avo 4.0.23 → 4.0.25

data/app/components/avo/index/resource_controls_component.rb

@@ -57,11 +57,15 @@ class Avo::Index::ResourceControlsComponent < Avo::ResourceComponent
     Avo.resource_manager.get_resource_by_model_class @parent_record.class
   end
 
+  # Rails uses ThroughReflection for both `has_many :through` and
+  # `has_one :through`, so the class alone can't tell a collection from a
+  # singular association — `collection?` is what separates them.
   def is_has_many_association?
+    return @reflection.collection? if @reflection.instance_of?(ActiveRecord::Reflection::ThroughReflection)
+
     @reflection.class.in? [
       ActiveRecord::Reflection::HasManyReflection,
-      ActiveRecord::Reflection::HasAndBelongsToManyReflection,
-      ActiveRecord::Reflection::ThroughReflection
+      ActiveRecord::Reflection::HasAndBelongsToManyReflection
     ]
   end
 

data/app/components/avo/keyboard_shortcuts_component.rb

@@ -17,7 +17,8 @@ class Avo::KeyboardShortcutsComponent < Avo::BaseComponent
             keys_aria_label: "Up arrow or down arrow"
           ),
           shortcut(action: "Go back", keys: ["B"]),
-          shortcut(action: "Toggle keyboard shortcut badges", keys: ["Shift", "K"])
+          shortcut(action: "Toggle keyboard shortcut badges", keys: ["Shift", "K"]),
+          *assistant_shortcuts
         ]
       ),
       build_section(
@@ -89,6 +90,15 @@ class Avo::KeyboardShortcutsComponent < Avo::BaseComponent
 
   private
 
+  # avo-intelligence binds Cmd/Ctrl+J itself (its chat bar listens for the keydown directly, so it
+  # fires from inside a field too). Core has no assistant to open, so the modal only lists it when
+  # the gem is installed.
+  def assistant_shortcuts
+    return [] unless Avo.plugin_manager.installed?("avo-intelligence")
+
+    [shortcut(action: "Open the assistant", keys: {mac: ["Cmd", "J"], other: ["Ctrl", "J"]})]
+  end
+
   def build_section(title, shortcuts)
     {
       id: "hotkey-group-#{title.parameterize.underscore}",

data/app/components/avo/u_i/dropdown_component.html.erb

@@ -9,11 +9,29 @@
         class: class_names("popover-menu__panel", @classes),
         data: {controller: "popover-menu"} do %>
         <div class="dropdown-menu">
+          <% if @searchable %>
+            <div class="dropdown-menu__search search-input">
+              <input type="search"
+                     class="search-input__input"
+                     placeholder="<%= search_placeholder %>"
+                     aria-label="<%= search_placeholder %>"
+                     autocomplete="off"
+                     data-popover-menu-target="searchInput"
+                     data-action="input->popover-menu#filter">
+              <span class="search-input__prefix" aria-hidden="true"><%= helpers.svg "tabler/outline/search" %></span>
+            </div>
+          <% end %>
           <div class="dropdown-menu__group">
             <div class="dropdown-menu__list">
               <%= items %>
             </div>
           </div>
+          <% if @searchable %>
+            <p class="dropdown-menu__search-empty" data-popover-menu-target="empty" hidden>No matching options</p>
+          <% end %>
+          <% if footer? %>
+            <div class="dropdown-menu__footer"><%= footer %></div>
+          <% end %>
         </div>
       <% end %>
     <% end %>

data/app/components/avo/u_i/dropdown_component.rb

@@ -7,9 +7,16 @@ class Avo::UI::DropdownComponent < Avo::BaseComponent
   prop :open, default: false
   prop :dropdown_menu_classes, default: ""
   prop :popover_mode, default: false
+  # Renders a filter input above the items that narrows them as the user types
+  # (client-side, over the rendered items). Popover mode only.
+  prop :searchable, default: false
+  prop :search_placeholder
 
   renders_one :trigger
   renders_one :items
+  # A row pinned under the list — outside the scrollable group and the inline
+  # search's filter scope, so it stays visible. Popover mode only.
+  renders_one :footer
 
   # this is used to trigger the dropdown menu from trigger element
   # data: {action: component.action} => click->dropdown-menu#toggle
@@ -21,6 +28,10 @@ class Avo::UI::DropdownComponent < Avo::BaseComponent
     @popover_id ||= "popover-#{SecureRandom.hex(3)}"
   end
 
+  def search_placeholder
+    @search_placeholder || I18n.t("avo.search.placeholder", default: "Search")
+  end
+
   def data
     return {} if items.blank?
 

data/app/controllers/avo/associations_controller.rb

@@ -110,7 +110,7 @@ module Avo
       association_name = BaseResource.valid_association_name(@record, @field.for_attribute || params[:related_name])
 
       if through_reflection?
-        join_record.destroy!
+        join_record&.destroy!
       elsif has_many_reflection?
         @record.send(association_name).delete @attachment_record
       else
@@ -223,13 +223,29 @@ module Avo
       @reflection.source_reflection.foreign_key
     end
 
-    def through_foreign_key
-      @reflection.through_reflection.foreign_key
+    # Resolve the join record through the (scoped) through association rather
+    # than an unscoped `find_by` on the join model. When a pair of records is
+    # linked more than once, the association's scope is the only thing that
+    # tells one join row from another — `-> { where level: :admin }` picking the
+    # admin row out of a user's memberships, say. An unscoped lookup matches on
+    # the two foreign keys alone and destroys whichever row it happens to hit.
+    #
+    # A `has_many :through` narrows the association down to the record being
+    # detached. A `has_one :through` already *is* that record, so it only has to
+    # be checked against the one named in the URL — otherwise a stale page or a
+    # double detach would destroy whatever is currently attached.
+    def join_record
+      return through_association.find_by(source_foreign_key => @attachment_record.id) if @reflection.collection?
+
+      record = through_association
+      record if record.present? && record[source_foreign_key] == @attachment_record.id
     end
 
-    def join_record
-      @reflection.through_reflection.klass.find_by(source_foreign_key => @attachment_record.id,
-        through_foreign_key => @record.id)
+    # The through association itself: a collection proxy for `has_many :through`,
+    # the join record (or nil) for `has_one :through`. Reading it rather than the
+    # join model is what keeps the association's scope in play.
+    def through_association
+      @record.send(@reflection.through_reflection.name)
     end
 
     def has_many_reflection?
@@ -243,6 +259,13 @@ module Avo
       @reflection.instance_of? ActiveRecord::Reflection::ThroughReflection
     end
 
+    # Rails uses ThroughReflection for both `has_many :through` and
+    # `has_one :through`, so `through_reflection?` alone can't tell a collection
+    # from a singular association.
+    def collection_through_reflection?
+      through_reflection? && @reflection.collection?
+    end
+
     def additional_params
       @additional_params ||= params[:fields].slice(*@attach_fields&.map(&:id))
     end
@@ -257,22 +280,57 @@ module Avo
     end
 
     def attach_record(association_name, attachment_record)
-      if through_reflection? && additional_params.present?
+      # Hand-build the join record only when attach fields have to land before
+      # the insert: `<<` saves immediately, and a join model that validates one
+      # of those columns (StorePatron#review) fails before we could fill it.
+      # Otherwise prefer `<<` — it fills in the polymorphic source type and
+      # handles composite primary keys, neither of which we do by hand.
+      #
+      # Collection-only, and not merely by preference: it builds *through* the
+      # association, and `new` is a collection proxy method. A singular through
+      # also needs replace semantics, which only assignment gives — building a
+      # second join record would leave the association with two rows to pick
+      # from.
+      if collection_through_reflection? && additional_params.present?
         new_join_record(attachment_record).save!
-      elsif has_many_reflection? || through_reflection?
+      elsif has_many_reflection? || collection_through_reflection?
         @record.send(association_name) << attachment_record
       else
         @record.send(:"#{association_name}=", attachment_record)
         @record.save!
+
+        persist_join_record if through_reflection?
       end
     end
 
+    # A singular through association owns exactly one join record, and the
+    # assignment in `attach_record` already created or replaced it through the
+    # (scoped) through association.
+    def persist_join_record
+      through_record = through_association
+
+      return if through_record.blank?
+
+      # Fill the attach fields onto that row instead of inserting a second one
+      # that the association's scope wouldn't even match.
+      @resource.fill_record(through_record, additional_params, fields: @attach_fields) if additional_params.present?
+
+      # Rails writes the join record with `create`, which returns an unsaved
+      # record instead of raising when it's invalid. Without this `save!` the
+      # attach would report success while nothing was written.
+      through_record.save!
+    end
+
+    # Build the join record *through* the (scoped) through association, so Rails
+    # stamps the scope's attributes on it — `-> { where level: :admin }` writing
+    # `level` — along with the through foreign key. Building it on the join
+    # model instead writes the two foreign keys and nothing else, so a scoped
+    # association reports a successful attach and then doesn't match the row it
+    # just wrote. The `<<` arm below already goes through the association; this
+    # only differs in having attach fields to fill.
     def new_join_record(attachment_record)
       @resource.fill_record(
-        @reflection.through_reflection.klass.new(
-          source_foreign_key => attachment_record.id,
-          through_foreign_key => @record.id
-        ),
+        through_association.new(source_foreign_key => attachment_record.id),
         additional_params,
         fields: @attach_fields
       )

data/app/javascript/js/controllers/popover_menu_controller.js

@@ -1,6 +1,8 @@
 import { Controller } from '@hotwired/stimulus'
 
 export default class extends Controller {
+  static targets = ['searchInput', 'empty']
+
   // Used by both onToggle (auto-focus) and handleKeydown (arrow navigation).
   get focusableItems() {
     return [...this.element.querySelectorAll('a, button')].filter(
@@ -25,9 +27,19 @@ export default class extends Controller {
   onToggle(event) {
     if (event.newState !== 'open') return
 
+    // Each open starts unfiltered — a leftover query from the last visit would
+    // silently hide items.
+    if (this.hasSearchInputTarget) this.resetFilter()
+
     // requestAnimationFrame ensures the popover is fully rendered before we focus.
     // Focusing before the browser paints causes the scroll to jump in some cases.
     requestAnimationFrame(() => {
+      // A searchable menu hands focus to its filter input so the user can just type.
+      if (this.hasSearchInputTarget) {
+        this.searchInputTarget.focus()
+        return
+      }
+
       const items = this.focusableItems
       if (items.length === 0) return
 
@@ -38,24 +50,46 @@ export default class extends Controller {
     })
   }
 
+  // Narrows the rendered items to those whose text matches the query. Items are
+  // queried at call time (not cached) so lazily loaded content — e.g. a
+  // turbo-frame inside the list — is filterable as soon as it arrives. An item
+  // carrying data-filter-text matches on that instead of its full text, so
+  // decorations (timestamps, tags) don't count as matches.
+  filter() {
+    const query = this.searchInputTarget.value.trim().toLowerCase()
+    let anyVisible = false
+
+    this.element.querySelectorAll('.dropdown-menu__list a, .dropdown-menu__list button').forEach((item) => {
+      const text = item.dataset.filterText ?? item.textContent
+      const match = query === '' || text.replace(/\s+/g, ' ').trim().toLowerCase().includes(query)
+      item.hidden = !match
+      if (match) anyVisible = true
+    })
+
+    if (this.hasEmptyTarget) this.emptyTarget.hidden = anyVisible || query === ''
+  }
+
+  resetFilter() {
+    this.searchInputTarget.value = ''
+    this.filter()
+  }
+
   handleKeydown(event) {
     // The keydown listener is always attached, so guard against firing when closed.
     if (!this.element.matches(':popover-open')) return
 
-    const items = this.focusableItems
-    if (items.length === 0) return
-
-    const idx = items.indexOf(document.activeElement)
-
     switch (event.key) {
       case 'ArrowDown':
+      case 'ArrowUp': {
+        const items = this.focusableItems
+        if (items.length === 0) return
+
         event.preventDefault()
-        items[idx < items.length - 1 ? idx + 1 : 0].focus()
-        break
-      case 'ArrowUp':
-        event.preventDefault()
-        items[idx > 0 ? idx - 1 : items.length - 1].focus()
+        const idx = items.indexOf(document.activeElement)
+        if (event.key === 'ArrowDown') items[idx < items.length - 1 ? idx + 1 : 0].focus()
+        else items[idx > 0 ? idx - 1 : items.length - 1].focus()
         break
+      }
       case 'Escape':
         // Close on Escape ourselves. Native popover light-dismiss is unreliable
         // here because other document-level keydown handlers (e.g. the index-row
@@ -63,7 +97,13 @@ export default class extends Controller {
         // also reacting; hidePopover restores focus to the trigger.
         event.preventDefault()
         event.stopPropagation()
-        this.element.hidePopover()
+        // With a non-empty search query the first Escape only clears it; the next closes.
+        if (this.hasSearchInputTarget && this.searchInputTarget.value !== '') {
+          this.resetFilter()
+          this.searchInputTarget.focus()
+        } else {
+          this.element.hidePopover()
+        }
         break
       default:
     }

data/lib/avo/version.rb

@@ -1,3 +1,3 @@
 module Avo
-  VERSION = "4.0.23" unless const_defined?(:VERSION)
+  VERSION = "4.0.25" unless const_defined?(:VERSION)
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: avo
 version: !ruby/object:Gem::Version
-  version: 4.0.23
+  version: 4.0.25
 platform: ruby
 authors:
 - Adrian Marin
@@ -224,6 +224,8 @@ files:
 - app/assets/builds/avo/application.css
 - app/assets/builds/avo/application.js
 - app/assets/builds/avo/application.js.map
+- app/assets/builds/avo/avo.custom.js
+- app/assets/builds/avo/avo.custom.js.map
 - app/assets/builds/avo/dependencies.css
 - app/assets/builds/avo/late-registration.js
 - app/assets/builds/avo/late-registration.js.map