alchemy_cms 8.4.1 → 8.4.3

data/app/components/alchemy/admin/main_navigation/menu.rb

@@ -11,9 +11,26 @@ module Alchemy
           </div>
         ERB
 
+        # Entries without a position that were inserted between Alchemy's own
+        # entries are listed after the positioned entry preceding them, so
+        # +Alchemy.config.menu.insert+ can replace the deprecated position.
+        # Appended entries without a position are listed last.
         def items
-          positioned, unpositioned = Alchemy.config.menu.partition(&:position)
-          positioned.sort_by(&:position) + unpositioned
+          menu = Alchemy.config.menu.to_a
+          core_names = Alchemy::Configurations::Menu::DEFAULT.map { |entry| entry[:name] }
+          last_core_index = menu.rindex { |item| core_names.include?(item.name) } || -1
+          preceding_position = 0
+          menu.each_with_index.map do |item, index|
+            preceding_position = item.position if item.position
+            key = if item.position
+              [item.position, 0, index]
+            elsif index < last_core_index
+              [preceding_position, 1, index]
+            else
+              [Float::INFINITY, 0, index]
+            end
+            [item, key]
+          end.sort_by(&:last).map(&:first)
         end
       end
     end

data/app/controllers/alchemy/admin/dashboard/widgets_controller.rb

@@ -11,10 +11,13 @@ module Alchemy
       private
 
       def get_widget(id)
-        "#{MODULE_NAMESPACE}::#{id.camelcase}".constantize
-      rescue NameError => e
+        widget = "#{MODULE_NAMESPACE}::#{id.camelcase}".safe_constantize
+        # Constant lookup also finds classes in the ancestors of a widget,
+        # e.g. "system_info/template" resolves to a ViewComponent internal.
+        return widget if widget.is_a?(Class) && widget.module_parent_name == MODULE_NAMESPACE
+
         Alchemy::Logger.error "No dashboard widget found for id: #{id}"
-        raise ActionController::RoutingError, e.message
+        raise ActionController::RoutingError, "No dashboard widget found for id: #{id}"
       end
     end
   end

data/app/controllers/alchemy/base_controller.rb

@@ -9,7 +9,7 @@ module Alchemy
     include Alchemy::ControllerActions
     include Alchemy::Modules
 
-    protect_from_forgery
+    protect_from_forgery prepend: true
 
     before_action :mailer_set_url_options
     before_action :set_locale

data/app/helpers/alchemy/admin/base_helper.rb

@@ -258,6 +258,12 @@ module Alchemy
         ].compact
       end
 
+      # Restores the elements window width the user dragged it to.
+      def alchemy_body_style
+        width = cookies["alchemy-elements-window-width"]
+        "--elements-window-width: #{width}px" if width&.match?(/\A\d+(\.\d+)?\z/)
+      end
+
       # (internal) Returns options for the clipboard select tag
       def clipboard_select_tag_options(items)
         options = items.map do |item|

data/app/javascript/alchemy_admin/components/elements_window.js

@@ -32,6 +32,8 @@ class ElementsWindow extends HTMLElement {
   }
 
   #onWindowMessage = (event) => {
+    if (event.source !== this.previewWindow?.contentWindow) return
+
     const data = event.data
     if (data?.message == "Alchemy.focusElementEditor") {
       const element = document.getElementById(`element_${data.element_id}`)

data/app/javascript/alchemy_admin/components/preview_window.js

@@ -5,6 +5,7 @@ class PreviewWindow extends HTMLIFrameElement {
   #afterLoad
   #reloadIcon
   #loadTimeout
+  #previewOrigin = null
 
   handleEvent(evt) {
     if (evt.type === "load") {
@@ -15,7 +16,10 @@ class PreviewWindow extends HTMLIFrameElement {
   }
 
   #onPreviewReady = (event) => {
+    if (event.source !== this.contentWindow) return
+
     if (event.data.message === "Alchemy.previewReady") {
+      this.#previewOrigin = event.origin
       this.#clearLoadTimeout()
       this.#stopSpinner()
       // Deliberately does not resolve #afterLoad: previewReady fires before the
@@ -47,7 +51,9 @@ class PreviewWindow extends HTMLIFrameElement {
   }
 
   postMessage(data) {
-    this.contentWindow.postMessage(data, "*")
+    if (this.#previewOrigin) {
+      this.contentWindow.postMessage(data, this.#previewOrigin)
+    }
   }
 
   resize(width) {
@@ -55,6 +61,7 @@ class PreviewWindow extends HTMLIFrameElement {
   }
 
   refresh(url) {
+    this.#previewOrigin = null
     this.#startSpinner()
 
     if (url) {

data/app/models/alchemy/element/element_ingredients.rb

@@ -18,10 +18,24 @@ module Alchemy
         before_create :build_ingredients,
           unless: -> { autogenerate_ingredients == false }
 
-        accepts_nested_attributes_for :ingredients
+        accepts_nested_attributes_for :ingredients, reject_if: ->(attributes) { attributes[:id].blank? }
         validates_associated :ingredients, on: :update
       end
 
+      # Only the editable attributes of each ingredient's own class are
+      # assigned, so +type+, +role+ or +related_object_type+ can never be.
+      def ingredients_attributes=(attributes)
+        attributes = attributes.to_h if attributes.respond_to?(:permitted?)
+        if attributes.is_a?(Hash) && !attributes.key?("id") && !attributes.key?(:id)
+          attributes = attributes.values
+        end
+        super(Array.wrap(attributes).map { |ingredient_attributes|
+          ingredient_attributes = ingredient_attributes.to_h.with_indifferent_access
+          ingredient = ingredients.detect { _1.id.to_s == ingredient_attributes[:id].to_s }
+          ingredient_attributes.slice(:id, *ingredient&.class&.editable_attributes)
+        })
+      end
+
       # The value of an ingredient of the element by role
       def value_for(role)
         ingredient_by_role(role)&.value

data/app/models/alchemy/ingredient.rb

@@ -34,6 +34,8 @@ module Alchemy
 
     attribute :data, :json
 
+    class_attribute :related_object_id_alias, instance_accessor: false
+
     belongs_to :element, touch: true, class_name: "Alchemy::Element", inverse_of: :ingredients
     belongs_to :related_object, polymorphic: true, optional: true
 
@@ -72,6 +74,7 @@ module Alchemy
       # @param [String|Symbol] The name of the alias
       # @param [String] The class name of the related object
       def related_object_alias(name, class_name:)
+        self.related_object_id_alias = :"#{name}_id"
         alias_method name, :related_object
         alias_method :"#{name}=", :related_object=
 
@@ -116,6 +119,11 @@ module Alchemy
       def allowed_settings
         @allowed_settings ||= []
       end
+
+      # Attributes editors may assign through the element form
+      def editable_attributes
+        [:value, *stored_attributes[:data], related_object_id_alias].compact
+      end
     end
 
     # The value or the related object if present

data/app/stylesheets/alchemy/admin/archive.scss

@@ -19,7 +19,8 @@ alchemy-uploader {
 
 .resources-table-wrapper {
   width: 100%;
-  height: 100%;
+  flex: 1;
+  min-height: 0;
   overflow-x: auto;
   padding: var(--spacing-2);
 }

data/app/stylesheets/alchemy/admin/frame.scss

@@ -115,6 +115,8 @@ div#overlay_text_box {
   }
 
   &:has(.resources-table-wrapper) {
+    display: flex;
+    flex-direction: column;
     padding-top: var(--top-menu-height);
     padding-right: 0;
     padding-bottom: 0;

data/app/stylesheets/alchemy/admin/sitemap.scss

@@ -65,8 +65,8 @@ alchemy-sitemap {
 }
 
 #alchemy_pages_tree {
-  display: block;
-  height: calc(100vh - var(--top-menu-height) - var(--spacing-3));
+  display: flow-root;
+  height: 100%;
   position: relative;
 }
 

data/app/views/layouts/alchemy/admin.html.erb

@@ -37,7 +37,7 @@
   </head>
   <%= content_tag :body, id: 'alchemy',
     class: alchemy_body_class,
-    style: cookies["alchemy-elements-window-width"] && "--elements-window-width: #{cookies["alchemy-elements-window-width"]}px" do %>
+    style: alchemy_body_style do %>
     <noscript>
       <h1><%= Alchemy.t(:javascript_disabled_headline) %></h1>
       <p><%= Alchemy.t(:javascript_disabled_text) %></p>

data/lib/alchemy/configurations/menu_item.rb

@@ -24,14 +24,38 @@ module Alchemy
       option :nested_actions, :collection, item_type: :string
       option :nested, :collection, item_type: :configuration, config_class: MenuItem
 
+      alias_method :set_position, :position=
+      private :set_position
+
+      # Alchemy's own entries still need their positions for sorting,
+      # so only positions of other entries are deprecated.
+      def position=(value)
+        if value && Menu::DEFAULT.none? { |entry| entry[:name] == name }
+          Alchemy::Deprecation.warn(
+            "The `position` of menu entries is deprecated and will be removed in Alchemy 9.0, " \
+            "which lists the entries in the order of `Alchemy.config.menu`. " \
+            "Use `Alchemy.config.menu.insert` to place the #{name.inspect} entry instead."
+          )
+        end
+        set_position(value)
+      end
+
       def self.from_legacy_hash(hash)
         hash = hash.to_h.deep_stringify_keys
-        new(
+        item = new(
           from_legacy_navigation(hash["navigation"] || {}, engine_name: hash["engine_name"]).merge(
-            "name" => hash["name"],
-            "position" => hash["position"]
+            "name" => hash["name"]
           ).compact
         )
+        # +register_module+ is deprecated already
+        item.send(:set_position, hash["position"]) if hash["position"]
+        item
+      end
+
+      # Positions sort entries around the default menu's entries, which use
+      # the positions 1 to 7, so +4.1+ maps to the index before Sites.
+      def self.index_for_legacy_position(position)
+        [position.ceil - 1, 0].max
       end
 
       def self.from_legacy_navigation(navigation, engine_name:)
@@ -82,8 +106,8 @@ module Alchemy
         current_path = view_context.request.path
         path_matches = if match_path
           match_path.match?(current_path)
-        elsif (own_path = local_path(view_context))
-          current_path == own_path || current_path.start_with?("#{own_path.chomp("/")}/")
+        elsif (own_path = local_path(view_context)&.chomp("/"))
+          current_path.chomp("/") == own_path || current_path.start_with?("#{own_path}/")
         end
 
         path_matches || [self, *nested].any? do |entry|

data/lib/alchemy/upgrader/eight_four.rb

@@ -169,10 +169,11 @@ module Alchemy
         list = ->(files) { files.map { |file| "  - #{Pathname.new(file).relative_path_from(Rails.root)}" }.join("\n") }
 
         if rewritten.any?
-          todo(<<~TODO.strip, "`register_module` calls were rewritten to `Alchemy.config.menu.add`")
+          todo(<<~TODO.strip, "`register_module` calls were rewritten to `Alchemy.config.menu`")
             `Alchemy::Modules.register_module` is deprecated and will be removed in
             Alchemy 9.0. We rewrote its calls in the following initializers to
-            `Alchemy.config.menu.add`:
+            `Alchemy.config.menu.add`, or to `Alchemy.config.menu.insert` if they
+            had a position between Alchemy's own entries:
 
             #{list.call(rewritten)}
 
@@ -212,7 +213,9 @@ module Alchemy
             the former `navigation` hash now live on the entry itself, its `name`
             is now `title`, `sub_navigation` is now `children`, `icon-style` is now
             `icon_style`, `data: {turbo: false}` is now `turbo: false`, and `params`
-            is no longer supported.
+            is no longer supported. Instead of a `position`, use
+            `config.menu.insert(index, ...)` to place an entry between Alchemy's
+            own entries, e.g. `4` to place it between Languages and Sites.
 
             Call `config.menu.add` once at boot and not inside `to_prepare`, as it
             does not skip entries that are already present like `register_module`

data/lib/alchemy/upgrader/register_module_rewriter.rb

@@ -3,7 +3,8 @@
 module Alchemy
   class Upgrader
     # Rewrites +Alchemy::Modules.register_module+ calls with a static literal
-    # argument into +Alchemy.config.menu.add+ calls.
+    # argument into +Alchemy.config.menu.add+ calls, or +Alchemy.config.menu.insert+
+    # calls if they have a position within the default menu.
     #
     # Calls inside a +to_prepare+ block are guarded by the entry's name, because
     # +Alchemy.config.menu.add+ does not skip entries that are already present.
@@ -15,7 +16,7 @@ module Alchemy
       RECEIVERS = ["Alchemy::Modules", "::Alchemy::Modules"].freeze
 
       KEYS = %w[
-        name title engine_name position icon icon_style image inline_image turbo
+        name title engine_name icon icon_style image inline_image turbo
         controller action nested_controllers nested_actions children nested
       ].freeze
 
@@ -70,24 +71,36 @@ module Alchemy
         return unless arguments.first.is_a?(Prism::HashNode) || arguments.first.is_a?(Prism::KeywordHashNode)
         return unless heredocs_inside?(arguments.first, call, source)
 
-        item = Alchemy::Configurations::MenuItem.from_legacy_hash(literal(arguments.first))
+        definition = literal(arguments.first)
+        item = Alchemy::Configurations::MenuItem.from_legacy_hash(definition)
         return if in_to_prepare && item.name.blank?
 
+        index = menu_index(definition["position"])
+
         indent = " " * call.location.start_column
         if in_to_prepare
           <<~RUBY.chomp
             unless Alchemy.config.menu.any? { |item| item.name == #{item.name.inspect} }
-            #{indent}  #{menu_add(item, "#{indent}  ")}
+            #{indent}  #{menu_add(item, "#{indent}  ", index)}
             #{indent}end
           RUBY
         else
-          menu_add(item, indent)
+          menu_add(item, indent, index)
         end
       rescue NonLiteralError, Alchemy::Configuration::ConfigurationError
         nil
       end
 
-      def menu_add(item, indent)
+      # @return [Integer, nil] The index to insert the entry at or +nil+ to append it
+      def menu_index(position)
+        return if position.nil?
+        raise NonLiteralError unless position.is_a?(Numeric)
+
+        index = Alchemy::Configurations::MenuItem.index_for_legacy_position(position)
+        index if index < Alchemy::Configurations::Menu::DEFAULT.size
+      end
+
+      def menu_add(item, indent, index)
         pairs = attributes(item).map do |key, value|
           if key == "children" || key == "nested"
             entries = value.map { |entry| "#{indent}    #{inline_hash(entry)}" }
@@ -96,7 +109,11 @@ module Alchemy
             "#{indent}  #{key}: #{value.inspect}"
           end
         end
-        "Alchemy.config.menu.add(\n#{pairs.join(",\n")}\n#{indent})"
+        if index
+          "Alchemy.config.menu.insert(\n#{indent}  #{index},\n#{pairs.join(",\n")}\n#{indent})"
+        else
+          "Alchemy.config.menu.add(\n#{pairs.join(",\n")}\n#{indent})"
+        end
       end
 
       def inline_hash(item)

data/lib/alchemy/version.rb

@@ -3,7 +3,7 @@
 module Alchemy
   extend self
 
-  VERSION = "8.4.1"
+  VERSION = "8.4.3"
 
   def version
     VERSION

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: alchemy_cms
 version: !ruby/object:Gem::Version
-  version: 8.4.1
+  version: 8.4.3
 platform: ruby
 authors:
 - Thomas von Deyen