fe 2.4.0 → 2.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e5901527c0d559c346f9b5260706bae3c5dca50aa53acad6e3389a9953ad3258
-  data.tar.gz: 6ce8e73924606203040a84222cf1ff2127855dff223331b9f83524a91ee8effb
+  metadata.gz: 07eacfa22a5212645158341f32b217501965ae360aa06b6e68b37ad4aee69431
+  data.tar.gz: 53552e5f2241cefc323121123da3778bd372cfe1ad65eb167173af4fa37c5bd8
 SHA512:
-  metadata.gz: 2d944254d553ae54b9ac39016114c797a2176fcdedaee5543e50da0fa9dc6162a81087df058f893900194c963c321141c63de5c21d3e25c3c74a103a263a7bc5
-  data.tar.gz: 120a3a78d3a8b443ca1c2cf9f43c36166e0883dfd8d075cc61655637053d02b4600100c9bcdce96a6102fe5fa40ca0e4c7ca150c13ba342234027aa10fe77c70
+  metadata.gz: 43ec7038e4d46ee2fcd3937685a877b8ff8bb3145a3a80957942313c3522c4d16000c60efda5b7f912db8fe6b73af39e280499904756dc5bfae08ee9b56f2fb5
+  data.tar.gz: '0854508da501735e100982d86842624bb71f634ec91b1736f0f687c34bfbd98b18b8b56ceacb300522ed53769c46066811fe1c4a5e4e4b94e13436747bdd8877'

data/README.md

@@ -202,6 +202,7 @@ sends 403. Exceptions raised in your hooks are not rescued.
 
 ### 2.4
 
+- **2.4.1**: Fixes to overwrite protection. The first save after a page loads is now checked in apps that load jQuery and fe's JavaScript as modules (importmap); before, the inline script that records the page's starting answers threw `$ is not defined`. Questionnaire edit pages now tell Turbo not to cache them, so Back loads the current answers instead of a copy whose old digest made the next save fail with a false conflict. A form Turbo shows without a full page load no longer keeps the last form's autosave timer or conflict lock. Answering a question that reveals another page no longer turns off autosave for the current page or makes Next skip saving it, which lost what was typed on that page afterward. Apps that keep their own copy of `fe.public.nojquery.js` should copy it again to get the last two fixes.
 - **Deny by default**: fe refuses answer sheets and its admin screens unless the host app allows them, and the app won't boot until it defines fe's access hooks. See [Upgrading to 2.4](#upgrading-to-24).
 
 ### 2.2

data/app/assets/javascripts/fe/fe.public.nojquery.js.erb

@@ -37,7 +37,9 @@ fe.pageHandler = {
 
   initialize : function(page) {
     this.auto_save_frequency = 30;  // seconds
-    this.timer_id = null;
+    // A form Turbo shows without a full page load reuses this object, so the last
+    // form's conflict lock must not carry over to it.
+    this._locked = false;
 
     this.current_page = page;
     $('#' + page).data('form_data', this.captureForm($('#' + page)));
@@ -153,19 +155,24 @@ fe.pageHandler = {
       return;
     }
 
-    this.unregisterAutoSave();  // don't auto-save while loading/saving
-    // will register auto-save on new page once loaded/shown
-
-    // Only save the current page if we haven't already saved it during navigation.
-    // Rapid Next/Prev clicks can call loadPage multiple times while current_page
-    // is still the old page — the second save would have a stale digest.
-    let current = $('#' + this.current_page);
-    if (!current.data('saved_on_leave')) {
-      current.data('saved_on_leave', true);
-      fe.debugLog('[fe concurrency] loadPage calling savePage for ' + this.current_page);
-      this.savePage();
-    } else {
-      fe.debugLog('[fe concurrency] loadPage: already saved ' + this.current_page + ' on leave, skipping');
+    // A background load (a conditional revealing another page) stays on the current
+    // page, so it must not stop autosave or mark the page as saved on leave; nothing
+    // would undo either, and Next would then skip saving what was typed after it.
+    if (!background_load) {
+      this.unregisterAutoSave();  // don't auto-save while loading/saving
+      // will register auto-save on new page once loaded/shown
+
+      // Only save the current page if we haven't already saved it during navigation.
+      // Rapid Next/Prev clicks can call loadPage multiple times while current_page
+      // is still the old page, and the second save would have a stale digest.
+      let current = $('#' + this.current_page);
+      if (!current.data('saved_on_leave')) {
+        current.data('saved_on_leave', true);
+        fe.debugLog('[fe concurrency] loadPage calling savePage for ' + this.current_page);
+        this.savePage();
+      } else {
+        fe.debugLog('[fe concurrency] loadPage: already saved ' + this.current_page + ' on leave, skipping');
+      }
     }
 
     if (!background_load) { 
@@ -296,6 +303,7 @@ fe.pageHandler = {
 
   // setup a timer to auto-save (only one timer, for the page being viewed)
   registerAutoSave: function(page) {
+    this.unregisterAutoSave();  // one timer at a time; a second load of the form must not leave an extra one running
     this.timer_id = setInterval(this.savePages, this.auto_save_frequency * 1000);
   },
 

data/app/controllers/concerns/fe/answer_sheets_controller_concern.rb

@@ -113,16 +113,33 @@ module Fe::AnswerSheetsControllerConcern
     return true
   end
 
-  # Inject the initial answers digest into the page as a <script> tag.
-  # This runs regardless of which views the host app overrides.
+  # Inject the initial answers digest into the page as a <script> tag, and keep the
+  # page out of Turbo's cache. This runs regardless of which views the host app overrides.
   def inject_answers_digest_script
     return unless @answers_digest.present? && @presenter&.active_page_link
     return unless response.content_type&.include?('text/html')
 
-    page_dom = @presenter.active_page_link.dom_id
+    page_selector = "##{@presenter.active_page_link.dom_id}".to_json
+    digest = @answers_digest.to_json
     debug_js = Fe.verbose_js_logging? ? "fe._verboseLogging = true; " : ""
-    script = "<script>$(function(){ #{debug_js}$('##{page_dom}').data('answers_digest', '#{@answers_digest}'); " \
-             "fe.debugLog('[fe concurrency] initial digest set via after_action: #{@answers_digest}'); });</script>"
-    response.body = response.body.sub('</body>', "#{script}</body>")
+    # Hosts that load jQuery and fe's JS as modules (importmap) run them after this
+    # script, so while the page is still loading it waits for DOMContentLoaded, which
+    # fires after those modules.
+    script = <<~HTML
+      <script>(function(){
+        var tries = 0;
+        var run = function(){
+          if (!window.jQuery) { if (++tries < 100) { setTimeout(run, 50); } return; }
+          jQuery(#{page_selector}).data('answers_digest', #{digest});
+          if (window.fe) { #{debug_js}fe.debugLog('[fe concurrency] initial digest set via after_action: ' + #{digest}); }
+        };
+        if (document.readyState === 'loading') { document.addEventListener('DOMContentLoaded', run); } else { run(); }
+      })();</script>
+    HTML
+    # A copy Turbo restored on Back would carry the answers and digest from when the
+    # page was left, so a later save could get a false conflict. Back loads it fresh.
+    response.body = response.body
+      .sub('</head>', %(<meta name="turbo-cache-control" content="no-cache"></head>))
+      .sub('</body>', "#{script}</body>")
   end
 end

data/lib/fe/version.rb

@@ -1,3 +1,3 @@
 module Fe
-  VERSION = "2.4.0"
+  VERSION = "2.4.1"
 end

data/spec/controllers/fe/answer_sheets_controller_spec.rb

@@ -4,6 +4,10 @@ describe Fe::AnswerSheetsController, type: :controller do
   let(:question_sheet) { create(:question_sheet) }
   let(:answer_sheet) { create(:answer_sheet, applicant_id: create(:fe_person).id) }
 
+  def digest_script(body)
+    body.scan(%r{<script>(.*?)</script>}m).flatten.find { |script| script.include?('answers_digest') }
+  end
+
   context 'access control' do
     before do
       create(:answer_sheet_question_sheet, question_sheet: question_sheet, answer_sheet: answer_sheet)
@@ -143,6 +147,70 @@ describe Fe::AnswerSheetsController, type: :controller do
       expect(assigns(:elements)).to eq([])
       expect(assigns(:page)).to eq(page)
     end
+    it 'adds the initial answers digest script without calling jQuery first' do
+      create(:answer_sheet_question_sheet, question_sheet: question_sheet, answer_sheet: answer_sheet)
+      create(:page, question_sheet: question_sheet)
+
+      get :edit, params: {id: answer_sheet.id}
+
+      script = digest_script(response.body)
+      expect(script).to include(assigns(:answers_digest))
+      expect(script).not_to match(/\A\s*\$/)
+    end
+    it 'keeps the page out of the Turbo cache, so Back loads its current answers and digest' do
+      create(:answer_sheet_question_sheet, question_sheet: question_sheet, answer_sheet: answer_sheet)
+      create(:page, question_sheet: question_sheet)
+
+      get :edit, params: {id: answer_sheet.id}
+
+      head = response.body[%r{<head>.*</head>}m]
+      expect(head).to include('<meta name="turbo-cache-control" content="no-cache">')
+    end
+    it 'stores the initial answers digest whenever jQuery and fe load' do
+      skip 'node is not installed' unless system('node', '-v', out: File::NULL, err: File::NULL)
+      allow(Fe).to receive(:verbose_js_logging?).and_return(true)
+      create(:answer_sheet_question_sheet, question_sheet: question_sheet, answer_sheet: answer_sheet)
+      create(:page, question_sheet: question_sheet)
+
+      get :edit, params: {id: answer_sheet.id}
+
+      harness = <<~JS
+        const vm = require('vm');
+        // Runs the script in a fake page and returns the digest it stored in jQuery data.
+        // jquery: loaded 'before' the script, 'after' it but before DOMContentLoaded, or 'later' still.
+        const run = ({ readyState, jquery, fe = true }) => {
+          const data = {}, listeners = [], timers = [];
+          const ctx = {
+            document: { readyState, addEventListener: (event, fn) => { if (event === 'DOMContentLoaded') listeners.push(fn); } },
+            setTimeout: (fn) => { timers.push(fn); },
+          };
+          ctx.window = ctx;
+          const page = #{"##{assigns(:presenter).active_page_link.dom_id}".to_json};
+          const jQuery = (selector) => {
+            if (selector !== page) throw new Error('digest script looked up ' + selector + ' instead of ' + page);
+            return { data: (key, value) => { data[key] = value; } };
+          };
+          const load = () => { ctx.jQuery = jQuery; if (fe) ctx.fe = { debugLog() {} }; };
+          if (jquery === 'before') load();
+          vm.runInNewContext(#{digest_script(response.body).to_json}, ctx);
+          if (jquery === 'after') load();
+          listeners.forEach((fn) => fn());
+          if (jquery === 'later') load();
+          while (timers.length) timers.shift()();
+          return data.answers_digest || null;
+        };
+        console.log(JSON.stringify([
+          run({ readyState: 'loading', jquery: 'after' }),
+          run({ readyState: 'loading', jquery: 'before' }),
+          run({ readyState: 'complete', jquery: 'before' }),
+          run({ readyState: 'complete', jquery: 'before', fe: false }),
+          run({ readyState: 'complete', jquery: 'later' }),
+        ]));
+      JS
+
+      output = IO.popen(['node', '-e', harness], &:read)
+      expect(JSON.parse(output)).to eq([assigns(:answers_digest)] * 5)
+    end
     context 'when the question_sheet is blank' do
       context 'when referrer is available' do
         it 'should redirect to referrer' do

data/spec/controllers/fe/optimistic_concurrency_spec.rb

@@ -14,6 +14,21 @@ describe Fe::AnswerPagesController, 'optimistic concurrency', type: :controller
     page.rebuild_all_element_ids
   end
 
+  describe 'save response' do
+    it 'sends the page its new digest in the header and in the JS it returns' do
+      put :update, params: {
+        answers: { element1.id.to_s => 'An answer' },
+        answers_digest: answer_sheet.answers_digest(page),
+        id: page.id,
+        answer_sheet_id: answer_sheet.id
+      }, xhr: true, format: :js
+
+      new_digest = answer_sheet.answers_digest(page)
+      expect(response.headers['X-Answers-Digest']).to eq(new_digest)
+      expect(response.body).to include(".data('answers_digest', '#{new_digest}')")
+    end
+  end
+
   describe 'full round-trip: load → save → concurrent edit → stale save' do
     it 'allows first save, rejects second save with stale digest' do
       # === Tab A loads the page and gets the initial digest ===

data/spec/javascripts/fe_page_handler_spec.rb

@@ -0,0 +1,49 @@
+require 'rails_helper'
+
+# fe has no JS test runner, so this loads the real fe.public.nojquery script in Node
+# with a stand-in jQuery and checks what loadPage does to the page being left.
+describe 'fe.pageHandler.loadPage' do
+  let(:script) do
+    ERB.new(File.read(Fe::Engine.root.join('app/assets/javascripts/fe/fe.public.nojquery.js.erb'))).result(binding)
+  end
+
+  def run_load_page(background_load)
+    harness = <<~JS
+      const vm = require('vm');
+      const elements = {};
+      const element = (selector) => {
+        if (elements[selector]) return elements[selector];
+        const data = {};
+        const target = { length: 0, data: (key, value) => (value === undefined ? data[key] : (data[key] = value, proxy)) };
+        const proxy = new Proxy(target, { get: (t, key) => (key in t ? t[key] : () => proxy) });
+        return (elements[selector] = proxy);
+      };
+      const chain = new Proxy(function() {}, { get: () => chain, apply: () => chain, set: () => true });
+      const $ = (arg) => (typeof arg === 'string' ? element(arg) : chain);
+      Object.assign($, { validator: chain, ajax: () => {}, _data: () => ({}) });
+      const cleared = [];
+      const ctx = { $, jQuery: $, document: { addEventListener() {} }, console, clearInterval: (id) => cleared.push(id), setInterval: () => 99 };
+      ctx.window = ctx;
+      vm.runInNewContext(#{script.to_json}, ctx);
+      const handler = ctx.fe.pageHandler;
+      let saves = 0;
+      Object.assign(handler, {
+        current_page: 'page_a', timer_id: 42,
+        savePage: () => { saves += 1; }, validatePage: () => true, isPageLoaded: () => true, showPage: () => {},
+      });
+      handler.loadPage('page_b', '/page_b/edit', #{background_load});
+      console.log(JSON.stringify({ timerCleared: cleared.includes(42), saves, savedOnLeave: element('#page_a').data('saved_on_leave') || false }));
+    JS
+    JSON.parse(IO.popen(['node', '-e', harness], &:read))
+  end
+
+  before { skip 'node is not installed' unless system('node', '-v', out: File::NULL, err: File::NULL) }
+
+  it 'leaves autosave running and the page unmarked when a conditional loads another page in the background' do
+    expect(run_load_page(true)).to eq('timerCleared' => false, 'saves' => 0, 'savedOnLeave' => false)
+  end
+
+  it 'stops autosave and saves the page once when the user moves to another page' do
+    expect(run_load_page(false)).to eq('timerCleared' => true, 'saves' => 1, 'savedOnLeave' => true)
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: fe
 version: !ruby/object:Gem::Version
-  version: 2.4.0
+  version: 2.4.1
 platform: ruby
 authors:
 - CruGlobal
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-11-10 00:00:00.000000000 Z
+date: 2026-11-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -639,6 +639,7 @@ files:
 - spec/factories/question_sheet.rb
 - spec/factories/reference_questions.rb
 - spec/factories/reference_sheets.rb
+- spec/javascripts/fe_page_handler_spec.rb
 - spec/jobs/fe/update_reference_sheet_visibility_job_spec.rb
 - spec/lib/fe/access_control_spec.rb
 - spec/mailers/fe/notifier_spec.rb
@@ -797,6 +798,7 @@ test_files:
 - spec/factories/question_sheet.rb
 - spec/factories/reference_questions.rb
 - spec/factories/reference_sheets.rb
+- spec/javascripts/fe_page_handler_spec.rb
 - spec/jobs/fe/update_reference_sheet_visibility_job_spec.rb
 - spec/lib/fe/access_control_spec.rb
 - spec/mailers/fe/notifier_spec.rb