backstage 0.1.12 → 0.1.14

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e1dc01f215a31bcb5c84237cdfb95a7622ab7c8298e3b822eb476a9363e2f35c
-  data.tar.gz: 2a83eb127cfe5da24e409bf9f1ef69019a4d11be122402b5ca712f66ddfd1b3d
+  metadata.gz: af33e498a31b4178f2565526576a747f3b40f79fe869d0c9f02e7b9147f250ed
+  data.tar.gz: e4a561394fe10ec3ac30a8bcbc3492bd13285881c9e1e1cf2d16a2ef3302e259
 SHA512:
-  metadata.gz: 46f7f8d377fa8c1fa57f3113b224df3428cdc99d21282ea1812a3e4d6b5f617c1f051adcc303217df1da8f4c2edfa1c800fa32dc3ae91b4f77aca0f3deb90a82
-  data.tar.gz: 3600c7c9e27c410a887fa6e63458eee543eb2d23271ee24adb99d1a8785272c7e3625498a86ae6ee54f0d68da3b6a6ed826c858a764394dcaea0b30536195d81
+  metadata.gz: faf0d674103b06bffd2625b114aec195037f8ab3c08ff6a5c8786abb8b8fd5c53938c6f394a934e10820459089af5c0fcafda82d86ddae9c584081918287ceef
+  data.tar.gz: 1b2ee32beb0c16edfd8a7d2b08f86671ead990cc131272a60b9fd3a027fd8b9b1c5d37314ee7eccec221e6cd037fb9e6706d60dc8f97041dbfd1f11470e1a2ac

data/CHANGELOG.md

@@ -7,6 +7,33 @@ This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ## [Unreleased]
 
+## [0.1.14] — 2026-05-26
+
+### Fixed
+
+- `ActionsController` no longer falls back to `Backstage::ResourcesController` when no custom controller exists — raises `NotImplementedError` instead of silently dispatching inherited CRUD actions
+- Custom action dispatch now uses `method_defined?(name, false)` so only actions defined directly on the host subclass are callable; inherited methods (`index`, `create`, `update`, `destroy`, etc.) are blocked
+- Gemspec `homepage` corrected to point to the right repository
+
+## [0.1.13] — 2026-05-26
+
+### Added
+
+- `c.nested :assoc, fields: [...]` DSL for `accepts_nested_attributes_for` associations — renders existing nested records as editable rows
+
+### Fixed
+
+- SQL injection: sort column now uses Arel table quoting instead of raw string interpolation
+- XSS: `respond_with_success` now HTML-escapes the message argument before rendering
+- `new.html.erb` now respects container fields (row/section) — previously rendered a spurious wrapper `<div>` and label around each
+- `decimal` and `float` column types now map to `:decimal` instead of `:integer`; a new `_decimal` partial renders them with `step: "any"`
+- `section` block now uses `ensure` to reset `@current_target`, preventing a stale target if the block raises
+- `find_field` now searches inside container `sub_fields`, preventing duplicate fields when re-specifying a field already moved into a section
+- `DashboardConfig` now raises `ArgumentError` at initialisation if `name` or `model` is missing from the YAML hash
+- `params.permit!` in `index.html.erb` replaced with explicit param slice
+- Edit page no longer renders an empty `class=""` attribute when no sidebar is present
+- Removed unused `sidebar_links`, `custom_actions`, and `excluded_columns` attributes from `ResourceConfig`
+
 ## [0.1.12] — 2026-05-25
 
 ### Added

data/app/controllers/backstage/actions_controller.rb

@@ -8,14 +8,19 @@ module Backstage
       end
 
       resource_name = params[:resource].classify.pluralize
-      controller_class = "Backstage::#{resource_name}Controller".safe_constantize ||
-        Backstage::ResourcesController
+      controller_class = "Backstage::#{resource_name}Controller".safe_constantize
       action_name = params[:action_name]
 
-      unless controller_class.method_defined?(action_name)
+      if controller_class.nil? || controller_class == Backstage::ResourcesController
+        raise NotImplementedError,
+          "Backstage: no custom controller found for #{resource_name}. " \
+          "Define Backstage::#{resource_name}Controller."
+      end
+
+      unless controller_class.method_defined?(action_name.to_sym, false)
         raise NotImplementedError,
           "Backstage: no action '#{action_name}' on #{controller_class}. " \
-          "Define it in a Backstage::#{resource_name}Controller subclass."
+          "Define it in Backstage::#{resource_name}Controller."
       end
 
       status, headers, body = controller_class.action(action_name).call(request.env)

data/app/controllers/backstage/resources_controller.rb

@@ -22,7 +22,8 @@ module Backstage
       if params[:sort].present? && valid_columns.include?(params[:sort])
         @sort = params[:sort]
         @dir = (params[:dir] == "desc") ? "desc" : "asc"
-        scope = scope.order("#{@sort} #{@dir}")
+        arel_col = @resource_config.model_class.arel_table[@sort]
+        scope = scope.order((@dir == "desc") ? arel_col.desc : arel_col.asc)
       end
 
       @total_pages = [(scope.count.to_f / per_page).ceil, 1].max
@@ -78,8 +79,9 @@ module Backstage
     end
 
     def respond_with_success(message)
+      safe_message = ERB::Util.html_escape(message)
       render html: %(<turbo-stream action="prepend" target="flash">
-        <template><p class="notice">#{message}</p></template>
+        <template><p class="notice">#{safe_message}</p></template>
       </turbo-stream>).html_safe,
         content_type: "text/vnd.turbo-stream.html"
     end
@@ -96,6 +98,9 @@ module Backstage
           permitted_field_names(field.sub_fields)
         elsif field.has_many?
           [{field.name => []}]
+        elsif field.nested?
+          writable = field.nested_fields - field.nested_readonly_fields
+          [{"#{field.name}_attributes": [:id, *writable]}]
         else
           [field.name]
         end

data/app/views/backstage/fields/_decimal.html.erb

@@ -0,0 +1 @@
+<%= f.number_field field.name, step: "any", readonly: field.readonly? %>

data/app/views/backstage/fields/_nested.html.erb

@@ -0,0 +1,30 @@
+<% records = record.public_send(field.name) %>
+<% if records.any? %>
+  <table>
+    <thead>
+      <tr>
+        <% field.nested_fields.each do |col| %>
+          <th><%= col.to_s.humanize %></th>
+        <% end %>
+      </tr>
+    </thead>
+    <tbody>
+      <%= f.fields_for field.name do |nf| %>
+        <%= nf.hidden_field :id %>
+        <tr>
+          <% field.nested_fields.each do |col| %>
+            <td>
+              <% if field.nested_readonly_fields.include?(col) %>
+                <%= nf.object.public_send(col) %>
+              <% else %>
+                <%= nf.text_field col %>
+              <% end %>
+            </td>
+          <% end %>
+        </tr>
+      <% end %>
+    </tbody>
+  </table>
+<% else %>
+  <em>None</em>
+<% end %>

data/app/views/backstage/resources/edit.html.erb

@@ -1,7 +1,7 @@
 <h1>Edit <%= @resource_config.model_class.model_name.human %></h1>
 
 <% sidebar = @resource_config.sidebar_config %>
-<div class="<%= sidebar&.links&.any? ? "edit-layout" : "" %>">
+<div<% if sidebar&.links&.any? %> class="edit-layout"<% end %>>
   <div>
     <%= form_with model: @record, url: resource_path(resource: params[:resource], id: @record.id), method: :patch do |f| %>
       <% @resource_config.edit_fields.each do |field| %>

data/app/views/backstage/resources/index.html.erb

@@ -6,10 +6,11 @@
 </form>
 
 <% @resource_config.index_fields.select(&:enum?).each do |field| %>
+  <% safe_params = params.permit(:q, :sort, :dir, :page, field.name) %>
   <nav class="enum-filters">
-    <%= link_to "All", url_for(params.permit!.except(:status, :page)) %>
+    <%= link_to "All", url_for(safe_params.except(field.name.to_s, "page")) %>
     <% field.enum_values.each do |label, value| %>
-      <%= link_to label, url_for(params.permit!.merge(field.name => value, page: nil)) %>
+      <%= link_to label, url_for(safe_params.merge(field.name => value, page: nil)) %>
     <% end %>
   </nav>
 <% end %>

data/app/views/backstage/resources/new.html.erb

@@ -2,10 +2,14 @@
 
 <%= form_with model: @record, url: resources_path(resource: params[:resource]), method: :post do |f| %>
   <% @resource_config.edit_fields.each do |field| %>
-    <div>
-      <%= f.label field.name %>
+    <% if field.container? %>
       <%= render partial: field.partial_path, locals: { f: f, field: field, record: @record } %>
-    </div>
+    <% else %>
+      <div>
+        <%= f.label field.name %>
+        <%= render partial: field.partial_path, locals: { f: f, field: field, record: @record } %>
+      </div>
+    <% end %>
   <% end %>
   <%= f.submit "Create" %>
 <% end %>

data/lib/backstage/auto_discovery.rb

@@ -6,8 +6,8 @@ module Backstage
       string: :string,
       text: :text,
       integer: :integer,
-      decimal: :integer,
-      float: :integer,
+      decimal: :decimal,
+      float: :decimal,
       boolean: :boolean,
       date: :date,
       datetime: :datetime

data/lib/backstage/dashboard_config.rb

@@ -3,8 +3,8 @@ module Backstage
     attr_reader :name, :model_name, :scope
 
     def initialize(hash)
-      @name = hash["name"]
-      @model_name = hash["model"]
+      @name = hash["name"] or raise ArgumentError, "Dashboard config missing 'name'"
+      @model_name = hash["model"] or raise ArgumentError, "Dashboard config missing 'model'"
       @scope = hash["scope"] || {}
     end
 

data/lib/backstage/field.rb

@@ -32,6 +32,18 @@ module Backstage
       type == :has_many
     end
 
+    def nested?
+      type == :nested
+    end
+
+    def nested_fields
+      options[:nested_fields] || []
+    end
+
+    def nested_readonly_fields
+      options[:nested_readonly_fields] || []
+    end
+
     def row?
       type == :row
     end

data/lib/backstage/resource_config.rb

@@ -1,7 +1,6 @@
 module Backstage
   class ResourceConfig
-    attr_accessor :model_class, :index_fields, :edit_fields,
-      :associations, :sidebar_links, :custom_actions, :excluded_columns
+    attr_accessor :model_class, :index_fields, :edit_fields, :associations
     attr_writer :display_column
 
     def initialize(model_class)
@@ -9,9 +8,6 @@ module Backstage
       @index_fields = []
       @edit_fields = []
       @associations = []
-      @sidebar_links = []
-      @custom_actions = []
-      @excluded_columns = []
     end
 
     def display_column(value = nil)
@@ -56,6 +52,14 @@ module Backstage
       end
     end
 
+    def nested(name, fields:, readonly_fields: [])
+      field_obj = Field.new(name.to_sym, :nested,
+        nested_fields: Array(fields).map(&:to_sym),
+        nested_readonly_fields: Array(readonly_fields).map(&:to_sym))
+      @edit_fields.reject! { |f| f.name == field_obj.name }
+      (@current_target || @edit_fields) << field_obj
+    end
+
     def belongs_to(name, **opts)
       assoc = AssociationConfig.new(name, :belongs_to, opts)
       @associations << assoc
@@ -98,14 +102,23 @@ module Backstage
         heading: heading, sub_fields: [], **opts)
       @current_target = section_field.sub_fields
       yield if block_given?
-      @current_target = nil
       @edit_fields << section_field
+    ensure
+      @current_target = nil
     end
 
     private
 
     def find_field(name)
-      (@index_fields + @edit_fields).uniq.find { |f| f.name == name }
+      all_fields = @index_fields + @edit_fields
+      all_fields.uniq.each do |f|
+        return f if f.name == name
+        if f.container?
+          found = f.sub_fields.find { |sf| sf.name == name }
+          return found if found
+        end
+      end
+      nil
     end
 
     def find_or_build_field(name)

data/lib/backstage/version.rb

@@ -1,3 +1,3 @@
 module Backstage
-  VERSION = "0.1.12"
+  VERSION = "0.1.14"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: backstage
 version: !ruby/object:Gem::Version
-  version: 0.1.12
+  version: 0.1.14
 platform: ruby
 authors:
 - Gareth James
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-05-25 00:00:00.000000000 Z
+date: 2026-05-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties
@@ -26,7 +26,6 @@ dependencies:
         version: '8.0'
 description:
 email:
-- g.claude@bemused.org
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -47,10 +46,12 @@ files:
 - app/views/backstage/fields/_boolean.html.erb
 - app/views/backstage/fields/_date.html.erb
 - app/views/backstage/fields/_datetime.html.erb
+- app/views/backstage/fields/_decimal.html.erb
 - app/views/backstage/fields/_enum.html.erb
 - app/views/backstage/fields/_has_many.html.erb
 - app/views/backstage/fields/_image_url.html.erb
 - app/views/backstage/fields/_integer.html.erb
+- app/views/backstage/fields/_nested.html.erb
 - app/views/backstage/fields/_row.html.erb
 - app/views/backstage/fields/_section.html.erb
 - app/views/backstage/fields/_string.html.erb
@@ -78,7 +79,7 @@ files:
 - lib/generators/backstage/install/templates/SKILL.md
 - lib/generators/backstage/install/templates/backstage.rb
 - lib/generators/backstage/install/templates/backstage.yml
-homepage: https://github.com/gjtorikian/backstage
+homepage: https://github.com/garethfr/backstage
 licenses:
 - MIT
 metadata: {}