brick 1.0.244 → 1.0.246

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4de3ef8371e163df0913a1fe70d55666010abefcdcc77d26813a27ea3b72967f
-  data.tar.gz: 73dffd4bb0f5c5e9f57d1e19550cc212a67b4cc9636dd6eed53bee458cd155ee
+  metadata.gz: 3410ae5fca9b12aa31007df9d3fac95a39f09eee58f4ffc2089bada97bde7793
+  data.tar.gz: 0da56c9311d8dd0ce2fd3a05039a6f85ca9910c64b303c25fc26f8d65fab512b
 SHA512:
-  metadata.gz: 948aaae186933b70b69b8df65ac2081168edd4d3badc9cf7bcdfb2d2a49243be376bb70c3c15aef7e00fdbf42f5be5c51185a91e01e4728332e0e0a476382403
-  data.tar.gz: 500f395af03a898ed11ee8e3caad5fa0571568b19f1183a4f7b90793a8324e5d87870220b8a60b7e91d61e73ad7855d450a46711e8404c519bded7599b761866
+  metadata.gz: 7a2e821dfee25a5df265caf5700e25003cbc7cab88e439102fc949f5dfbba2f9f7b73803c98068d373ffbf12cab27dac3859c76a7772ea19bbaf4ffdbfbddbe6
+  data.tar.gz: 701d6d9e7d374cbe850806ce732f5b765c1ea3d051c111f316bcd29fdf45622d8999c04fa89ca058f13052670f56c77350fde24e00139ef40dc892b0c97ca896

data/lib/brick/extensions.rb

@@ -162,7 +162,7 @@ module ActiveRecord
       def _brick_deserialized_id(obj, id_col)
         id = []
         self._pk_as_array.each_with_index do |pk_part, idx|
-          id << if obj.respond_to?(id_sym = id_col[idx].to_sym)
+          id << if (id_sym = id_col[idx]&.to_sym) && obj.respond_to?(id_sym)
                     self._brick_deserialized_value(obj, [[pk_part, id_col[idx]]])&.first
                   else
                     id_col[idx]
@@ -926,11 +926,13 @@ module ActiveRecord
                            poly_ft = [hm.source_reflection.inverse_of.foreign_type, hmt_assoc.source_reflection.class_name]
                          end
                          # link_back << hm.source_reflection.inverse_of.name
-                         while hmt_assoc.options[:through] && (hmt_assoc = klass.reflect_on_association(hmt_assoc.options[:through]))
+                         while hmt_assoc.options[:through] && (hmt_assoc = klass.reflect_on_association(xy = hmt_assoc.options[:through]))
+                           if hmt_assoc.macro == :has_and_belongs_to_many
+                             through_sources.unshift(hmt_assoc)
+                             link_back << hmt_assoc.source_reflection.klass.reflect_on_all_associations.find { |a| a.macro == :has_and_belongs_to_many && a.join_table == hmt_assoc.join_table }.name
+                           end
                            through_sources.unshift(hmt_assoc)
                          end
-                         # Turn the last member of link_back into a foreign key
-                         link_back << hmt_assoc.source_reflection.foreign_key
                          # If it's a HMT based on a HM -> HM, must JOIN the last table into the mix at the end
                          this_hm = hm
                          while !(src_ref = this_hm.source_reflection).belongs_to? && (thr = src_ref.options[:through])
@@ -940,39 +942,48 @@ module ActiveRecord
                          from_clause = +"#{_br_quoted_name(through_sources.first.table_name)} br_t0"
                          # ActiveStorage will not get the correct count unless we do some extra filtering later
                          tbl_nm = 'br_t0' if Object.const_defined?('ActiveStorage') && through_sources.first.klass <= ::ActiveStorage::Attachment
-                         fk_col = through_sources.shift.foreign_key
-
+                         # Turn the last member of link_back into a foreign key
+                         link_back << ((tsf = through_sources.shift).macro == :has_and_belongs_to_many ?
+                           tsf.klass.primary_key : hmt_assoc.source_reflection.foreign_key)
+                         fk_col = tsf.macro == :has_and_belongs_to_many ?
+                           tsf.klass.primary_key : tsf.foreign_key
                          idx = 0
                          bail_out = nil
                          the_chain = through_sources.map do |a|
-                           from_clause << "\n LEFT OUTER JOIN #{a.table_name} br_t#{idx += 1} "
-                           from_clause << if (src_ref = a.source_reflection).macro == :belongs_to
-                                            link_back << (nm = hmt_assoc.source_reflection.inverse_of&.name)
-                                            # puts "BT #{a.table_name}"
-                                            "ON br_t#{idx}.#{a.active_record.primary_key} = br_t#{idx - 1}.#{a.foreign_key}"
-                                          elsif src_ref.options[:as]
-                                            "ON br_t#{idx}.#{src_ref.type} = '#{src_ref.active_record.name}'" + # "polymorphable_type"
-                                            " AND br_t#{idx}.#{src_ref.foreign_key} = br_t#{idx - 1}.id"
-                                          elsif src_ref.options[:source_type]
-                                            if a == hm.source_reflection
-                                              print "Skipping #{hm.name} --HMT-> #{hm.source_reflection.name} as it uses source_type in a way which is not yet supported"
-                                              nix << k
-                                              bail_out = true
-                                              break
-                                              # "ON br_t#{idx}.#{a.foreign_type} = '#{src_ref.options[:source_type]}' AND " \
-                                              #   "br_t#{idx}.#{a.foreign_key} = br_t#{idx - 1}.#{a.active_record.primary_key}"
-                                            else # Works for HMT through a polymorphic HO
-                                              link_back << hmt_assoc.source_reflection.inverse_of&.name # Some polymorphic "_able" thing
-                                              "ON br_t#{idx - 1}.#{a.foreign_type} = '#{src_ref.options[:source_type]}' AND " \
-                                                "br_t#{idx - 1}.#{a.foreign_key} = br_t#{idx}.#{a.active_record.primary_key}"
+                           puts "#{a.name} - #{a.macro}"
+                           if a.macro == :has_and_belongs_to_many
+                             from_clause << "\n LEFT OUTER JOIN #{a.join_table} br_t#{idx += 1} ON br_t#{idx}.#{a.association_foreign_key} = br_t#{idx - 1}.#{a.active_record.primary_key}"
+                             from_clause << "\n LEFT OUTER JOIN #{a.active_record.table_name} br_t#{idx += 1} ON br_t#{idx}.#{a.active_record.primary_key} = br_t#{idx - 1}.#{a.foreign_key}"
+                           else
+                            from_clause << "\n LEFT OUTER JOIN #{a.table_name} br_t#{idx += 1} "
+                            from_clause << if (src_ref = a.source_reflection).macro == :belongs_to
+                                              link_back << (nm = hmt_assoc.source_reflection.inverse_of&.name)
+                                              # puts "BT #{a.table_name}"
+                                              "ON br_t#{idx}.#{a.active_record.primary_key} = br_t#{idx - 1}.#{a.foreign_key}"
+                                            elsif src_ref.options[:as]
+                                              "ON br_t#{idx}.#{src_ref.type} = '#{src_ref.active_record.name}'" + # "polymorphable_type"
+                                              " AND br_t#{idx}.#{src_ref.foreign_key} = br_t#{idx - 1}.id"
+                                            elsif src_ref.options[:source_type]
+                                              if a == hm.source_reflection
+                                                print "Skipping #{hm.name} --HMT-> #{hm.source_reflection.name} as it uses source_type in a way which is not yet supported"
+                                                nix << k
+                                                bail_out = true
+                                                break
+                                                # "ON br_t#{idx}.#{a.foreign_type} = '#{src_ref.options[:source_type]}' AND " \
+                                                #   "br_t#{idx}.#{a.foreign_key} = br_t#{idx - 1}.#{a.active_record.primary_key}"
+                                              else # Works for HMT through a polymorphic HO
+                                                link_back << hmt_assoc.source_reflection.inverse_of&.name # Some polymorphic "_able" thing
+                                                "ON br_t#{idx - 1}.#{a.foreign_type} = '#{src_ref.options[:source_type]}' AND " \
+                                                  "br_t#{idx - 1}.#{a.foreign_key} = br_t#{idx}.#{a.active_record.primary_key}"
+                                              end
+                                            else # Standard has_many or has_one
+                                              # puts "HM #{a.table_name}"
+                                              nm = hmt_assoc.source_reflection.inverse_of&.name
+                                              # binding.pry unless nm
+                                              link_back << nm # if nm
+                                              "ON br_t#{idx}.#{a.foreign_key} = br_t#{idx - 1}.#{a.active_record.primary_key}"
                                             end
-                                          else # Standard has_many or has_one
-                                            # puts "HM #{a.table_name}"
-                                            nm = hmt_assoc.source_reflection.inverse_of&.name
-                                            # binding.pry unless nm
-                                            link_back << nm # if nm
-                                            "ON br_t#{idx}.#{a.foreign_key} = br_t#{idx - 1}.#{a.active_record.primary_key}"
-                                          end
+                           end
                            link_back.unshift(a.source_reflection.name)
                            [a.table_name, a.foreign_key, a.source_reflection.macro]
                          end
@@ -980,7 +991,9 @@ module ActiveRecord
 
                          # puts "LINK BACK! #{k} : #{hm.table_name} #{link_back.map(&:to_s).join('.')}"
                          # count_column is determined from the originating HMT member
-                         if (src_ref = hm.source_reflection).nil?
+                         if hmt_assoc.macro == :has_and_belongs_to_many
+                           "br_t#{idx}.#{src_ref.active_record.primary_key}"
+                         elsif (src_ref = hm.source_reflection).nil?
                            puts "*** Warning:  Could not determine destination model for this HMT association in model #{klass.name}:\n  has_many :#{hm.name}, through: :#{hm.options[:through]}"
                            puts
                            nix << k
@@ -2162,7 +2175,9 @@ class Object
         # (More information on https://docs.avohq.io/3.0/controllers.html)
         controller_base = Avo::ResourcesController
       end
-      if !model&.table_exists? && (tn = model&.table_name)
+      if model && !(model < ActiveRecord::Base)
+        raise "Your project defines class \"#{model.name}\" which is not an ActiveRecord model.  If some other model class for this resource exists that can be used instead, you can configure a Brick table_name_prefix in order to have a specific table name refer to that class."
+      elsif !model&.table_exists? && (tn = model&.table_name)
         msg = +"Can't find table \"#{tn}\" for model #{model.name}."
         puts
         # Potential bad inflection?
@@ -2706,7 +2721,6 @@ class Object
             #   ActiveRecord::Base.execute_sql("SET SEARCH_PATH = ?;", schema)
             # end
 
-            is_need_params = true
             code << "  def edit\n"
             code << "    #{find_by_name}\n"
             code << "  end\n"
@@ -2799,7 +2813,7 @@ class Object
             end
           end
 
-          code << "private\n" if pk.present? || is_need_params
+          code << "private\n"
 
           if pk.present?
             code << "  def #{find_obj}
@@ -2829,29 +2843,23 @@ class Object
             private find_obj
           end
 
-          if is_need_params
-            code << "  def #{params_name}\n"
-            require_txt = model.base_class.name.underscore.tr('/', '_')
-            is_for_expects = ::ActiveSupport.version >= ::Gem::Version.new('8.0a')
-            permits_txt = model._brick_find_permits(model, permits = model._brick_all_fields(true), is_for_expects)
-            if is_for_expects
-              code << "    params.expect(#{require_txt
-                              }: #{permits_txt})\n"
-              code << "  end\n"
-              self.define_method(params_name) do
-                params.expect({ model.base_class.name.underscore.tr('/', '_').to_sym => permits })
-              end
-            else
-              code << "    params.require(:#{require_txt
-                              }).permit(#{permits_txt.map(&:inspect).join(', ')})\n"
-              code << "  end\n"
-              self.define_method(params_name) do
-                params.require(model.base_class.name.underscore.tr('/', '_').to_sym).permit(permits)
-              end
+          code << "  def #{params_name}\n"
+          require_txt = model.base_class.name.underscore.tr('/', '_')
+          is_for_expects = ::ActiveSupport.version >= ::Gem::Version.new('8.0a')
+          permits_txt = model._brick_find_permits(model, permits = model._brick_all_fields(true), is_for_expects)
+          if is_for_expects
+            code << "    params.expect(#{require_txt}: #{permits_txt})\n"
+            self.define_method(params_name) do
+              params.expect({ model.base_class.name.underscore.tr('/', '_').to_sym => permits })
+            end
+          else
+            code << "    params.require(:#{require_txt}).permit(#{permits_txt.map(&:inspect).join(', ')})\n"
+            self.define_method(params_name) do
+              params.require(model.base_class.name.underscore.tr('/', '_').to_sym).permit(permits)
             end
-            private params_name
-            # Get column names for params from relations[model.table_name][:cols].keys
           end
+          code << "  end\n"
+          private params_name
         end # unless is_openapi
         code << "end # #{class_name}\n"
       end # class definition
@@ -3210,7 +3218,6 @@ module Brick
                      end
                    end
       abstract_activerecord_bases = ::Brick.eager_load_classes(true)
-      rails_root = ::Rails.root.to_s
       models = ::Brick.relations.each_with_object({}) do |rel, s|
                  next if rel.first.is_a?(Symbol)
 

data/lib/brick/rails/engine.rb

@@ -324,7 +324,7 @@ function linkSchemas() {
                       end
                     end
                   end
-"<script>
+"<script<%= @_request.env['_brick_nonce'] %>>
 #{JS_CHANGEOUT}
 document.addEventListener(\"turbo:render\", linkSchemas);
 window.addEventListener(\"popstate\", linkSchemas);
@@ -826,56 +826,51 @@ window.addEventListener(\"popstate\", linkSchemas);
                ['Crosstab', is_crosstab]].each do |table_option, show_it|
                 table_options << "<option value=\"#{prefix}brick_#{table_option.downcase}\">(#{table_option})</option>".html_safe if show_it
               end
-              css = +"<style>#{::Brick::Rails::BRICK_CSS}</style>
-<script>
+              css = +"
+<%
+          if @_request.respond_to?(:content_security_policy) && (csp = @_request.content_security_policy)&.directives&.present?
+            @_request.env['_is_brick'] = true
+            if @_request.respond_to?(:content_security_policy_nonce_directives)
+              @_request.content_security_policy_nonce_directives = %w[ script-src ]
+              @_request.env['_brick_nonce'] = \" nonce=\\\"#\{@_request.content_security_policy_nonce}\\\"\".html_safe
+              %><meta name=\"csp-nonce\" content=\"<%= @_request.content_security_policy_nonce %>\"><%
+            end
+            if !@_request.respond_to?(:_brick_content_security_policy)
+              if csp.instance_variables.exclude?(:@_brick_style_shas)
+                csp.instance_variable_set(:@_brick_style_shas, [
+                  \"'sha256-#\{Base64.encode64(Digest.const_get(:SHA256).digest(::Brick::Rails::BRICK_CSS)).chomp}'\",
+                  \"'sha256-#\{Base64.encode64(Digest.const_get(:SHA256).digest(::Brick::Rails::IN_APP_STYLE)).chomp}'\",
+                  \"'sha256-y+oXtN5Bag5VRQgH6D87Eo4UdOZOJiqg31ZNfDibDwM='\", # SHA for the text_field used in brick_field ('min-width: 154px;field-sizing: content;')
+                  \"'sha256-aOKu38ec/bSbd1BWfOZWow6kP78MsLOsTmNyCpYqsXM='\", # SHA for Mermaid ('font-family: Arial')
+                  \"'sha256-P8hbc8HpnNaBWbGVqO8n4uIP3lIM4rGog3PnEYWwrzQ='\"  # SHA for flatpickr calendar ('.flatpickr-calendar {background: #A0FFA0;}')
+#                  \"'sha256-oU3/kVZLL/AmlO0Oi4iZplNUwV9XJW7qt6J9Mm2ASNs='\"  # SHA for Mermaid (SVG things)
+                ])
+              end
+
+              ::ActionDispatch::ContentSecurityPolicy::Request.module_exec do
+                alias :_brick_content_security_policy :content_security_policy
+                def content_security_policy
+                  return _brick_content_security_policy if env['_is_brick'].blank?
+
+                  csp = ::ActionDispatch::ContentSecurityPolicy.new
+                  csp.directives.merge! ({
+                    'style-src': [\"'self'\", 'https://cdn.jsdelivr.net', \"'unsafe-hashes'\", \"'nonce-#\{content_security_policy_nonce}'\"] +
+                      _brick_content_security_policy.instance_variable_get(:@_brick_style_shas),
+                    'script-src': [\"'self'\", 'https://cdn.jsdelivr.net', 'https://apis.google.com', 'https://accounts.google.com', \"'nonce-#\{content_security_policy_nonce}'\"],
+                    'connect-src': [\"'self'\", 'https://cdn.jsdelivr.net']
+                  })
+                  csp
+                end
+              end
+            end
+          end %>
+<style>#{::Brick::Rails::BRICK_CSS}</style>
+<script<%= @_request.env['_brick_nonce'] %>>
   if (window.history.state && window.history.state.turbo)
     window.addEventListener(\"popstate\", function () { location.reload(true); });
 </script>
 
 <%
-if @_request.respond_to?(:content_security_policy)
-  @_request.env['_is_brick'] = true
-  if (csp = @_request.content_security_policy).instance_variables.exclude?(:@_brick_style_shas)
-    csp.instance_variable_set(:@_brick_style_shas, [
-      \"'sha256-#\{Base64.encode64(Digest.const_get(:SHA256).digest(::Brick::Rails::BRICK_CSS)).chomp}'\",
-      \"'sha256-#\{Base64.encode64(Digest.const_get(:SHA256).digest(::Brick::Rails::IN_APP_STYLE)).chomp}'\"
-    ])
-  end
-  if !@_request.respond_to?(:_brick_content_security_policy)
-    ::ActionDispatch::ContentSecurityPolicy::Request.module_exec do
-      alias :_brick_content_security_policy :content_security_policy
-      def content_security_policy
-        # Add appropriate hashes for inline styles to the content-security-policy if needed
-        if (cspd = (csp = _brick_content_security_policy).directives.fetch('style-src', nil)) && env['_is_brick']
-          cspd.select! { |val| val == \"'self'\" }
-          if params['action'] == 'show'
-            cspd << \"'unsafe-inline'\"
-          else
-            csp.instance_variable_get(:@_brick_style_shas).each { |s| cspd << s }
-            cspd << \"'unsafe-hashes'\"
-          end
-          cspd << 'https://cdn.jsdelivr.net'
-        end
-        if (cspsd = csp.directives.fetch('script-src', nil))
-          cspsd.select! { |val| val == \"'self'\" }
-          cspsd << \"'unsafe-inline'\"
-          cspsd << 'https://cdn.jsdelivr.net'
-        end
-        if (cspcd = csp.directives.fetch('connect-src', nil))
-          cspcd.select! { |val| val == \"'self'\" }
-          cspcd << 'https://cdn.jsdelivr.net'
-        end
-        csp
-      end
-
-      alias :_brick_content_security_policy_nonce :content_security_policy_nonce
-      def content_security_policy_nonce
-        _brick_content_security_policy_nonce unless env['_is_brick']
-      end
-    end
-  end
-end
-
 # Accommodate composite primary keys that include strings with forward-slash characters
 def slashify(*vals)
   vals.map { |val_part| val_part.is_a?(String) ? val_part.gsub('/', '^^sl^^') : val_part }
@@ -890,7 +885,11 @@ callbacks = {} %>"
                                        poly_cols << @_brick_model.brick_foreign_type(v[1].first)
                                        v.last[1].each_with_object([]) { |x, s| s << "[#{x.name}, #{x.primary_key.inspect}]" }.join(', ')
                                      else
-                                       "[#{v.last[1].name}, #{v.last[1].primary_key.inspect}]"
+                                       # If the BT association specifies a column for the primary_key, use that ...
+                                       fm_pk = @_brick_model.reflect_on_association(v.last.first)&.options&.[](:primary_key)&.to_s ||
+                                               # ... otherwise, use the model's primary_key.
+                                               (v.last[1].primary_key.present? && v.last[1].primary_key)
+                                       "[#{v.last[1].name}, #{fm_pk.inspect}]"
                                      end
                     s << "#{v.first.inspect} => [#{v.last.first.inspect}, [#{foreign_models}], #{v.last[2].inspect}]"
                   end
@@ -902,7 +901,7 @@ callbacks = {} %>"
               end
 
               # %%% When doing schema select, if we're on a new page go to index
-              script = "<script>
+              script = "<script<%= @_request.env['_brick_nonce'] %>>
 // Add \"Are you sure?\" behaviour to any data-confirm buttons out there
 document.querySelectorAll(\"input[type=submit][data-confirm]\").forEach(function (btn) {
   btn.addEventListener(\"click\", function (evt) {
@@ -919,7 +918,8 @@ document.querySelectorAll(\"input[type=submit][data-confirm]\").forEach(function
   "\nbrickTestSchema = \"#{::Brick.test_schema}\";" if ::Brick.test_schema
 }
 function doFetch(method, payload, success) {
-  payload.authenticity_token = <%= (session[:_csrf_token] || form_authenticity_token).inspect.html_safe %>;
+  payload.authenticity_token = <%=
+   (!session.respond_to?(:enabled?) || session.enabled?) ? ((session[:_csrf_token] || form_authenticity_token).inspect.html_safe) : 'null' %>;
   var action = payload._brick_action || location.href;
   delete payload._brick_action;
   if (!success) {
@@ -954,7 +954,7 @@ if (window.brickFontFamily) {
   <div id=\"dropper\" contenteditable=\"true\"></div>
   <input type=\"button\" id=\"btnImport\" value=\"Import\">
 
-<script>
+<script<%= @_request.env['_brick_nonce'] %>>
   var dropperDiv = document.getElementById(\"dropper\");
   var btnImport = document.getElementById(\"btnImport\");
   var droppedTSV;
@@ -981,19 +981,6 @@ if (window.brickFontFamily) {
   }
   var sheetUrl;
   var spreadsheetId;
-  var sheetsLink = document.getElementById(\"sheetsLink\");
-  function gapiLoaded() {
-    // Have a click on the sheets link to bring up the sign-in window.  (Must happen from some kind of user click.)
-    sheetsLink.addEventListener(\"click\", async function (evt) {
-      evt.preventDefault();
-      var client = google.accounts.oauth2.initTokenClient({
-        client_id: \"487319557829-fgj4u660igrpptdji7ev0r5hb6kh05dh.apps.googleusercontent.com\",
-        scope: \"https://www.googleapis.com/auth/spreadsheets https://www.googleapis.com/auth/drive.file\",
-        callback: updateSignInStatus
-      });
-      client.requestAccessToken();
-    });
-  }
 
   async function updateSignInStatus(token) {
     await new Promise(function (resolve) {
@@ -1052,7 +1039,24 @@ if (window.brickFontFamily) {
   }
 </script>
 <script src=\"https://apis.google.com/js/api.js\"></script>
-<script async defer src=\"https://accounts.google.com/gsi/client\" onload=\"gapiLoaded()\"></script>
+<script async defer src=\"https://accounts.google.com/gsi/client\" id=\"gapiScript\"<%= @_request.env['_brick_nonce'] %>></script>
+<script<%= @_request.env['_brick_nonce'] %>>
+  document.getElementById(\"gapiScript\").addEventListener(\"onload\",
+    function () { // gapiLoaded
+      var sheetsLink = document.getElementById(\"sheetsLink\");
+      // Have a click on the sheets link to bring up the sign-in window.  (Must happen from some kind of user click.)
+      sheetsLink.addEventListener(\"click\", async function (evt) {
+        evt.preventDefault();
+        var client = google.accounts.oauth2.initTokenClient({
+          client_id: \"487319557829-fgj4u660igrpptdji7ev0r5hb6kh05dh.apps.googleusercontent.com\",
+          scope: \"https://www.googleapis.com/auth/spreadsheets https://www.googleapis.com/auth/drive.file\",
+          callback: updateSignInStatus
+        });
+        client.requestAccessToken();
+      });
+    }
+  );
+</script>
 "
                          end # DutyFree data export and import
 # %%% Instead of our current "for Janet Leverling (Employee)" kind of link we previously had this code that did a "where x = 123" thing:
@@ -1130,7 +1134,7 @@ end
     <div class=\"colExclusion\"><%= excl %></div>
   <% end %>
   </div>
-  <script>
+  <script<%= @_request.env['_brick_nonce'] %>>
     [... document.getElementsByClassName(\"colExclusion\")].forEach(function (excl) {
       excl.addEventListener(\"click\", function () {
         doFetch(\"POST\", {_brick_unexclude: this.innerHTML});
@@ -1141,7 +1145,7 @@ end
    # SEARCH BOX
    if @_brick_es && @_brick_es&.index('r') # Must have at least Elasticsearch Read access %>
   <input type=\"text\" id=\"esSearch\" class=\"dimmed\">
-  <script>
+  <script<%= @_request.env['_brick_nonce'] %>>
     var esSearch = document.getElementById(\"esSearch\");
     var usedTerms = {};
     var isEsFiltered = false;
@@ -1327,7 +1331,7 @@ end
             kls = Object.const_get((rel = ::Brick.relations.fetch(r[0], nil))&.fetch(:class_name, nil))
           rescue
           end
-          if kls.is_a?(Class) && (path_helper = respond_to?(bi_path = \"#\{kls._brick_index}_path\".to_sym) ? bi_path : nil)
+          if kls.is_a?(Class) && kls.respond_to?(:_brick_index) && (path_helper = respond_to?(bi_path = \"#\{kls._brick_index}_path\".to_sym) ? bi_path : nil)
             link_to(r[0], send(path_helper))
           else
             r[0]
@@ -1504,7 +1508,7 @@ end
                  end
       s << "<table id=\"#{hm_name}\" class=\"shadow\">
         <tr><th>#{hm[1]}#{' poly' if hm[0].options[:as]} #{hm[3]}
-          <% if predicates && respond_to?(:new_#{partial_new_path_name = hm.first.klass._brick_index(:singular)}_path) %>
+          <% if defined?(predicates) && predicates && respond_to?(:new_#{partial_new_path_name = hm.first.klass._brick_index(:singular)}_path) %>
           <span class = \"add-hm-related\"><%=
             pk_val = (obj_pk = model.primary_key).is_a?(String) ? obj.send(obj_pk) : obj_pk.map { |pk_part| obj.send(pk_part) }
             pk_val_arr = [pk_val] unless pk_val.is_a?(Array)
@@ -1590,7 +1594,7 @@ end}
 }
 </style>
 <script src=\"https://cdn.jsdelivr.net/npm/flatpickr\"></script>
-<script>
+<script<%= @_request.env['_brick_nonce'] %>>
 flatpickr(\".datepicker\");
 flatpickr(\".datetimepicker\", {enableTime: true});
 flatpickr(\".timepicker\", {enableTime: true, noCalendar: true});
@@ -1611,7 +1615,7 @@ flatpickr(\".timepicker\", {enableTime: true, noCalendar: true});
    # Uncaught TypeError: Failed to resolve module specifier \"immutable-json-patch\". Relative references must start with either \"/\", \"./\", or \"../\".
    if @_json_fields_present %>
 <link rel=\"stylesheet\" type=\"text/css\" href=\"https://cdn.jsdelivr.net/npm/vanilla-jsoneditor@0.19.0/themes/jse-theme-default.min.css\">
-<script type=\"module\">
+<script type=\"module\"<%= @_request.env['_brick_nonce'] %>>
   import { JSONEditor } from \"https://cdn.jsdelivr.net/npm/vanilla-jsoneditor@0.19.0/index.min.js\";
   document.querySelectorAll(\"input.jsonpicker\").forEach(function (inp) {
     var jsonDiv;
@@ -1639,7 +1643,7 @@ flatpickr(\".timepicker\", {enableTime: true, noCalendar: true});
 
 <% if true # @_brick_erd
 %>
-<script>
+<script<%= @_request.env['_brick_nonce'] %>>
   var imgErd = document.getElementById(\"imgErd\");
   var mermaidErd = document.getElementById(\"mermaidErd\");
   var mermaidCode;
@@ -1708,7 +1712,7 @@ flatpickr(\".timepicker\", {enableTime: true, noCalendar: true});
 "
               end
               if representation == :grid
-                inline << "<script>
+                inline << "<script<%= @_request.env['_brick_nonce'] %>>
 <% # Make column headers sort when clicked
    # %%% Create a smart javascript routine which can do this client-side %>
 [... document.getElementsByTagName(\"TH\")].forEach(function (th) {

data/lib/brick/rails/form_tags.rb

@@ -112,7 +112,7 @@ module Brick::Rails::FormTags
       next unless klass.table_exists?
 
       rid = pk.map { |pk_part| obj.send(pk_part.to_sym) }
-      out << "<tr x-id=\"#{rid.join('/')}\">\n"
+      out << "<tr x-id=\"#{slashed_rid = rid.join('/')}\">\n"
       out << "<td class=\"col-sticky alternating-gray\">#{link_to('⇛', send("#{klass._brick_index(:singular)}_path".to_sym, rid),
                                                                   { class: 'big-arrow' })}</td>\n" if pk.present?
       ac = obj.instance_variable_get(:@association_cache) || obj.instance_variable_set(:@association_cache, {})
@@ -134,8 +134,14 @@ module Brick::Rails::FormTags
           if bt[2] && obj.respond_to?(poly_id_col = "#{bt.first}_id") # Polymorphic?
             if (poly_id = obj.send(poly_id_col))
               bt_class = obj.send(klass.brick_foreign_type(bt.first))
-              base_class_underscored = (::Brick.existing_stis[bt_class] || bt_class).constantize.base_class._brick_index(:singular)
-              out << link_to("#{bt_class} ##{poly_id}", send("#{base_class_underscored}_path".to_sym, poly_id))
+              root_class_name = (::Brick.existing_stis[bt_class] || bt_class)
+              begin
+                base_class_underscored = root_class_name.constantize.base_class._brick_index(:singular)
+                out << link_to("#{bt_class} ##{poly_id}", send("#{base_class_underscored}_path".to_sym, poly_id))
+              rescue NameError => ee
+                puts "WARNING:  While searching for a polymorphically associated #{bt.first} for the #{klass.name} with ID #{slashed_rid}, was unable to locate a model called \"#{root_class_name}\".  This model might have been deleted, thereby orphaning rows in the #{klass.table_name} table."
+                out << "<span class=\"orphan\">&lt;&lt; Orphaned \"#{root_class_name}\" with ID: #{slashed_rid} >></span>"
+              end
             end
           else # BT or HOT
             bt_class = bt[1].first.first
@@ -151,11 +157,17 @@ module Brick::Rails::FormTags
             end
             br_descrip_args = [obj]
             br_descrip_args += [bt_class._brick_deserialized_value(obj, descrips[0..-2]), bt_id_col] if descrips
-            bt_txt = bt_class.brick_descrip(*br_descrip_args)
-            bt_txt = ::Brick::Rails.display_binary(bt_txt).html_safe if bt_txt&.encoding&.name == 'ASCII-8BIT'
-            bt_txt ||= "<span class=\"orphan\">&lt;&lt; Orphaned ID: #{val} >></span>" if val
-            bt_id = bt_class._brick_deserialized_id(obj, bt_id_col)
-            out << (bt_id&.first ? link_to(bt_txt, send("#{bt_class.base_class._brick_index(:singular)}_path".to_sym, bt_id)) : bt_txt || '')
+            out << if bt_id_col.blank? && bt[1].first[1] # Is this a BT which references a table with no primary key?
+                     # Although we have no way to directly reference this record via a show action, we can at least create a link like this:
+                     #   http://localhost:3000/brick/local_authority_postcode?__value=PA2Y+5LQ
+                     link_to(val, send("#{bt_class.base_class._brick_index(:singular)}_path".to_sym, '__the_id__')).gsub('__the_id__', "?__#{bt[1].first[1]}=#{CGI.escape(val)}")
+                   else # Normal BT or HOT
+                     bt_txt = bt_class.brick_descrip(*br_descrip_args)
+                     bt_txt = ::Brick::Rails.display_binary(bt_txt).html_safe if bt_txt&.encoding&.name == 'ASCII-8BIT'
+                     bt_txt ||= "<span class=\"orphan\">&lt;&lt; Orphaned ID: #{val} >></span>" if val
+                     bt_id = bt_class._brick_deserialized_id(obj, bt_id_col)
+                     (bt_id&.first ? link_to(bt_txt, send("#{bt_class.base_class._brick_index(:singular)}_path".to_sym, bt_id)) : bt_txt || '')
+                   end
           end
         elsif (hms_col = hms_cols[col_name])
           if hms_col.length == 1
@@ -165,15 +177,14 @@ module Brick::Rails::FormTags
             if col[2] == 'HO'
               descrips = bt_descrip[col_name.to_sym][hm_klass]
               if (descrip_parts = hm_klass._brick_deserialized_value(obj, descrips[0..-2]))&.first
+                ho_id = hm_klass._brick_deserialized_id(obj, ho_id_col = descrips.last)
                 ho_txt = if hm_klass.name == 'ActiveStorage::Attachment'
                            begin
                              ::Brick::Rails.display_binary(obj.send(col[3])&.blob&.download)&.html_safe
                            rescue
+                             # Attachment is missing for some reason ... default to showing just a description.
                            end
-                         else
-                           hm_klass.brick_descrip(obj, descrip_parts, ho_id_col = descrips.last)
-                         end
-                ho_id = hm_klass._brick_deserialized_id(obj, ho_id_col)
+                         end || hm_klass.brick_descrip(obj, descrip_parts, ho_id_col)
                 out << link_to(ho_txt, send("#{hm_klass.base_class._brick_index(:singular)}_path".to_sym, ho_id))
               end
             elsif obj.respond_to?(ct_col = hms_col[1].to_sym) && (ct = obj.send(ct_col)&.to_i)&.positive?
@@ -402,7 +413,7 @@ module Brick::Rails::FormTags
     end
     out << "  </tbody>
 </table>
-<script>
+<script<%= @_request.env['_brick_nonce'] %>>
   var constellation = document.getElementById(\"#{table_name}\");
   var nextSib,
       _this;
@@ -868,7 +879,7 @@ function onImagesLoaded(event) {
 </select></td>
 <td class=\"paddingTopZero\"><input id=\"txtColName\"></td>
 </tr></table>
-<script>
+<script<%= @_request.env['_brick_nonce'] %>>
 var btnAddCol = document.getElementById(\"btnAddCol\");
 btnAddCol.addEventListener(\"click\", function () {
  var txtColName = document.getElementById(\"txtColName\");

data/lib/brick/rails.rb

@@ -179,7 +179,7 @@ erDiagram
        'timestamp without time zone' => 'timestamp',
        'timestamp with time zone' => 'timestamp',
        'time without time zone' => 'time',
-       'time with time zone' => 'time' }[dt] || dt&.tr(' (', '_').tr(')', '') || 'int'
+       'time with time zone' => 'time' }[dt] || dt&.tr(' (', '_')&.tr(')', '') || 'int'
    end
    callbacks.merge({#{model_short_name.inspect} => ::#{model.name}}).each do |cb_k, cb_class|
      cb_relation = ::Brick.relations[cb_class.table_name]

data/lib/brick/reflect_tables.rb

@@ -425,8 +425,7 @@ ORDER BY 1, 2, c.internal_column_id, acc.position"
                                       end
                         )&.present?
                        if tnp.last&.start_with?('::') # TNP that points to an exact class?
-                         # Had considered:  [tnp.last[2..-1]]
-                         [singular]
+                         tnp.last[2..-1].split('::')
                        elsif tnp.last
                          v[:auto_prefixed_schema], v[:auto_prefixed_class] = tnp
                          # v[:resource] = rel_name.last[tnp.first.length..-1]

data/lib/brick/version_number.rb

@@ -5,7 +5,7 @@ module Brick
   module VERSION
     MAJOR = 1
     MINOR = 0
-    TINY = 244
+    TINY = 246
 
     # PRE is nil unless it's a pre-release (beta, RC, etc.)
     PRE = nil

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: brick
 version: !ruby/object:Gem::Version
-  version: 1.0.244
+  version: 1.0.246
 platform: ruby
 authors:
 - Lorin Thwaits
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-06-23 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activerecord
@@ -246,7 +245,6 @@ homepage: https://github.com/lorint/brick
 licenses:
 - MIT
 metadata: {}
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -261,8 +259,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 1.3.6
 requirements: []
-rubygems_version: 3.4.19
-signing_key:
+rubygems_version: 4.0.18
 specification_version: 4
 summary: Create a Rails app from data alone
 test_files: []