concerns_on_rails 1.28.8 → 1.28.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3ae4fb29ea12389fc8aaff341a565a482bf3c8ef99fdcfc7791c64c7302d1ca5
-  data.tar.gz: 02ea08bceb25e2a479e27ef00342c69cfeac2ffc8129b689269f423819c0c0ae
+  metadata.gz: f292a3f1cf7d1fae3b1e47be9daa416ae0b6c8b69ce0d4fd2efd583496f2d9aa
+  data.tar.gz: 661ffce3f3fa4fb305957b239fbb560752ea22f369da3268d03575efb35701da
 SHA512:
-  metadata.gz: 4ac2edd1717ef0e4c157b851e75554ba057321e1ae9f283bcdb015e9e6d49d63f1f4bf9bc9ee4419e0b28a111487147516957a03b17ae3915c7ac23f8a721109
-  data.tar.gz: 826dd0234e22faa23b089fbedd7900c8bc847f8f7af5670c6a6b0dafc22ec838b29e0cf196b0269b8dde798302d43c677eb4c93d60396db207d6e733d0f16ff2
+  metadata.gz: a49931859e637327e55313e7473236a4ceca6a5f61c01f7f701a7d7acba317c8fe6a83ec05ec2dafa5d7e61da45d8d2623a26f15a876d9e7d12036cd9c40c451
+  data.tar.gz: 625395f36729c2d789b303cfeec6537dfa173364b70c0a6c971707616a0fb3161d5eef083417aadcc9586a7b99c89d9a7617355e08284cdb76d210a62a3df82f

data/CHANGELOG.md

@@ -1,5 +1,60 @@
 <!-- CHANGELOG.md -->
 
+## 1.28.9 (2026-09-19)
+
+CI now runs the matrix the gemspec actually claims: Rails 7.0–8.0 across Ruby 3.2/3.3/3.4,
+plus **PostgreSQL and MySQL** alongside SQLite. The suite had only ever run on SQLite, which
+is the most permissive of the three, and the first green-on-SQLite run of the new matrix
+failed 29 examples on MySQL and 7 on PostgreSQL.
+
+Almost all of those were specs asserting SQLite's own SQL rather than the gem misbehaving —
+but one was a real bug, and it is the reason this is a release and not just a CI change.
+
+### Fixed
+- **Models::Taggable**: `tagged_with` was broken on MySQL and inconsistent on PostgreSQL.
+  - On **MySQL** every `tagged_with` query was a **syntax error**. The clause inlined
+    `ESCAPE '\'` into hand-written SQL, and MySQL treats backslash as an escape character
+    inside string literals, so the escape consumed its own closing quote. SQLite and
+    PostgreSQL (with `standard_conforming_strings`) read it as a literal backslash, which is
+    why this was invisible for so long. The clause is now built with Arel `matches`, so the
+    adapter quotes the escape character itself — one code path, no per-adapter branching.
+  - On **PostgreSQL** `tagged_with` was case-SENSITIVE, while on SQLite and MySQL it folded
+    case: the same query returned different rows depending on the database. It is now
+    case-insensitive on all three (`ILIKE` on PostgreSQL).
+
+  ⚠️ **PostgreSQL users: this widens `tagged_with`.** A lookup that was case-sensitive before
+  now also matches differently-cased tags. That is the documented intent of the concern and
+  it makes the three adapters agree, but it is a behaviour change on upgrade. If you relied
+  on case-sensitive matching, declare `taggable_by :tags, downcase: true` and fold on write.
+  SQLite and MySQL users see no change. Note the Ruby-side helpers (`tagged_with?`,
+  `all_tags`, `tag_counts`) still compare exactly — `downcase: true` is what makes the scope
+  and the helpers agree.
+
+### Internal
+- **CI**: `.github/workflows/ci.yml` gains a Rails-version axis (7.0, 7.1, 7.2, 8.0 × Ruby
+  3.2/3.3/3.4, via `gemfiles/*.gemfile`) and an adapter axis (PostgreSQL and MySQL service
+  containers). `DB=postgresql` / `DB=mysql2` selects the adapter locally; SQLite stays the
+  default so a plain checkout still needs no services. (#102)
+- **Specs**: examples that asserted SQL now build the expected fragment from the
+  connection's own quoting, via new `TestDatabase.quoted_table` / `quoted_column` /
+  `qualified` helpers and `sqlite?` / `postgresql?` / `mysql?` predicates — so an assertion
+  means the same thing on every adapter instead of encoding SQLite's. Several examples got
+  *stronger* in the process: the Sortable NULL-ordering pair now asserts the PostgreSQL
+  native-`NULLS` branch and the portable-`CASE` branch separately, each also asserting the
+  other is absent.
+- Three examples depended on SQLite-only tolerance rather than on the gem: a grouped
+  relation selecting `*` (rejected by PostgreSQL, and by MySQL under `only_full_group_by`),
+  a non-finite Float written to a float column (SQLite's adapter overrides `quote` for
+  those; MySQL emits a bare `NaN`), and a NULL page-boundary fixture that assumed SQLite's
+  NULLs-first ordering (PostgreSQL sorts NULLs last ascending).
+
+### Known gap
+- `Models::Storable` guards its JSON extraction with `json_valid` on SQLite only. MySQL has
+  `JSON_VALID()` (5.7.8+) and could have the same guard; it was left alone deliberately
+  rather than shipped unverified, since a wrong guess there would break every
+  `where_<key>` query on that adapter. PostgreSQL has no equivalent before PG 16's
+  `IS JSON`. Now that the MySQL leg runs, this is a small follow-up.
+
 ## 1.28.8 (2026-09-19)
 
 The last six open feature PRs, released as a patch by request. These had never been

data/README.md

@@ -148,7 +148,7 @@ across all 43 concerns — press <kbd>/</kbd> and type.
 - **Lean dependencies** — only `acts_as_list` (Sortable) and `friendly_id` (Sluggable), and both load **lazily**: an app that never includes those concerns never loads them. Depends on `activerecord`/`actionpack`/`activesupport`, not the full `rails` meta-gem; controller concerns have zero extra deps
 - **Schema-validated configuration** — every macro checks that the configured columns exist and raises `ArgumentError` early — listing *every* missing column at once, with one ready-to-paste `rails generate migration` command that adds them all
 - **Composable** — concerns are independent; mix and match per model
-- **Tested like an app, not a snippet** — **1,828 RSpec examples** run against a real database on every CI build
+- **Tested like an app, not a snippet** — **1,830 RSpec examples** run against a real database on every CI build
 - **Documented twice** — everything in this README also lives as a per-concern page on the [docs site](https://vsn2015.github.io/concerns_on_rails), searchable and deep-linkable
 
 ---
@@ -1200,6 +1200,7 @@ Article.published.tag_counts(limit: 20)        # => { "ruby" => 12, "rails" => 7
 
 **Notes**
 - Matching is **boundary-safe** — searching `rail` does not match `rails`. An explicit SQL `ESCAPE` clause makes tags containing `_` / `%` match literally on every adapter.
+- `tagged_with` matches **case-insensitively on every adapter** — `LIKE` on SQLite and MySQL, `ILIKE` on PostgreSQL — so one call means one thing everywhere (how non-ASCII characters fold is still the database collation's business). The Ruby-side helpers (`tagged_with?`, `all_tags`, `tag_counts`) compare exactly, so `downcase: true` — which folds on write — is what makes the scope and the helpers agree.
 - Tags are normalized in `before_validation`, so a direct `record.tags = "a, b"` assignment is cleaned too. An empty list stores `NULL`.
 - `tag_counts` runs one `GROUP BY` on the raw column — identical tag strings ship once with their row count and are split in Ruby — so it scales with distinct tag strings, not rows; ordered by count desc then name, `limit:` keeps the top N.
 - Reach for [`acts-as-taggable-on`](https://github.com/mbleigh/acts-as-taggable-on) when you need tag contexts, ownership, or polymorphic tags shared across models.
@@ -2502,9 +2503,9 @@ Point your agent at `llms.txt` for an overview, or paste a single concern's `.md
 
 ```sh
 bundle install                                  # install dev dependencies
-bundle exec rspec                               # run the test suite (1,828 examples)
+bundle exec rspec                               # run the test suite (1,830 examples)
 gem build concerns_on_rails.gemspec             # build the gem
-gem install ./concerns_on_rails-1.28.8.gem      # install locally
+gem install ./concerns_on_rails-1.28.9.gem      # install locally
 
 # Preview the docs site locally (GitHub Pages serves docs/ as-is):
 cd docs && python3 -m http.server 8000          # → http://localhost:8000

data/lib/concerns_on_rails/models/taggable.rb

@@ -28,6 +28,12 @@ module ConcernsOnRails
     #
     # Notes:
     #   * Matching is boundary-safe ("rail" does not match "rails").
+    #   * `tagged_with` matches case-INsensitively on every adapter — LIKE on
+    #     SQLite and MySQL, ILIKE on PostgreSQL — so one call means one thing
+    #     everywhere (how non-ASCII characters fold is still the database
+    #     collation's business). The Ruby-side helpers (`tagged_with?`,
+    #     `all_tags`, `tag_counts`) compare exactly, so `downcase: true`, which
+    #     folds on write, is what makes the scope and the helpers agree.
     #   * A tag cannot contain the delimiter (default ",") — input containing
     #     it is split into multiple tags on the spot (`add_tags("a,b")` adds
     #     "a" and "b"), everywhere, so what you read back always matches what
@@ -40,6 +46,10 @@ module ConcernsOnRails
       LABEL = "ConcernsOnRails::Models::Taggable".freeze
       DEFAULT_FIELD = :tags
       DEFAULT_DELIMITER = ",".freeze
+      # Same LIKE-escaping contract as Models::Searchable: the adapter quotes
+      # the escape character for us, so a backslash is portable here.
+      LIKE_ESCAPE = "\\".freeze
+      LIKE_SPECIAL = /[\\%_]/
 
       included do
         class_attribute :taggable_field, instance_accessor: false, default: DEFAULT_FIELD
@@ -68,9 +78,10 @@ module ConcernsOnRails
           tags = taggable_clean_all(names)
           return all if tags.empty?
 
-          clauses = tags.map { |t| taggable_clause(t) }
-          sql = clauses.map(&:first).join(any ? " OR " : " AND ")
-          where(sql, *clauses.flat_map(&:last))
+          predicates = tags.map { |tag| taggable_predicate(tag) }
+          return where(predicates.reduce { |memo, node| memo.or(node) }) if any
+
+          predicates.reduce(all) { |memo, node| memo.where(node) }
         end
 
         # All distinct tags currently stored across the table, sorted.
@@ -150,26 +161,36 @@ module ConcernsOnRails
                .reject(&:blank?).uniq
         end
 
-        # Boundary-safe match for one tag against the delimiter-joined column.
-        # Returns [sql_fragment, [bind_params...]]. An explicit ESCAPE clause makes
-        # the backslash escaping below work on every adapter (SQLite has no default
-        # LIKE escape), so a tag containing `_` or `%` matches literally.
-        def taggable_clause(tag)
-          column = "#{connection.quote_table_name(table_name)}.#{connection.quote_column_name(taggable_field)}"
-          # Escape the delimiter too (not just the tag): a delimiter that is a LIKE
-          # wildcard (% or _) must match literally. Use LIKE for the whole-column
-          # branch as well, so casing is uniform across all four branches — the
-          # previous `= ?` was case-sensitive while LIKE is not.
+        # Boundary-safe match for one tag against the delimiter-joined column:
+        # the tag alone, first, last, or somewhere in the middle. Built from
+        # Arel's `matches` rather than a hand-written LIKE string for two
+        # reasons.
+        #
+        # 1. The ESCAPE character is then quoted by the adapter. An inlined
+        #    `ESCAPE '\'` is a syntax error on MySQL, where a backslash escapes
+        #    its own closing quote inside a string literal, even though the very
+        #    same text is fine on SQLite and on PostgreSQL.
+        # 2. `case_sensitive: false` emits ILIKE on PostgreSQL, whose LIKE —
+        #    unlike SQLite's, and unlike MySQL's under a default _ci collation —
+        #    is case-sensitive, so `tagged_with` used to mean something
+        #    different there.
+        #
+        # An explicit ESCAPE is still what makes a tag containing `_` or `%`
+        # match literally (SQLite has no default LIKE escape).
+        def taggable_predicate(tag)
+          column = arel_table[taggable_field]
+          # Escape the delimiter too (not just the tag): a delimiter that is a
+          # LIKE wildcard (% or _) must match literally.
           delim = taggable_escape_like(taggable_delimiter)
           escaped = taggable_escape_like(tag)
-          esc = " ESCAPE '\\'"
-          ["(#{column} LIKE ?#{esc} OR #{column} LIKE ?#{esc} OR #{column} LIKE ?#{esc} OR #{column} LIKE ?#{esc})",
-           [escaped, "#{escaped}#{delim}%", "%#{delim}#{escaped}", "%#{delim}#{escaped}#{delim}%"]]
+          [escaped, "#{escaped}#{delim}%", "%#{delim}#{escaped}", "%#{delim}#{escaped}#{delim}%"]
+            .map { |pattern| column.matches(pattern, LIKE_ESCAPE, false) }
+            .reduce { |memo, node| memo.or(node) }
         end
 
         # Treat the user's tag as a LIKE literal: %, _ and \ are not wildcards.
         def taggable_escape_like(str)
-          str.gsub(/[\\%_]/) { |char| "\\#{char}" }
+          str.gsub(LIKE_SPECIAL) { |char| "#{LIKE_ESCAPE}#{char}" }
         end
       end
 

data/lib/concerns_on_rails/version.rb

@@ -1,3 +1,3 @@
 module ConcernsOnRails
-  VERSION = "1.28.8".freeze
+  VERSION = "1.28.9".freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: concerns_on_rails
 version: !ruby/object:Gem::Version
-  version: 1.28.8
+  version: 1.28.9
 platform: ruby
 authors:
 - Ethan Nguyen