glib-web 6.3.2 → 6.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4f55e891cbc4a9325dbf8fe235dcb593982686ec8e36f62d86b6aea853e83f22
-  data.tar.gz: 6299bcaf264a60d4a604dc6dc7f44f45f2671f2827b8a6fe26f266979d82dbf5
+  metadata.gz: d0c733a1c0dbc779a2bd72cbcd304074238f10a2efde2d74ee4c75f50bf861d4
+  data.tar.gz: 0ea1e58d18cea237c50fccaafb56a165abaa104caecd2011cbbeb7e5bdf7a97d
 SHA512:
-  metadata.gz: 368a1c82a9ee9f539b38d4e3396b0fa14cf449fef03d50862239b549d3d9593a19b8961f41e521d8a627bf58530b63b5ac6f1a89310bebe1d0b5a5e61d811361
-  data.tar.gz: b8fe1cd9c3256ad9d3d7ea1cafb5adef1ec80e984ec7678edfd5e6aaec585babdc96aaddcef189003269ab9a33b89b00aae5fe5ac1c4988458de0ec3fa33fec4
+  metadata.gz: ff566900716099396b7817beca6b934ad2d18f8338c2dfa6743c9b3ed851927becc596d75d5bd71c9fc90ff3e9bbba572f665228755cc4cac60d6389b50103ff
+  data.tar.gz: 93e89c3f04019cf9517412416b4c8bb917b3171677f67a3214d8e12d705bddafb9f1744522452b93a1fa77d2278ed14499ee41d9097fc4a482db6b6ec40ac186

data/app/controllers/glib/blob_url_generators_controller.rb

@@ -16,6 +16,18 @@
 module Glib
   class BlobUrlGeneratorsController < ::ActionController::Base
     def create
+      # Same failure class as the upload fields' `url_for(attachment)` (see
+      # AbstractField#existing_attachment_url): `rails_blob_path` resolves
+      # through ActiveStorage's default routes, so in apps that disable those
+      # this endpoint would 500 in exactly and only the environments with the
+      # routes off. Fail with a teaching error instead.
+      unless ::ActiveStorage.draw_routes
+        raise 'the default blob URL generator returns `rails_blob_path`, which resolves through ' \
+              "ActiveStorage's default routes, and this app does not draw them " \
+              '(config.active_storage.draw_routes = false). Point `blobUrlGenerator:` at an app ' \
+              'endpoint that returns an authorized URL instead.'
+      end
+
       blob = ::ActiveStorage::Blob.find_signed(params[:signed_id])
       url = blob.present? ? rails_blob_path(blob) : nil
 

data/app/helpers/glib/json_ui/view_builder/fields.rb

@@ -181,6 +181,34 @@ class Glib::JsonUi::ViewBuilder
         association = form.nested_associations.last
         @context ||= association || form
       end
+
+      # Builds the URL of a file that is ALREADY attached to the model (e.g.
+      # the pre-population list an upload field shows when re-editing a
+      # record). An app-defined `glib_attachment_url_for(attachment)` view
+      # helper takes precedence; otherwise this falls back to
+      # `url_for(attachment)`, which resolves through ActiveStorage's default
+      # routes. Apps that disable those routes
+      # (`config.active_storage.draw_routes = false`, commonly a
+      # production-only hardening) MUST define the helper: without it,
+      # url_for raises in exactly and only the environments with the routes
+      # off, invisible to tests that run with them on. The draw_routes check
+      # below turns that into the same loud, teaching error in every
+      # environment.
+      def existing_attachment_url(attachment)
+        view = page.context
+        return view.glib_attachment_url_for(attachment) if view.respond_to?(:glib_attachment_url_for)
+
+        unless ::ActiveStorage.draw_routes
+          raise 'cannot build the URL of an existing attachment: `url_for(attachment)` resolves ' \
+                "through ActiveStorage's default routes, and this app does not draw them " \
+                '(config.active_storage.draw_routes = false). Define a ' \
+                '`glib_attachment_url_for(attachment)` view helper that returns the app\'s own ' \
+                'authorized file URL; for `fields_upload` you can instead supply the list ' \
+                'yourself via `multiProgressView: { files: [...] }`.'
+        end
+
+        url_for(attachment)
+      end
     end
 
     # Basic text input field for single-line text entry.
@@ -740,7 +768,7 @@ class Glib::JsonUi::ViewBuilder
 
           if (value = context.field_value(@prop)).attached?
             json.fileTitle value.blob.filename
-            json.fileUrl url_for(value)
+            json.fileUrl existing_attachment_url(value.attachment)
           end
         end
 
@@ -755,6 +783,15 @@ class Glib::JsonUi::ViewBuilder
       end
     end
 
+    # File upload field with direct-upload support and a progress list of
+    # already-attached files.
+    #
+    # When re-editing a record, the field pre-populates
+    # `multiProgressView.files` from the model's attachments. Apps that
+    # disable ActiveStorage's default routes
+    # (`config.active_storage.draw_routes = false`) must define a
+    # `glib_attachment_url_for(attachment)` view helper returning their own
+    # authorized file URL -- see AbstractField#existing_attachment_url.
     class Upload < AbstractField
       include Glib::JsonUi::Upload
       include Glib::JsonUi::FileUploadErrorHandler
@@ -766,7 +803,12 @@ class Glib::JsonUi::ViewBuilder
       hash :clipboardView, optional: [:icon]
 
       def multiProgressView(values)
-        @multi_progress = values
+        # Consumers naturally write jbuilder hashes with symbol keys, but the
+        # reads in `created` use string keys. Normalize so a symbol-keyed
+        # `files:`/`responseMessages:` is honored instead of silently ignored
+        # (an ignored `files:` used to send the field down the url_for
+        # pre-population path even when the app supplied its own list).
+        @multi_progress = values&.stringify_keys
       end
 
       def created
@@ -779,18 +821,25 @@ class Glib::JsonUi::ViewBuilder
         if @prop && context && @multi_progress
           value = context.field_value(@prop, collect_ids: false)
           attachments = value.is_a?(::ActiveStorage::Attached::One) ? Array.wrap(value.attachment) : value.to_a
-          @multi_progress['files'] ||= attachments.map { |file| { name: file.blob&.filename, signed_id: file.signed_id, url: url_for(file) } }
+          @multi_progress['files'] ||= attachments.map do |file|
+            { name: file.blob&.filename, signed_id: file.signed_id, url: existing_attachment_url(file) }
+          end
         end
 
         if @multi_progress
-          @multi_progress['responseMessages'] ||= {}
+          # Copy before writing: `stringify_keys` is shallow, so the nested
+          # hash may still be the caller's own object, and the I18n merge
+          # below must not mutate (or accumulate state in) a hash the
+          # consumer may freeze or reuse across renders.
+          messages = (@multi_progress['responseMessages'] || {}).dup
           ['200', '403', '401', 'else'].each do |status|
             key = "glib.multi_upload.responseMessages.#{status}"
-            @multi_progress['responseMessages'][status] = I18n.t(key) if I18n.exists?(key)
+            messages[status] = I18n.t(key) if I18n.exists?(key)
           end
+          @multi_progress['responseMessages'] = messages
 
           json.responseMessages(
-            (@multi_progress['responseMessages'] || {}).reverse_merge(
+            messages.reverse_merge(
               '200' => 'Completed',
               '403' => 'Forbidden',
               '401' => 'Session expired',

data/app/models/glib/application_record.rb

@@ -5,11 +5,15 @@ module Glib
 
     self.abstract_class = true
 
-    scope :created_asc, -> { order(created_at: :asc) }
-    scope :created_desc, -> { order(created_at: :desc) }
+    # The id tiebreakers keep the order deterministic when timestamps tie
+    # (rows created in one transaction, dumped fixtures): a bare timestamp
+    # ORDER BY returns tied rows in unspecified database order, which flips
+    # listings -- and their test snapshots -- between runs.
+    scope :created_asc, -> { order(created_at: :asc, id: :asc) }
+    scope :created_desc, -> { order(created_at: :desc, id: :desc) }
 
-    scope :updated_asc, -> { order(updated_at: :asc) }
-    scope :updated_desc, -> { order(updated_at: :desc) }
+    scope :updated_asc, -> { order(updated_at: :asc, id: :asc) }
+    scope :updated_desc, -> { order(updated_at: :desc, id: :desc) }
 
     def self.glib_has_one_attached(field_name)
       has_one_attached field_name

data/app/views/json_ui/garage/test_page/form_dirty_fields.json.jbuilder

@@ -0,0 +1,152 @@
+json.title 'Test Page (Form dirty fields)'
+
+page = json_ui_page json
+
+render 'json_ui/garage/test_page/header', json: json, page: page
+
+# A battery of field types wired to the same dirty-hooks contract as
+# `form_dirty_hooks`: the submit enables only while the form is dirty. Each
+# field here has at least one value-changing gesture that must flip the
+# dirty state (pinned by formDirtyFields.cy.js).
+page.body childViews: ->(body) do
+  body.panels_form \
+    padding: glib_json_padding_body,
+    onDirty: ->(action) do
+      action.logics_set targetId: 'dirty_fields_submit', data: { disabled: false }
+    end,
+    onPristine: ->(action) do
+      action.logics_set targetId: 'dirty_fields_submit', data: { disabled: true }
+    end,
+    # Pins that programmatic value changes reach the form-level onChange too
+    # (they fire the same synthetic `change` that native edits do).
+    onChange: ->(action) do
+      action.logics_set targetId: 'change_marker', data: { text: 'Changed' }
+    end,
+    childViews: ->(form) do
+      form.h2 text: 'Form dirty fields'
+      form.spacer height: 8
+
+      form.label id: 'change_marker', text: 'Unchanged'
+      form.spacer height: 8
+
+      form.fields_text name: 'user[name]', width: 'matchParent', label: 'Name', value: 'Initial', clearable: true
+      form.spacer height: 14
+
+      form.fields_date id: 'dirty_date', name: 'user[date]', width: 'matchParent', label: 'Date', value: '2020-01-10', clearable: true
+      form.spacer height: 14
+
+      form.fields_rating id: 'dirty_rating', name: 'user[rating]', value: 2
+      form.spacer height: 14
+
+      form.fields_otp id: 'dirty_otp', name: 'user[otp]', width: 'matchParent', length: 4
+      form.spacer height: 14
+
+      form.fields_dynamicSelect id: 'dirty_dynamic_select', name: 'user[language]', width: 'matchParent', label: 'Language',
+        selectedOptions: [{ value: 'id3', text: 'Item 3' }],
+        url: json_ui_garage_url(path: 'forms/dynamic_select_data'),
+        placeholder: 'Start typing'
+      form.spacer height: 14
+
+      form.button text: 'Check all', onClick: ->(action) do
+        action.components_invoke targetId: 'dirty_check_group', name: 'checkAll'
+      end
+      form.spacer height: 4
+      form.fields_checkGroup id: 'dirty_check_group', name: 'user[hobbies][]', childViews: ->(group) do
+        group.fields_check checkValue: 'grape', label: 'Grape'
+        group.fields_check checkValue: 'banana', label: 'Banana'
+      end
+      form.spacer height: 14
+
+      properties = [
+        [{ name: 'question', value: 'Punctuality' }]
+      ]
+      form.fields_dynamicGroup id: 'dirty_dynamic_group', width: 'matchParent', name: 'user[evaluation]', groupFieldProperties: properties, titlePrefix: 'Entry', content: ->(group) do
+        group.template childViews: ->(template) do
+          template.fields_text width: 'matchParent', name: 'question', label: 'Question', styleClass: 'question'
+        end
+      end
+      form.spacer height: 14
+
+      form.fields_upload \
+        id: 'dirty_upload',
+        name: 'user[attachments][]',
+        label: 'Attachments',
+        width: 320,
+        directUploadUrl: glib_direct_uploads_url,
+        multiProgressView: { files: [] }
+      form.spacer height: 14
+
+      # Avatar-style upload prepopulated with a saved value; resetting it
+      # changes the submitted value, so it must count as dirty.
+      form.fields_upload \
+        id: 'dirty_avatar',
+        name: 'user[avatar]',
+        width: 320,
+        directUploadUrl: glib_direct_uploads_url,
+        value: 'saved-avatar-signed-id',
+        placeholderView: { type: 'avatar', url: 'https://picsum.photos/id/11/100/60', width: 64, height: 64 }
+      form.button text: 'Reset avatar', onClick: ->(action) do
+        action.components_invoke targetId: 'dirty_avatar', name: 'reset'
+      end
+      form.spacer height: 14
+
+      form.fields_sign id: 'dirty_sign', name: 'user[signature]', directUploadUrl: glib_direct_uploads_url, width: 320, height: 160
+      form.spacer height: 14
+
+      # Prepopulated phone: must stay pristine at load (the lib normalises the
+      # value at mount) and a type/backspace round trip must return pristine.
+      form.fields_phone id: 'dirty_phone', name: 'user[phone]', width: 'matchParent', label: 'Phone',
+        value: '+61212345678', defaultCountry: 'AU', disableAutoDetect: true
+      form.spacer height: 14
+
+      # Input-view upload; reset must count as a change.
+      form.fields_upload \
+        id: 'dirty_document',
+        name: 'user[document]',
+        label: 'Document',
+        width: 320,
+        directUploadUrl: glib_direct_uploads_url,
+        inputView: {}
+      form.button text: 'Reset document', onClick: ->(action) do
+        action.components_invoke targetId: 'dirty_document', name: 'reset'
+      end
+      form.spacer height: 14
+
+      # Clipboard uploads: direct-upload mode and plain (no-upload) mode.
+      form.fields_upload \
+        id: 'dirty_clipboard',
+        name: 'user[snippet]',
+        label: 'Snippet',
+        width: 320,
+        directUploadUrl: glib_direct_uploads_url,
+        clipboardView: {}
+      form.spacer height: 14
+      form.fields_upload \
+        id: 'dirty_clipboard_plain',
+        name: 'user[snippet_plain]',
+        label: 'Snippet (plain)',
+        width: 320,
+        clipboardView: {}
+      form.spacer height: 14
+
+      # Single-file upload with a saved value; replacing it must count.
+      form.fields_upload \
+        id: 'dirty_cover',
+        name: 'user[cover]',
+        label: 'Cover',
+        width: 320,
+        directUploadUrl: glib_direct_uploads_url,
+        multiple: false,
+        multiProgressView: { files: [{ name: 'cover.png', signed_id: 'saved-cover', url: 'https://picsum.photos/id/12/100/60' }] }
+      form.spacer height: 14
+
+      form.fields_richText id: 'dirty_rich_text', name: 'user[bio]', width: 'matchParent', label: 'Bio', value: '<p>hello</p>'
+      form.spacer height: 14
+
+      # Populated from the URL hash at mount; must be absorbed into the
+      # pristine baseline, not read as an edit.
+      form.fields_urlFragment name: 'user[fragment]'
+
+      form.fields_submit id: 'dirty_fields_submit', text: 'Save'
+    end
+end

data/app/views/json_ui/garage/test_page/form_dirty_hooks.json.jbuilder

@@ -26,6 +26,17 @@ page.body childViews: ->(body) do
       form.fields_text name: 'user[ignored]', width: 'matchParent', label: 'Ignored', disableDirtyCheck: true
       form.spacer height: 14
 
+      # Direct-upload field -- a completed upload (and a removal) must count
+      # towards dirtiness just like a typed edit.
+      form.fields_upload \
+        name: 'user[attachments][]',
+        id: 'dirty_hooks_upload',
+        label: 'Attachments',
+        width: 320,
+        directUploadUrl: glib_direct_uploads_url,
+        multiProgressView: { files: [] }
+      form.spacer height: 14
+
       form.fields_submit id: 'dirty_hooks_submit', text: 'Save'
     end
 end

data/lib/glib/engine.rb

@@ -16,9 +16,10 @@ module Glib
           end
 
           # Mirror `Glib::ApplicationRecord.created_desc` so call sites can use the codebase-wide
-          # convention instead of `order(created_at: :desc)`.
+          # convention instead of `order(created_at: :desc)`. Includes the same id
+          # tiebreaker: tied timestamps otherwise return in unspecified order.
           unless respond_to?(:created_desc)
-            scope :created_desc, -> { order(created_at: :desc) }
+            scope :created_desc, -> { order(created_at: :desc, id: :desc) }
           end
 
           # Parses the stored diff into a flat hash of Change structs:

metadata

@@ -1,13 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: glib-web
 version: !ruby/object:Gem::Version
-  version: 6.3.2
+  version: 6.4.1
 platform: ruby
 authors:
 - ''
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-24 00:00:00.000000000 Z
+date: 2026-08-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activestorage
@@ -177,6 +178,7 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+description:
 email: ''
 executables: []
 extensions: []
@@ -451,6 +453,7 @@ files:
 - app/views/json_ui/garage/test_page/fields_url_fragment.json.jbuilder
 - app/views/json_ui/garage/test_page/flow.json.jbuilder
 - app/views/json_ui/garage/test_page/form.json.jbuilder
+- app/views/json_ui/garage/test_page/form_dirty_fields.json.jbuilder
 - app/views/json_ui/garage/test_page/form_dirty_hooks.json.jbuilder
 - app/views/json_ui/garage/test_page/form_dynamic.json.jbuilder
 - app/views/json_ui/garage/test_page/form_dynamic_dirty.json.jbuilder
@@ -571,8 +574,10 @@ files:
 - lib/glib/time_returning_mailer.rb
 - lib/glib/value.rb
 - lib/tasks/db.rake
+homepage:
 licenses: []
 metadata: {}
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -587,7 +592,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.6
+rubygems_version: 3.4.6
+signing_key:
 specification_version: 4
 summary: ''
 test_files: []