backstage 0.1.11 → 0.1.13

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: da942f19c113814d2f7a5e738b3b7f7ce1cc1e8b23beeaabe8e9ef7e1f0d1b50
-  data.tar.gz: 805dedf4003e77e48d6e9bf5eb426d3f24e91fe61297a97eebd3c1f8a858e8f1
+  metadata.gz: 9de1bd6823d300ceef1f45b44ff97b635b6497ed1e58df6d814ec5ce45efc56e
+  data.tar.gz: d2863d1096ece91857ab403a4fa874f015f4065b5d9922553eaccc09d2245061
 SHA512:
-  metadata.gz: 76d4dd10a000b8aeb880f7df124140c351553e44fd98ee3ab42b980cb7abb315297fc959c50a2f3770c48d289db77b28326d4073677046c43dc83cb12022d29d
-  data.tar.gz: 800c78a96cc7e9289edff896f5264d0aa73399c4ae30f1ad6557e100213a1c4975f6da1c823fc0f4842744952320f9fe18f3f6a5f1ebe7a3de9b964742c1999a
+  metadata.gz: f2799b494c57a749cc0c29595121fda2a90bf5c99704138bf70597fe14b1480c96c49984528b29f95fee0b1714ce0376e351be31057ea67b0fd6fb261675cb5d
+  data.tar.gz: d95bbf7d40f238529b320ed0194f8c4fd6ecfc7799630e1274145423d869f1e36aeeb581a9abeb8a17761bc85464ca4618f705ad1e776ddf91f3cdb9bb1dcbef

data/CHANGELOG.md

@@ -7,6 +7,33 @@ This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ## [Unreleased]
 
+## [0.1.13] — 2026-05-26
+
+### Added
+
+- `c.nested :assoc, fields: [...]` DSL for `accepts_nested_attributes_for` associations — renders existing nested records as editable rows
+
+### Fixed
+
+- SQL injection: sort column now uses Arel table quoting instead of raw string interpolation
+- XSS: `respond_with_success` now HTML-escapes the message argument before rendering
+- `new.html.erb` now respects container fields (row/section) — previously rendered a spurious wrapper `<div>` and label around each
+- `decimal` and `float` column types now map to `:decimal` instead of `:integer`; a new `_decimal` partial renders them with `step: "any"`
+- `section` block now uses `ensure` to reset `@current_target`, preventing a stale target if the block raises
+- `find_field` now searches inside container `sub_fields`, preventing duplicate fields when re-specifying a field already moved into a section
+- `DashboardConfig` now raises `ArgumentError` at initialisation if `name` or `model` is missing from the YAML hash
+- `params.permit!` in `index.html.erb` replaced with explicit param slice
+- Edit page no longer renders an empty `class=""` attribute when no sidebar is present
+- Removed unused `sidebar_links`, `custom_actions`, and `excluded_columns` attributes from `ResourceConfig`
+
+## [0.1.12] — 2026-05-25
+
+### Added
+
+- `c.row :field1, :field2` groups fields horizontally in a Pico CSS grid on the edit page
+- `c.section "Label" [, collapsed: true]` wraps fields in a native `<details>`/`<summary>` collapsible block (no JavaScript required); rows and individual fields can be nested inside sections
+- `c.field` called inside a `section` block moves an existing auto-discovered field into the section rather than leaving it at the top level
+
 ## [0.1.11] — 2026-05-25
 
 ### Fixed

data/app/controllers/backstage/resources_controller.rb

@@ -22,7 +22,8 @@ module Backstage
       if params[:sort].present? && valid_columns.include?(params[:sort])
         @sort = params[:sort]
         @dir = (params[:dir] == "desc") ? "desc" : "asc"
-        scope = scope.order("#{@sort} #{@dir}")
+        arel_col = @resource_config.model_class.arel_table[@sort]
+        scope = scope.order((@dir == "desc") ? arel_col.desc : arel_col.asc)
       end
 
       @total_pages = [(scope.count.to_f / per_page).ceil, 1].max
@@ -78,17 +79,32 @@ module Backstage
     end
 
     def respond_with_success(message)
+      safe_message = ERB::Util.html_escape(message)
       render html: %(<turbo-stream action="prepend" target="flash">
-        <template><p class="notice">#{message}</p></template>
+        <template><p class="notice">#{safe_message}</p></template>
       </turbo-stream>).html_safe,
         content_type: "text/vnd.turbo-stream.html"
     end
 
     def record_params
-      permitted = @resource_config.edit_fields.reject(&:readonly?).map do |field|
-        field.has_many? ? {field.name => []} : field.name
+      params
+        .require(@resource_config.model_class.model_name.param_key)
+        .permit(permitted_field_names(@resource_config.edit_fields))
+    end
+
+    def permitted_field_names(fields)
+      fields.reject(&:readonly?).flat_map do |field|
+        if field.container?
+          permitted_field_names(field.sub_fields)
+        elsif field.has_many?
+          [{field.name => []}]
+        elsif field.nested?
+          writable = field.nested_fields - field.nested_readonly_fields
+          [{"#{field.name}_attributes": [:id, *writable]}]
+        else
+          [field.name]
+        end
       end
-      params.require(@resource_config.model_class.model_name.param_key).permit(permitted)
     end
   end
 end

data/app/views/backstage/fields/_decimal.html.erb

@@ -0,0 +1 @@
+<%= f.number_field field.name, step: "any", readonly: field.readonly? %>

data/app/views/backstage/fields/_nested.html.erb

@@ -0,0 +1,30 @@
+<% records = record.public_send(field.name) %>
+<% if records.any? %>
+  <table>
+    <thead>
+      <tr>
+        <% field.nested_fields.each do |col| %>
+          <th><%= col.to_s.humanize %></th>
+        <% end %>
+      </tr>
+    </thead>
+    <tbody>
+      <%= f.fields_for field.name do |nf| %>
+        <%= nf.hidden_field :id %>
+        <tr>
+          <% field.nested_fields.each do |col| %>
+            <td>
+              <% if field.nested_readonly_fields.include?(col) %>
+                <%= nf.object.public_send(col) %>
+              <% else %>
+                <%= nf.text_field col %>
+              <% end %>
+            </td>
+          <% end %>
+        </tr>
+      <% end %>
+    </tbody>
+  </table>
+<% else %>
+  <em>None</em>
+<% end %>

data/app/views/backstage/fields/_row.html.erb

@@ -0,0 +1,8 @@
+<div class="grid">
+  <% field.sub_fields.each do |sub| %>
+    <div>
+      <%= f.label sub.name %>
+      <%= render partial: sub.partial_path, locals: { f: f, field: sub, record: @record } %>
+    </div>
+  <% end %>
+</div>

data/app/views/backstage/fields/_section.html.erb

@@ -0,0 +1,13 @@
+<details <%= "open" unless field.collapsed? %>>
+  <summary><strong><%= field.heading %></strong></summary>
+  <% field.sub_fields.each do |sub| %>
+    <% if sub.container? %>
+      <%= render partial: sub.partial_path, locals: { f: f, field: sub, record: @record } %>
+    <% else %>
+      <div>
+        <%= f.label sub.name %>
+        <%= render partial: sub.partial_path, locals: { f: f, field: sub, record: @record } %>
+      </div>
+    <% end %>
+  <% end %>
+</details>

data/app/views/backstage/resources/edit.html.erb

@@ -1,14 +1,18 @@
 <h1>Edit <%= @resource_config.model_class.model_name.human %></h1>
 
 <% sidebar = @resource_config.sidebar_config %>
-<div class="<%= sidebar&.links&.any? ? "edit-layout" : "" %>">
+<div<% if sidebar&.links&.any? %> class="edit-layout"<% end %>>
   <div>
     <%= form_with model: @record, url: resource_path(resource: params[:resource], id: @record.id), method: :patch do |f| %>
       <% @resource_config.edit_fields.each do |field| %>
-        <div>
-          <%= f.label field.name %>
+        <% if field.container? %>
           <%= render partial: field.partial_path, locals: { f: f, field: field, record: @record } %>
-        </div>
+        <% else %>
+          <div>
+            <%= f.label field.name %>
+            <%= render partial: field.partial_path, locals: { f: f, field: field, record: @record } %>
+          </div>
+        <% end %>
       <% end %>
       <%= f.submit "Save" %>
     <% end %>

data/app/views/backstage/resources/index.html.erb

@@ -6,10 +6,11 @@
 </form>
 
 <% @resource_config.index_fields.select(&:enum?).each do |field| %>
+  <% safe_params = params.permit(:q, :sort, :dir, :page, field.name) %>
   <nav class="enum-filters">
-    <%= link_to "All", url_for(params.permit!.except(:status, :page)) %>
+    <%= link_to "All", url_for(safe_params.except(field.name.to_s, "page")) %>
     <% field.enum_values.each do |label, value| %>
-      <%= link_to label, url_for(params.permit!.merge(field.name => value, page: nil)) %>
+      <%= link_to label, url_for(safe_params.merge(field.name => value, page: nil)) %>
     <% end %>
   </nav>
 <% end %>

data/app/views/backstage/resources/new.html.erb

@@ -2,10 +2,14 @@
 
 <%= form_with model: @record, url: resources_path(resource: params[:resource]), method: :post do |f| %>
   <% @resource_config.edit_fields.each do |field| %>
-    <div>
-      <%= f.label field.name %>
+    <% if field.container? %>
       <%= render partial: field.partial_path, locals: { f: f, field: field, record: @record } %>
-    </div>
+    <% else %>
+      <div>
+        <%= f.label field.name %>
+        <%= render partial: field.partial_path, locals: { f: f, field: field, record: @record } %>
+      </div>
+    <% end %>
   <% end %>
   <%= f.submit "Create" %>
 <% end %>

data/lib/backstage/auto_discovery.rb

@@ -6,8 +6,8 @@ module Backstage
       string: :string,
       text: :text,
       integer: :integer,
-      decimal: :integer,
-      float: :integer,
+      decimal: :decimal,
+      float: :decimal,
       boolean: :boolean,
       date: :date,
       datetime: :datetime

data/lib/backstage/dashboard_config.rb

@@ -3,8 +3,8 @@ module Backstage
     attr_reader :name, :model_name, :scope
 
     def initialize(hash)
-      @name = hash["name"]
-      @model_name = hash["model"]
+      @name = hash["name"] or raise ArgumentError, "Dashboard config missing 'name'"
+      @model_name = hash["model"] or raise ArgumentError, "Dashboard config missing 'model'"
       @scope = hash["scope"] || {}
     end
 

data/lib/backstage/field.rb

@@ -32,6 +32,42 @@ module Backstage
       type == :has_many
     end
 
+    def nested?
+      type == :nested
+    end
+
+    def nested_fields
+      options[:nested_fields] || []
+    end
+
+    def nested_readonly_fields
+      options[:nested_readonly_fields] || []
+    end
+
+    def row?
+      type == :row
+    end
+
+    def section?
+      type == :section
+    end
+
+    def container?
+      row? || section?
+    end
+
+    def sub_fields
+      options[:sub_fields] || []
+    end
+
+    def heading
+      options[:heading]
+    end
+
+    def collapsed?
+      options.fetch(:collapsed, false)
+    end
+
     def association
       options[:association]
     end

data/lib/backstage/resource_config.rb

@@ -1,7 +1,6 @@
 module Backstage
   class ResourceConfig
-    attr_accessor :model_class, :index_fields, :edit_fields,
-      :associations, :sidebar_links, :custom_actions, :excluded_columns
+    attr_accessor :model_class, :index_fields, :edit_fields, :associations
     attr_writer :display_column
 
     def initialize(model_class)
@@ -9,9 +8,6 @@ module Backstage
       @index_fields = []
       @edit_fields = []
       @associations = []
-      @sidebar_links = []
-      @custom_actions = []
-      @excluded_columns = []
     end
 
     def display_column(value = nil)
@@ -56,6 +52,14 @@ module Backstage
       end
     end
 
+    def nested(name, fields:, readonly_fields: [])
+      field_obj = Field.new(name.to_sym, :nested,
+        nested_fields: Array(fields).map(&:to_sym),
+        nested_readonly_fields: Array(readonly_fields).map(&:to_sym))
+      @edit_fields.reject! { |f| f.name == field_obj.name }
+      (@current_target || @edit_fields) << field_obj
+    end
+
     def belongs_to(name, **opts)
       assoc = AssociationConfig.new(name, :belongs_to, opts)
       @associations << assoc
@@ -74,17 +78,47 @@ module Backstage
       if existing
         existing.options.merge!(opts)
         existing.instance_variable_set(:@type, type.to_sym) if type
+        if @current_target
+          @edit_fields.reject! { |f| f.name == sym }
+          @current_target << existing
+        end
       else
         new_field = Field.new(sym, type || :string, opts)
-        @edit_fields << new_field
-        @index_fields << new_field unless @index_fields_explicit
+        (@current_target || @edit_fields) << new_field
+        @index_fields << new_field unless @index_fields_explicit || @current_target
       end
     end
 
+    def row(*names)
+      syms = names.map(&:to_sym)
+      sub = syms.map { |n| find_field(n) || Field.new(n, :string) }
+      @edit_fields.reject! { |f| syms.include?(f.name) }
+      row_field = Field.new(:"row_#{names.first}", :row, sub_fields: sub)
+      (@current_target || @edit_fields) << row_field
+    end
+
+    def section(heading, **opts)
+      section_field = Field.new(:"section_#{heading.parameterize}", :section,
+        heading: heading, sub_fields: [], **opts)
+      @current_target = section_field.sub_fields
+      yield if block_given?
+      @edit_fields << section_field
+    ensure
+      @current_target = nil
+    end
+
     private
 
     def find_field(name)
-      (@index_fields + @edit_fields).uniq.find { |f| f.name == name }
+      all_fields = @index_fields + @edit_fields
+      all_fields.uniq.each do |f|
+        return f if f.name == name
+        if f.container?
+          found = f.sub_fields.find { |sf| sf.name == name }
+          return found if found
+        end
+      end
+      nil
     end
 
     def find_or_build_field(name)

data/lib/backstage/version.rb

@@ -1,3 +1,3 @@
 module Backstage
-  VERSION = "0.1.11"
+  VERSION = "0.1.13"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: backstage
 version: !ruby/object:Gem::Version
-  version: 0.1.11
+  version: 0.1.13
 platform: ruby
 authors:
 - Gareth James
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-05-25 00:00:00.000000000 Z
+date: 2026-05-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties
@@ -47,10 +47,14 @@ files:
 - app/views/backstage/fields/_boolean.html.erb
 - app/views/backstage/fields/_date.html.erb
 - app/views/backstage/fields/_datetime.html.erb
+- app/views/backstage/fields/_decimal.html.erb
 - app/views/backstage/fields/_enum.html.erb
 - app/views/backstage/fields/_has_many.html.erb
 - app/views/backstage/fields/_image_url.html.erb
 - app/views/backstage/fields/_integer.html.erb
+- app/views/backstage/fields/_nested.html.erb
+- app/views/backstage/fields/_row.html.erb
+- app/views/backstage/fields/_section.html.erb
 - app/views/backstage/fields/_string.html.erb
 - app/views/backstage/fields/_text.html.erb
 - app/views/backstage/fields/_thumbnails.html.erb