glib-web 6.10.2 → 6.10.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a644c2f81a6edaeaf5bb946f57402098bab2f8e841392a57568a76244856be89
-  data.tar.gz: 03ab9e4058180c9ecd70f14d6a26e488ca56dcdc1388175393f24c8ed5d4176b
+  metadata.gz: af62a06f4071bb5b2779e61b2dfa771d9984d4f2f15bd6ed121fd71a676d7918
+  data.tar.gz: f5100fe92e6d2959a4479b82887e0009c0aaea1a2ef419f1ae6205c8fbda427b
 SHA512:
-  metadata.gz: 13fb675a42739c4d67d50b26a359a6cc4136fc695c0f2730d2c21e721b193f955335a39bcab550704bc29cbfb3073569154b7c08b45924de5c576036842fb965
-  data.tar.gz: 1610d45e4b2e60d70475115ca741929585939c847108f46e7b5c209cbc5bff7292720ad85e3eced53f43a43efd2c9bb5756ac3067bab586fe0db17a07177efb0
+  metadata.gz: b0e19fa8b04dc2a7d44826f0c28eefe5411610d26226180dbd20079af4287177d44967331c56dd1c0dc7ebf0b3f01df08f1a38939958fe58c37a08183e8d10c0
+  data.tar.gz: 3c717ab4989d1e67f712d7d118d77cc6e99d136e0b1ed2e4e403a0974d0c364f705d064bad706b5f1bbfeca295333c523708e76f259a78cba969e958f6a494de

data/app/controllers/concerns/glib/json/libs.rb

@@ -96,6 +96,18 @@ module Glib::Json::Libs
 
         json_ui_redirect_to url, status: status
       end
+      # Any other request format (e.g. a browser tab opening a protected file link
+      # `/temp_blobs/:id/report.pdf`, where the filename sets the format) used to raise
+      # ActionController::UnknownFormat -> a bare 406 with an empty body. Mirror the html
+      # branch instead: whatever opened the URL (browser tab, iframe, img) is redirected
+      # to the target, which the browser follows natively.
+      #
+      # MUST stay the LAST block. `negotiate_mime` answers `Accept: */*` requests with
+      # the FIRST declared format, so an `any` block placed before html would capture
+      # ordinary browser page loads and leave request.format as `*/*` for the action.
+      format.any do
+        redirect_to url
+      end
     end
   end
 
@@ -142,6 +154,17 @@ module Glib::Json::Libs
           redirect_to sign_in_url, **redirect_options
         end
       end
+      # Other non-HTML/JSON formats (a protected file link whose filename sets the
+      # request format, an XML export, ...) used to raise UnknownFormat -> a bare 406.
+      # Mirrors the csv branch: a clean gate status in test, a redirect in production.
+      # MUST stay the LAST block -- see glib_redirect_to.
+      format.any do
+        if Rails.env.test?
+          head :unauthorized
+        else
+          redirect_to sign_in_url, **redirect_options
+        end
+      end
     end
   end
 
@@ -185,6 +208,16 @@ module Glib::Json::Libs
           redirect_to user_default_url
         end
       end
+      # Other non-HTML/JSON formats -- mirrors the csv branch (clean gate status in
+      # test, redirect in production); previously raised UnknownFormat -> a bare 406.
+      # MUST stay the LAST block -- see glib_redirect_to.
+      format.any do
+        if Rails.env.test?
+          head :forbidden
+        else
+          redirect_to user_default_url
+        end
+      end
     end
   end
 

data/app/helpers/glib/json_ui/view_builder/fields.rb

@@ -211,6 +211,51 @@ class Glib::JsonUi::ViewBuilder
       end
     end
 
+    # Timing options for the `onChange` / `onChangeAndLoad` actions of fields
+    # whose value changes while the user is still typing.
+    #
+    # Honoured by the single-line text family (text, number, email, url,
+    # password -- all one Vue component) and by textarea. Other fields ignore
+    # them: the discrete ones (check, radio, select, chip group, date pickers)
+    # commit a value the moment it is picked, and richText/phone/file keep
+    # their own reporting. The options are declared on `Text`, so its other
+    # subclasses accept them without effect -- same as `leftIcon` and
+    # `onTypeStart` there.
+    #
+    # In both modes the change is also reported when focus leaves the field.
+    # Under `input` that only flushes a change already pending in the debounce
+    # window -- it cannot produce a second run, because a value that was
+    # already reported is not reported again.
+    module ChangeTrigger
+      def self.included(base)
+        # When the `onChange` / `onChangeAndLoad` actions fire.
+        #
+        # - `input` (default): after the user pauses typing for `changeDelay`.
+        # - `blur`: only once focus leaves the field. Use for actions too
+        #   expensive to run mid-word -- a server round trip, a recalculation
+        #   that rewrites other fields under the user's cursor.
+        #
+        # @example Round-trip only once the user is done with the field
+        #   form.fields_text \
+        #     name: 'user[promo_code]',
+        #     label: 'Promo code',
+        #     changeOn: 'blur',
+        #     onChange: ->(action) { action.http_get url: verify_promo_path }
+        base.enum :changeOn, options: %w[input blur]
+
+        # Milliseconds of no typing before `changeOn: 'input'` fires.
+        # Defaults to 300. Ignored under `changeOn: 'blur'`.
+        #
+        # @example Slow down a search-as-you-type round trip
+        #   form.fields_text \
+        #     name: 'q',
+        #     label: 'Search',
+        #     changeDelay: 800,
+        #     onChange: ->(action) { action.http_get url: search_path }
+        base.int :changeDelay
+      end
+    end
+
     # Basic text input field for single-line text entry.
     #
     # The most common field type, supporting various customizations like
@@ -228,6 +273,8 @@ class Glib::JsonUi::ViewBuilder
     #
     # @see app/views/json_ui/garage/forms/basic.json.jbuilder Garage example
     class Text < AbstractField
+      include ChangeTrigger
+
       # Maximum number of characters allowed.
       int :maxLength
 

data/app/jobs/glib/purge_unattached_job.rb

@@ -6,17 +6,21 @@ module Glib
   # Opt-in: if the host app has not run the gem's `create_snapshot_blob_references` migration,
   # `SnapshotBlobReference.table_exists?` is false and the exclusion subquery short-circuits —
   # the job then behaves identically to Rails' built-in unattached-blob cleanup, just delayed
-  # by 8 hours to give upload flows time to attach.
+  # by `Glib::PurgeUnattached::Config.min_age` (8 hours by default) to give upload flows time
+  # to attach.
   #
   # Schedule from the host app (e.g. via sidekiq-cron):
   #   Glib::PurgeUnattachedJob.perform_later
+  #
+  # Adjust the grace window from the host app (e.g. for a slower upload flow):
+  #   Glib::PurgeUnattached::Config.min_age = 10.hours
   class PurgeUnattachedJob < ApplicationJob
     queue_as :cleanup
 
     def perform(*_args)
       scope = ActiveStorage::Blob
         .unattached
-        .where('active_storage_blobs.created_at < ?', 8.hours.ago)
+        .where('active_storage_blobs.created_at < ?', Glib::PurgeUnattached::Config.min_age.ago)
 
       if SnapshotBlobReference.table_exists?
         scope = scope.where.not(id: SnapshotBlobReference.select(:blob_id))

data/app/models/concerns/glib/snapshot_v2.rb

@@ -10,6 +10,27 @@ require 'hashdiff'
 #   2. Nil has_one safe-nav in check_snapshot_changed.
 #   3. has_one wrapping in diff_associations (V2 only tested with has_many in mapping-web).
 #   4. ActiveStorage in diff_associations (convert Attached::One/Many to attachment records).
+#   5. same_as_before? derives from the computed diff instead of the instance-local
+#      `snapshot_changed` flag (mapping-web's flag-gating silently dropped a target's
+#      snapshot when taken after the owner's -- see "Snapshot ordering" below, issue #481),
+#      with the flag re-entering as a NEGATIVE signal for first snapshots only (see
+#      `same_as_before?` for why an empty association baseline cannot decide those).
+#
+# ## Snapshot ordering: owner vs association targets
+#
+# Owner and association-target snapshots may be taken in ANY order within a request.
+# `same_as_before?` decides from persisted state, so a target snapshotted after its owner
+# (through the replaced association target) still records its version.
+#
+# The one residual ordering caveat: `diff` compares against the instance's IN-MEMORY
+# attributes, so unsaved changes live only on the instance that holds them. If a target is
+# modified in memory without saving, snapshot it via a local captured BEFORE the owner's
+# `glib_create_snapshot!` (whose `with_lock` reload replaces the association targets) --
+# reading the target back through the association snapshots the persisted state instead.
+#
+# `snapshot_changed` / `attributes_before_save` remain writable instance accessors for
+# call-site use; `snapshot_changed` is consulted by the skip decision only as a NEGATIVE
+# signal on first snapshots (see `same_as_before?`).
 #
 # To get all records of a model, you can use the following query:
 # MyModel.joins(:snapshots).distinct
@@ -42,7 +63,16 @@ module Glib
         # Only set snapshot_changed if not already set (handles case where before_save
         # is called multiple times - e.g., when associated records are saved before parent)
         if snapshot_changed.nil?
-          self.attributes_before_save = attributes_in_database
+          # For a save with no pending change `attributes_in_database` is empty -- an
+          # unchanged persisted record has no database-side delta -- which would make a
+          # first snapshot diff every attribute as an addition. Capture the full
+          # persisted state instead, so an unchanged save yields an empty item diff and
+          # the nil-guard keeps that baseline stable for later changes on the same
+          # instance. New records keep `attributes_in_database` (their all-nil
+          # originals): that non-empty baseline is exactly why a create's version 1
+          # records the full initial state. `unless` keeps the accessor nil, never
+          # `false`, for call-site nil-safety.
+          self.attributes_before_save = attributes_in_database.presence || (attributes unless new_record?)
           self.snapshot_changed = check_snapshot_changed
         end
       end
@@ -106,8 +136,11 @@ module Glib
                 metadata: {} # Keep for potential future use, but main data in columns
               }
 
-              # Don't create version if same as before
-              unless same_as_before?
+              # Don't create version if same as before. Reuses `calculated_diff` instead of
+              # recomputing it inside `same_as_before?`. `version == 1` (no previous
+              # version exists) tells `same_as_before?` this is a FIRST snapshot, where the
+              # association baseline is empty and the flag carries decision weight.
+              unless same_as_before?(calculated_diff, first_snapshot: version == 1)
                 # No nil guard: active_snapshot's `create_snapshot!` raises on failure and
                 # always returns the snapshot.
                 snapshot = create_snapshot!(**snapshot_obj)
@@ -166,10 +199,29 @@ module Glib
       snapshots.order(version: :desc).first
     end
 
-    def same_as_before?
-      return !snapshot_changed if snapshot_prev.blank?
+    # Decides whether `glib_create_snapshot!` should skip the version write. Derived from
+    # the computed diff (persisted state), not from the instance-local `snapshot_changed`
+    # flag: the flag dies with its instance, and an owner's snapshot replaces association
+    # targets with fresh instances (`with_lock`'s reload clears the association cache, then
+    # the diff walk re-reads the targets), so flag-gating used to silently drop a target's
+    # follow-up snapshot taken through the association (issue #481).
+    #
+    # The one place the flag still decides: a FIRST snapshot whose association diff is
+    # meaningless. With no previous version, `fetch_snapshot_items(nil)` returns `{}`
+    # for associations, so every pre-existing child row reads as `+` and the diff alone
+    # can never prove a no-op — any never-snapshotted record with children would mint a
+    # version on every snapshot call (observed as spurious "Edited" audit entries on
+    # routine re-saves). There the flag is consulted as a NEGATIVE signal:
+    #   - `false` — this instance crossed the before_save boundary and
+    #     `check_snapshot_changed` found no item or child change, and the item diff is
+    #     net-zero against `attributes_before_save` => skip;
+    #   - `nil` — no save boundary on this instance (an owner-triggered snapshot of a
+    #     replaced association target, issue #481) => mint;
+    #   - `true` — a change was detected at the save boundary; falls through to the
+    #     diff-based decision (a reverted change still no-ops).
+    def same_as_before?(computed_diff = diff, first_snapshot: false)
+      return true if first_snapshot && snapshot_changed == false && computed_diff['item'].blank?
 
-      computed_diff = diff
       item_unchanged = computed_diff['item'].blank?
       assoc_diff = computed_diff['associations']
       associations_unchanged = assoc_diff.nil? || assoc_diff.values.all?(&:blank?)

data/app/views/json_ui/garage/test_page/_header.json.jbuilder

@@ -37,6 +37,7 @@ nav_groups = {
     'fields_stripeExternalAccount',
     'fields_creditCard',
     'fields_timer',
+    'fields_change_trigger',
     'fields_upload',
     'fields_url_fragment',
     'fields_captcha',

data/app/views/json_ui/garage/test_page/fields_change_trigger.json.jbuilder

@@ -0,0 +1,128 @@
+json.title 'Test Page (Fields Change Trigger)'
+
+page = json_ui_page json
+
+render 'json_ui/garage/test_page/header', json: json, page: page
+
+page.body(
+  childViews: ->(body) do
+
+    body.panels_responsive(
+      padding: glib_json_padding_body,
+      childViews: ->(res) do
+        res.h2 text: 'Fields Change Trigger'
+        res.spacer height: 8
+        res.label text: 'changeOn / changeDelay control WHEN a typed-input field reports its change to onChange.'
+        res.spacer height: 12
+
+        res.panels_form(
+          url: json_ui_garage_url(path: 'forms/generic_post'),
+          method: 'post',
+          childViews: ->(form) do
+
+            # ── Default: changeOn 'input', 300ms ──────────────────────────────
+            form.h4 text: 'Default (changeOn: input)'
+            form.spacer height: 8
+            form.label text: 'No options set: reports once the user pauses for the default 300ms.'
+            form.spacer height: 8
+
+            form.fields_text(
+              name: 'user[default_value]',
+              label: 'Default',
+              placeholder: 'default',
+              width: 'matchParent',
+              onChange: ->(action) do
+                action.logics_set(
+                  targetId: 'status_default',
+                  conditionalData: { text: { 'printf': ['Default: {0}', { 'var': 'user[default_value]' }] } }
+                )
+              end
+            )
+            form.spacer height: 8
+            form.label id: 'status_default', text: 'Default: idle'
+
+            form.spacer height: 12
+            form.hr width: 'matchParent'
+            form.spacer height: 12
+
+            # ── changeDelay ───────────────────────────────────────────────────
+            form.h4 text: 'changeDelay: 1500'
+            form.spacer height: 8
+            form.label text: 'Same input mode, longer pause. Leaving the field still reports right away, rather than waiting out the remaining delay.'
+            form.spacer height: 8
+
+            form.fields_text(
+              name: 'user[slow]',
+              label: 'Slow',
+              placeholder: 'slow',
+              width: 'matchParent',
+              changeDelay: 1500,
+              onChange: ->(action) do
+                action.logics_set(
+                  targetId: 'status_slow',
+                  conditionalData: { text: { 'printf': ['Slow: {0}', { 'var': 'user[slow]' }] } }
+                )
+              end
+            )
+            form.spacer height: 8
+            form.label id: 'status_slow', text: 'Slow: idle'
+
+            form.spacer height: 12
+            form.hr width: 'matchParent'
+            form.spacer height: 12
+
+            # ── changeOn: 'blur' ──────────────────────────────────────────────
+            form.h4 text: "changeOn: 'blur'"
+            form.spacer height: 8
+            form.label text: 'Stays idle no matter how long the user pauses; reports only once focus leaves.'
+            form.spacer height: 8
+
+            form.fields_text(
+              name: 'user[on_blur]',
+              label: 'Reports on blur',
+              placeholder: 'on blur',
+              width: 'matchParent',
+              changeOn: 'blur',
+              onChange: ->(action) do
+                action.logics_set(
+                  targetId: 'status_on_blur',
+                  conditionalData: { text: { 'printf': ['Blur: {0}', { 'var': 'user[on_blur]' }] } }
+                )
+              end
+            )
+            form.spacer height: 8
+            form.label id: 'status_on_blur', text: 'Blur: idle'
+
+            form.spacer height: 12
+            form.hr width: 'matchParent'
+            form.spacer height: 12
+
+            # ── Textarea on blur ──────────────────────────────────────────────
+            form.h4 text: "fields_textarea with changeOn: 'blur'"
+            form.spacer height: 8
+
+            form.fields_textarea(
+              name: 'user[notes]',
+              label: 'Notes',
+              placeholder: 'notes',
+              width: 'matchParent',
+              rows: 3,
+              changeOn: 'blur',
+              onChange: ->(action) do
+                action.logics_set(
+                  targetId: 'status_notes',
+                  conditionalData: { text: { 'printf': ['Notes: {0}', { 'var': 'user[notes]' }] } }
+                )
+              end
+            )
+            form.spacer height: 8
+            form.label id: 'status_notes', text: 'Notes: idle'
+
+            form.spacer height: 16
+            form.fields_submit text: 'Submit'
+          end
+        )
+      end
+    )
+  end
+)

data/lib/glib/purge_unattached/config.rb

@@ -0,0 +1,38 @@
+require 'active_support/core_ext/numeric/time'
+
+module Glib
+  module PurgeUnattached
+    # Global settings for Glib::PurgeUnattachedJob.
+    #
+    # `min_age` is how long an unattached ActiveStorage blob must exist before
+    # the purge may remove it. The 8-hour default leaves room for multi-step
+    # upload flows (direct upload -> form submit -> attach) to finish before
+    # their blob becomes eligible; apps with slower flows raise it:
+    #
+    #   # config/initializers/glib.rb
+    #   Glib::PurgeUnattached::Config.min_age = 10.hours
+    #
+    # Deliberately NOT a setting on the job class: the job is autoloaded from
+    # app/, so an initializer-assigned value would be wiped the first time the
+    # class is reloaded. This file lives in lib/ and is required eagerly by
+    # glib-web.rb, which is what makes the setting survive reloads.
+    class Config
+      # The shipped default. Apps opt into a different window via the setter.
+      DEFAULT_MIN_AGE = 8.hours
+
+      @@min_age = DEFAULT_MIN_AGE
+
+      def self.min_age
+        @@min_age
+      end
+
+      def self.min_age=(value)
+        unless value.is_a?(ActiveSupport::Duration) && value.positive?
+          raise ArgumentError, "Invalid min_age: #{value.inspect}. Expected a positive ActiveSupport::Duration (e.g. 10.hours)."
+        end
+
+        @@min_age = value
+      end
+    end
+  end
+end

data/lib/glib-web.rb

@@ -6,10 +6,12 @@ if defined?(::Rails)
 end
 require 'glib/value'
 # Loaded eagerly (not autoloaded from app/) so an app initializer can set
-# `Glib::JsonUi::Config.name_separator` without tripping Rails' ban on
-# autoloading during initialization -- and so the setting survives a reload.
+# `Glib::JsonUi::Config.name_separator` or `Glib::PurgeUnattached::Config.min_age`
+# without tripping Rails' ban on autoloading during initialization -- and so the
+# setting survives a reload.
 require 'glib/json_ui/config'
 require 'glib/json_ui/name'
+require 'glib/purge_unattached/config'
 require 'glib/json_crawler'
 
 require 'glib/dynamic_text'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: glib-web
 version: !ruby/object:Gem::Version
-  version: 6.10.2
+  version: 6.10.4
 platform: ruby
 authors:
 - ''
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-11 00:00:00.000000000 Z
+date: 2026-09-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activestorage
@@ -456,6 +456,7 @@ files:
 - app/views/json_ui/garage/test_page/duplicate_names.json.jbuilder
 - app/views/json_ui/garage/test_page/fields.json.jbuilder
 - app/views/json_ui/garage/test_page/fields_captcha.json.jbuilder
+- app/views/json_ui/garage/test_page/fields_change_trigger.json.jbuilder
 - app/views/json_ui/garage/test_page/fields_creditCard.json.jbuilder
 - app/views/json_ui/garage/test_page/fields_date_time.json.jbuilder
 - app/views/json_ui/garage/test_page/fields_dynamicSelect.json.jbuilder
@@ -590,6 +591,7 @@ files:
 - lib/glib/last_resort_unit_test.rb
 - lib/glib/mailer_tester.rb
 - lib/glib/non_http_integration_test.rb
+- lib/glib/purge_unattached/config.rb
 - lib/glib/rubocop.rb
 - lib/glib/rubocop/cops/json_ui/base_nested_parameter.rb
 - lib/glib/rubocop/cops/json_ui/nested_action_parameter.rb