brick 1.0.245 → 1.0.247

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 74ab9c3403cc8ec25b0a2a2d24cc8c9cf871aa5de82daf92055542c70d4977df
-  data.tar.gz: 6e119a05135fb27a1d89b67cf8762a2d2d394876dfd79795481eb5f416476f06
+  metadata.gz: baf36636026c4ecad5ff76ccdeea80604c6c9128f7065d7b546ab41cc4fccf1c
+  data.tar.gz: ec8c081354229eb5b4cdcd3112b24313468aaf731f856168cace28d3882e1f51
 SHA512:
-  metadata.gz: 220af7d1a7be7d224d0b25c8b9e3e635384067c408cd80bf012b289b83957c1bcda11a43eb152208b76bf80ec2d3cfa4c25b91ecfd9db4fa8710b217602ec766
-  data.tar.gz: 01c63fd12b462aa64ac72812f30541036c78e5934b4b5215ee1215394105d521be44771adcd9a5685cba2d784546f216b07016784c820e4cd510a4e367b9d873
+  metadata.gz: 3742d4d628c4f0ff18008f5dd965b3e49c545d24141cea917a0ba141cff7f3243b6f159e732f2e786b87f274e80237bcea2af74f17b9494345cf898e54e72928
+  data.tar.gz: 3aa5e54bc3b4af270e5b2342430e294920b151139af66ec5771b15a575377f7275f9c10e593d7c1d314e67d145fd9ffb0ae834b4f68a5d4c1afff8b22ecc404c

data/lib/brick/extensions.rb

@@ -105,13 +105,41 @@ module ActiveRecord
         col_names = columns_hash.keys
         # If it's a composite primary key then allow all the values through
         # TODO: Should disallow any autoincrement / SERIAL columns
-        if skip_id && (pk_as_array = _pk_as_array).length == 1
-          col_names -= _pk_as_array
+        if skip_id && (pk_as_array = _pk_as_array).length == 1 &&
+           [:string, :text].exclude?(columns_hash[pk_as_array.first]&.type)
+          col_names -= pk_as_array
         end
         hoa, hma, rtans = _activestorage_actiontext_fields
         col_names.map(&:to_sym) + hoa + hma.map { |as| { as => [] } } + rtans.values
       end
 
+      def _brick_set_wheres(params, join_array = nil)
+        is_distinct = nil
+        wheres = {}
+        params.each do |k, v|
+          k = k.to_s # Rails < 4.2 comes in as a symbol
+          next unless k.start_with?('__')
+
+          k = k[2..-1] # Take off leading "__"
+          if (where_col = (ks = k.split('.')).last)[-1] == '!'
+            where_col = where_col[0..-2]
+          end
+          case ks.length
+          when 1
+            next unless self.column_names.any?(where_col) || self._brick_get_fks.include?(where_col)
+          when 2
+            assoc_name = ks.first.to_sym
+            # Make sure it's a good association name and that the model has that column name
+            next unless self.reflect_on_association(assoc_name)&.klass&.column_names&.any?(where_col)
+
+            join_array&.[]=(assoc_name, nil) # Store this relation name in our special collection for .joins()
+            is_distinct = true
+          end
+          wheres[k] = v.is_a?(String) ? v.split(',') : v
+        end
+        [wheres, is_distinct]
+      end
+
       # Return three lists of fields for this model --
       # has_one_attached, has_many_attached, and has_rich_text
       def _activestorage_actiontext_fields
@@ -162,7 +190,7 @@ module ActiveRecord
       def _brick_deserialized_id(obj, id_col)
         id = []
         self._pk_as_array.each_with_index do |pk_part, idx|
-          id << if obj.respond_to?(id_sym = id_col[idx].to_sym)
+          id << if (id_sym = id_col[idx]&.to_sym) && obj.respond_to?(id_sym)
                     self._brick_deserialized_value(obj, [[pk_part, id_col[idx]]])&.first
                   else
                     id_col[idx]
@@ -219,10 +247,17 @@ module ActiveRecord
         else
           # If there's no DSL yet specified, just try to find the first usable column on this model
           dsl = if table_exists?
-                  skip_columns = _brick_get_fks + (::Brick.config.metadata_columns || []) + [primary_key]
-                  if (descrip_col = columns.find { |c| c.type == :string && skip_columns.exclude?(c.name) })
+                  skip_columns = _brick_get_fks + (::Brick.config.metadata_columns || [])
+                  column_list = columns.dup
+                  pk_idx = column_list.index { |c| c.name == primary_key }
+                  if pk_idx
+                    pk_column = column_list.delete_at(pk_idx)
+                    # if the PK column is a string, put it at the end so it will get chosen as a last resort
+                    column_list << pk_column if [:string, :text].include?(columns_hash[primary_key]&.type)
+                  end
+                  if (descrip_col = column_list.find { |c| c.type == :string && skip_columns.exclude?(c.name) })
                     "[#{descrip_col.name}]"
-                  elsif (descrip_col = columns.find { |c| [:boolean, :binary, :xml].exclude?(c.type) && skip_columns.exclude?(c.name) })
+                  elsif (descrip_col = column_list.find { |c| [:boolean, :binary, :xml].exclude?(c.type) && skip_columns.exclude?(c.name) })
                     "[#{descrip_col.name}]"
                   else
                     "#{name} ##{_pk_as_array.map { |pk_part| "[#{pk_part}]" }.join(', ')}"
@@ -689,32 +724,10 @@ module ActiveRecord
       # model early in case the user wants to do an ORDER BY based on any of that.
       model._brick_calculate_bts_hms(translations, join_array) if is_add_bts || is_add_hms
 
-      is_distinct = nil
-      wheres = {}
       params = params.to_unsafe_h unless params.is_a?(Hash)
       params.merge!(args[1]) if args[1]
-      params.each do |k, v|
-        k = k.to_s # Rails < 4.2 comes in as a symbol
-        next unless k.start_with?('__')
-
-        k = k[2..-1] # Take off leading "__"
-        if (where_col = (ks = k.split('.')).last)[-1] == '!'
-          where_col = where_col[0..-2]
-        end
-        case ks.length
-        when 1
-          next unless klass.column_names.any?(where_col) || klass._brick_get_fks.include?(where_col)
-        when 2
-          assoc_name = ks.first.to_sym
-          # Make sure it's a good association name and that the model has that column name
-          next unless klass.reflect_on_association(assoc_name)&.klass&.column_names&.any?(where_col)
-
-          join_array[assoc_name] = nil # Store this relation name in our special collection for .joins()
-          is_distinct = true
-          distinct!
-        end
-        wheres[k] = v.is_a?(String) ? v.split(',') : v
-      end
+      wheres, is_distinct = klass._brick_set_wheres(params, join_array)
+      distinct! if is_distinct
 
       # %%% Skip the metadata columns
       if selects.empty? # Default to all columns
@@ -926,11 +939,13 @@ module ActiveRecord
                            poly_ft = [hm.source_reflection.inverse_of.foreign_type, hmt_assoc.source_reflection.class_name]
                          end
                          # link_back << hm.source_reflection.inverse_of.name
-                         while hmt_assoc.options[:through] && (hmt_assoc = klass.reflect_on_association(hmt_assoc.options[:through]))
+                         while hmt_assoc.options[:through] && (hmt_assoc = klass.reflect_on_association(xy = hmt_assoc.options[:through]))
+                           if hmt_assoc.macro == :has_and_belongs_to_many
+                             through_sources.unshift(hmt_assoc)
+                             link_back << hmt_assoc.source_reflection.klass.reflect_on_all_associations.find { |a| a.macro == :has_and_belongs_to_many && a.join_table == hmt_assoc.join_table }.name
+                           end
                            through_sources.unshift(hmt_assoc)
                          end
-                         # Turn the last member of link_back into a foreign key
-                         link_back << hmt_assoc.source_reflection.foreign_key
                          # If it's a HMT based on a HM -> HM, must JOIN the last table into the mix at the end
                          this_hm = hm
                          while !(src_ref = this_hm.source_reflection).belongs_to? && (thr = src_ref.options[:through])
@@ -940,39 +955,48 @@ module ActiveRecord
                          from_clause = +"#{_br_quoted_name(through_sources.first.table_name)} br_t0"
                          # ActiveStorage will not get the correct count unless we do some extra filtering later
                          tbl_nm = 'br_t0' if Object.const_defined?('ActiveStorage') && through_sources.first.klass <= ::ActiveStorage::Attachment
-                         fk_col = through_sources.shift.foreign_key
-
+                         # Turn the last member of link_back into a foreign key
+                         link_back << ((tsf = through_sources.shift).macro == :has_and_belongs_to_many ?
+                           tsf.klass.primary_key : hmt_assoc.source_reflection.foreign_key)
+                         fk_col = tsf.macro == :has_and_belongs_to_many ?
+                           tsf.klass.primary_key : tsf.foreign_key
                          idx = 0
                          bail_out = nil
                          the_chain = through_sources.map do |a|
-                           from_clause << "\n LEFT OUTER JOIN #{a.table_name} br_t#{idx += 1} "
-                           from_clause << if (src_ref = a.source_reflection).macro == :belongs_to
-                                            link_back << (nm = hmt_assoc.source_reflection.inverse_of&.name)
-                                            # puts "BT #{a.table_name}"
-                                            "ON br_t#{idx}.#{a.active_record.primary_key} = br_t#{idx - 1}.#{a.foreign_key}"
-                                          elsif src_ref.options[:as]
-                                            "ON br_t#{idx}.#{src_ref.type} = '#{src_ref.active_record.name}'" + # "polymorphable_type"
-                                            " AND br_t#{idx}.#{src_ref.foreign_key} = br_t#{idx - 1}.id"
-                                          elsif src_ref.options[:source_type]
-                                            if a == hm.source_reflection
-                                              print "Skipping #{hm.name} --HMT-> #{hm.source_reflection.name} as it uses source_type in a way which is not yet supported"
-                                              nix << k
-                                              bail_out = true
-                                              break
-                                              # "ON br_t#{idx}.#{a.foreign_type} = '#{src_ref.options[:source_type]}' AND " \
-                                              #   "br_t#{idx}.#{a.foreign_key} = br_t#{idx - 1}.#{a.active_record.primary_key}"
-                                            else # Works for HMT through a polymorphic HO
-                                              link_back << hmt_assoc.source_reflection.inverse_of&.name # Some polymorphic "_able" thing
-                                              "ON br_t#{idx - 1}.#{a.foreign_type} = '#{src_ref.options[:source_type]}' AND " \
-                                                "br_t#{idx - 1}.#{a.foreign_key} = br_t#{idx}.#{a.active_record.primary_key}"
+                           puts "#{a.name} - #{a.macro}"
+                           if a.macro == :has_and_belongs_to_many
+                             from_clause << "\n LEFT OUTER JOIN #{a.join_table} br_t#{idx += 1} ON br_t#{idx}.#{a.association_foreign_key} = br_t#{idx - 1}.#{a.active_record.primary_key}"
+                             from_clause << "\n LEFT OUTER JOIN #{a.active_record.table_name} br_t#{idx += 1} ON br_t#{idx}.#{a.active_record.primary_key} = br_t#{idx - 1}.#{a.foreign_key}"
+                           else
+                            from_clause << "\n LEFT OUTER JOIN #{a.table_name} br_t#{idx += 1} "
+                            from_clause << if (src_ref = a.source_reflection).macro == :belongs_to
+                                              link_back << (nm = hmt_assoc.source_reflection.inverse_of&.name)
+                                              # puts "BT #{a.table_name}"
+                                              "ON br_t#{idx}.#{a.active_record.primary_key} = br_t#{idx - 1}.#{a.foreign_key}"
+                                            elsif src_ref.options[:as]
+                                              "ON br_t#{idx}.#{src_ref.type} = '#{src_ref.active_record.name}'" + # "polymorphable_type"
+                                              " AND br_t#{idx}.#{src_ref.foreign_key} = br_t#{idx - 1}.id"
+                                            elsif src_ref.options[:source_type]
+                                              if a == hm.source_reflection
+                                                print "Skipping #{hm.name} --HMT-> #{hm.source_reflection.name} as it uses source_type in a way which is not yet supported"
+                                                nix << k
+                                                bail_out = true
+                                                break
+                                                # "ON br_t#{idx}.#{a.foreign_type} = '#{src_ref.options[:source_type]}' AND " \
+                                                #   "br_t#{idx}.#{a.foreign_key} = br_t#{idx - 1}.#{a.active_record.primary_key}"
+                                              else # Works for HMT through a polymorphic HO
+                                                link_back << hmt_assoc.source_reflection.inverse_of&.name # Some polymorphic "_able" thing
+                                                "ON br_t#{idx - 1}.#{a.foreign_type} = '#{src_ref.options[:source_type]}' AND " \
+                                                  "br_t#{idx - 1}.#{a.foreign_key} = br_t#{idx}.#{a.active_record.primary_key}"
+                                              end
+                                            else # Standard has_many or has_one
+                                              # puts "HM #{a.table_name}"
+                                              nm = hmt_assoc.source_reflection.inverse_of&.name
+                                              # binding.pry unless nm
+                                              link_back << nm # if nm
+                                              "ON br_t#{idx}.#{a.foreign_key} = br_t#{idx - 1}.#{a.active_record.primary_key}"
                                             end
-                                          else # Standard has_many or has_one
-                                            # puts "HM #{a.table_name}"
-                                            nm = hmt_assoc.source_reflection.inverse_of&.name
-                                            # binding.pry unless nm
-                                            link_back << nm # if nm
-                                            "ON br_t#{idx}.#{a.foreign_key} = br_t#{idx - 1}.#{a.active_record.primary_key}"
-                                          end
+                           end
                            link_back.unshift(a.source_reflection.name)
                            [a.table_name, a.foreign_key, a.source_reflection.macro]
                          end
@@ -980,7 +1004,9 @@ module ActiveRecord
 
                          # puts "LINK BACK! #{k} : #{hm.table_name} #{link_back.map(&:to_s).join('.')}"
                          # count_column is determined from the originating HMT member
-                         if (src_ref = hm.source_reflection).nil?
+                         if hmt_assoc.macro == :has_and_belongs_to_many
+                           "br_t#{idx}.#{src_ref.active_record.primary_key}"
+                         elsif (src_ref = hm.source_reflection).nil?
                            puts "*** Warning:  Could not determine destination model for this HMT association in model #{klass.name}:\n  has_many :#{hm.name}, through: :#{hm.options[:through]}"
                            puts
                            nix << k
@@ -1743,7 +1769,7 @@ class Object
       end
       full_name = if relation || schema_name.blank?
                     if singular_table_name != table_name.singularize && # %%% Try this with http://localhost:3000/brick/spree/property_translations
-                       (schema_module = ::Brick.config.table_name_prefixes.find { |k, v| table_name.start_with?(k) }&.last&.constantize)
+                       (schema_module = ::Brick.config.table_name_prefixes.find { |k, v| table_name.length > k&.length && table_name.start_with?(k) }&.last&.constantize)
                       "#{schema_module&.name}::#{inheritable_name || model_name}"
                     else
                       inheritable_name || model_name
@@ -1762,7 +1788,7 @@ class Object
                 ::Brick.config.exclude_tables.include?(matching)
 
       # Are they trying to use a pluralised class name such as "Employees" instead of "Employee"?
-      if table_name == singular_table_name && !ActiveSupport::Inflector.inflections.uncountable.include?(table_name)
+      if table_name == singular_table_name && model_name.pluralize == model_name && !ActiveSupport::Inflector.inflections.uncountable.include?(table_name)
         # unless ::Brick.config.sti_namespace_prefixes&.key?("::#{singular_table_name.camelize}::")
         #   puts "Warning: Class name for a model that references table \"#{matching
         #        }\" should be \"#{ActiveSupport::Inflector.singularize(inheritable_name || model_name)}\"."
@@ -2162,7 +2188,9 @@ class Object
         # (More information on https://docs.avohq.io/3.0/controllers.html)
         controller_base = Avo::ResourcesController
       end
-      if !model&.table_exists? && (tn = model&.table_name)
+      if model && !(model < ActiveRecord::Base)
+        raise "Your project defines class \"#{model.name}\" which is not an ActiveRecord model.  If some other model class for this resource exists that can be used instead, you can configure a Brick table_name_prefix in order to have a specific table name refer to that class."
+      elsif !model&.table_exists? && (tn = model&.table_name)
         msg = +"Can't find table \"#{tn}\" for model #{model.name}."
         puts
         # Potential bad inflection?
@@ -2460,10 +2488,19 @@ class Object
 
             real_model = model.find_real_model(params)
 
+            # %%% Allow params to define which columns to use for order_by
+            # Overriding the default by providing a querystring param?
+            order_by = params['_brick_order']&.split(',')&.map(&:to_sym) || Object.send(:default_ordering, table_name, pk)
+
             if request.format == :csv # Asking for a template?
               require 'csv'
               exported_csv = CSV.generate(force_quotes: false) do |csv_out|
-                real_model.df_export(true, real_model.brick_import_template, false, wheres, order_by).each do |row|
+                export_args = [true, real_model.brick_import_template, false]
+                if real_model.method(:df_export).parameters.length > 3
+                  wheres, _is_distinct = real_model._brick_set_wheres(params)
+                  export_args += [wheres, order_by]
+                end
+                real_model.df_export(*export_args).each do |row|
                   row.each do |d|
                     row.each_with_index do |d, idx|
                       # "false" disallows HTML encoding the descriptions of binary content
@@ -2484,11 +2521,6 @@ class Object
             end
 
             # Normal (not swagger or CSV) request
-
-            # %%% Allow params to define which columns to use for order_by
-            # Overriding the default by providing a querystring param?
-            order_by = params['_brick_order']&.split(',')&.map(&:to_sym) || Object.send(:default_ordering, table_name, pk)
-
             ar_relation = ActiveRecord.version < Gem::Version.new('4') ? real_model.preload : real_model.all
             params['_brick_is_api'] = true if (is_api = request.format == :js || current_api_root)
             @_brick_params = ar_relation._brick_querying((selects ||= []), params: params, order_by: order_by,
@@ -2681,7 +2713,14 @@ class Object
               render json: { result: es_result }
             else
               real_model, real_singular_table_name = model.real_singular(params)
-              created_obj = model.send(:new, send(params_name_sym))
+              # If there are any foreign keys that are strings and we've received a blank value, set that to nil
+              internal_params = (ac_params = send(params_name_sym))&.send(:parameters)
+              real_model.reflect_on_all_associations.each do |a|
+                if a.belongs_to? && internal_params.key?(fk_name = a.foreign_key.to_s) && [:string, :text].include?((fk_col = real_model.columns_hash[fk_name])&.type)
+                  internal_params[fk_name] = nil if internal_params[fk_name].blank?
+                end
+              end
+              created_obj = model.send(:new, ac_params)
               if created_obj.respond_to?(inh_col = model.inheritance_column) && created_obj.send(inh_col) == ''
                 created_obj.send("#{inh_col}=", model.name)
               end
@@ -2706,7 +2745,6 @@ class Object
             #   ActiveRecord::Base.execute_sql("SET SEARCH_PATH = ?;", schema)
             # end
 
-            is_need_params = true
             code << "  def edit\n"
             code << "    #{find_by_name}\n"
             code << "  end\n"
@@ -2799,7 +2837,7 @@ class Object
             end
           end
 
-          code << "private\n" if pk.present? || is_need_params
+          code << "private\n"
 
           if pk.present?
             code << "  def #{find_obj}
@@ -2829,29 +2867,23 @@ class Object
             private find_obj
           end
 
-          if is_need_params
-            code << "  def #{params_name}\n"
-            require_txt = model.base_class.name.underscore.tr('/', '_')
-            is_for_expects = ::ActiveSupport.version >= ::Gem::Version.new('8.0a')
-            permits_txt = model._brick_find_permits(model, permits = model._brick_all_fields(true), is_for_expects)
-            if is_for_expects
-              code << "    params.expect(#{require_txt
-                              }: #{permits_txt})\n"
-              code << "  end\n"
-              self.define_method(params_name) do
-                params.expect({ model.base_class.name.underscore.tr('/', '_').to_sym => permits })
-              end
-            else
-              code << "    params.require(:#{require_txt
-                              }).permit(#{permits_txt.map(&:inspect).join(', ')})\n"
-              code << "  end\n"
-              self.define_method(params_name) do
-                params.require(model.base_class.name.underscore.tr('/', '_').to_sym).permit(permits)
-              end
+          code << "  def #{params_name}\n"
+          require_txt = model.base_class.name.underscore.tr('/', '_')
+          is_for_expects = ::ActiveSupport.version >= ::Gem::Version.new('8.0a')
+          permits = model._brick_find_permits(model, model._brick_all_fields(true), is_for_expects)
+          if is_for_expects
+            code << "    params.expect(#{require_txt}: #{permits})\n"
+            self.define_method(params_name) do
+              params.expect({ model.base_class.name.underscore.tr('/', '_').to_sym => permits })
+            end
+          else
+            code << "    params.require(:#{require_txt}).permit(#{permits.map(&:inspect).join(', ')})\n"
+            self.define_method(params_name) do
+              params.require(model.base_class.name.underscore.tr('/', '_').to_sym).permit(permits)
             end
-            private params_name
-            # Get column names for params from relations[model.table_name][:cols].keys
           end
+          code << "  end\n"
+          private params_name
         end # unless is_openapi
         code << "end # #{class_name}\n"
       end # class definition
@@ -3210,7 +3242,6 @@ module Brick
                      end
                    end
       abstract_activerecord_bases = ::Brick.eager_load_classes(true)
-      rails_root = ::Rails.root.to_s
       models = ::Brick.relations.each_with_object({}) do |rel, s|
                  next if rel.first.is_a?(Symbol)
 

data/lib/brick/rails/engine.rb

@@ -826,20 +826,24 @@ window.addEventListener(\"popstate\", linkSchemas);
                ['Crosstab', is_crosstab]].each do |table_option, show_it|
                 table_options << "<option value=\"#{prefix}brick_#{table_option.downcase}\">(#{table_option})</option>".html_safe if show_it
               end
-              css = +"<style>#{::Brick::Rails::BRICK_CSS}</style>
-<script<%=
+              css = +"
+<%
           if @_request.respond_to?(:content_security_policy) && (csp = @_request.content_security_policy)&.directives&.present?
             @_request.env['_is_brick'] = true
             if @_request.respond_to?(:content_security_policy_nonce_directives)
               @_request.content_security_policy_nonce_directives = %w[ script-src ]
               @_request.env['_brick_nonce'] = \" nonce=\\\"#\{@_request.content_security_policy_nonce}\\\"\".html_safe
+              %><meta name=\"csp-nonce\" content=\"<%= @_request.content_security_policy_nonce %>\"><%
             end
             if !@_request.respond_to?(:_brick_content_security_policy)
               if csp.instance_variables.exclude?(:@_brick_style_shas)
                 csp.instance_variable_set(:@_brick_style_shas, [
                   \"'sha256-#\{Base64.encode64(Digest.const_get(:SHA256).digest(::Brick::Rails::BRICK_CSS)).chomp}'\",
                   \"'sha256-#\{Base64.encode64(Digest.const_get(:SHA256).digest(::Brick::Rails::IN_APP_STYLE)).chomp}'\",
-                  \"'sha256-y+oXtN5Bag5VRQgH6D87Eo4UdOZOJiqg31ZNfDibDwM='\" # SHA for the text_field used in brick_field ('min-width: 154px;field-sizing: content;')
+                  \"'sha256-y+oXtN5Bag5VRQgH6D87Eo4UdOZOJiqg31ZNfDibDwM='\", # SHA for the text_field used in brick_field ('min-width: 154px;field-sizing: content;')
+                  \"'sha256-aOKu38ec/bSbd1BWfOZWow6kP78MsLOsTmNyCpYqsXM='\", # SHA for Mermaid ('font-family: Arial')
+                  \"'sha256-P8hbc8HpnNaBWbGVqO8n4uIP3lIM4rGog3PnEYWwrzQ='\"  # SHA for flatpickr calendar ('.flatpickr-calendar {background: #A0FFA0;}')
+#                  \"'sha256-oU3/kVZLL/AmlO0Oi4iZplNUwV9XJW7qt6J9Mm2ASNs='\"  # SHA for Mermaid (SVG things)
                 ])
               end
 
@@ -850,18 +854,18 @@ window.addEventListener(\"popstate\", linkSchemas);
 
                   csp = ::ActionDispatch::ContentSecurityPolicy.new
                   csp.directives.merge! ({
-                    'style-src': [\"'self'\", 'https://cdn.jsdelivr.net', \"'unsafe-hashes'\"] +
+                    'style-src': [\"'self'\", 'https://cdn.jsdelivr.net', \"'unsafe-hashes'\", \"'nonce-#\{content_security_policy_nonce}'\"] +
                       _brick_content_security_policy.instance_variable_get(:@_brick_style_shas),
-                    'script-src': [\"'self'\", 'https://cdn.jsdelivr.net', \"'nonce-#\{content_security_policy_nonce}'\"],
+                    'script-src': [\"'self'\", 'https://cdn.jsdelivr.net', 'https://apis.google.com', 'https://accounts.google.com', \"'nonce-#\{content_security_policy_nonce}'\"],
                     'connect-src': [\"'self'\", 'https://cdn.jsdelivr.net']
                   })
                   csp
                 end
               end
             end
-          end
-
-          @_request.env['_brick_nonce'] %>>
+          end %>
+<style>#{::Brick::Rails::BRICK_CSS}</style>
+<script<%= @_request.env['_brick_nonce'] %>>
   if (window.history.state && window.history.state.turbo)
     window.addEventListener(\"popstate\", function () { location.reload(true); });
 </script>
@@ -881,7 +885,11 @@ callbacks = {} %>"
                                        poly_cols << @_brick_model.brick_foreign_type(v[1].first)
                                        v.last[1].each_with_object([]) { |x, s| s << "[#{x.name}, #{x.primary_key.inspect}]" }.join(', ')
                                      else
-                                       "[#{v.last[1].name}, #{v.last[1].primary_key.inspect}]"
+                                       # If the BT association specifies a column for the primary_key, use that ...
+                                       fm_pk = @_brick_model.reflect_on_association(v.last.first)&.options&.[](:primary_key)&.to_s ||
+                                               # ... otherwise, use the model's primary_key.
+                                               (v.last[1].primary_key.present? && v.last[1].primary_key)
+                                       "[#{v.last[1].name}, #{fm_pk.inspect}]"
                                      end
                     s << "#{v.first.inspect} => [#{v.last.first.inspect}, [#{foreign_models}], #{v.last[2].inspect}]"
                   end
@@ -942,7 +950,10 @@ if (window.brickFontFamily) {
                        when 'index'
                          if Object.const_defined?('DutyFree')
                            template_link = "
-  <%= link_to 'CSV', #{@_brick_model._brick_index}_path(format: :csv) %> &nbsp; <a href=\"#\" id=\"sheetsLink\">Sheets</a>
+  <%= csv_path = #{@_brick_model._brick_index}_path(format: :csv)
+      where_params = params.to_unsafe_h.each_with_object([]) { |v, s| s << \"#\{v.first}=#\{v[1]}\" if v.first.start_with?('__') }.join('&')
+      csv_path << \"?#\{where_params}\" unless where_params.blank?
+      link_to 'CSV', csv_path %> &nbsp; <a href=\"#\" id=\"sheetsLink\">Sheets</a>
   <div id=\"dropper\" contenteditable=\"true\"></div>
   <input type=\"button\" id=\"btnImport\" value=\"Import\">
 
@@ -973,19 +984,6 @@ if (window.brickFontFamily) {
   }
   var sheetUrl;
   var spreadsheetId;
-  var sheetsLink = document.getElementById(\"sheetsLink\");
-  function gapiLoaded() {
-    // Have a click on the sheets link to bring up the sign-in window.  (Must happen from some kind of user click.)
-    sheetsLink.addEventListener(\"click\", async function (evt) {
-      evt.preventDefault();
-      var client = google.accounts.oauth2.initTokenClient({
-        client_id: \"487319557829-fgj4u660igrpptdji7ev0r5hb6kh05dh.apps.googleusercontent.com\",
-        scope: \"https://www.googleapis.com/auth/spreadsheets https://www.googleapis.com/auth/drive.file\",
-        callback: updateSignInStatus
-      });
-      client.requestAccessToken();
-    });
-  }
 
   async function updateSignInStatus(token) {
     await new Promise(function (resolve) {
@@ -1044,7 +1042,24 @@ if (window.brickFontFamily) {
   }
 </script>
 <script src=\"https://apis.google.com/js/api.js\"></script>
-<script async defer src=\"https://accounts.google.com/gsi/client\" onload=\"gapiLoaded()\"></script>
+<script async defer src=\"https://accounts.google.com/gsi/client\" id=\"gapiScript\"<%= @_request.env['_brick_nonce'] %>></script>
+<script<%= @_request.env['_brick_nonce'] %>>
+  document.getElementById(\"gapiScript\").addEventListener(\"onload\",
+    function () { // gapiLoaded
+      var sheetsLink = document.getElementById(\"sheetsLink\");
+      // Have a click on the sheets link to bring up the sign-in window.  (Must happen from some kind of user click.)
+      sheetsLink.addEventListener(\"click\", async function (evt) {
+        evt.preventDefault();
+        var client = google.accounts.oauth2.initTokenClient({
+          client_id: \"487319557829-fgj4u660igrpptdji7ev0r5hb6kh05dh.apps.googleusercontent.com\",
+          scope: \"https://www.googleapis.com/auth/spreadsheets https://www.googleapis.com/auth/drive.file\",
+          callback: updateSignInStatus
+        });
+        client.requestAccessToken();
+      });
+    }
+  );
+</script>
 "
                          end # DutyFree data export and import
 # %%% Instead of our current "for Janet Leverling (Employee)" kind of link we previously had this code that did a "where x = 123" thing:
@@ -1319,7 +1334,7 @@ end
             kls = Object.const_get((rel = ::Brick.relations.fetch(r[0], nil))&.fetch(:class_name, nil))
           rescue
           end
-          if kls.is_a?(Class) && (path_helper = respond_to?(bi_path = \"#\{kls._brick_index}_path\".to_sym) ? bi_path : nil)
+          if kls.is_a?(Class) && kls.respond_to?(:_brick_index) && (path_helper = respond_to?(bi_path = \"#\{kls._brick_index}_path\".to_sym) ? bi_path : nil)
             link_to(r[0], send(path_helper))
           else
             r[0]
@@ -1454,21 +1469,11 @@ if (description = rel&.fetch(:description, nil)) %>
 end
 %><%= link_to \"(See all #\{model_name.pluralize})\", see_all_path, { class: '__brick' } %>
 #{::Brick::Rails.erd_markup(@_brick_model, prefix) if @_brick_model}
-<% if obj
-     # path_options = [obj.#{pk}]
-     # path_options << { '_brick_schema':  } if
-     options = {}
-     options[:url] = if obj.new_record?
-                       link_to_brick(obj.class, path_only: true) # Properly supports STI, but only works for :new
-                     else
-                       path_helper = obj.new_record? ? #{model_name}._brick_index : #{model_name}._brick_index(:singular)
-                       options[:url] = send(\"#\{path_helper}_path\".to_sym, obj) if ::Brick.config.path_prefix || (path_helper != obj.class.table_name)
-                     end
-%>
+<% if obj %>
   <br><br>
 
 <%= # Write out the mega-form
-    brick_form_for(obj, options, #{model_name}, bts, #{pk.inspect}) %>
+    brick_form_with(model: obj, bts: bts, pk: #{pk.inspect}) %>
 
 #{unless args.first == 'new'
   # Was:  confirm_are_you_sure = ActionView.version < ::Gem::Version.new('7.0') ? "data: { confirm: \"Delete #\{model_name} -- Are you sure?\" }" : "form: { data: { turbo_confirm: \"Delete #\{model_name} -- Are you sure?\" } }"
@@ -1603,7 +1608,7 @@ flatpickr(\".timepicker\", {enableTime: true, noCalendar: true});
    # Uncaught TypeError: Failed to resolve module specifier \"immutable-json-patch\". Relative references must start with either \"/\", \"./\", or \"../\".
    if @_json_fields_present %>
 <link rel=\"stylesheet\" type=\"text/css\" href=\"https://cdn.jsdelivr.net/npm/vanilla-jsoneditor@0.19.0/themes/jse-theme-default.min.css\">
-<script type=\"module\">
+<script type=\"module\"<%= @_request.env['_brick_nonce'] %>>
   import { JSONEditor } from \"https://cdn.jsdelivr.net/npm/vanilla-jsoneditor@0.19.0/index.min.js\";
   document.querySelectorAll(\"input.jsonpicker\").forEach(function (inp) {
     var jsonDiv;