glib-web 5.1.5 → 6.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9663b2eb594fba65030c257cc3e343228a2d3a32857e11db73310a5ae12a264b
-  data.tar.gz: 577f3c5be804d1efd40e2e9de4bfa629216f4514a3bd14ca92beef6cfbd6cedb
+  metadata.gz: 8378cb302a462be1ed8ee965c9ace54b77c4eb29f7d1cc9d83a469c89d0f6d93
+  data.tar.gz: 91f29270361f13067e3bc513cd01091e82b09d7a89a40eadb4dab893b59f7a66
 SHA512:
-  metadata.gz: 37260aff5b03ad55ed5ffd904bc349d8a256d11ceb824380b4c541db0765237b82b05d376cb0835d8d83948460be97bacbfe176b6a442603496626d7ddf2fd83
-  data.tar.gz: ff4072d9f930e5a8da3ee7084c6a4be66da62d06b9fe49e3160876564c5ea3b251671832d68d44b9551b046b1182f3e7e3e3edabba9c07879b58a59026f23c96
+  metadata.gz: 62c1600d052a52e8fb020662ca4db7455518945e298c6e5ea5663e4960955d9d29129252b0780107b138bd4d585a4463f4bef253dc26460203acee362b083af8
+  data.tar.gz: 4d816f8451f71efbbb96fbcbe64fe1586211b3e328c42ec89580d711abe9f5d62033ff645f1622b855fa31e86eee5a383ed2ff6732d0a817ba6462bea6e23821

data/app/controllers/concerns/glib/json/ui.rb

@@ -32,6 +32,16 @@ module Glib::Json::Ui
     @__json_ui_activated
   end
 
+  # Call this after `render`-ing a json_ui response from a HALTING callback,
+  # e.g. a `rate_limit` handler or any before_action that renders. Halting
+  # skips the rest of the callback chain, including the after_action that
+  # swaps the JSON body for the HTML shell on browser page loads — without
+  # this, an HTML request would receive raw JSON. Safe to call
+  # unconditionally: the swap is a no-op for JSON/XHR requests.
+  def json_ui_commit_now
+    __json_ui_commit(self.class.__json_libs_init_options)
+  end
+
   def __json_ui_rendering?
     @__json_ui_rendering != nil
   end

data/app/controllers/glib/errors_controller.rb

@@ -1,7 +1,63 @@
 module Glib
+  # Receives browser-side JS error reports (see the npm package's
+  # `useGlibErrorReporter`) and forwards them to the app's error tracker
+  # server-side -- no client-side token or SDK needed. The client dedupes and
+  # caps reports per page load, so this endpoint is not expected to see
+  # sustained traffic.
   class ErrorsController < ::ActionController::Base
+    # The reporter sends the CSRF token when available, but a stale token
+    # must not turn error reporting itself into an error source (and a forged
+    # report is harmless telemetry).
+    skip_forgery_protection
+
+    # Abuse ceilings (Rails' built-in limiter, backed by the host app's cache
+    # store), TIERED by whether the report's CSRF token verifies: a valid
+    # token proves the report came from a page this app served to this
+    # session, so crafted floods live in the low tier while real browsers get
+    # headroom. Stale tabs (expired sessions -- often the very tabs that are
+    # erroring) also land in the low tier, which is SIZED TOGETHER with the
+    # client's self-caps (glib-web-npm utils/log.js budgets: 10 errors + 10
+    # warnings per page load, deduped) -- change them together or stale-tab
+    # reports get dropped. Excess reports are DROPPED with the same 204 as accepted ones,
+    # so an abuser learns nothing about the threshold or the tiers. NOTE:
+    # inert where the cache store is :null_store (typical test envs).
+    rate_limit to: 10, within: 1.minute, name: 'untrusted', with: -> { head :no_content }, unless: :trusted_report?
+    rate_limit to: 60, within: 1.minute, name: 'trusted', with: -> { head :no_content }, if: :trusted_report?
+    rate_limit to: 300, within: 1.hour, name: 'hourly', with: -> { head :no_content }
+
     def create
-      Rollbar.error(params[:stack], params[:message])
+      if defined?(Rollbar)
+        # `GLib.log.warn` reports arrive with level=warning; everything else
+        # (uncaught errors, `GLib.log.error`) is an error. Prefixed so
+        # browser-side reports are distinguishable from server exceptions;
+        # the details ride along as custom data for grouping.
+        rollbar_level = params[:level] == 'warning' ? :warning : :error
+        Rollbar.public_send(
+          rollbar_level,
+          "JS: #{params[:message]}",
+          stack: params[:stack],
+          url: params[:url],
+          context: params[:context],
+          user_agent: request.user_agent
+        )
+      end
+      head :no_content
     end
+
+    private
+      # CSRF enforcement stays skipped (stale tabs must still be able to
+      # report), but VERIFYING the token it sends anyway upgrades the
+      # rate-limit tier. Must never raise: a malformed token is simply
+      # untrusted.
+      def trusted_report?
+        return @trusted_report if defined?(@trusted_report)
+
+        @trusted_report =
+          begin
+            valid_authenticity_token?(session, params[:authenticity_token].to_s)
+          rescue StandardError
+            false
+          end
+      end
   end
 end

data/app/helpers/glib/json_ui/action_builder/logics.rb

@@ -10,6 +10,14 @@ class Glib::JsonUi::ActionBuilder
       bool :cacheData
       bool :skipOnChange
 
+      # Wrap the generated setter to lint the JsonLogic rules at render
+      # time (see JsonLogicLint). The rules are hashes keyed by target prop.
+      alias_method :conditionalData_without_lint, :conditionalData
+      def conditionalData(value)
+        Glib::JsonUi::JsonLogicLint.validate!(value) unless Rails.env.production?
+        conditionalData_without_lint(value)
+      end
+
       def dataBuilder(block)
         json.data do
           block.call(page.sview_builder)
@@ -22,6 +30,12 @@ class Glib::JsonUi::ActionBuilder
       hash :variables
       action :onTrue
       action :onFalse
+
+      alias_method :condition_without_lint, :condition
+      def condition(value)
+        Glib::JsonUi::JsonLogicLint.validate!(value) unless Rails.env.production?
+        condition_without_lint(value)
+      end
     end
 
     # Under consideration, likely not a good idea.

data/app/helpers/glib/json_ui/action_builder/windows.rb

@@ -9,6 +9,13 @@ class Glib::JsonUi::ActionBuilder
       action :onClose
     end
 
+    # "You OPEN a page you're not on; you RELOAD the page you're on" (see
+    # Reload below for the other half of the rule). `updateExisting: true`
+    # REPLACES the current history entry instead of pushing (matching
+    # `dialogs_open updateExisting`) -- for forward moves that should
+    # collapse history, e.g. wizard steps and post-filter landings. Landing
+    # is always fresh: scroll resets to the top, and `loaderViews` skeletons
+    # can cover the fetch.
     class Open < Action
       string :url, cache: true
       bool :updateExisting
@@ -46,13 +53,21 @@ class Glib::JsonUi::ActionBuilder
         end
     end
 
+    # Contract (see the npm package's actions/windows/reload.js): re-renders
+    # the current page from the server in place. User input is discarded
+    # (guarded by the dirty prompt), scroll position is preserved, and the
+    # history entry is REPLACED, never pushed. Partial updates that must
+    # keep user input belong to `logics_set`.
     class Reload < Action
-      string :url, cache: true # deprecated
-      bool :disableDirtyCheck
+      # "You RELOAD the page you're on; you OPEN a page you're not on":
+      # `url` is for reloading a VARIANT of the current page (sort order,
+      # active tab, tweaked params) while the user stays where they are --
+      # Back skips the pre-reload state, so sorting/tab-switching doesn't
+      # pollute history. To navigate to a DIFFERENT page while replacing
+      # history (wizard steps, post-filter landings), use `windows_open
+      # updateExisting: true`, which lands fresh at the top.
+      string :url, cache: true
       action :onReload
-
-      # deprecated
-      bool :skipUpdateKey
     end
 
     class CloseWithReload < Action

data/app/helpers/glib/json_ui/json_logic_lint.rb

@@ -0,0 +1,82 @@
+# Render-time sanity check for JsonLogic rules that compare form-field values.
+#
+# Form values always travel as strings (or arrays of strings for multi-value
+# fields), so a rule that compares a form-field `var` against a typed constant
+# (integer, date, boolean, ...) depends on client-side coercion at best and
+# silently never matches at worst -- e.g. JsonLogic's `==` cannot equate
+# arrays at all. These bugs don't crash anything; the affected condition just
+# evaluates wrongly forever.
+#
+# This lint runs while the rule is being rendered into the page JSON (outside
+# production), so any page exercised by tests -- including crawler-style tests
+# that visit every route -- surfaces the mistake as a hard failure.
+#
+# A `var` is treated as a form field when its name uses the nested-param
+# convention (`model[attr]`), which is how form inputs are named. Ordering
+# operators (>, <, ...) and vars without that shape are left alone: numeric
+# comparisons against action variables or computed values are legitimate.
+module Glib
+  module JsonUi
+    module JsonLogicLint
+      EQUALITY_OPS = %w[== != === !== setEq in].freeze
+
+      def self.validate!(rule)
+        walk(rule)
+      end
+
+      def self.walk(node)
+        case node
+        when Array
+          node.each { |child| walk(child) }
+        when Hash
+          node.each do |op, operands|
+            check_comparison(op.to_s, operands) if EQUALITY_OPS.include?(op.to_s) && operands.is_a?(Array)
+            walk(operands)
+          end
+        end
+      end
+
+      def self.check_comparison(op, operands)
+        return unless operands.any? { |operand| form_field_var?(operand) }
+
+        operands.each do |operand|
+          next unless non_string_constant?(operand)
+
+          field = operands.find { |o| form_field_var?(o) }
+          raise "JsonLogic rule compares form field #{var_name(field).inspect} against " \
+                "non-string constant #{operand.inspect} (`#{op}`).\n" \
+                'Why strings: rules never read the field spec (which may legitimately carry ' \
+                'integers); a `var` reads the LIVE form data, which the client collects from ' \
+                'DOM inputs -- and DOM input values are always strings (arrays of strings for ' \
+                "multi-value fields). The comparison would rely on JS coercion or fail outright.\n" \
+                'Fix: serialize the constant as a string, e.g. `record.id.to_s`, arrays via ' \
+                '`.map(&:to_s)`. For array comparisons, prefer the `setEq` operator, which ' \
+                'string-normalizes both sides.'
+        end
+      end
+
+      def self.form_field_var?(operand)
+        operand.is_a?(Hash) && (name = var_name(operand)) && name.include?('[')
+      end
+
+      def self.var_name(operand)
+        value = operand['var'] || operand[:var]
+        value&.to_s
+      end
+
+      # What matters is the JSON wire type, not the Ruby type: symbols and
+      # dates serialize to JSON strings and compare fine, but numerics and
+      # booleans stay typed in JSON while form values are always strings.
+      def self.non_string_constant?(operand)
+        case operand
+        when Numeric, TrueClass, FalseClass
+          true
+        when Array
+          operand.flatten.any? { |element| non_string_constant?(element) }
+        else
+          false
+        end
+      end
+    end
+  end
+end

data/app/helpers/glib/json_ui/view_builder/panels.rb

@@ -47,6 +47,16 @@ class Glib::JsonUi::ViewBuilder
       # Use this when field changes require server-side processing.
       action :onChangeAndLoad
 
+      # Actions executed when the form's dirty state TRANSITIONS (per the same
+      # tracking that powers the unsaved-changes prompts): `onDirty` fires
+      # when the form first deviates from its initial values, `onPristine`
+      # when it returns to them — plus once on mount, since forms always start
+      # pristine. Because each hook corresponds to a known state, the actions
+      # can use plain static `data` (e.g. a `logics_set` disabling the submit
+      # button while pristine) — no conditional rules needed.
+      action :onDirty
+      action :onPristine
+
       # Custom parameter name for form data when submitting.
       # By default, uses the model name as the parameter namespace.
       string :paramNameForFormData
@@ -486,6 +496,10 @@ class Glib::JsonUi::ViewBuilder
     class BulkEdit2 < View
       hash :import, required: [:submitUrl, :paramName]
 
+      # Maximum number of data rows an uploaded file may contain; files with
+      # more rows are rejected with an error dialog. No limit when unset.
+      int :maxRows
+
       # string :statusViewIdPrefix
       array :viewHeaders
 

data/app/views/json_ui/garage/test_page/fields_upload.json.jbuilder

@@ -28,7 +28,7 @@ page.body(
       value: image&.signed_id
     }
 
-    base_props[:onFinishUpload] = ->(action) do # rubocop:disable Glib/MultilineMethodCallStyle
+    base_props[:onFinishUpload] = ->(action) do
       action.snackbars_alert message: 'Get the signed ids!'
     end
 

data/app/views/json_ui/garage/test_page/form_dirty_hooks.json.jbuilder

@@ -0,0 +1,31 @@
+json.title 'Test Page (Form dirty hooks)'
+
+page = json_ui_page json
+
+render 'json_ui/garage/test_page/header', json: json, page: page
+
+page.body childViews: ->(body) do
+  body.panels_form \
+    padding: glib_json_padding_body,
+    # `onDirty`/`onPristine` fire on dirty-state TRANSITIONS (plus `onPristine`
+    # once on mount), so plain static `data` is enough -- no conditional rules.
+    onDirty: ->(action) do
+      action.logics_set targetId: 'dirty_hooks_submit', data: { disabled: false, tooltip: nil }
+    end,
+    onPristine: ->(action) do
+      action.logics_set targetId: 'dirty_hooks_submit', data: { disabled: true, tooltip: 'No changes to save' }
+    end,
+    childViews: ->(form) do
+      form.h2 text: 'Form dirty hooks'
+      form.spacer height: 8
+
+      form.fields_text name: 'user[name]', width: 'matchParent', label: 'Name', value: 'Initial'
+      form.spacer height: 14
+
+      # Excluded from dirty tracking -- edits here must not fire `onDirty`.
+      form.fields_text name: 'user[ignored]', width: 'matchParent', label: 'Ignored', disableDirtyCheck: true
+      form.spacer height: 14
+
+      form.fields_submit id: 'dirty_hooks_submit', text: 'Save'
+    end
+end

data/app/views/json_ui/garage/test_page/form_dynamic_dirty.json.jbuilder

@@ -0,0 +1,41 @@
+json.title 'Test Page (Form Dynamic Dirty)'
+
+page = json_ui_page json
+
+render 'json_ui/garage/test_page/header', json: json, page: page
+
+# A deliberately MINIMAL dynamic group -- no onLoad/conditionalData writes --
+# so the dirty tracker's late-registration handling is observable in
+# isolation: entries added after the initial mount join the baseline with
+# their mount-time values (see form_dynamic for the fully-featured demo).
+page.body childViews: ->(body) do
+  body.panels_responsive padding: glib_json_padding_body, childViews: ->(res) do
+    res.h2 text: 'Dynamic group dirty tracking'
+    res.spacer height: 8
+    res.panels_form \
+      url: json_ui_garage_url(path: 'forms/generic_post'),
+      method: 'post',
+      childViews: ->(form) do
+        form.fields_text width: 'matchParent', name: 'user[name]', label: 'Name', value: 'Initial'
+        form.spacer height: 8
+
+        form.fields_dynamicGroup id: 'dirty_dynamic_group', width: 'matchParent', name: 'user[items]', groupFieldProperties: [
+          [{ name: 'label', value: 'First' }]
+        ], content: ->(group) do
+          group.template childViews: ->(template) do
+            template.fields_text width: 'matchParent', name: 'label', label: 'Label', styleClass: 'item_label'
+          end
+        end
+
+        form.spacer height: 8
+        form.button \
+          text: 'Add item',
+          onClick: ->(action) do
+            action.components_invoke targetId: 'dirty_dynamic_group', name: 'addGroupEntry'
+          end
+
+        form.spacer height: 20
+        form.fields_submit text: 'Submit'
+      end
+  end
+end

data/app/views/json_ui/garage/test_page/form_removed_field.json.jbuilder

@@ -0,0 +1,55 @@
+json.title 'Test Page (Form Removed Field)'
+
+page = json_ui_page json
+
+render 'json_ui/garage/test_page/header', json: json, page: page
+
+# Probes how dirty tracking treats fields REMOVED from the DOM after they
+# have registered (`displayed: false` drives `loadIf`/v-if, so hidden fields
+# genuinely unmount and leave the form data). This page covers USER-triggered
+# hide/show; the onLoad-hidden flavor lives on form_removed_field_onload so
+# its baseline effect cannot contaminate these scenarios.
+page.body childViews: ->(body) do
+  body.panels_responsive padding: glib_json_padding_body, childViews: ->(res) do
+    res.h2 text: 'Removed-field dirty tracking'
+    res.spacer height: 8
+    res.panels_form \
+      url: json_ui_garage_url(path: 'forms/generic_post'),
+      method: 'post',
+      childViews: ->(form) do
+        form.fields_text width: 'matchParent', name: 'user[name]', label: 'Name', value: 'Initial'
+        form.fields_text width: 'matchParent', id: 'extra_field', name: 'user[extra]', label: 'Extra', value: 'Extra'
+
+        # Hiding this PANEL unmounts its child field's component subtree --
+        # the other removal flavor (a self-hidden field keeps its component
+        # mounted and only unmounts its inner v-if).
+        form.panels_vertical width: 'matchParent', id: 'extra_panel', childViews: ->(panel) do
+          panel.fields_text width: 'matchParent', name: 'user[grouped]', label: 'Grouped', value: 'Grouped'
+        end
+
+        form.spacer height: 8
+        form.panels_flow innerPadding: { bottom: 0 }, width: 'matchParent', childViews: ->(flow) do
+          flow.button \
+            text: 'Hide extra',
+            onClick: ->(action) do
+              action.logics_set targetId: 'extra_field', data: { displayed: false }
+            end
+          flow.spacer width: 8
+          flow.button \
+            text: 'Show extra',
+            onClick: ->(action) do
+              action.logics_set targetId: 'extra_field', data: { displayed: true }
+            end
+          flow.spacer width: 8
+          flow.button \
+            text: 'Hide panel',
+            onClick: ->(action) do
+              action.logics_set targetId: 'extra_panel', data: { displayed: false }
+            end
+        end
+
+        form.spacer height: 20
+        form.fields_submit text: 'Submit'
+      end
+  end
+end

data/app/views/json_ui/garage/test_page/form_removed_field_onload.json.jbuilder

@@ -0,0 +1,34 @@
+json.title 'Test Page (Form Removed Field Onload)'
+
+page = json_ui_page json
+
+render 'json_ui/garage/test_page/header', json: json, page: page
+
+# Companion to form_removed_field: here the field is hidden by PAGE LOGIC at
+# load (the onLoad conditionalData pattern, e.g. a conditional section
+# reflecting current values), after it has already registered with the dirty
+# tracker.
+page.body childViews: ->(body) do
+  body.panels_responsive padding: glib_json_padding_body, childViews: ->(res) do
+    res.h2 text: 'Removed-field dirty tracking (onLoad)'
+    res.spacer height: 8
+    res.panels_form \
+      url: json_ui_garage_url(path: 'forms/generic_post'),
+      method: 'post',
+      childViews: ->(form) do
+        form.fields_text width: 'matchParent', name: 'user[name]', label: 'Name', value: 'Initial'
+        form.fields_text \
+          width: 'matchParent',
+          id: 'preloaded_field',
+          name: 'user[preloaded]',
+          label: 'Preloaded',
+          value: 'P',
+          onLoad: ->(action) do
+            action.logics_set targetId: 'preloaded_field', data: { displayed: false }
+          end
+
+        form.spacer height: 20
+        form.fields_submit text: 'Submit'
+      end
+  end
+end

data/app/views/json_ui/garage/test_page/form_touched_validation.json.jbuilder

@@ -0,0 +1,35 @@
+json.title 'Test Page (Form Touched Validation)'
+
+page = json_ui_page json
+
+render 'json_ui/garage/test_page/header', json: json, page: page
+
+# Mirrors a sign-in-style form: the first field is empty, required, and
+# autofocused (panels_form defaults autofocus on). Untouched fields must stay
+# silent on blur/navigation; validation surfaces on submit, or on blur once
+# the user has actually typed.
+page.body childViews: ->(body) do
+  body.panels_responsive padding: glib_json_padding_body, childViews: ->(res) do
+    res.h2 text: 'Touched-field validation'
+    res.spacer height: 8
+    res.panels_form \
+      url: json_ui_garage_url(path: 'forms/generic_post'),
+      method: 'post',
+      childViews: ->(form) do
+        form.fields_email \
+          width: 'matchParent',
+          name: 'user[email]',
+          label: 'Email',
+          validation: { presence: { message: "can't be blank" } }
+        form.spacer height: 8
+        form.fields_text \
+          width: 'matchParent',
+          name: 'user[nickname]',
+          label: 'Nickname',
+          validation: { presence: { message: "can't be blank" } }
+
+        form.spacer height: 20
+        form.fields_submit text: 'Submit'
+      end
+  end
+end

data/app/views/json_ui/garage/test_page/logics_run.json.jbuilder

@@ -0,0 +1,79 @@
+json.title 'Test Page (Logics Run)'
+
+page = json_ui_page json
+
+page.form(
+  childViews: ->(body) do
+    body.panels_responsive(
+      padding: glib_json_padding_body,
+      childViews: ->(res) do
+        res.h2 text: 'Logics Run - form field condition'
+        res.spacer height: 8
+        # Form values are strings at the DOM boundary, so the condition
+        # compares against a string constant.
+        res.fields_text label: 'Status', name: 'user[status]', width: 300, value: 'active'
+        res.spacer height: 8
+        res.button(
+          text: 'Check status',
+          onClick: ->(action) do
+            action.logics_run(
+              condition: { '==': [{ 'var': 'user[status]' }, 'active'] },
+              onTrue: ->(subaction) do
+                subaction.logics_set targetId: 'run_status', data: { text: 'MATCH' }
+              end,
+              onFalse: ->(subaction) do
+                subaction.logics_set targetId: 'run_status', data: { text: 'NO MATCH' }
+              end
+            )
+          end
+        )
+        res.spacer height: 8
+        res.label id: 'run_status', text: 'PENDING'
+
+        res.spacer height: 16
+        res.hr width: 'matchParent'
+        res.spacer height: 16
+
+        res.h2 text: 'Logics Run - variables'
+        res.spacer height: 8
+        # Server-provided `variables` keep their JSON types (unlike form
+        # values), so a numeric comparison is legitimate here. They are also
+        # merged OVER the form data, so a variable that shares a form field's
+        # name takes precedence.
+        res.button(
+          text: 'Check variables',
+          onClick: ->(action) do
+            action.logics_run(
+              condition: { '==': [{ 'var': 'level' }, 5] },
+              variables: { level: 5 },
+              onTrue: ->(subaction) do
+                subaction.logics_set targetId: 'run_variables_status', data: { text: 'MATCH' }
+              end,
+              onFalse: ->(subaction) do
+                subaction.logics_set targetId: 'run_variables_status', data: { text: 'NO MATCH' }
+              end
+            )
+          end
+        )
+        res.spacer width: 8
+        res.button(
+          text: 'Check variable precedence',
+          onClick: ->(action) do
+            action.logics_run(
+              condition: { '==': [{ 'var': 'user[status]' }, 'override'] },
+              variables: { 'user[status]': 'override' },
+              onTrue: ->(subaction) do
+                subaction.logics_set targetId: 'run_variables_status', data: { text: 'PRECEDENCE' }
+              end,
+              onFalse: ->(subaction) do
+                subaction.logics_set targetId: 'run_variables_status', data: { text: 'FORM VALUE' }
+              end
+            )
+          end
+        )
+        res.spacer height: 8
+        res.label id: 'run_variables_status', text: 'PENDING'
+      end
+    )
+  end
+)

data/app/views/json_ui/garage/test_page/logics_run_multi_form.json.jbuilder

@@ -0,0 +1,45 @@
+json.title 'Test Page (Logics Run Multi Form)'
+
+page = json_ui_page json
+
+render 'json_ui/garage/test_page/header', json: json, page: page
+
+# Two mounted forms deliberately sharing a field name: actions that read
+# merged form data (logics/run, logics/set conditions, fields/getValues) use
+# the LAST form's value and warn about the collision.
+page.body childViews: ->(body) do
+  body.panels_responsive padding: glib_json_padding_body, childViews: ->(res) do
+    res.h2 text: 'Cross-form field-name collision'
+    res.spacer height: 8
+    res.panels_form \
+      url: json_ui_garage_url(path: 'forms/generic_post'),
+      method: 'post',
+      childViews: ->(form) do
+        form.fields_text width: 'matchParent', name: 'user[status]', label: 'First form status', value: 'first'
+      end
+    res.spacer height: 8
+    res.panels_form \
+      url: json_ui_garage_url(path: 'forms/generic_post'),
+      method: 'post',
+      childViews: ->(form) do
+        form.fields_text width: 'matchParent', name: 'user[status]', label: 'Second form status', value: 'second'
+      end
+
+    res.spacer height: 8
+    res.button \
+      text: 'Check status',
+      onClick: ->(action) do
+        action.logics_run(
+          condition: { '==': [{ 'var': 'user[status]' }, 'second'] },
+          onTrue: ->(subaction) do
+            subaction.logics_set targetId: 'collision_status', data: { text: 'LAST FORM WINS' }
+          end,
+          onFalse: ->(subaction) do
+            subaction.logics_set targetId: 'collision_status', data: { text: 'FIRST FORM WINS' }
+          end
+        )
+      end
+    res.spacer height: 8
+    res.label id: 'collision_status', text: 'PENDING'
+  end
+end

data/app/views/json_ui/garage/test_page/logics_set.json.jbuilder

@@ -134,6 +134,25 @@ page.form(
         )
         res.spacer height: 8
         res.label id: 'say_label', text: 'Visible label text'
+
+        res.spacer height: 16
+        res.h2 text: 'Logics Set - setEq'
+        res.spacer height: 8
+        # `setEq` treats both sides as sets of strings (order-insensitive;
+        # scalar and single-element array compare equal), which makes it safe
+        # for multi-value form fields whose DOM values are always strings.
+        set_eq_check = ->(action) do
+          action.logics_set(
+            targetId: 'set_eq_status',
+            conditionalData: {
+              text: { 'if': [{ 'setEq': [{ 'var': 'user[tags][]' }, %w[a b]] }, 'MATCH', 'NO MATCH'] }
+            }
+          )
+        end
+        res.fields_check name: 'user[tags][]', checkValue: 'a', label: 'Tag A', onChange: set_eq_check
+        res.fields_check name: 'user[tags][]', checkValue: 'b', label: 'Tag B', onChange: set_eq_check
+        res.spacer height: 8
+        res.label id: 'set_eq_status', text: 'PENDING'
       end
     )
   end

data/app/views/json_ui/garage/test_page/panels_bulkEdit2.json.jbuilder

@@ -83,6 +83,9 @@ page.body(
           id: 'bulk_edit_main',
           width: 'matchParent',
           paramNameForRowId: 'row_id',
+          # Files with more data rows than this are rejected wholesale with an
+          # error dialog (the header row doesn't count).
+          maxRows: 3,
           import: import_settings,
           viewHeaders: default_headers,
           viewCells: default_cells,