avo 4.3.8 → 4.3.10

data/app/components/avo/view_types/base_view_type_component.rb

@@ -28,4 +28,48 @@ class Avo::ViewTypes::BaseViewTypeComponent < Avo::BaseComponent
       field_per_page: field&.per_page
     )
   end
+
+  def selected_page_label
+    if @resource.pagination_type.countless?
+      t "avo.x_records_selected_from_page_html", selected: @pagy.in
+    else
+      t "avo.x_records_selected_from_a_total_of_x_html", selected: @pagy.in, count: @pagy.count
+    end
+  end
+
+  def selected_all_label
+    if @resource.pagination_type.countless?
+      t "avo.records_selected_from_all_pages_html"
+    else
+      t "avo.x_records_selected_from_all_pages_html", count: @pagy.count
+    end
+  end
+
+  def encrypted_query
+    # A page cut by its source is all that is held, so there is nothing to select across pages
+    return :select_all_disabled if @query.is_a?(Avo::Resources::ArrayResource::Page)
+
+    # TODO: move this to the resource where we can apply the adapter pattern
+    if Module.const_defined?("Ransack::Search") && @query.instance_of?(Ransack::Search)
+      @query = @query.result
+    end
+
+    Avo::Services::EncryptionService.encrypt(message: @query, purpose: :select_all, serializer: Marshal)
+  rescue
+    disable_select_all
+  end
+
+  private
+
+  def disable_select_all
+    if Rails.env.development?
+      Avo.error_manager.add({
+        url: "https://docs.avohq.io/4.0/select-all.html#serialization-known-issues",
+        target: "_blank",
+        message: "An error occurred while serializing the query object. The Select All feature has been disabled because it depends on successful query serialization. For more details and troubleshooting steps, click here."
+      })
+    end
+
+    :select_all_disabled
+  end
 end

data/app/components/avo/view_types/grid_component.html.erb

@@ -1,21 +1,75 @@
 <turbo-frame id="<%= list_frame_id %>" target="_top" class="relative flex w-full flex-col @container">
-  <%# tabindex=-1 makes the wrapper a Shift+T focus anchor (top-level grids only, %>
-  <%# never a has-many grid on a show page); from here Tab steps through the cards. %>
+  <%# The selection controller wraps the bar and the cards. The reorder gem sorts the grid wrapper's children, %>
+  <%# so the bar can't sit inside it. %>
   <%= content_tag :div,
-    class: "grid-wrapper",
-    tabindex: (@reflection.present? ? nil : "-1"),
+    class: "flex w-full flex-col gap-3",
     data: {
-      component_name: self.class.to_s.underscore,
       controller: "item-select-all",
       resource_name: resource_name_for(@resource),
+      item_select_all_selected_all_value: false,
+      item_select_all_selected_all_query_value: encrypted_query,
+      item_select_all_page_count_value: @pagy.pages,
       selected_resources_name: resource_name_for(@resource),
-      selected_resources: [],
-      **(@reflection.present? ? {} : {"content-focus": ""}),
-      **(try(:drag_reorder_data_attributes) || {})
+      selected_resources: []
     } do %>
-    <% @resources.each_with_index do |resource, index| %>
-      <% cache_if Avo.configuration.cache_resources_on_index_view, resource.index_cache_key(@parent_record, cache_context:), expires_in: 1.day do %>
-        <%= render(resource.resolve_component(Avo::Index::GridItemComponent).new(resource: resource, reflection: @reflection, parent_record: @parent_record, parent_resource: @parent_resource, actions: actions)) %>
+    <% if @resource.record_selector %>
+      <div class="flex min-h-7 flex-wrap items-center gap-x-3 gap-y-1 px-2 text-sm" data-component-name="avo/view_types/grid_select_all">
+        <%= content_tag :label, class: "flex items-center gap-2 cursor-pointer text-content-secondary" do %>
+          <%= tag :input,
+            type: "checkbox",
+            name: t("avo.select_all"),
+            autocomplete: :off,
+            data: {
+              action: "input->item-select-all#toggle",
+              item_select_all_target: "checkbox"
+            } %>
+          <%= t "avo.select_all" %>
+        <% end %>
+
+        <% if @pagy.pages > 1 %>
+          <div class="hidden border-s border-tertiary ps-3" data-item-select-all-target="selectAllOverlay">
+            <div data-item-select-all-target="unselectedMessage">
+              <%= selected_page_label %>
+
+              <%= a_link request.url,
+                size: :xs,
+                color: :primary,
+                class: "relative -top-[0.1rem] ms-2 cursor-pointer text-primary-500",
+                data: {action: "click->item-select-all#selectAll"} do %>
+                <%= t "avo.select_all_matching" %>
+              <% end %>
+            </div>
+
+            <div class="hidden" data-item-select-all-target="selectedMessage">
+              <%= selected_all_label %>
+
+              <%= a_link request.url,
+                size: :xs,
+                color: :primary,
+                class: "relative -top-[0.1rem] ms-2 cursor-pointer text-primary-500",
+                data: {action: "click->item-select-all#selectAll"} do %>
+                <%= t("avo.undo").humanize %>
+              <% end %>
+            </div>
+          </div>
+        <% end %>
+      </div>
+    <% end %>
+
+    <%# tabindex=-1 makes the wrapper a Shift+T focus anchor (top-level grids only, %>
+    <%# never a has-many grid on a show page); from here Tab steps through the cards. %>
+    <%= content_tag :div,
+      class: "grid-wrapper",
+      tabindex: (@reflection.present? ? nil : "-1"),
+      data: {
+        component_name: self.class.to_s.underscore,
+        **(@reflection.present? ? {} : {"content-focus": ""}),
+        **(try(:drag_reorder_data_attributes) || {})
+      } do %>
+      <% @resources.each_with_index do |resource, index| %>
+        <% cache_if Avo.configuration.cache_resources_on_index_view, resource.index_cache_key(@parent_record, cache_context:), expires_in: 1.day do %>
+          <%= render(resource.resolve_component(Avo::Index::GridItemComponent).new(resource: resource, reflection: @reflection, parent_record: @parent_record, parent_resource: @parent_resource, actions: actions)) %>
+        <% end %>
       <% end %>
     <% end %>
   <% end %>

data/app/components/avo/view_types/table_component.rb

@@ -24,36 +24,6 @@ class Avo::ViewTypes::TableComponent < Avo::ViewTypes::BaseViewTypeComponent
     }
   end
 
-  def encrypted_query
-    # A page cut by its source is all that is held, so there is nothing to select across pages
-    return :select_all_disabled if @query.is_a?(Avo::Resources::ArrayResource::Page)
-
-    # TODO: move this to the resource where we can apply the adapter pattern
-    if Module.const_defined?("Ransack::Search") && @query.instance_of?(Ransack::Search)
-      @query = @query.result
-    end
-
-    Avo::Services::EncryptionService.encrypt(message: @query, purpose: :select_all, serializer: Marshal)
-  rescue
-    disable_select_all
-  end
-
-  def selected_page_label
-    if @resource.pagination_type.countless?
-      t "avo.x_records_selected_from_page_html", selected: @pagy.in
-    else
-      t "avo.x_records_selected_from_a_total_of_x_html", selected: @pagy.in, count: @pagy.count
-    end
-  end
-
-  def selected_all_label
-    if @resource.pagination_type.countless?
-      t "avo.records_selected_from_all_pages_html"
-    else
-      t "avo.x_records_selected_from_all_pages_html", count: @pagy.count
-    end
-  end
-
   # Table rows are not fragment-cached. A `cache_if` wrapped this until it was
   # removed: a `return` inside its block unwound past Action View's
   # `write_fragment`, so nothing was ever written, and a hit would have handed
@@ -97,18 +67,4 @@ class Avo::ViewTypes::TableComponent < Avo::ViewTypes::BaseViewTypeComponent
 
     [header_fields, table_row_components]
   end
-
-  private
-
-  def disable_select_all
-    if Rails.env.development?
-      Avo.error_manager.add({
-        url: "https://docs.avohq.io/4.0/select-all.html#serialization-known-issues",
-        target: "_blank",
-        message: "An error occurred while serializing the query object. The Select All feature has been disabled because it depends on successful query serialization. For more details and troubleshooting steps, click here."
-      })
-    end
-
-    :select_all_disabled
-  end
 end

data/app/controllers/avo/actions_controller.rb

@@ -71,7 +71,7 @@ module Avo
     def set_query
       # If the user selected all records, use the decrypted index query
       # Otherwise, find the records from the resource ids
-      @query = if action_params[:fields]&.dig(:avo_selected_all) == "true"
+      @query = if selected_all?
         decrypted_index_query
       else
         find_records_from_resource_ids
@@ -252,8 +252,23 @@ module Avo
       end
     end
 
+    def selected_all?
+      action_params[:fields]&.dig(:avo_selected_all) == "true"
+    end
+
     def verify_authorization
-      raise Avo::NotAuthorizedError.new unless @action.authorized?
+      raise Avo::NotAuthorizedError.new unless @action.authorized? && act_on_authorized?
+    end
+
+    # The Actions button asks `act_on?`, so the run asks it too, of every record it names: the one in
+    # the URL and the selected ids. With none, the model class stands in, as on the index. A select-all
+    # run is the index query the button already allowed, and is not loaded here to ask it row by row.
+    def act_on_authorized?
+      records = [@record, *(@query unless selected_all?)].compact
+
+      (records.presence || [@resource.model_class]).all? do |record|
+        @resource.authorization.authorize_action(:act_on, record:, raise_exception: false)
+      end
     end
   end
 end

data/app/controllers/avo/base_application_controller.rb

@@ -245,16 +245,21 @@ module Avo
       Avo.configuration.locale = locale if locale
     end
 
+    # With nowhere to go back to, the refusal renders here: redirecting to the root loops when the
+    # home page is the one refused.
     def render_unauthorized(exception)
-      flash[:notice] = t "avo.not_authorized"
-
-      redirect_url = if request.referrer.blank? || (request.referrer == request.url)
-        root_url
-      else
-        request.referrer
+      if request.referrer.present? && request.referrer != request.url
+        flash[:notice] = t "avo.not_authorized"
+        return redirect_to(request.referrer)
       end
 
-      redirect_to(redirect_url)
+      respond_to do |format|
+        format.html do
+          Avo.error_manager.add t("avo.not_authorized")
+          render html: "", layout: "avo/application", status: :forbidden
+        end
+        format.any { head :forbidden }
+      end
     end
 
     def set_authorization

data/app/javascript/js/controllers/item_select_all_controller.js

@@ -1,6 +1,8 @@
 import { AttributeObserver, Controller } from '@hotwired/stimulus'
 import { setSelection, takeSelection } from '../index_state'
 
+const MAX_ACTION_URL_LENGTH = 6000
+
 export default class extends Controller {
   static targets = [
     'itemCheckbox',
@@ -24,6 +26,10 @@ export default class extends Controller {
     this.selectedResourcesObserver = new AttributeObserver(this.element, 'data-selected-resources', this)
     this.selectedResourcesObserver.start()
 
+    // The action links carry the index query from the start, so an action's fields and messages can read it
+    // even when nothing is selected.
+    this.updateLinks('resourceIds')
+
     // Wait for the rows' item-selector controllers to connect; they apply the selection.
     if (rememberedIds.length > 0) {
       Promise.resolve().then(() => this.restoreSelection(rememberedIds))
@@ -58,7 +64,8 @@ export default class extends Controller {
     if (!this.hasCheckboxTarget) return
 
     // If all are selected, mark the checkbox as checked.
-    const rowCount = this.element.querySelectorAll('tbody tr').length
+    // Table rows and grid cards both carry an item checkbox.
+    const rowCount = this.itemCheckboxTargets.length
     // Reset the checkbox
     this.checkboxTarget.indeterminate = false
     this.checkboxTarget.checked = false
@@ -151,11 +158,19 @@ export default class extends Controller {
           url.searchParams.set('fields[avo_resource_ids]', resourceIds)
           url.searchParams.set('fields[avo_selected_all]', 'false')
         } else if (param === 'selectedQuery') {
-          const selectedQuery = this.element.dataset.itemSelectAllSelectedAllQueryValue
-          url.searchParams.set('fields[avo_index_query]', selectedQuery)
           url.searchParams.set('fields[avo_selected_all]', 'true')
         }
 
+        if (this.indexQueryAvailable()) {
+          url.searchParams.set('fields[avo_index_query]', this.selectedAllQueryValue)
+
+          // Puma and nginx reject request lines around 8-10 KB. Only select all needs the query to open the
+          // modal; without it, the modal texts see no index_query and handle still gets it from the form.
+          if (param !== 'selectedQuery' && url.toString().length > MAX_ACTION_URL_LENGTH) {
+            url.searchParams.delete('fields[avo_index_query]')
+          }
+        }
+
         link.href = url.toString()
       } catch (error) {
         console.error('Error updating link:', link, error)
@@ -179,6 +194,11 @@ export default class extends Controller {
 
   // True if there are more pages available and if query encryption run successfully
   selectAllEnabled() {
-    return this.pageCountValue > 1 && this.selectedAllQueryValue !== 'select_all_disabled'
+    return this.pageCountValue > 1 && this.indexQueryAvailable()
+  }
+
+  // A view type renders 'select_all_disabled' when it can't encrypt the query, and a custom one may render none
+  indexQueryAvailable() {
+    return this.selectedAllQueryValue !== '' && this.selectedAllQueryValue !== 'select_all_disabled'
   }
 }

data/lib/avo/base_action.rb

@@ -41,6 +41,7 @@ module Avo
     attr_reader :appended_turbo_streams
     attr_reader :records_to_reload
     attr_reader :query
+    attr_reader :index_query
 
     # TODO: find a differnet way to delegate this to the uninitialized Current variable
     delegate :context, to: Avo::Current
@@ -130,7 +131,8 @@ module Avo
           record: @record,
           view: @view,
           arguments: @arguments,
-          query: @query
+          query: @query,
+          index_query: @index_query
         ).handle
       end
 
@@ -388,7 +390,8 @@ module Avo
         record: @record,
         view: @view,
         arguments:,
-        query: @query
+        query: @query,
+        index_query: @index_query
       ).handle
     end
 
@@ -406,7 +409,8 @@ module Avo
         record: @record,
         view: @view,
         arguments: @arguments,
-        query: @query
+        query: @query,
+        index_query: @index_query
       ).handle
     end
 

data/lib/avo/skills/avo-actions/SKILL.md

@@ -260,7 +260,7 @@ When an index spans multiple pages, checking "Select all" offers to select **eve
 
 - **`query` is always an array.** Even a single-record action gets `[record]`. Use `query.first` for the one-record case; don't call record methods on `query` directly. `records` is an alias.
 - **Records deleted after selection are omitted.** Another user may delete a checked record before the action request arrives. Avo drops that missing record and still passes every surviving selection to `handle`; action authors do not need to rescue `ActiveRecord::RecordNotFound` for this race. `query` can therefore come back **empty** when every selected record is gone — guard with `return error "No record selected" if query.blank?` if that matters.
-- **"My action doesn't show up" is usually the policy.** With Pundit, `act_on?` in the resource's policy gates action visibility (and `authorize` on the action gates it further). Check the policy first. See the **`avo-authorization`** skill.
+- **"My action doesn't show up", or is refused, is usually the policy.** With Pundit, `act_on?` in the resource's policy gates the Actions dropdown and every run: Avo asks it of the record in the URL and of each selected record (of the model class when there are none, and for a "Select all" run), and one refusal refuses the whole run. An action started from an association panel shows under the parent's `act_on_<assoc>?`, but still runs only on children whose own `act_on?` allows it. `authorize` on the action gates it further. Check the policy first. See the **`avo-authorization`** skill.
 - **`view` is the view the action was started from.** In `authorize`, `visible`, the modal text blocks, `fields`, and `handle`, `view` (and `resource.view`) is `index`, `show`, or `edit` — the page the user opened the action from — both while the modal renders and while the action runs. It is never `new`; the modal is not a view. It arrives with the request and is checked against the route (`show` and `edit` need a record in the URL), so use it to adapt behavior (`reload_records if view.index?`), never as the only gate on who may run the action: gate people on `current_user`, and single-versus-bulk on `query.size` or `record`.
 - **Every field in `fields` renders in the modal.** `hide_on`/`show_on` marks are for resource views and are ignored here. A field with a form component (text, select, hidden...) renders as an input; a display-only field (badge, key/value) renders read-only, as on Show. The one mark that counts: a badge declared with `show_on: :forms` renders as a select. The modal focuses its first input; a field with `autofocus: true` takes the focus instead (avo-fields lists the fields that support it). Use it to show context next to the inputs.
 - **The modal is a NEW request.** Params from the Index/Show page that opened it are **not** available in `fields`/`handle`. To prefill from the triggering page, parse `request.referer`:

data/lib/avo/skills/avo-setup/SKILL.md

@@ -221,7 +221,7 @@ A license authorizes **one app, one production URL** (`Rails.env.production?`).
 
 Verify at the **status page**: `https://yourapp.com/<mount-path>/avo_private/status` (e.g. `.../avo/avo_private/status` or `.../admin/avo_private/status`). It shows whether the license authenticated and what the checking server returned; the key is masked unless you set `config.exclude_from_status = []`. The viewing user must be an Avo admin. Deep failure diagnosis (unlicensed after deploy, timeouts, test-suite blocking the check host) is the **avo-troubleshoot** skill.
 
-**Trials are full licenses.** Every add-on a trial covers behaves exactly as it does on a paid license while the trial runs — nothing is gated or degraded. The **Avo Status** indicator in the sidebar footer is green when all is well, **amber** when a trial needs attention, and orange when the license is invalid. Amber is not a failure; it means either no payment method is on file (access stops on the trial's end date) or the subscription behind the trial was cancelled (access stops on the cancellation date, and adding a payment method won't change that — the subscription has to be resumed). Both are fixed on https://avohq.io/licenses, and the status page names which one applies. Avo caches the license response between checks, so press **Refresh license** on the status page afterwards or the app keeps showing the older billing state. Trial state needs `avo-licensing` **4.0.10+**; the amber indicator needs Avo **4.0.20+** (an older Avo renders an uncolored dot rather than breaking).
+**Trials are full licenses.** Every add-on a trial covers behaves exactly as it does on a paid license while the trial runs — nothing is gated or degraded. The **Avo Status** indicator in the sidebar footer is green when all is well, **amber** when a trial needs attention, and orange when the license is invalid. Amber is not a failure: the status page names why, and the fix is on https://avohq.io/licenses. The **avo-troubleshoot** skill lists each case and its fix. Avo caches the license response between checks, so press **Refresh license** on the status page afterwards or the app keeps showing the older billing state. Trial state needs `avo-licensing` **4.0.10+**; the amber indicator needs Avo **4.0.20+** (an older Avo renders an uncolored dot rather than breaking).
 
 ### 7. (Optional) Append your own routes inside the engine
 

data/lib/avo/skills/avo-troubleshoot/SKILL.md

@@ -210,7 +210,12 @@ self.search = {
 1. **Key not set on the server.** The most frequent cause. Confirm `config.license_key = ENV["AVO_LICENSE_KEY"]` and that the env var is actually present in **production** (not just locally).
 2. **Check the status page.** Every Avo app exposes `https://yourapp.com/<mount>/avo_private/status` — e.g. `/admin/avo_private/status` if you mounted Avo at `admin`. It shows whether the license authenticated and the raw response from the check server. The viewing user must be an Avo admin.
 3. **Key hidden on the status page.** The key is redacted by default; set `exclude_from_status = []` in the initializer if you need to see it while debugging.
-4. **The sidebar indicator is amber, not orange.** That is not a license failure — it is a running trial that needs attention: either no payment method is on file, or the subscription behind the trial was cancelled. Access continues until the date the status page reports. Both are fixed on https://avohq.io/licenses (a cancelled subscription must be resumed — adding a payment method won't help), then press **Refresh license** on the status page, since Avo caches the license response between checks.
+4. **The sidebar indicator is amber, not orange.** That is not a license failure — it is a running trial that needs attention, and the status page shows an **Action needed before <date>** tag below the license name, the date being when access stops. Access continues until the date the status page reports. Each case is fixed on https://avohq.io/licenses:
+   - No payment method is on file: add one.
+   - The subscription behind the trial was cancelled: resume it. A payment method won't help.
+   - An Avo 4 trial runs beside an Avo 3 subscription: press **Migrate to Avo 4** before the trial's end date, or Avo 4 stops working in the app when the trial ends (the Avo 3 license stays active, so the app can move back to Avo 3). A payment method won't help. An older `avo-licensing` shows add-a-payment-method steps for this case; migrating is still the fix.
+
+   Then press **Refresh license** on the status page, since Avo caches the license response between checks.
 
 → `license-troubleshooting.html`
 

data/lib/avo/version.rb

@@ -1,3 +1,3 @@
 module Avo
-  VERSION = "4.3.8" unless const_defined?(:VERSION)
+  VERSION = "4.3.10" unless const_defined?(:VERSION)
 end

data/lib/tasks/avo_tasks.rake

@@ -1,5 +1,19 @@
-desc "Runs the update command for all Avo gems."
+require "open3"
+
+desc "Updates all Avo gems; set AVO_UPDATE_PUSH=1 to commit Gemfile.lock and push."
 task "avo:update" => :environment do
+  push = ENV["AVO_UPDATE_PUSH"] == "1"
+  lockfile = Bundler.default_lockfile.to_s
+
+  if push
+    status, result = Open3.capture2("git", "status", "--porcelain", "--untracked-files=no")
+    abort "[Avo->] AVO_UPDATE_PUSH requires a Git repository." unless result.success?
+    abort "[Avo->] AVO_UPDATE_PUSH requires no changes to tracked files." unless status.empty?
+    unless system("git", "rev-parse", "--verify", "@{upstream}", out: File::NULL, err: File::NULL)
+      abort "[Avo->] AVO_UPDATE_PUSH requires a branch with an existing upstream."
+    end
+  end
+
   # Start with avo core (it doesn't register itself as a plugin), then resolve
   # every registered plugin to its real gem name. Plugins register under
   # nicknames (e.g. `avo-rhino_field` registers as `:rhino`), so we ask each
@@ -20,7 +34,21 @@ task "avo:update" => :environment do
   # `bundle exec` settings (BUNDLE_GEMFILE, BUNDLE_FROZEN/--deployment, RUBYOPT),
   # which can make the update silently refuse. Exported credentials survive
   # because they're part of the original env Bundler snapshotted at boot.
-  Bundler.with_original_env { system cmd }
+  abort "[Avo->] Gem update failed; nothing committed or pushed." unless Bundler.with_original_env { system cmd }
+
+  if push
+    abort "[Avo->] Could not stage #{lockfile}; nothing pushed." unless system("git", "add", "--", lockfile)
+    _, result = Open3.capture2("git", "diff", "--cached", "--quiet", "--", lockfile)
+    if result.success?
+      puts "[Avo->] Gemfile.lock is unchanged; nothing committed or pushed."
+      next
+    end
+    abort "[Avo->] Could not inspect Gemfile.lock; nothing pushed." unless result.exitstatus == 1
+    unless system("git", "commit", "--only", "-m", "Update Avo gems", "--", lockfile)
+      abort "[Avo->] Commit failed; nothing pushed."
+    end
+    abort "[Avo->] Push failed; the update commit is available locally." unless system("git", "push")
+  end
 end
 
 desc "Builds Avo (just assets for now)"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: avo
 version: !ruby/object:Gem::Version
-  version: 4.3.8
+  version: 4.3.10
 platform: ruby
 authors:
 - Adrian Marin