cafe_car 0.2.1 → 0.3.0

data/lib/cafe_car/controller/filtering.rb

@@ -1,20 +1,105 @@
 module CafeCar::Controller::Filtering
   extend ActiveSupport::Concern
 
+  # URL params CafeCar consumes for control flow (sorting, pagination, view
+  # switching, keyword search) plus Rails' routing/form internals. Everything
+  # else on an index request is treated as a filter, so a bare `?price.min=10`
+  # or `?name=Widget` reaches the query DSL without a namespacing prefix.
+  CONTROL_PARAMS = %w[
+    controller action format id
+    sort page per view tab q chart_x chart_y chart_by
+    _method authenticity_token commit utf8 button _
+  ].freeze
+
   included do
-    helper_method :parsed_params, :dot_params, :filtered?, :search_term
+    helper_method :parsed_params, :filter_params, :permitted_filter_params,
+                  :filtered?, :search_term, :filtered_scope
   end
 
   private
 
   def filtered(scope)
-    scope.query([ parsed_params[""], search_term ].compact_blank)
+    scope.query([ permitted_filter_params, search_term ].compact_blank)
+  end
+
+  # The policy-scoped collection narrowed by the active filters + keyword search
+  # — the set the index is showing, before sorting/pagination. The single source
+  # of truth for "the viewed scope": #scope sorts + paginates it for display, a
+  # collection action runs its bang over exactly this set (Controller#collection_action),
+  # and the toolbar button counts it (Helpers#collection_action).
+  def filtered_scope(klass = model)
+    filtered(policy_scope(klass))
   end
 
   def filtered?
-    parsed_params[""].present? || search_term.present?
+    permitted_filter_params.present? || search_term.present?
+  end
+
+  # The filter params the policy permits — the enforcement half of the
+  # policy-is-source-of-truth pattern (Policy#permitted_filters /
+  # #permitted_scopes). Keys the policy doesn't list are silently dropped: a
+  # stray or hostile param just doesn't filter (no 400, and it never reaches
+  # the query DSL where an unknown key would raise).
+  def permitted_filter_params
+    @permitted_filter_params ||= prune_filters(policy(model.new), model, parsed_params[""] || {})
+  end
+
+  # Recursively keep only filter params whose FULL dot-path the policy permits.
+  # An association keyed to a nested hash (`{client: {status: ...}}`, not an
+  # operator group like `{min:, max:}`) is descended into the far model, extending
+  # the path; every other entry is a leaf validated at its full path. A crafted
+  # `?client.owner.secret=` — an undeclared nested path — is pruned here, before
+  # the query DSL builds any join. The security guarantee is identical to the
+  # top-level gate, just path-aware: the FULL path must clear #permitted_filter?.
+  def prune_filters(policy, klass, params, prefix = "")
+    params.each_with_object({}) do |(key, value), kept|
+      base = key.to_s.sub(/\W+$/, "")
+      ref  = klass.reflect_on_association(base)
+      if ref && value.is_a?(Hash) && !operator_params?(value)
+        nested = prune_filters(policy, ref.klass, value, "#{prefix}#{base}.")
+        kept[key] = nested if nested.present?
+      elsif permits_filter?(policy, klass, "#{prefix}#{base}", base)
+        kept[key] = value
+      end
+    end
+  end
+
+  # Classify a filter key the way QueryBuilder#param! does — on the base name,
+  # operator suffix stripped (`price>` → price, `title~` → title): a known
+  # attribute or association checks #permitted_filters at its full (possibly
+  # nested) path, anything else is a would-be scope and checks #permitted_scopes
+  # (scopes are top-level only, so `base` alone is right there).
+  def permits_filter?(policy, klass, path, base)
+    if klass.reflect_on_association(base) || klass.columns_hash.key?(base)
+      policy.permitted_filter?(path)
+    else
+      policy.permitted_scope?(base)
+    end
+  end
+
+  # A filter value whose keys are ALL comparison operators (`{min:, max:}`) is a
+  # terminal operator group, not a nested-association hash — the same test
+  # QueryBuilder#operators? makes before desugaring it to a range.
+  def operator_params?(hash)
+    hash.any? && hash.keys.all? { CafeCar::QueryBuilder::OPS.key?(_1.to_s) }
+  end
+
+  # The `?sort=` keys the policy permits — the sort half of the same gate that
+  # guards filtering. Ordering exposes a column's values as surely as filtering
+  # does, so a key is honored only when its base attribute clears
+  # #permitted_filter?; a non-permitted or hidden column (e.g. password_digest,
+  # or an attribute a policy leaves off #permitted_filters) is dropped before it
+  # reaches Model.sorted. A leading "-" (descending) and an `assoc.column`
+  # association-sort suffix are stripped to find the base name.
+  def permitted_sort
+    policy = policy(model.new)
+    sort_keys.select { |key| policy.permitted_filter?(sort_base(key)) }
   end
 
+  def sort_keys = params[:sort].to_s.split(",").filter_map { _1.strip.presence }
+
+  def sort_base(key) = key.delete_prefix("-").split(".", 2).first
+
   # Keyword term from the index search box. Read raw (not through ParamParser) so a
   # term keeps its literal text, then funneled into the query DSL as a bare String
   # that routes to `QueryBuilder#search!` alongside the dot-filters. Only a String
@@ -22,16 +107,33 @@ module CafeCar::Controller::Filtering
   # (otherwise the non-String would reach the query DSL and raise a 500).
   def search_term = (params[:q] if params[:q].is_a?(String)).presence
 
-  def dot_params
-    request.params.slice(*request.params.keys.grep(/^\./))
+  # Raw (unparsed) filter params — every request param that isn't a control
+  # param — for round-tripping the active filter into hidden form fields so a
+  # search or sort resubmission keeps it.
+  def filter_params
+    request.params.except(*CONTROL_PARAMS)
   end
 
+  # Filters always ride the URL, never a request body: on an index GET the whole
+  # param set is filters; on a collection-action POST they ride the query string
+  # (see Helpers#collection_action). A model-mutation POST (create/update) has no
+  # query string, so its body stays raw — it never reads parsed_params anyway.
   def parsed_params
     @parsed_params ||=
       if request.get? || request.head?
-        CafeCar::ParamParser.new(request.params).parsed
+        parse(request.params)
+      elsif request.query_parameters.present?
+        parse(request.query_parameters)
       else
         request.params
       end
   end
+
+  # Nest dot-keyed params (`price.min` → `{price: {min:}}`) via ParamParser, then
+  # stash the filter subset (control params removed) under "" for
+  # #permitted_filter_params.
+  def parse(params)
+    parsed = CafeCar::ParamParser.new(params).parsed
+    parsed.merge("" => parsed.except("", *CONTROL_PARAMS))
+  end
 end

data/lib/cafe_car/controller.rb

@@ -12,8 +12,14 @@ module CafeCar
         define_method(:model) { @model ||= model }
       end
 
-      def default_view(v = @default_view || "table")
-        @default_view = v.to_s
+      # The index view (`table`/`grid`/`chart`) shown when no `?view=` is given.
+      # `default_view :grid` sets it; a bare call reads the current value. Backed
+      # by an inheritable class_attribute (`_default_view`) so a subclass keeps
+      # its parent's setting — a bare class ivar would not carry across
+      # subclassing.
+      def default_view(view = nil)
+        self._default_view = view.to_s if view
+        _default_view
       end
 
       def cafe_car(only: nil, except: nil, model: nil)
@@ -36,11 +42,16 @@ module CafeCar
 
         before_action :set_current_attributes
 
-        before_action :find_object,       only: _only.(%i[show edit update destroy])
+        before_action :find_object,       only: _only.(%i[show edit update destroy member_action])
         before_action :build_object,      only: _only.(%i[new create])
         before_action :find_objects,      only: _only.(%i[index])
         before_action :assign_attributes, only: _only.(%i[create update])
-        before_action :authorize!
+        # `batch`, `options` and the custom-action endpoints are excluded: each
+        # authorizes on its own — `batch` per selected record (see #batch),
+        # `options` via `index?` plus the policy scope on the typeahead feed
+        # (see #options), `member_action`/`collection_action` via the named
+        # action's own policy predicate.
+        before_action :authorize!, except: %i[batch options member_action collection_action]
 
         after_action :verify_authorized, :verify_policy_scoped
       end
@@ -71,6 +82,11 @@ module CafeCar
       self.responder = CafeCar[:ApplicationResponder]
       default_form_builder CafeCar[:FormBuilder]
 
+      # Inheritable backing for `default_view` (see the class method) — a
+      # class_attribute carries the setting to subclasses; a bare class ivar
+      # would not.
+      class_attribute :_default_view, default: "table", instance_accessor: false
+
       define_callbacks_with_helpers :render, :update, :create, :destroy
       add_flash_types :success, :warning, :error
 
@@ -101,6 +117,86 @@ module CafeCar
       respond_with object
     end
 
+    # Apply a bulk action, named by `params[:bulk_action]`, to the selected records.
+    # The action name is derived, not registered: the model policy's
+    # `permitted_bulk_actions` is the whitelist (a name outside it is a bad request),
+    # `name?` is the per-record authorization predicate, and `name!` the model bang
+    # method applied. Every record is authorized ON ITS OWN — the candidate set is
+    # first narrowed to the policy scope (rows the user may see), then each is checked
+    # against `name?`; unauthorized rows are skipped, never bulk-bypassed. That
+    # per-record check is the security boundary, so Pundit's blanket
+    # `verify_authorized` is satisfied by `skip_authorization` after the fact.
+    def batch
+      skip_authorization # authorization is per-record below, not one blanket check
+      action = permitted_bulk_action(params[:bulk_action])
+      unless action
+        skip_policy_scope # no candidate query on the reject path
+        return head(:bad_request)
+      end
+
+      records = policy_scope(model).where(id: Array(params[:ids]))
+      batched = records.select { |record| action_allowed?(record, action) }
+      batched.each { |record| record.public_send("#{action}!") }
+
+      redirect_to url_for(action: :index), success: batch_notice(action, batched.size)
+    end
+
+    # Run a policy-declared custom action on one record:
+    # POST /<resources>/:id/actions/:member_action. The name resolves through the
+    # model policy's `permitted_member_actions` whitelist (anything else is a
+    # 404), its `name?` predicate authorizes, then — by convention — the record's
+    # `name!` bang method runs. A host overrides the behavior by defining a
+    # public controller method of the action's name; it takes over after
+    # authorization and owns the response.
+    def member_action
+      skip_authorization # authorized via the action's own predicate below
+      name = permitted_custom_action(params[:member_action], policy(object).attributes.actions.member)
+      return head(:not_found) unless name
+
+      authorize_action! object, name
+      return public_send(name) if respond_to?(name)
+
+      object.public_send("#{name}!")
+      redirect_back_or_to href_for(object), success: action_notice(:member_action, name)
+    end
+
+    # Run a policy-declared custom action over the collection:
+    # POST /<resources>/actions/:collection_action. Same derivation as
+    # #member_action — `permitted_collection_actions` whitelists, `name?` (asked
+    # of the model class) authorizes — then `name!` runs on the #filtered_scope,
+    # which ActiveRecord delegates to a class method within that scoping. It runs
+    # over the currently-viewed, filtered set (the button carries the active
+    # filters, its label shows the count) — "Publish all" acts on exactly the
+    # records the user is looking at. A host override (a public controller method
+    # of the action's name) scopes its own query.
+    def collection_action
+      skip_authorization # authorized via the action's own predicate below
+      name = permitted_custom_action(params[:collection_action], policy(model.new).attributes.actions.collection)
+      unless name
+        skip_policy_scope # no query on the reject path
+        return head(:not_found)
+      end
+
+      authorize_action! model, name
+      return public_send(name) if respond_to?(name)
+
+      filtered_scope.public_send("#{name}!")
+      redirect_to url_for(action: :index), success: action_notice(:collection_action, name)
+    end
+
+    # JSON typeahead feed for a searchable association select (Tom Select). Returns
+    # `[{value, text}]` for the model, filtered by the `?q=` keyword search and
+    # capped at `max_collection_options` — so an association field can reach records
+    # PAST the render cap. Authorized twice: `index?` gates list access at all, and
+    # `policy_scope` narrows rows to those the user may see (never leaking hidden ones).
+    def options
+      authorize model, :index?
+      scope = policy_scope(model)
+      scope = scope.query([ search_term ]) if search_term
+      records = scope.limit(CafeCar.max_collection_options)
+      render json: records.map { |record| { value: record.id, text: option_label(record) } }
+    end
+
     def respond_with(*resources, **options, &block)
       super(*namespace, *resources, **options, &block)
     end
@@ -117,13 +213,72 @@ module CafeCar
       flash[:success] = present(object).i18n("#{action_name}_html", scope: :flashes)
     end
 
+    def permitted_bulk_action(param)
+      permitted_custom_action(param, policy(model.new).attributes.actions.bulk)
+    end
+
+    # The whitelisted action name matching `param` — a symbol drawn from the
+    # given policy-declared list, or nil for a name outside it. #batch,
+    # #member_action and #collection_action send `<name>!`/`<name>?`, so
+    # resolving through the whitelist here means the derived method is always a
+    # policy-declared name, never the raw request value (a bare param would be
+    # a dynamic-send footgun).
+    def permitted_custom_action(param, permitted)
+      permitted.find { |a| a.to_s == param.to_s }
+    end
+
+    # Whether `subject` (a record, or the model class for collection actions)
+    # grants `action` — its `action?` policy predicate. Guarded by `respond_to?`
+    # so a permitted action without a predicate simply denies rather than erroring.
+    def action_allowed?(subject, action)
+      policy    = policy(subject)
+      predicate = "#{action}?"
+      policy.respond_to?(predicate) && policy.public_send(predicate)
+    end
+
+    # #action_allowed?, but raising: one denied custom action is a refusal
+    # (rendered by render_unauthorized), not a skippable row like in #batch.
+    def authorize_action!(subject, action)
+      return if action_allowed?(subject, action)
+      raise Pundit::NotAuthorizedError.new(query: "#{action}?", record: subject, policy: policy(subject))
+    end
+
+    # Success flash for a custom action, from the locale —
+    # `flashes.member_action` / `flashes.collection_action`, interpolating the
+    # action's label (`en.<name>`, humanized fallback) and the model name.
+    def action_notice(kind, name)
+      label = I18n.t(name, default: name.to_s.humanize)
+      I18n.t(kind, scope: :flashes, action: label,
+             model: model_name.human.downcase, models: model_name.human(count: 2).downcase)
+    end
+
+    def batch_notice(action, count)
+      label = I18n.t(action, default: action.to_s.humanize)
+      "#{label} #{count} #{model_name.human(count:).downcase}"
+    end
+
+    # Plain-text label for a typeahead option — the record's policy title attribute
+    # (e.g. a user's name), falling back to its id. Kept scalar so the JSON feed
+    # never serializes the HTML the presenter's #title emits.
+    def option_label(record)
+      attribute = policy(record).title_attribute
+      record.public_send(attribute).to_s.presence || record.to_s
+    end
+
     def sorted(scope)
-      scope.sorted(*params[:sort].presence)
+      scope.sorted(*permitted_sort)
     end
 
     def paginated(scope, page: params[:page], per: params[:per])
       return scope if request.format.csv? # CSV exports the full filtered+sorted set
-      scope.page(page).per(per)
+      scope.page(page).per(capped_per(per))
+    end
+
+    # Clamp `?per=` to `CafeCar.max_per_page` so an oversized request can't load an
+    # unbounded table into memory. A blank `per` falls through to Kaminari's default.
+    def capped_per(per)
+      return per if per.blank?
+      [ per.to_i, CafeCar.max_per_page ].min
     end
 
     def build_object
@@ -146,10 +301,60 @@ module CafeCar
       object.assign_attributes(permitted_attributes(object))
     end
 
-    def scope   = model.all.then { policy_scope _1 }
-                           .then { sorted _1 }
-                           .then { filtered _1 }
-                           .then { paginated _1 }
+    # Pundit permits attachment names as scalars, but a `has_many_attached`
+    # field posts an array of uploads that a scalar permit silently drops — so
+    # only one file (or none) would persist. Expand those keys to `{ name => [] }`
+    # so every uploaded file survives strong-params.
+    def permitted_attributes(record, action = action_name)
+      policy = policy(record)
+      method = "permitted_attributes_for_#{action}"
+      method = "permitted_attributes" unless policy.respond_to?(method)
+      multi  = multiple_attachments(record)
+      keys   = policy.public_send(method).map { |k| multi.include?(k) ? { k => [] } : k }
+      pundit_params_for(record).permit(*keys)
+    end
+
+    # Names of the record's `has_many_attached` attachments — the fields whose
+    # form submits an array of files.
+    def multiple_attachments(record)
+      klass = record.is_a?(Class) ? record : record.class
+      klass.try(:reflect_on_all_attachments)
+           &.select { _1.macro == :has_many_attached }
+           &.map    { _1.name.to_sym } || []
+    end
+
+    def scope   = filtered_scope.then { sorted _1 }
+                                .then { eager_loaded _1 }
+                                .then { paginated _1 }
+
+    # Preload the associations an index will render so a multi-row table costs a
+    # bounded number of queries instead of one-per-row-per-association (N+1).
+    # With nothing to preload, `.includes` would raise on empty args — skip it.
+    def eager_loaded(scope)
+      eager_loaded_associations.then { _1.any? ? scope.includes(*_1) : scope }
+    end
+
+    # The displayed belongs_to / has_many associations, each nested with the
+    # attachment its preview renders (so the association's own avatar isn't a
+    # second-order N+1). Intersecting with `displayable_associations` drops
+    # polymorphic ones — which can't be naively `.includes`d — since it already
+    # excludes them.
+    def eager_loaded_associations
+      policy = policy(model.new)
+      (policy.attributes.displayable & policy.displayable_associations).map { with_preview(_1) }
+    end
+
+    # `name`, or `{ name => { logo_attachment: :blob } }` when the associated
+    # record's preview shows a logo attachment.
+    def with_preview(name)
+      klass      = model.reflect_on_association(name).klass
+      logo       = policy(klass.new).logo_attribute
+      attachment = logo && klass.reflect_on_attachment(logo)
+      return name unless attachment
+
+      plural = attachment.macro == :has_many_attached
+      { name => { "#{logo}_attachment#{'s' if plural}": :blob } }
+    end
     def objects = instance_variable_get("@#{model_name.plural}")
     def objects=(value)
       instance_variable_set("@#{model_name.plural}", value)
@@ -198,10 +403,14 @@ module CafeCar
     end
 
     def _render_with_renderer_json(obj, options)
+      # Plain payloads (e.g. the #options typeahead feed's [{value, text}] array)
+      # aren't records — serialize them verbatim rather than deriving model columns.
+      return super unless obj.is_a?(CafeCar::Model) || obj.respond_to?(:klass)
+
       # permitted_attributes is record-oriented, so ask a record for the column
       # list even when serializing a collection.
       record = obj.is_a?(CafeCar::Model) ? obj : obj.klass.new
-      options[:only] ||= [ :id ] | policy(record).displayable_attributes
+      options[:only] ||= [ :id ] | policy(record).attributes.displayable
 
       if obj.is_a?(CafeCar::Model)
         options[:include] ||= policy(obj).displayable_associations

data/lib/cafe_car/engine.rb

@@ -83,12 +83,12 @@ module CafeCar
       require "csv"
 
       # CSV export of an index's filtered+sorted collection. Columns mirror the
-      # JSON renderer's policy-respecting basis (`[:id] | displayable_attributes`)
+      # JSON renderer's policy-respecting basis (`[:id] | attributes.displayable`)
       # so exports never leak attributes the policy hides, narrowed to scalar DB
       # columns. Associations are out of scope for v1 (only scalar values).
       ActionController::Renderers.add :csv do |collection, options|
         klass   = collection.respond_to?(:klass) ? collection.klass : collection.class
-        basis   = options[:only] || [ :id ] | policy(klass.new).displayable_attributes
+        basis   = options[:only] || [ :id ] | policy(klass.new).attributes.displayable
         columns = basis & klass.column_names.map(&:to_sym)
         text    = columns.select { klass.columns_hash[_1.to_s]&.type.in?(%i[string text]) }
 

data/lib/cafe_car/field_info.rb

@@ -25,13 +25,20 @@ module CafeCar
     def associated?  = reflection.present?
     def polymorphic? = reflection&.polymorphic?
     def digest?      = method =~ /_digest$/
+    def enum?        = model.try(:defined_enums)&.key?(@method.to_s)
+    def values       = model.defined_enums[@method.to_s].keys
     def password?    = type == :password
     def rich_text?   = reflection&.name =~ /^rich_text_(\w+)$/
     def attachment?  = model.reflect_on_attachment(method)
-    def collection   = reflection.klass.all
+    def multiple?    = attachment?&.macro == :has_many_attached
+    def collection   = reflection.klass.limit(CafeCar.max_collection_options)
     def reflection
       return if @method.nil?
-      model.try(:reflect_on_association, @method) || reflections_by_attribute[@method]
+      # A nested-attributes permit names the key `<assoc>_attributes` (what Rails'
+      # strong-params and `fields_for` use) — resolve it back to the association,
+      # the same way `nested_attributes_type` chomps the suffix.
+      key = @method.to_s.chomp("_attributes")
+      model.try(:reflect_on_association, key) || reflections_by_attribute[key]
     end
 
     def abrogated_keys
@@ -42,11 +49,12 @@ module CafeCar
 
     def default_type
       case method
-      when :controls then method
+      when :controls, :select then method
       end
     end
 
     def reflection_type = reflection&.macro
+    def enum_type       = (:enum if enum?)
     def attribute_type  = model.type_for_attribute(@method)&.type
     def digest_type
       key = @method.to_s.chomp("_confirmation")
@@ -85,7 +93,7 @@ module CafeCar
 
     def type
       return if @method.nil?
-      @type ||= nested_attributes_type || reflection_type || attribute_type || digest_type ||
+      @type ||= nested_attributes_type || reflection_type || enum_type || attribute_type || digest_type ||
                 attachment_type || default_type ||
                 raise(NoMethodError.new "Can't find attribute :#{@method} on #{model_name}", @method)
     end
@@ -107,10 +115,12 @@ module CafeCar
       when :decimal  then :text_field
       when :text, :json then :text_area
       when :integer  then :number_field
+      when :boolean  then :check_box
       when :date     then :date_field
       when :datetime then :datetime_field
       when :password then :password_field
       when :nested   then :fields_for
+      when :enum     then :enum
       when :attachment then :file_field
       when :belongs_to, :has_many then :association
       when :has_one

data/lib/cafe_car/filter/field_info.rb

@@ -4,15 +4,64 @@ class CafeCar::Filter::FieldInfo < CafeCar[:FieldInfo]
   rescue I18n::MissingTranslationData
   end
 
+  # A nested filter names a dot-path (`client.status`, `client.owner_id`) — the
+  # panel's control still posts the full path, but the TYPE that picks its control
+  # comes from the terminal attribute on the far model. `#terminal` is that far
+  # FieldInfo, reached by walking the leading association hops; the three data
+  # sources a control needs (type, enum values, reflection) delegate to it, so a
+  # nested belongs_to renders the same select as a top-level one, a nested enum
+  # the same enum select, etc. Labels/placeholders stay on the dotted path so they
+  # read disambiguated ("Client status"). `#method` keeps the dotted key, so every
+  # `_*_filter` partial names the control with the exact param the gate consumes.
+  def nested? = @method.to_s.include?(".")
+
+  def terminal
+    @terminal ||= begin
+      *hops, leaf = @method.to_s.split(".")
+      far = hops.reduce(@model) { |klass, hop| klass.reflect_on_association(hop).klass }
+      self.class.new(model: far, method: leaf)
+    end
+  end
+
+  def type       = nested? ? terminal.type       : super
+  def values     = nested? ? terminal.values     : super
+  def reflection = nested? ? terminal.reflection : super
+
+  # The submitted field name for the terminal control. A nested belongs_to posts
+  # the far foreign key under the full path (`client.owner` declared → the select
+  # posts `client.owner_id`); every other nested control posts the path itself.
+  def input_key
+    return super unless nested?
+    *hops, _leaf = @method.to_s.split(".")
+    type == :belongs_to ? [ *hops, terminal.reflection.foreign_key ].join(".") : @method.to_s
+  end
+
+  # An accepts_nested_attributes association is still just an association to
+  # filter by — the :nested type only matters to edit forms (fields_for).
+  def nested_attributes_type = nil
+
+  # Enum choices are the enum keys — the URL carries the readable key
+  # (`?status=archived`); QueryBuilder#parse_value passes enum keys through
+  # untouched and ActiveRecord casts them to the stored value.
+  def choices = values
+
+  # Types filtered by a min/max control pair (see _range_filter).
+  def range? = type.in?(%i[integer decimal float date datetime])
+
+  # Attributes the panel renders no control for: file attachments, rich text
+  # (keyword search already covers body text), polymorphic targets (no single
+  # collection to enumerate), and write-only password fields.
+  def unfilterable? = attachment? || rich_text? || polymorphic? || password?
+
   def input
     case type
-    when :string   then :text_field
-    when :text     then :text_field
-    when :decimal  then :text_field # :range_field
-    when :integer  then :text_field # :range_field
-    when :date     then :text_field
-    when :datetime then :text_field
-    when :password then :password_field
+    when :string, :text         then :text_field
+    when :integer               then :number_field
+    when :decimal, :float       then :number_field
+    when :date, :datetime       then :date_field
+    when :enum                  then :enum
+    when :boolean               then :select
+    when :password              then :password_field
     when :belongs_to, :has_many then :association
     when :has_one
       rich_text? ? :text_field : nil

data/lib/cafe_car/filter/form_builder.rb

@@ -1,21 +1,71 @@
 module CafeCar::Filter
   class FormBuilder < CafeCar[:FormBuilder]
+    # Rewrites a control's name to its bare dot-query key — `price` stays
+    # `price`, operators compose as `price.min` — instead of the edit form's
+    # `model[price]` nesting, so a submitted control IS a filter param
+    # (Controller::Filtering treats every non-control index param as a filter).
     def self.dotted_name(method)
       define_method method do |key, *args, **opts, &block|
         super(key, *args, name: field_name(key), **opts, &block)
       end
     end
 
-    instance_methods.grep(/_(field|select)$/).each do |method|
-      dotted_name method
+    instance_methods.grep(/_field$/).each { dotted_name _1 }
+
+    # The select family takes (options, html_options) hash pairs positionally,
+    # so the name rewrite rides in html_options (an explicit :name still wins).
+    def select(method, choices = nil, options = {}, html_options = {}, &block)
+      super(method, choices, options, { name: field_name(clean(method)) }.merge(html_options), &block)
+    end
+
+    def collection_select(method, collection, value_method, text_method, options = {}, html_options = {})
+      # A multi-select posts a set (`author_id[]`). We name every filter control
+      # explicitly, which defeats Rails' automatic `[]` suffix, so restore it here.
+      name  = field_name(clean(method))
+      name += "[]" if html_options[:multiple]
+      super(method, collection, value_method, text_method, options,
+            { name: }.merge(html_options))
+    end
+
+    def model = object.model
+
+    def clean(method)        = method.to_s.sub(/^\W+|\W+$/, "")
+    def field_name(*methods) = methods.join(".")
+
+    # Filter fields reflect through Filter::FieldInfo (the typed filter control
+    # mapping), keyed on the cleaned name so `name~` and `name` share one info.
+    def info(method)
+      @infos ||= {}
+      @infos[clean(method)] ||= const(:FieldInfo).new(model:, method: clean(method))
     end
 
-    def clean(method) = method.to_s.sub(/^\W+|\W+$/, "")
-    def info(method)  = super(clean(method))
+    # The policy's permitted_filters — the panel's enumeration source — minus
+    # what the view already rendered and the types no control can express.
+    def remaining_attributes
+      policy.attributes.filterable.reject { info(_1).unfilterable? } - @fields.keys
+    end
+
+    def scopes = policy.permitted_scopes
+
+    # A filter is always optional — no required-* marker on its label.
+    def label(method, text = nil, **opts, &)
+      opts[:class] = [ ui.class(%i[field label]), *opts[:class] ]
+      super(method, *text, required: false, **opts, &)
+    end
+
+    # The typed control for one permitted filter: the `_<type>_filter` partial
+    # (host-overridable per type), `_range_filter` for the min/max family, then
+    # the generic `_filter` fallback.
+    def filter(method, **opts)
+      info    = info(method)
+      partial = [ "#{info.type}_filter", ("range_filter" if info.range?), "filter" ]
+                  .compact.find { @template.partial?(_1) }
+      @template.render(partial, f: self, info:, **opts)
+    end
 
-    def field_name(*methods, multiple: false, index: @options[:index])
-      # TODO: handle multiple/index
-      [ "", *methods ].join(".")
+    # A checkbox that turns a permitted model scope on (`?published=true`).
+    def scope_toggle(scope)
+      @template.render("scope_filter", f: self, scope:)
     end
   end
 end