      alchemy/page: |
+        <h2>This language has no homepage yet</h2>
+        <p>Please create one below.</p>
+      alchemy/picture: |
+        <h2>You don't have any images in your archive yet.</h2>
+        <p>Use the button below or drag images into this window to upload your first image.</p>
+      alchemy/site: |
+        <h2>You do not have any websites yet.</h2>
+        <p>In order to serve requests you need to create a website first.</p>
+        <p>This form has been filled with sensible defaults that work in most cases.</p>
+      layoutpages: |
+        <h2>This language has no global pages yet</h2>
+        <p>Global pages hold content that is shared across all pages, like headers or footers.</p>
     no_search_results: "Your search did not return any results."
     no_unpublished_changes: "No unpublished changes"
     "not a valid image": "This is not an valid image."
@@ -575,7 +609,7 @@ en:
         "true": "Page is being edited at the moment."
         "false": ""
       restricted:
-        "true": "Page is only accessible by members."
+        "true": "Page is only accessible by users with one of its roles."
         "false": "Page is accessible by all visitors."
       scheduled:
         public_on: "Page is visible from %{public_on}"
@@ -685,11 +719,11 @@ en:
     unlocked_page: "Unlocked page %{name}."
     uploader:
       alchemy/attachment:
-        button_label: Upload file(s)
+        button_label: Upload files
         upload_success: "File %{name} successfully uploaded"
         upload_failure: "File %{name} upload error: %{error}"
       alchemy/picture:
-        button_label: Upload image(s)
+        button_label: Upload images
         upload_success: "Picture %{name} uploaded successfully"
         upload_failure: "Error while uploading %{name}: %{error}"
       error: "Could not upload file! %{error}"
@@ -711,7 +745,7 @@ en:
     "stay logged in": "Stay Logged In"
     "or to completely": "or completely"
     "Are you sure?": "Are you sure?"
-    "Create": "Create"
+    "Create": "Create %{resource_name}"
     "Edit": "Edit"
     "Delete": "Delete"
     "Successfully created": "Successfully created"
@@ -764,6 +798,8 @@ en:
 
   # Translations for error messages.
   errors:
+    messages:
+      invalid_url_scheme: "uses the not allowed scheme %{scheme}:"
     attributes:
       public_until:
         must_be_after_public_on: "must be after visible from date"
@@ -851,6 +887,9 @@ en:
               conflicting_wildcard_param_key: 'has a conflicting wildcard param "%{param}" already used by the "%{conflicting_layout}" page layout'
             descendants:
               still_attached_to_nodes: "The following descendant pages are still attached to menu nodes: %{page_names}. Please remove them first."
+            permitted_roles:
+              blank: "needs at least one role a restricted page is accessible for"
+              inclusion: "contains roles that are not configured: %{roles}"
         alchemy/element:
           attributes:
             page_version_id:
@@ -968,6 +1007,7 @@ en:
         public_on: Visible from
         public_until: Visible until
         restricted: "restricted"
+        permitted_roles: "except for users with one of these roles"
         searchable: "show in search"
         robot_follow: "robot may follow links"
         robot_index: "allow robot to index"
@@ -982,6 +1022,7 @@ en:
         image_file_height: "Height"
         image_file_width: "Width"
         image_file_dimensions: "Dimensions"
+        image_file_format: "File type"
         image_file_size: "Filesize"
         name: "Name"
         tag_list: Tags

data/config/routes.rb

@@ -5,12 +5,13 @@ require "alchemy/routing_constraints"
 Alchemy::Engine.routes.draw do
   root to: "pages#index"
 
-  get "/sitemap.xml", to: "pages#sitemap", format: "xml"
+  get "/sitemap.xml", to: "sitemap#show", format: "xml"
 
   scope Alchemy.admin_path, constraints: Alchemy.admin_constraints do
     get "/", to: redirect("#{Alchemy.admin_path}/dashboard"), as: :admin
     get "/dashboard", to: "admin/dashboard#index", as: :admin_dashboard
     get "/dashboard/info", to: "admin/dashboard#info", as: :dashboard_info
+    get "/dashboard/license", to: "admin/dashboard#license", as: :dashboard_license
     get "/dashboard/widgets/:id", to: "admin/dashboard/widgets#show", as: :admin_dashboard_widget
     get "/help", to: "admin/dashboard#help", as: :help
     get "/update_check" => "admin/update_checks#show", :as => :update_check
@@ -25,7 +26,6 @@ Alchemy::Engine.routes.draw do
       collection do
         post :flush
         post :copy_language_tree
-        get :create_language
         get :link
         get :tree
       end
@@ -84,7 +84,7 @@ Alchemy::Engine.routes.draw do
     resources :legacy_page_urls
     resources :languages do
       collection do
-        get :switch
+        post :switch
       end
     end
 

data/db/migrate/20260727120000_add_permitted_roles_to_alchemy_pages.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+class AddPermittedRolesToAlchemyPages < ActiveRecord::Migration[7.2]
+  # Only SQLite needs this: it has no real ALTER TABLE, so the remove_column in
+  # down rebuilds the table via DROP TABLE, whose implicit DELETE cascades into
+  # alchemy_page_versions, alchemy_elements and alchemy_ingredients. The
+  # adapter's PRAGMA foreign_keys = OFF guard against that is a silent no-op
+  # inside a transaction.
+  disable_ddl_transaction! if connection.adapter_name.match?(/sqlite/i)
+
+  def up
+    # Adding a nullable column is a plain ALTER TABLE ADD COLUMN, so up can keep
+    # the atomicity the declaration above gives up for both directions.
+    connection.transaction do
+      add_column :alchemy_pages, :permitted_roles, :text, if_not_exists: true
+      execute(%(UPDATE #{quote_table_name("alchemy_pages")} SET permitted_roles = '["member"]' WHERE permitted_roles IS NULL))
+    end
+  end
+
+  def down
+    remove_column :alchemy_pages, :permitted_roles, if_exists: true
+  end
+end

data/db/migrate/20260820120000_add_cached_tag_list_to_taggables.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+class AddCachedTagListToTaggables < ActiveRecord::Migration[7.2]
+  # Only SQLite needs this: it has no real ALTER TABLE, so the remove_column
+  # calls in down rebuild the tables via DROP TABLE, whose implicit DELETE
+  # cascades into every child row, emptying alchemy_ingredients among others.
+  # The adapter's PRAGMA foreign_keys = OFF guard against that is a silent
+  # no-op inside a transaction.
+  disable_ddl_transaction! if connection.adapter_name.match?(/sqlite/i)
+
+  TAGGABLE_MODELS = %w[
+    Alchemy::Element
+    Alchemy::Page
+    Alchemy::Picture
+    Alchemy::Attachment
+  ]
+
+  def up
+    # Adding nullable columns is a plain ALTER TABLE ADD COLUMN, so up can keep
+    # the atomicity the declaration above gives up for both directions.
+    connection.transaction do
+      TAGGABLE_MODELS.each do |model_name|
+        add_column model_name.constantize.table_name, :cached_tag_list, :text, if_not_exists: true
+      end
+
+      say_with_time "Backfilling cached_tag_list from existing taggings" do
+        backfill
+      end
+    end
+  end
+
+  def down
+    TAGGABLE_MODELS.each do |model_name|
+      remove_column model_name.constantize.table_name, :cached_tag_list, if_exists: true
+    end
+  end
+
+  private
+
+  def backfill
+    TAGGABLE_MODELS.each do |model_name|
+      table = model_name.constantize.table_name
+      # Throwaway model so writing the raw JSON bypasses the real model's
+      # serializer and picks up the freshly added column without touching it.
+      klass = Class.new(ActiveRecord::Base) { self.table_name = table }
+
+      Gutentag::Tagging
+        .where(taggable_type: model_name)
+        .joins(:tag)
+        .pluck(:taggable_id, "gutentag_tags.name")
+        .group_by(&:first)
+        .each do |taggable_id, rows|
+          klass.where(id: taggable_id).update_all(cached_tag_list: rows.map(&:last).uniq.to_json)
+        end
+    end
+  end
+end

data/lib/alchemy/configuration/number_option.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+require "alchemy/configuration/base_option"
+
+module Alchemy
+  class Configuration
+    class NumberOption < BaseOption
+      def self.value_class
+        Numeric
+      end
+    end
+  end
+end

data/lib/alchemy/configuration/proc_option.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+require "alchemy/configuration/base_option"
+
+module Alchemy
+  class Configuration
+    class ProcOption < BaseOption
+      def self.value_class
+        Proc
+      end
+    end
+  end
+end

data/lib/alchemy/configuration.rb

@@ -8,7 +8,9 @@ require "alchemy/configuration/collection_option"
 require "alchemy/configuration/configuration_option"
 require "alchemy/configuration/class_option"
 require "alchemy/configuration/integer_option"
+require "alchemy/configuration/number_option"
 require "alchemy/configuration/pathname_option"
+require "alchemy/configuration/proc_option"
 require "alchemy/configuration/regexp_option"
 require "alchemy/configuration/string_option"
 require "alchemy/configuration/symbol_option"

data/lib/alchemy/configurations/admin_components.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module Alchemy
+  module Configurations
+    # === Admin Component Registry
+    #
+    # Overridable admin ViewComponents, keyed by role. Extensions can swap a
+    # component for their own by assigning a different class name in an
+    # initializer:
+    #
+    #     Alchemy.config.admin_components.element_publish_button =
+    #       "MyEngine::Admin::CustomPublishButton"
+    #
+    # Core renders these through the registry instead of referencing the class
+    # directly, so the swap takes effect everywhere the component is used.
+    class AdminComponents < Alchemy::Configuration
+      # The per-element publish control rendered in the element toolbar.
+      option :element_publish_button, :class, default: "Alchemy::Admin::PublishElementButton"
+
+      # The page publication/visibility fields rendered in the page settings form.
+      option :page_publication_fields, :class, default: "Alchemy::Admin::PagePublicationFields"
+
+      # The visibility state badges rendered in the element header.
+      option :element_status_indicators, :class, default: "Alchemy::Admin::ElementStatusIndicators"
+
+      # The status badges rendered for a page in the page listing and sitemap.
+      option :page_status_indicators, :class, default: "Alchemy::Admin::PageStatusIndicators"
+    end
+  end
+end

data/lib/alchemy/configurations/format_matchers.rb

@@ -3,9 +3,15 @@
 module Alchemy
   module Configurations
     class FormatMatchers < Alchemy::Configuration
+      # Naming the hierarchical schemes explicitly matters: a shape match like
+      # `[a-z]+://` also admits `javascript://%0aalert(1)`, which browsers
+      # execute. This is the link dialog's client side check only, the server
+      # side boundary is Alchemy.config.allowed_url_schemes.
+      LINK_URL = /^((mailto|tel):|(https?|ftp):\/\/|\/)/
+
       option :email, :regexp, default: /\A[^@\s]+@([^@\s]+\.)+[^@\s]+\z/
       option :url, :regexp, default: /\A[a-z0-9]+([-.]{1}[a-z0-9]+)*\.[a-z]{2,5}(:[0-9]{1,5})?(\/.*)?\z/ix
-      option :link_url, :regexp, default: /^(tel:|mailto:|\/|[a-z]+:\/\/)/
+      option :link_url, :regexp, default: LINK_URL
     end
   end
 end