avo 4.3.4 → 4.3.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d65ffce7512335a86a24c0bf2e3fc39bf3a4bb5b13db6b8ef88e73ea045f9ff5
-  data.tar.gz: d4c48cce328b20420e4dd91987f343bbbbcde5df9db020c032c8aa5ccab6d916
+  metadata.gz: 5ddab6468262c61b878d497c3c6c35847b0e646d131c06ccb32e7bf89f98a328
+  data.tar.gz: 3d6e374b3b15f9272d319bec1dbbd58ae6e4bc8f1f22d7c560ae2d05cd771b53
 SHA512:
-  metadata.gz: c063f5cae2dde7b15a45121333425b509b2337408cc2809737f5487d058a5d06d4b21d39bb30ae2bd4302c22ec7d2b8da062a522ae02a0b556f2807065aa2d49
-  data.tar.gz: 43c6aa663a35c9663c01fe2e99c0fa3335d50126820d0780416e66e2597455e918177cc444cde3a9ea5d68cc46f46fec1f27976e21966cb917ee2b1e02be127f
+  metadata.gz: 87458e20763b4c2c4b094d195cbfb7b7dbc23cb7dccd9bb5120b8e7dec6122f0bf258de1fdf13f76acc9a10da11bb7660f6118b403fd2448505edb1cd50fbc1a
+  data.tar.gz: f36f83193fed39820345714623eccaafe8c6cce3f8074656758bf3214be30c4bde406af75c6723c394336851e091bb0b364ee704f57bd9f6879d46ef9a234891

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    avo (4.3.4)
+    avo (4.3.5)
       actionview (>= 6.1)
       active_link_to
       activerecord (>= 6.1)

data/app/assets/builds/avo/application.css

@@ -7920,6 +7920,9 @@ tag.tagify__tag {
       width: calc(var(--spacing) * 52);
     }
   }
+  .field-wrapper__label .field_with_errors {
+    display: inline;
+  }
   .field-wrapper__help {
     margin-top: calc(var(--spacing) * 2);
     font-size: var(--text-xs);

data/app/assets/stylesheets/css/components/field-wrapper.css

@@ -6,6 +6,12 @@
   @apply flex self-start items-center shrink-0 w-full px-4 font-medium text-content text-sm md:w-52 min-h-10;
 }
 
+/* Rails' field_error_proc wraps an errored label in a block div, which would push the
+   required asterisk onto its own line. */
+.field-wrapper__label .field_with_errors {
+  @apply inline;
+}
+
 .field-wrapper__help {
   @apply text-content-secondary mt-2 text-xs leading-4;
 }

data/app/components/avo/debug/status_component.html.erb

@@ -46,7 +46,14 @@
               <ul>
                 <li>Avo <%= Avo::VERSION %></li>
                 <% Avo.plugin_manager.plugins.each do |plugin| %>
-                  <li><%= plugin.name %> - <%= plugin.version %></li>
+                  <li>
+                    <% if plugin.gem_name.present? %>
+                      <%= link_to plugin.name, "https://avohq.io/gems/#{plugin.gem_name}", target: "_blank", rel: "noopener", class: "underline" %>
+                    <% else %>
+                      <%= plugin.name %>
+                    <% end %>
+                    - <%= plugin.version %>
+                  </li>
                 <% end %>
               </ul>
             </div>

data/app/controllers/avo/actions_controller.rb

@@ -78,24 +78,13 @@ module Avo
       end
     end
 
-    def find_records_from_resource_ids
-      if (ids = action_params[:fields]&.dig(:avo_resource_ids)&.split(",") || []).any?
-        @resource.find_record(ids, params: params)
-      else
-        []
-      end
     # A record may be deleted between the moment it was checked on the index and
-    # the moment the action is submitted, and the bulk lookup above raises for the
-    # whole batch when that happens. Fall back to the resource's own per-record
-    # lookup so custom `find_record_method`s and FriendlyId keep working, and drop
-    # only the records that are really gone. This is O(n) queries on purpose: it
-    # runs only on the race, never on the happy path.
-    rescue ActiveRecord::RecordNotFound
-      ids.filter_map do |id|
-        @resource.find_record(id, params: params)
-      rescue ActiveRecord::RecordNotFound
-        nil
-      end
+    # the moment the action is submitted. Only the records that are really gone drop out.
+    def find_records_from_resource_ids
+      ids = action_params[:fields]&.dig(:avo_resource_ids)&.split(",") || []
+      return [] if ids.empty?
+
+      @resource.find_records(ids, params: params).compact.uniq
     end
 
     def set_fields

data/app/controllers/avo/associations_controller.rb

@@ -53,12 +53,7 @@ module Avo
       @resource.hydrate(record: @record)
 
       if @field.present? && !@field.is_searchable?
-        query = @related_authorization.apply_policy @attachment_class
-
-        # Add the association scope to the query scope
-        if @field.attach_scope.present?
-          query = Avo::ExecutionContext.new(target: @field.attach_scope, query: query, parent: @record).handle
-        end
+        query = attachable_query
 
         @options = if attach_using_checkbox_list?
           checkbox_list_options(query)
@@ -100,6 +95,10 @@ module Avo
             attach_record(association_name, attachment_record)
           end
         end
+      rescue Avo::Fields::BelongsToField::TargetNotFound => error
+        # Worded on the join record, which owns the fields; `@record` has no attribute to put them on
+        join_record = @reflection.through_reflection.klass.new
+        error.field_ids.each { |field_id| @record.errors.add(:base, ActiveModel::Error.new(join_record, field_id, :invalid).full_message) }
       end
     end
 
@@ -150,13 +149,10 @@ module Avo
     end
 
     def set_attachment_record
-      if action_name == "create"
-        @attachment_records = attachment_ids.map do |id|
-          @related_resource.find_record id, params: params
-        end
-        @attachment_record = @attachment_records.first
+      @attachment_record = if action_name == "create"
+        attachment_records.first
       else
-        @attachment_record = @related_resource.find_record attachment_id, params: params
+        @related_resource.find_record attachment_id, params: params
       end
     end
 
@@ -174,12 +170,25 @@ module Avo
       Array(attachment_id).reject(&:blank?)
     end
 
+    # Whether the finder raises (`find`) or answers nil (`find_by`), a refused id raises like a missing one
     def attachment_records
-      @attachment_records ||= attachment_ids.map do |id|
-        @related_resource.find_record id, params: params
+      @attachment_records ||= begin
+        query = attachable_query
+
+        attachment_ids.map do |id|
+          @related_resource.find_record(id, query:, params:) || raise(ActiveRecord::RecordNotFound, "Couldn't find #{@attachment_class} with '#{id}'")
+        end
       end
     end
 
+    # What the attach picker offers, and so the only records the save accepts
+    def attachable_query
+      query = @related_authorization.apply_policy @attachment_class
+      return query if @field.attach_scope.blank?
+
+      Avo::ExecutionContext.new(target: @field.attach_scope, query: query, parent: @record).handle
+    end
+
     def reflection_class
       if @reflection.is_a?(ActiveRecord::Reflection::ThroughReflection)
         @reflection.through_reflection.class
@@ -277,15 +286,19 @@ module Avo
     end
 
     def additional_params
-      @additional_params ||= params[:fields].slice(*@attach_fields&.map(&:id))
+      @additional_params ||= params[:fields].slice(*@resource.fields_by_param(Array(@attach_fields)).compact.keys)
     end
 
     def set_attach_fields
       @attach_fields = if @field.attach_fields.present?
+        # Attach fields describe the join record, so a belongs_to among them finds its association there
+        join_record = @reflection.through_reflection&.klass&.new
+
         Avo::FieldsExecutionContext.new(target: @field.attach_fields)
           .detect_fields
           .items_holder
           .items
+          .each { |field| field.hydrate(record: join_record) }
       end
     end
 

data/app/controllers/avo/base_application_controller.rb

@@ -193,6 +193,9 @@ module Avo
 
       @record = @resource.fill_record(@record_to_fill, cast_nullable(model_params), extra_params: extra_params)
       assign_default_value_to_disabled_fields if @view.create?
+    rescue Avo::Fields::BelongsToField::TargetNotFound => error
+      @record = @record_to_fill
+      error.field_ids.each { |field_id| @record.errors.add(field_id, :invalid) }
     end
 
     def is_attach_action?

data/app/controllers/avo/base_controller.rb

@@ -231,6 +231,9 @@ module Avo
     end
 
     def save_record
+      # Saving runs the validations, which would clear an error that filling the record left on it
+      return false if @record.errors.any?
+
       perform_action_and_record_errors do
         save_record_action
       end

data/lib/avo/fields/belongs_to_field.rb

@@ -57,6 +57,20 @@ module Avo
     # - is_disabled?
 
     class BelongsToField < BaseField
+      # A value that matches no record the field may attach, which a form shows on the field.
+      # A RecordNotFound, so code that already rescues one keeps working.
+      class TargetNotFound < ActiveRecord::RecordNotFound
+        attr_reader :field_id
+        # This field and every other one the same fill could not resolve, so a form shows them all
+        attr_accessor :field_ids
+
+        def initialize(message, model, id, field_id:)
+          @field_id = field_id
+          @field_ids = [field_id]
+          super(message, model, nil, id)
+        end
+      end
+
       include Avo::Fields::Concerns::IsSearchable
       include Avo::Fields::Concerns::UseResource
 
@@ -204,6 +218,16 @@ module Avo
         if polymorphic_as.present?
           valid_model_class = valid_polymorphic_class params[:"#{polymorphic_as}_type"]
 
+          # A type sent without its id keeps the current record. A new type can't take the current id, which names a record only
+          # under its own type. With no current id (a create through a parent fills it in later), the type is set as before.
+          if valid_model_class.present? && !params.key?(id_input_foreign_key)
+            return record if valid_model_class.to_s == record.public_send(type_input_foreign_key)
+
+            if record.public_send(id_input_foreign_key).present?
+              raise TargetNotFound.new("Couldn't find #{valid_model_class} without #{id_input_foreign_key}", valid_model_class.name, nil, field_id: id)
+            end
+          end
+
           record.send(:"#{polymorphic_as}_type=", valid_model_class)
 
           # If the type is blank, reset the id too.
@@ -331,10 +355,11 @@ module Avo
 
       private
 
-      # A custom finder can answer nil (`find_by`) where the default one raises, so raise for it
+      # Whether the finder raises (`find`) or answers nil (`find_by`), the field raises TargetNotFound
       def find_target!(target, record, id)
-        target.find_record(id, query: scoped_target_query(target, record, for_find: true)) ||
-          raise(ActiveRecord::RecordNotFound.new("Couldn't find #{target.model_class.name} with '#{id}'", target.model_class.name))
+        target.find_record(id, query: scoped_target_query(target, record, for_find: true)) || raise(ActiveRecord::RecordNotFound)
+      rescue ActiveRecord::RecordNotFound
+        raise TargetNotFound.new("Couldn't find #{target.model_class.name} with '#{id}'", target.model_class.name, id, field_id: self.id)
       end
 
       def scoped_target_query(resource, parent_record, for_find: false)

data/lib/avo/fields/files_field.rb

@@ -45,8 +45,9 @@ module Avo
       def fill_field(record, key, value, params)
         return record unless record.methods.include? key.to_sym
 
-        # attach files in one call to avoid index_active_storage_attachments_uniqueness violation
-        record.send(key).attach(value.compact_blank)
+        # `attach` without its immediate save on a persisted record, so the files are saved with the record and a form
+        # that fails saves none. One assignment avoids an index_active_storage_attachments_uniqueness violation.
+        record.public_send(:"#{key}=", record.public_send(key).blobs + value.compact_blank)
 
         record
       end

data/lib/avo/resources/array_resource.rb

@@ -55,12 +55,15 @@ module Avo
 
         return super(id, query: fetched_records, params:) if is_active_record_relation?(fetched_records)
 
-        # Id is Array when find record is called from actions controller
-        if id.is_a?(Array)
-          fetched_records.select { |record| id.map(&:to_s).include?(record.id.to_s) }
-        else
-          fetched_records.find { |record| record.id.to_s == id.to_s }
-        end
+        fetched_records.find { |record| record.id.to_s == id.to_s }
+      end
+
+      def find_records(ids, query: nil, params: nil)
+        fetched_records = fetch_records
+
+        return super(ids, query: fetched_records, params:) if is_active_record_relation?(fetched_records)
+
+        ids.map { |id| fetched_records.find { |record| record.id.to_s == id.to_s } }
       end
 
       def fetch_records(array_of_records = nil)

data/lib/avo/resources/base.rb

@@ -319,6 +319,37 @@ module Avo
           ).handle
         end
 
+        # The records `ids` name, each the way `find_record` finds one: by its `to_param`, through
+        # `find_record_method`. One entry per id, in order, nil where an id names no record in `query`.
+        #
+        # The finder is asked for the whole set first, then once per id it did not name: a finder
+        # that takes one id at a time, or a missing record.
+        def find_records(ids, query: nil, params: nil)
+          query ||= find_scope
+          ids = ids.map(&:to_s)
+
+          found = begin
+            ids.many? ? Array.wrap(find_record(ids.uniq, query:, params:)).index_by { |record| record.to_param.to_s } : {}
+          rescue
+            {}
+          end
+
+          (ids - found.keys).each do |id|
+            found[id] = find_record(id, query:, params:)
+          rescue ActiveRecord::ActiveRecordError, RangeError, ArgumentError, TypeError
+            nil
+          end
+
+          # Avo's own finder reads through `query`. A custom one may ignore it, so only what `query`
+          # also holds is kept.
+          unless find_record_method.equal?(Avo::Resources::Base.find_record_method)
+            in_query = query.where(model_class.primary_key => found.values.compact.map(&:id)).index_by(&:id)
+            found.transform_values! { |record| record if in_query.key?(record&.id) }
+          end
+
+          ids.map { |id| found[id] }
+        end
+
         def search_query
           search.dig(:query)
         end
@@ -335,7 +366,7 @@ module Avo
       delegate :plural_name, to: :class
       delegate :underscore_name, to: :class
       delegate :to_param, to: :class
-      delegate :find_record, to: :class
+      delegate :find_record, :find_records, to: :class
       delegate :model_key, to: :class
       delegate :translation_key, to: :class
       delegate :tab, to: :items_holder
@@ -646,33 +677,37 @@ module Avo
         end
       end
 
-      # Map the received params to their actual fields
-      # 'resource' argument is used on avo-advanced, don't remove
-      def fields_by_database_id(resource: self)
-        resource.get_field_definitions
-          .reject do |field|
-            field.computed
-          end
-          .map do |field|
-            [field.database_id.to_s, field]
-          end
+      # Every form param, mapped to the field that writes it: each non-computed field's params, and each
+      # top-level `extra_params` name, which no field writes (nil). A field hidden from the form keeps its
+      # params, as a resource tool can render it. When several fields take one param (a field declared
+      # once per view), the one this form shows to this user writes it. `fields` narrows the candidates.
+      def fields_by_param(fields = get_field_definitions)
+        form = Avo::ViewInquirer.new(view).form?
+        shown, hidden = fields.reject(&:computed).partition { |field| form && field.visible_in_view?(view:) && field.visible? }
+        extra = Array.wrap(self.class.extra_params).select { |param| param.is_a?(Symbol) || param.is_a?(String) }
+
+        # Shown fields last, so they win a param they share
+        (hidden + shown)
+          .flat_map { |field| flatten_keys(Array.wrap(field.to_permitted_param)).map { |param| [param.to_s, field] } }
           .to_h
+          .merge(extra.to_h { |param| [param.to_s, nil] }) { |_param, field| field }
       end
 
       def fill_record(record, permitted_params, extra_params: [], fields: nil)
-        fields_by_id = fields_by_database_id if fields.blank?
+        fields_by_key = fields.present? ? fields_by_param(fields) : fields_by_param
+        unresolved = []
 
-        # Write the field values
-        permitted_params.each do |key, value|
-          field = if fields.present?
-            fields.find { |f| f.id == key.to_sym }
-          else
-            fields_by_id[key]
-          end
+        # Write each field once, whichever of its params arrived. A param left out keeps the record's current value,
+        # except a polymorphic id, which its field keeps only under the current type.
+        permitted_params.keys.filter_map { |key| fields_by_key[key.to_s] }.uniq.each do |field|
+          left_out = fields_by_key.filter_map { |key, owner| key if owner == field && !permitted_params.key?(key) && record.respond_to?(key) && key != field.try(:id_input_foreign_key) }
+          params = permitted_params.reverse_merge(left_out.index_with { |key| record.public_send(key) })
+          key = field.database_id.to_s
 
-          next unless field.present?
-
-          record = field.fill_field record, key, value, permitted_params
+          record = field.fill_field record, key, params[key], params
+        rescue Avo::Fields::BelongsToField::TargetNotFound => error
+          # Raised once every field is filled, so the form that shows the error keeps the user's other edits
+          unresolved << error
         end
 
         # Write the user configured extra params to the record
@@ -685,7 +720,14 @@ module Avo
           record.assign_attributes extra_attributes
         end
 
-        safe_call(:fill_nested_records, record:, permitted_params:) || record
+        record = safe_call(:fill_nested_records, record:, permitted_params:) || record
+
+        if unresolved.any?
+          unresolved.first.field_ids = unresolved.map(&:field_id)
+          raise unresolved.first
+        end
+
+        record
       end
 
       # On the resource so one that isn't backed by a model can build, save and delete its own records,

data/lib/avo/skills/avo-associations/SKILL.md

@@ -168,6 +168,7 @@ Turning a long `belongs_to` / `has_many` picker into a type-to-search field is t
 - **A `belongs_to` field is disabled when you arrive through that same association.** Editing a Comment reached via a Post's comments panel disables the `post` field. Set `allow_via_detaching: true` to re-enable it.
 - **`polymorphic_as` and `types` are a pair** — using one without the other raises. `types` is an array of model classes (`[::Post, ::Project]`), matching a `polymorphic: true` `belongs_to`.
 - **`attach_scope` does not filter listed rows**, only the attach picker. To hide rows from a `has_many`/HABTM table, use `scope` or a Pundit policy scope.
+- **Build `attach_scope` on `query` to keep the policy scope.** `query` arrives already narrowed by the target's policy scope. A fresh relation (`-> { ::User.all }`) widens past it on purpose. On every association the save accepts exactly the records the picker offers, so a record outside the `attach_scope` is refused like a missing one.
 - **STI child resources must set `self.model_class`.** When a parent class and STI children share a table, give each child resource `self.model_class = "SuperUser"` so Avo maps it correctly. To route association rows / index clicks to the child resource instead of the parent, use `self.link_to_child_resource = true` on the parent resource or `link_to_child_resource:` on the field.
 - **Searchable can look "broken" but be misconfigured** — no query source means an empty picker, not an error. And it's a paid add-on.
 

data/lib/avo/skills/avo-resources/SKILL.md

@@ -286,7 +286,7 @@ Search (`self.search`), grid/map view types, record reordering, and i18n live on
 - **Two resources, one model → wrong one wins.** Avo resolves the default alphabetically. Set `config.model_resource_mapping` and/or `use_resource:` on associations.
 - **Secondary / namespaced / oddly-named resources need `self.model_class`** (or the matching namespace) or Avo can't infer the model. Namespaced resources whose namespace matches the model's namespace infer automatically.
 - **Array resources are Beta:** no sorting, and `records` re-runs every request. Cache inside `records` for large sets, or move to an HTTP Resource.
-- **`find_record_method` in batch contexts:** `id` arrives as an Array for bulk actions — return a collection (`query.where(...)`) in that branch, not a single record. If that branch raises `ActiveRecord::RecordNotFound` (as `query.find(id)` does when one record was deleted between selection and submit), Avo retries the **scalar** branch once per id and drops the ones that are gone — so keep the scalar branch able to handle every id the array branch receives.
+- **`find_record_method` in batch contexts:** `id` arrives as an Array for bulk actions — return a collection (`query.where(...)`) in that branch, not a single record. For every id that branch doesn't return (it raised, as `query.find(id)` does when one record was deleted between selection and submit, or it takes one id at a time), Avo retries the **scalar** branch once per id and drops the ones that are gone — so keep the scalar branch able to handle every id the array branch receives. In a batch, a custom finder's records are kept only when `query` also holds them, so ignoring it can't reach past the policy scope; a single lookup (Show, Edit, `belongs_to`) uses the finder's answer as-is, so keep reading through `query`. In your own code, `Avo::Resources::Post.find_records(ids, query:)` does the same lookup: one entry per id, in order, `nil` where none.
 - **`visible_on_sidebar` only affects the auto-generated menu.** If the app uses the menu editor, control visibility in its `visible` block instead.
 - **System specs that leave an edited form without saving now meet a confirmation dialog.** `config.warn_on_unsaved_changes` is on by default — accept the dialog with `accept_custom_alert { ... }` from `Avo::TestHelpers`, or set the option to `false` in the test environment.
 - **Don't re-invent fields/associations here.** Field DSL is the avo-fields skill; `belongs_to`/`has_many`/`use_resource` is avo-associations.

data/lib/avo/version.rb

@@ -1,3 +1,3 @@
 module Avo
-  VERSION = "4.3.4" unless const_defined?(:VERSION)
+  VERSION = "4.3.5" unless const_defined?(:VERSION)
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: avo
 version: !ruby/object:Gem::Version
-  version: 4.3.4
+  version: 4.3.5
 platform: ruby
 authors:
 - Adrian Marin