glib-web 6.3.1 → 6.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8378cb302a462be1ed8ee965c9ace54b77c4eb29f7d1cc9d83a469c89d0f6d93
-  data.tar.gz: 91f29270361f13067e3bc513cd01091e82b09d7a89a40eadb4dab893b59f7a66
+  metadata.gz: 66421bc5e4ae520c5229884ac1e89dc896990352772d0287413ba61e066e4015
+  data.tar.gz: '01995c09d93d6cd07e7cefab2ee5f566c41b83b723582d5434c571db1495e0ab'
 SHA512:
-  metadata.gz: 62c1600d052a52e8fb020662ca4db7455518945e298c6e5ea5663e4960955d9d29129252b0780107b138bd4d585a4463f4bef253dc26460203acee362b083af8
-  data.tar.gz: 4d816f8451f71efbbb96fbcbe64fe1586211b3e328c42ec89580d711abe9f5d62033ff645f1622b855fa31e86eee5a383ed2ff6732d0a817ba6462bea6e23821
+  metadata.gz: 99ed682bf5451d7a44b4f0e80f0ca77fbe9d7748c00a9bd784adc9ec6350a727d554371036e5d499f53a275f2594a34287784f6d4d2200471664fd425799788f
+  data.tar.gz: 00b5c68ba50339394fe5935622b7db12acfc2ca714fa68cb9224ada024293678296b4bb5e541e3a3fe90a6430497f7351d51fc9e33fbf2ace9fd1bdaafb49e7d

data/app/controllers/concerns/glib/form_stepper/controller.rb

@@ -0,0 +1,73 @@
+module Glib
+  module FormStepper
+    # A session-backed multi-step wizard: per-step answers accumulate in the
+    # session and nothing is persisted until the final step commits. Fits
+    # pre-account flows and any wizard where an abandoned run should simply
+    # disappear.
+    #
+    # The including controller declares the flow and its session bucket:
+    #
+    #   class ApplyController < ApplicationController
+    #     include Glib::FormStepper::Controller
+    #
+    #     STEPS = [
+    #       Glib::FormStepper::Step.new(key: :program, title: "Program", position: 1),
+    #       Glib::FormStepper::Step.new(key: :auditor, title: "Auditor", position: 2)
+    #     ].freeze
+    #     SESSION_KEY = "apply_application".freeze
+    #   end
+    #
+    # The current step is resolved from `params[:id]`, defaulting to the first step.
+    module Controller
+      extend ActiveSupport::Concern
+
+      included do
+        helper_method :current_step, :next_step, :prev_step, :step_data, :steps
+      end
+
+      def steps
+        self.class::STEPS
+      end
+
+      def current_step
+        @current_step ||= find_step(params[:id] || steps.first.key)
+      end
+
+      def next_step
+        idx = steps.index(current_step)
+        idx && steps[idx + 1]
+      end
+
+      def prev_step
+        idx = steps.index(current_step)
+        idx&.positive? ? steps[idx - 1] : nil
+      end
+
+      # Every answer gathered so far, one hash per step key.
+      def session_data
+        session[self.class::SESSION_KEY] ||= {}
+      end
+
+      # The current step's answers — what its form reads to prefill itself.
+      def step_data
+        session_data[current_step.key.to_s] || {}
+      end
+
+      # Merge (not replace) so re-submitting a step updates rather than clobbers.
+      def save_step_data(data)
+        key = current_step.key.to_s
+        session_data[key] = (session_data[key] || {}).merge(data)
+      end
+
+      def clear_session_data
+        session.delete(self.class::SESSION_KEY)
+      end
+
+      private
+        def find_step(key)
+          steps.find { |step| step.key == key.to_sym } ||
+            raise(ArgumentError, "Unknown step: #{key}")
+        end
+    end
+  end
+end

data/app/controllers/concerns/glib/form_stepper/step.rb

@@ -0,0 +1,12 @@
+module Glib
+  module FormStepper
+    # One step in a session-backed wizard: just its identity and label. `key` is
+    # coerced to a symbol so a step declared with either a symbol or string, and a
+    # `params[:id]` that always arrives as a string, resolve to the same step.
+    Step = Data.define(:key, :title, :position) do
+      def initialize(key:, title:, position:)
+        super(key: key.to_sym, title: title, position: position)
+      end
+    end
+  end
+end

data/app/controllers/glib/blob_url_generators_controller.rb

@@ -16,6 +16,18 @@
 module Glib
   class BlobUrlGeneratorsController < ::ActionController::Base
     def create
+      # Same failure class as the upload fields' `url_for(attachment)` (see
+      # AbstractField#existing_attachment_url): `rails_blob_path` resolves
+      # through ActiveStorage's default routes, so in apps that disable those
+      # this endpoint would 500 in exactly and only the environments with the
+      # routes off. Fail with a teaching error instead.
+      unless ::ActiveStorage.draw_routes
+        raise 'the default blob URL generator returns `rails_blob_path`, which resolves through ' \
+              "ActiveStorage's default routes, and this app does not draw them " \
+              '(config.active_storage.draw_routes = false). Point `blobUrlGenerator:` at an app ' \
+              'endpoint that returns an authorized URL instead.'
+      end
+
       blob = ::ActiveStorage::Blob.find_signed(params[:signed_id])
       url = blob.present? ? rails_blob_path(blob) : nil
 

data/app/helpers/glib/json_ui/view_builder/fields.rb

@@ -181,6 +181,34 @@ class Glib::JsonUi::ViewBuilder
         association = form.nested_associations.last
         @context ||= association || form
       end
+
+      # Builds the URL of a file that is ALREADY attached to the model (e.g.
+      # the pre-population list an upload field shows when re-editing a
+      # record). An app-defined `glib_attachment_url_for(attachment)` view
+      # helper takes precedence; otherwise this falls back to
+      # `url_for(attachment)`, which resolves through ActiveStorage's default
+      # routes. Apps that disable those routes
+      # (`config.active_storage.draw_routes = false`, commonly a
+      # production-only hardening) MUST define the helper: without it,
+      # url_for raises in exactly and only the environments with the routes
+      # off, invisible to tests that run with them on. The draw_routes check
+      # below turns that into the same loud, teaching error in every
+      # environment.
+      def existing_attachment_url(attachment)
+        view = page.context
+        return view.glib_attachment_url_for(attachment) if view.respond_to?(:glib_attachment_url_for)
+
+        unless ::ActiveStorage.draw_routes
+          raise 'cannot build the URL of an existing attachment: `url_for(attachment)` resolves ' \
+                "through ActiveStorage's default routes, and this app does not draw them " \
+                '(config.active_storage.draw_routes = false). Define a ' \
+                '`glib_attachment_url_for(attachment)` view helper that returns the app\'s own ' \
+                'authorized file URL; for `fields_upload` you can instead supply the list ' \
+                'yourself via `multiProgressView: { files: [...] }`.'
+        end
+
+        url_for(attachment)
+      end
     end
 
     # Basic text input field for single-line text entry.
@@ -740,7 +768,7 @@ class Glib::JsonUi::ViewBuilder
 
           if (value = context.field_value(@prop)).attached?
             json.fileTitle value.blob.filename
-            json.fileUrl url_for(value)
+            json.fileUrl existing_attachment_url(value.attachment)
           end
         end
 
@@ -755,6 +783,15 @@ class Glib::JsonUi::ViewBuilder
       end
     end
 
+    # File upload field with direct-upload support and a progress list of
+    # already-attached files.
+    #
+    # When re-editing a record, the field pre-populates
+    # `multiProgressView.files` from the model's attachments. Apps that
+    # disable ActiveStorage's default routes
+    # (`config.active_storage.draw_routes = false`) must define a
+    # `glib_attachment_url_for(attachment)` view helper returning their own
+    # authorized file URL -- see AbstractField#existing_attachment_url.
     class Upload < AbstractField
       include Glib::JsonUi::Upload
       include Glib::JsonUi::FileUploadErrorHandler
@@ -766,7 +803,12 @@ class Glib::JsonUi::ViewBuilder
       hash :clipboardView, optional: [:icon]
 
       def multiProgressView(values)
-        @multi_progress = values
+        # Consumers naturally write jbuilder hashes with symbol keys, but the
+        # reads in `created` use string keys. Normalize so a symbol-keyed
+        # `files:`/`responseMessages:` is honored instead of silently ignored
+        # (an ignored `files:` used to send the field down the url_for
+        # pre-population path even when the app supplied its own list).
+        @multi_progress = values&.stringify_keys
       end
 
       def created
@@ -779,18 +821,25 @@ class Glib::JsonUi::ViewBuilder
         if @prop && context && @multi_progress
           value = context.field_value(@prop, collect_ids: false)
           attachments = value.is_a?(::ActiveStorage::Attached::One) ? Array.wrap(value.attachment) : value.to_a
-          @multi_progress['files'] ||= attachments.map { |file| { name: file.blob&.filename, signed_id: file.signed_id, url: url_for(file) } }
+          @multi_progress['files'] ||= attachments.map do |file|
+            { name: file.blob&.filename, signed_id: file.signed_id, url: existing_attachment_url(file) }
+          end
         end
 
         if @multi_progress
-          @multi_progress['responseMessages'] ||= {}
+          # Copy before writing: `stringify_keys` is shallow, so the nested
+          # hash may still be the caller's own object, and the I18n merge
+          # below must not mutate (or accumulate state in) a hash the
+          # consumer may freeze or reuse across renders.
+          messages = (@multi_progress['responseMessages'] || {}).dup
           ['200', '403', '401', 'else'].each do |status|
             key = "glib.multi_upload.responseMessages.#{status}"
-            @multi_progress['responseMessages'][status] = I18n.t(key) if I18n.exists?(key)
+            messages[status] = I18n.t(key) if I18n.exists?(key)
           end
+          @multi_progress['responseMessages'] = messages
 
           json.responseMessages(
-            (@multi_progress['responseMessages'] || {}).reverse_merge(
+            messages.reverse_merge(
               '200' => 'Completed',
               '403' => 'Forbidden',
               '401' => 'Session expired',

data/app/models/glib/country_list.rb

@@ -0,0 +1,33 @@
+require 'countries' # ISO 3166 data (ISO3166::Country)
+
+module Glib
+  # ISO 3166 country data for country dropdowns.
+  #
+  # Backed entirely by the `countries` gem, so there is no table to migrate or
+  # seed, and renames (Türkiye, Czechia) arrive with a `bundle update`. Store
+  # the alpha-2 code rather than the name, so a rename never invalidates
+  # existing data.
+  module CountryList
+    class << self
+      # `common_name` is what people actually call the place ("South Korea",
+      # "United Kingdom") rather than the formal ISO name ("Korea (Republic of)").
+      def options
+        @options ||= ISO3166::Country.all
+          .map { |country| { value: country.alpha2, text: country.common_name || country.iso_short_name } }
+          .sort_by { |option| option[:text] }
+          .freeze
+      end
+
+      def codes
+        @codes ||= options.pluck(:value).freeze
+      end
+
+      def name_for(code)
+        return if code.blank?
+
+        country = ISO3166::Country[code]
+        country && (country.common_name || country.iso_short_name)
+      end
+    end
+  end
+end

data/app/models/glib/state_list.rb

@@ -0,0 +1,49 @@
+require 'countries' # ISO 3166-2 subdivision data (ISO3166::Country)
+
+module Glib
+  # ISO 3166-2 subdivision (state/province/territory) data for state dropdowns.
+  #
+  # The companion to Glib::CountryList: backed entirely by the `countries` gem,
+  # so there is no table to migrate or seed, and renames arrive with a
+  # `bundle update`. Store the subdivision code (e.g. "NSW") rather than the
+  # name, so a rename never invalidates existing data. The code is only unique
+  # within a country, so always store it alongside the country code.
+  #
+  # Not every country has subdivisions in the ISO data (e.g. Vatican City); for
+  # those `options_for` returns `[]` and the UI should fall back to a plain text
+  # field or omit the state input entirely.
+  module StateList
+    class << self
+      # Options for a single country's state dropdown, sorted by display name.
+      # `country_code` is an alpha-2 code, matching what Glib::CountryList stores.
+      def options_for(country_code)
+        return [] if country_code.blank?
+
+        (@options_by_country ||= {})[country_code.to_s.upcase] ||= build_options(country_code)
+      end
+
+      def codes_for(country_code)
+        options_for(country_code).pluck(:value)
+      end
+
+      def name_for(country_code, state_code)
+        return if country_code.blank? || state_code.blank?
+
+        country = ISO3166::Country[country_code]
+        subdivision = country&.subdivisions&.dig(state_code.to_s.upcase)
+        subdivision&.name
+      end
+
+      private
+        def build_options(country_code)
+          country = ISO3166::Country[country_code]
+          return [] if country.nil?
+
+          country.subdivisions
+            .map { |code, subdivision| { value: code, text: subdivision.name } }
+            .sort_by { |option| option[:text] }
+            .freeze
+        end
+    end
+  end
+end

data/app/views/json_ui/garage/actions/_dialogs_show.json.jbuilder

@@ -24,7 +24,11 @@ markdown = '## Emphasis' + "\n" +
   It has survived not only five centuries, but also the leap into electronic typesetting, remaining essentially unchanged.
   It was popularised in the 1960s with the release of Letraset sheets containing Lorem Ipsum passages,
   and more recently with desktop publishing software like Aldus PageMaker including versions of Lorem Ipsum.
-  "
+  ".gsub("\n", "  \n")
+# The gsub turns each bare newline into a markdown hard break: the renderer
+# uses standard (breaks: false) semantics, under which these hand-wrapped
+# lines would otherwise reflow into one block — and this dialog exists to
+# demonstrate scrolling, so it needs its ~20 visible lines.
 
 
 options = {}

data/app/views/json_ui/garage/test_page/charts.json.jbuilder

@@ -367,5 +367,8 @@ page.body childViews: ->(body) do
     #     end
     #   )
     # end
+    #
+
+    res.button text: 'windows/reload', onClick: ->(action) { action.windows_reload }
   end
 end

data/app/views/json_ui/garage/test_page/form_dirty_fields.json.jbuilder

@@ -0,0 +1,152 @@
+json.title 'Test Page (Form dirty fields)'
+
+page = json_ui_page json
+
+render 'json_ui/garage/test_page/header', json: json, page: page
+
+# A battery of field types wired to the same dirty-hooks contract as
+# `form_dirty_hooks`: the submit enables only while the form is dirty. Each
+# field here has at least one value-changing gesture that must flip the
+# dirty state (pinned by formDirtyFields.cy.js).
+page.body childViews: ->(body) do
+  body.panels_form \
+    padding: glib_json_padding_body,
+    onDirty: ->(action) do
+      action.logics_set targetId: 'dirty_fields_submit', data: { disabled: false }
+    end,
+    onPristine: ->(action) do
+      action.logics_set targetId: 'dirty_fields_submit', data: { disabled: true }
+    end,
+    # Pins that programmatic value changes reach the form-level onChange too
+    # (they fire the same synthetic `change` that native edits do).
+    onChange: ->(action) do
+      action.logics_set targetId: 'change_marker', data: { text: 'Changed' }
+    end,
+    childViews: ->(form) do
+      form.h2 text: 'Form dirty fields'
+      form.spacer height: 8
+
+      form.label id: 'change_marker', text: 'Unchanged'
+      form.spacer height: 8
+
+      form.fields_text name: 'user[name]', width: 'matchParent', label: 'Name', value: 'Initial', clearable: true
+      form.spacer height: 14
+
+      form.fields_date id: 'dirty_date', name: 'user[date]', width: 'matchParent', label: 'Date', value: '2020-01-10', clearable: true
+      form.spacer height: 14
+
+      form.fields_rating id: 'dirty_rating', name: 'user[rating]', value: 2
+      form.spacer height: 14
+
+      form.fields_otp id: 'dirty_otp', name: 'user[otp]', width: 'matchParent', length: 4
+      form.spacer height: 14
+
+      form.fields_dynamicSelect id: 'dirty_dynamic_select', name: 'user[language]', width: 'matchParent', label: 'Language',
+        selectedOptions: [{ value: 'id3', text: 'Item 3' }],
+        url: json_ui_garage_url(path: 'forms/dynamic_select_data'),
+        placeholder: 'Start typing'
+      form.spacer height: 14
+
+      form.button text: 'Check all', onClick: ->(action) do
+        action.components_invoke targetId: 'dirty_check_group', name: 'checkAll'
+      end
+      form.spacer height: 4
+      form.fields_checkGroup id: 'dirty_check_group', name: 'user[hobbies][]', childViews: ->(group) do
+        group.fields_check checkValue: 'grape', label: 'Grape'
+        group.fields_check checkValue: 'banana', label: 'Banana'
+      end
+      form.spacer height: 14
+
+      properties = [
+        [{ name: 'question', value: 'Punctuality' }]
+      ]
+      form.fields_dynamicGroup id: 'dirty_dynamic_group', width: 'matchParent', name: 'user[evaluation]', groupFieldProperties: properties, titlePrefix: 'Entry', content: ->(group) do
+        group.template childViews: ->(template) do
+          template.fields_text width: 'matchParent', name: 'question', label: 'Question', styleClass: 'question'
+        end
+      end
+      form.spacer height: 14
+
+      form.fields_upload \
+        id: 'dirty_upload',
+        name: 'user[attachments][]',
+        label: 'Attachments',
+        width: 320,
+        directUploadUrl: glib_direct_uploads_url,
+        multiProgressView: { files: [] }
+      form.spacer height: 14
+
+      # Avatar-style upload prepopulated with a saved value; resetting it
+      # changes the submitted value, so it must count as dirty.
+      form.fields_upload \
+        id: 'dirty_avatar',
+        name: 'user[avatar]',
+        width: 320,
+        directUploadUrl: glib_direct_uploads_url,
+        value: 'saved-avatar-signed-id',
+        placeholderView: { type: 'avatar', url: 'https://picsum.photos/id/11/100/60', width: 64, height: 64 }
+      form.button text: 'Reset avatar', onClick: ->(action) do
+        action.components_invoke targetId: 'dirty_avatar', name: 'reset'
+      end
+      form.spacer height: 14
+
+      form.fields_sign id: 'dirty_sign', name: 'user[signature]', directUploadUrl: glib_direct_uploads_url, width: 320, height: 160
+      form.spacer height: 14
+
+      # Prepopulated phone: must stay pristine at load (the lib normalises the
+      # value at mount) and a type/backspace round trip must return pristine.
+      form.fields_phone id: 'dirty_phone', name: 'user[phone]', width: 'matchParent', label: 'Phone',
+        value: '+61212345678', defaultCountry: 'AU', disableAutoDetect: true
+      form.spacer height: 14
+
+      # Input-view upload; reset must count as a change.
+      form.fields_upload \
+        id: 'dirty_document',
+        name: 'user[document]',
+        label: 'Document',
+        width: 320,
+        directUploadUrl: glib_direct_uploads_url,
+        inputView: {}
+      form.button text: 'Reset document', onClick: ->(action) do
+        action.components_invoke targetId: 'dirty_document', name: 'reset'
+      end
+      form.spacer height: 14
+
+      # Clipboard uploads: direct-upload mode and plain (no-upload) mode.
+      form.fields_upload \
+        id: 'dirty_clipboard',
+        name: 'user[snippet]',
+        label: 'Snippet',
+        width: 320,
+        directUploadUrl: glib_direct_uploads_url,
+        clipboardView: {}
+      form.spacer height: 14
+      form.fields_upload \
+        id: 'dirty_clipboard_plain',
+        name: 'user[snippet_plain]',
+        label: 'Snippet (plain)',
+        width: 320,
+        clipboardView: {}
+      form.spacer height: 14
+
+      # Single-file upload with a saved value; replacing it must count.
+      form.fields_upload \
+        id: 'dirty_cover',
+        name: 'user[cover]',
+        label: 'Cover',
+        width: 320,
+        directUploadUrl: glib_direct_uploads_url,
+        multiple: false,
+        multiProgressView: { files: [{ name: 'cover.png', signed_id: 'saved-cover', url: 'https://picsum.photos/id/12/100/60' }] }
+      form.spacer height: 14
+
+      form.fields_richText id: 'dirty_rich_text', name: 'user[bio]', width: 'matchParent', label: 'Bio', value: '<p>hello</p>'
+      form.spacer height: 14
+
+      # Populated from the URL hash at mount; must be absorbed into the
+      # pristine baseline, not read as an edit.
+      form.fields_urlFragment name: 'user[fragment]'
+
+      form.fields_submit id: 'dirty_fields_submit', text: 'Save'
+    end
+end

data/app/views/json_ui/garage/test_page/form_dirty_hooks.json.jbuilder

@@ -26,6 +26,17 @@ page.body childViews: ->(body) do
       form.fields_text name: 'user[ignored]', width: 'matchParent', label: 'Ignored', disableDirtyCheck: true
       form.spacer height: 14
 
+      # Direct-upload field -- a completed upload (and a removal) must count
+      # towards dirtiness just like a typed edit.
+      form.fields_upload \
+        name: 'user[attachments][]',
+        id: 'dirty_hooks_upload',
+        label: 'Attachments',
+        width: 320,
+        directUploadUrl: glib_direct_uploads_url,
+        multiProgressView: { files: [] }
+      form.spacer height: 14
+
       form.fields_submit id: 'dirty_hooks_submit', text: 'Save'
     end
 end

data/lib/glib-web.rb

@@ -1,3 +1,5 @@
+require 'ostruct'
+
 if defined?(::Rails)
   require 'glib/engine'
   require 'glib/snapshot'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: glib-web
 version: !ruby/object:Gem::Version
-  version: 6.3.1
+  version: 6.4.0
 platform: ruby
 authors:
 - ''
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-24 00:00:00.000000000 Z
+date: 2026-08-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activestorage
@@ -122,6 +122,34 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: ostruct
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: countries
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '7.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '7.1'
 - !ruby/object:Gem::Dependency
   name: rubocop
   requirement: !ruby/object:Gem::Requirement
@@ -163,6 +191,8 @@ files:
 - app/controllers/concerns/glib/analytics/funnel.rb
 - app/controllers/concerns/glib/auth/policy.rb
 - app/controllers/concerns/glib/auth/response.rb
+- app/controllers/concerns/glib/form_stepper/controller.rb
+- app/controllers/concerns/glib/form_stepper/step.rb
 - app/controllers/concerns/glib/json/dynamic_text.rb
 - app/controllers/concerns/glib/json/libs.rb
 - app/controllers/concerns/glib/json/new_dynamic_text.rb
@@ -228,8 +258,10 @@ files:
 - app/models/glib/active_storage/attachment.rb
 - app/models/glib/active_storage/blob.rb
 - app/models/glib/application_record.rb
+- app/models/glib/country_list.rb
 - app/models/glib/dummy_job_application.rb
 - app/models/glib/dynamic_text_record.rb
+- app/models/glib/state_list.rb
 - app/models/glib/text.rb
 - app/policies/glib/application_policy.rb
 - app/validators/email_typo_validator.rb
@@ -421,6 +453,7 @@ files:
 - app/views/json_ui/garage/test_page/fields_url_fragment.json.jbuilder
 - app/views/json_ui/garage/test_page/flow.json.jbuilder
 - app/views/json_ui/garage/test_page/form.json.jbuilder
+- app/views/json_ui/garage/test_page/form_dirty_fields.json.jbuilder
 - app/views/json_ui/garage/test_page/form_dirty_hooks.json.jbuilder
 - app/views/json_ui/garage/test_page/form_dynamic.json.jbuilder
 - app/views/json_ui/garage/test_page/form_dynamic_dirty.json.jbuilder