brick 1.0.244 → 1.0.245

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4de3ef8371e163df0913a1fe70d55666010abefcdcc77d26813a27ea3b72967f
-  data.tar.gz: 73dffd4bb0f5c5e9f57d1e19550cc212a67b4cc9636dd6eed53bee458cd155ee
+  metadata.gz: 74ab9c3403cc8ec25b0a2a2d24cc8c9cf871aa5de82daf92055542c70d4977df
+  data.tar.gz: 6e119a05135fb27a1d89b67cf8762a2d2d394876dfd79795481eb5f416476f06
 SHA512:
-  metadata.gz: 948aaae186933b70b69b8df65ac2081168edd4d3badc9cf7bcdfb2d2a49243be376bb70c3c15aef7e00fdbf42f5be5c51185a91e01e4728332e0e0a476382403
-  data.tar.gz: 500f395af03a898ed11ee8e3caad5fa0571568b19f1183a4f7b90793a8324e5d87870220b8a60b7e91d61e73ad7855d450a46711e8404c519bded7599b761866
+  metadata.gz: 220af7d1a7be7d224d0b25c8b9e3e635384067c408cd80bf012b289b83957c1bcda11a43eb152208b76bf80ec2d3cfa4c25b91ecfd9db4fa8710b217602ec766
+  data.tar.gz: 01c63fd12b462aa64ac72812f30541036c78e5934b4b5215ee1215394105d521be44771adcd9a5685cba2d784546f216b07016784c820e4cd510a4e367b9d873

data/lib/brick/rails/engine.rb

@@ -324,7 +324,7 @@ function linkSchemas() {
                       end
                     end
                   end
-"<script>
+"<script<%= @_request.env['_brick_nonce'] %>>
 #{JS_CHANGEOUT}
 document.addEventListener(\"turbo:render\", linkSchemas);
 window.addEventListener(\"popstate\", linkSchemas);
@@ -827,55 +827,46 @@ window.addEventListener(\"popstate\", linkSchemas);
                 table_options << "<option value=\"#{prefix}brick_#{table_option.downcase}\">(#{table_option})</option>".html_safe if show_it
               end
               css = +"<style>#{::Brick::Rails::BRICK_CSS}</style>
-<script>
+<script<%=
+          if @_request.respond_to?(:content_security_policy) && (csp = @_request.content_security_policy)&.directives&.present?
+            @_request.env['_is_brick'] = true
+            if @_request.respond_to?(:content_security_policy_nonce_directives)
+              @_request.content_security_policy_nonce_directives = %w[ script-src ]
+              @_request.env['_brick_nonce'] = \" nonce=\\\"#\{@_request.content_security_policy_nonce}\\\"\".html_safe
+            end
+            if !@_request.respond_to?(:_brick_content_security_policy)
+              if csp.instance_variables.exclude?(:@_brick_style_shas)
+                csp.instance_variable_set(:@_brick_style_shas, [
+                  \"'sha256-#\{Base64.encode64(Digest.const_get(:SHA256).digest(::Brick::Rails::BRICK_CSS)).chomp}'\",
+                  \"'sha256-#\{Base64.encode64(Digest.const_get(:SHA256).digest(::Brick::Rails::IN_APP_STYLE)).chomp}'\",
+                  \"'sha256-y+oXtN5Bag5VRQgH6D87Eo4UdOZOJiqg31ZNfDibDwM='\" # SHA for the text_field used in brick_field ('min-width: 154px;field-sizing: content;')
+                ])
+              end
+
+              ::ActionDispatch::ContentSecurityPolicy::Request.module_exec do
+                alias :_brick_content_security_policy :content_security_policy
+                def content_security_policy
+                  return _brick_content_security_policy if env['_is_brick'].blank?
+
+                  csp = ::ActionDispatch::ContentSecurityPolicy.new
+                  csp.directives.merge! ({
+                    'style-src': [\"'self'\", 'https://cdn.jsdelivr.net', \"'unsafe-hashes'\"] +
+                      _brick_content_security_policy.instance_variable_get(:@_brick_style_shas),
+                    'script-src': [\"'self'\", 'https://cdn.jsdelivr.net', \"'nonce-#\{content_security_policy_nonce}'\"],
+                    'connect-src': [\"'self'\", 'https://cdn.jsdelivr.net']
+                  })
+                  csp
+                end
+              end
+            end
+          end
+
+          @_request.env['_brick_nonce'] %>>
   if (window.history.state && window.history.state.turbo)
     window.addEventListener(\"popstate\", function () { location.reload(true); });
 </script>
 
 <%
-if @_request.respond_to?(:content_security_policy)
-  @_request.env['_is_brick'] = true
-  if (csp = @_request.content_security_policy).instance_variables.exclude?(:@_brick_style_shas)
-    csp.instance_variable_set(:@_brick_style_shas, [
-      \"'sha256-#\{Base64.encode64(Digest.const_get(:SHA256).digest(::Brick::Rails::BRICK_CSS)).chomp}'\",
-      \"'sha256-#\{Base64.encode64(Digest.const_get(:SHA256).digest(::Brick::Rails::IN_APP_STYLE)).chomp}'\"
-    ])
-  end
-  if !@_request.respond_to?(:_brick_content_security_policy)
-    ::ActionDispatch::ContentSecurityPolicy::Request.module_exec do
-      alias :_brick_content_security_policy :content_security_policy
-      def content_security_policy
-        # Add appropriate hashes for inline styles to the content-security-policy if needed
-        if (cspd = (csp = _brick_content_security_policy).directives.fetch('style-src', nil)) && env['_is_brick']
-          cspd.select! { |val| val == \"'self'\" }
-          if params['action'] == 'show'
-            cspd << \"'unsafe-inline'\"
-          else
-            csp.instance_variable_get(:@_brick_style_shas).each { |s| cspd << s }
-            cspd << \"'unsafe-hashes'\"
-          end
-          cspd << 'https://cdn.jsdelivr.net'
-        end
-        if (cspsd = csp.directives.fetch('script-src', nil))
-          cspsd.select! { |val| val == \"'self'\" }
-          cspsd << \"'unsafe-inline'\"
-          cspsd << 'https://cdn.jsdelivr.net'
-        end
-        if (cspcd = csp.directives.fetch('connect-src', nil))
-          cspcd.select! { |val| val == \"'self'\" }
-          cspcd << 'https://cdn.jsdelivr.net'
-        end
-        csp
-      end
-
-      alias :_brick_content_security_policy_nonce :content_security_policy_nonce
-      def content_security_policy_nonce
-        _brick_content_security_policy_nonce unless env['_is_brick']
-      end
-    end
-  end
-end
-
 # Accommodate composite primary keys that include strings with forward-slash characters
 def slashify(*vals)
   vals.map { |val_part| val_part.is_a?(String) ? val_part.gsub('/', '^^sl^^') : val_part }
@@ -902,7 +893,7 @@ callbacks = {} %>"
               end
 
               # %%% When doing schema select, if we're on a new page go to index
-              script = "<script>
+              script = "<script<%= @_request.env['_brick_nonce'] %>>
 // Add \"Are you sure?\" behaviour to any data-confirm buttons out there
 document.querySelectorAll(\"input[type=submit][data-confirm]\").forEach(function (btn) {
   btn.addEventListener(\"click\", function (evt) {
@@ -919,7 +910,8 @@ document.querySelectorAll(\"input[type=submit][data-confirm]\").forEach(function
   "\nbrickTestSchema = \"#{::Brick.test_schema}\";" if ::Brick.test_schema
 }
 function doFetch(method, payload, success) {
-  payload.authenticity_token = <%= (session[:_csrf_token] || form_authenticity_token).inspect.html_safe %>;
+  payload.authenticity_token = <%=
+   (!session.respond_to?(:enabled?) || session.enabled?) ? ((session[:_csrf_token] || form_authenticity_token).inspect.html_safe) : 'null' %>;
   var action = payload._brick_action || location.href;
   delete payload._brick_action;
   if (!success) {
@@ -954,7 +946,7 @@ if (window.brickFontFamily) {
   <div id=\"dropper\" contenteditable=\"true\"></div>
   <input type=\"button\" id=\"btnImport\" value=\"Import\">
 
-<script>
+<script<%= @_request.env['_brick_nonce'] %>>
   var dropperDiv = document.getElementById(\"dropper\");
   var btnImport = document.getElementById(\"btnImport\");
   var droppedTSV;
@@ -1130,7 +1122,7 @@ end
     <div class=\"colExclusion\"><%= excl %></div>
   <% end %>
   </div>
-  <script>
+  <script<%= @_request.env['_brick_nonce'] %>>
     [... document.getElementsByClassName(\"colExclusion\")].forEach(function (excl) {
       excl.addEventListener(\"click\", function () {
         doFetch(\"POST\", {_brick_unexclude: this.innerHTML});
@@ -1141,7 +1133,7 @@ end
    # SEARCH BOX
    if @_brick_es && @_brick_es&.index('r') # Must have at least Elasticsearch Read access %>
   <input type=\"text\" id=\"esSearch\" class=\"dimmed\">
-  <script>
+  <script<%= @_request.env['_brick_nonce'] %>>
     var esSearch = document.getElementById(\"esSearch\");
     var usedTerms = {};
     var isEsFiltered = false;
@@ -1504,7 +1496,7 @@ end
                  end
       s << "<table id=\"#{hm_name}\" class=\"shadow\">
         <tr><th>#{hm[1]}#{' poly' if hm[0].options[:as]} #{hm[3]}
-          <% if predicates && respond_to?(:new_#{partial_new_path_name = hm.first.klass._brick_index(:singular)}_path) %>
+          <% if defined?(predicates) && predicates && respond_to?(:new_#{partial_new_path_name = hm.first.klass._brick_index(:singular)}_path) %>
           <span class = \"add-hm-related\"><%=
             pk_val = (obj_pk = model.primary_key).is_a?(String) ? obj.send(obj_pk) : obj_pk.map { |pk_part| obj.send(pk_part) }
             pk_val_arr = [pk_val] unless pk_val.is_a?(Array)
@@ -1590,7 +1582,7 @@ end}
 }
 </style>
 <script src=\"https://cdn.jsdelivr.net/npm/flatpickr\"></script>
-<script>
+<script<%= @_request.env['_brick_nonce'] %>>
 flatpickr(\".datepicker\");
 flatpickr(\".datetimepicker\", {enableTime: true});
 flatpickr(\".timepicker\", {enableTime: true, noCalendar: true});
@@ -1639,7 +1631,7 @@ flatpickr(\".timepicker\", {enableTime: true, noCalendar: true});
 
 <% if true # @_brick_erd
 %>
-<script>
+<script<%= @_request.env['_brick_nonce'] %>>
   var imgErd = document.getElementById(\"imgErd\");
   var mermaidErd = document.getElementById(\"mermaidErd\");
   var mermaidCode;
@@ -1708,7 +1700,7 @@ flatpickr(\".timepicker\", {enableTime: true, noCalendar: true});
 "
               end
               if representation == :grid
-                inline << "<script>
+                inline << "<script<%= @_request.env['_brick_nonce'] %>>
 <% # Make column headers sort when clicked
    # %%% Create a smart javascript routine which can do this client-side %>
 [... document.getElementsByTagName(\"TH\")].forEach(function (th) {

data/lib/brick/rails/form_tags.rb

@@ -402,7 +402,7 @@ module Brick::Rails::FormTags
     end
     out << "  </tbody>
 </table>
-<script>
+<script<%= @_request.env['_brick_nonce'] %>>
   var constellation = document.getElementById(\"#{table_name}\");
   var nextSib,
       _this;
@@ -868,7 +868,7 @@ function onImagesLoaded(event) {
 </select></td>
 <td class=\"paddingTopZero\"><input id=\"txtColName\"></td>
 </tr></table>
-<script>
+<script<%= @_request.env['_brick_nonce'] %>>
 var btnAddCol = document.getElementById(\"btnAddCol\");
 btnAddCol.addEventListener(\"click\", function () {
  var txtColName = document.getElementById(\"txtColName\");

data/lib/brick/version_number.rb

@@ -5,7 +5,7 @@ module Brick
   module VERSION
     MAJOR = 1
     MINOR = 0
-    TINY = 244
+    TINY = 245
 
     # PRE is nil unless it's a pre-release (beta, RC, etc.)
     PRE = nil

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: brick
 version: !ruby/object:Gem::Version
-  version: 1.0.244
+  version: 1.0.245
 platform: ruby
 authors:
 - Lorin Thwaits
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-06-23 00:00:00.000000000 Z
+date: 2026-06-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activerecord