glib-web 7.0.1.beta1 → 7.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7a88117fbaf57f748a21abf1ea95fc18fdec09171c7b93e87ac8ef5e02850f93
-  data.tar.gz: d37adcb5e04c61400b5f073ada5a65d0cd5e5f39b62df49c3a28c93c93b06a41
+  metadata.gz: e178f9febdf54e054c6415f98e2dba1168d13ca1eea53c3a2e4c7aba62a434e9
+  data.tar.gz: f882a75e2b6c4c56b09b02419eb67b08e3d771958f5d3445f51ebbd93ffba806
 SHA512:
-  metadata.gz: a47b8e5826f8ac505d0e38b4530a9294140dcd8e5280178c636e2abe78d38d4c323a04d02e0915aec9bcaf73441fecb90d5d0f89650059e7cdc9a7658f737b56
-  data.tar.gz: 7c8ce8df263b855e5a09cd4e42d5e0bf039c0b24d9d08b1f6f6767e5d8857f4cd33d1f9b5a272f3a4c8b8aa16291ff26c57f4dfa350d8881d5b79129dd77f2be
+  metadata.gz: 5ad0e0bbe190e4e3c908561a379513b88d134cf2fafc454d8a843b0467a90d51577f9d1d40ab553774588ce23c454bccac19ba6608239fe5503ae2a5cf4ff4cd
+  data.tar.gz: 02f96c88f95bde1860894cb3e84d849b1a62bf35285178997ead4992ee4f9a8572ea9b48e7a5c73e0bf573cc3be56ee2dc056f2bce008792d180a286b8940813

data/app/controllers/concerns/glib/json/libs.rb

@@ -96,6 +96,18 @@ module Glib::Json::Libs
 
         json_ui_redirect_to url, status: status
       end
+      # Any other request format (e.g. a browser tab opening a protected file link
+      # `/temp_blobs/:id/report.pdf`, where the filename sets the format) used to raise
+      # ActionController::UnknownFormat -> a bare 406 with an empty body. Mirror the html
+      # branch instead: whatever opened the URL (browser tab, iframe, img) is redirected
+      # to the target, which the browser follows natively.
+      #
+      # MUST stay the LAST block. `negotiate_mime` answers `Accept: */*` requests with
+      # the FIRST declared format, so an `any` block placed before html would capture
+      # ordinary browser page loads and leave request.format as `*/*` for the action.
+      format.any do
+        redirect_to url
+      end
     end
   end
 
@@ -142,6 +154,17 @@ module Glib::Json::Libs
           redirect_to sign_in_url, **redirect_options
         end
       end
+      # Other non-HTML/JSON formats (a protected file link whose filename sets the
+      # request format, an XML export, ...) used to raise UnknownFormat -> a bare 406.
+      # Mirrors the csv branch: a clean gate status in test, a redirect in production.
+      # MUST stay the LAST block -- see glib_redirect_to.
+      format.any do
+        if Rails.env.test?
+          head :unauthorized
+        else
+          redirect_to sign_in_url, **redirect_options
+        end
+      end
     end
   end
 
@@ -185,6 +208,16 @@ module Glib::Json::Libs
           redirect_to user_default_url
         end
       end
+      # Other non-HTML/JSON formats -- mirrors the csv branch (clean gate status in
+      # test, redirect in production); previously raised UnknownFormat -> a bare 406.
+      # MUST stay the LAST block -- see glib_redirect_to.
+      format.any do
+        if Rails.env.test?
+          head :forbidden
+        else
+          redirect_to user_default_url
+        end
+      end
     end
   end
 

data/app/controllers/concerns/glib/params/allowlist.rb

@@ -11,7 +11,8 @@ module Glib::Params
 
     # Resolve a stringly-typed request param (or any boundary string) to one
     # symbol drawn from a closed allow-list (+allowed_symbols+), returning
-    # +default+ when the value is missing, blank, or not recognised.
+    # +default+ when the value is missing, blank, or not recognised — with
+    # one default-config exception on mutating requests, spelled out below.
     #
     # This is the symbol-DoS-safe replacement for `params[:x].to_sym`. A bare
     # `.to_sym` on a raw value mints a symbol for every distinct string a client
@@ -30,16 +31,23 @@ module Glib::Params
     # Blank/missing values fall through to +default+ quietly on EVERY method
     # (forms legitimately post no value; no symbol's string form is blank).
     #
+    # +raise_on_unrecognized+ (default +true+) keeps that raise. Pass +false+
+    # for endpoints anyone can POST to — anonymous public endpoints where junk
+    # values are expected traffic: the present-but-unrecognised case then
+    # degrades to +default+ on every method instead of raising, so bot probes
+    # cannot 500 the endpoint. Endpoints whose only writers are the app's own
+    # UI keep the default — there the raise is the forgotten-entry detector.
+    #
     # +allowed_symbols+ may also contain strings (e.g. a Rails enum's `.keys`)
     # — the matched entry is symbolized on the way out, so the return value is
     # ALWAYS a symbol (or +default+). That `to_sym` runs only on the
     # developer-controlled list entry, never on +value+, so the DoS-safety
     # above is unaffected.
-    def glib_allowlist_symbol_param(value, allowed_symbols, default:)
+    def glib_allowlist_symbol_param(value, allowed_symbols, default:, raise_on_unrecognized: true)
       match = allowed_symbols.find { |symbol| symbol.to_s == value.to_s }&.to_sym
       return match if match
 
-      if value.present? && !request.get? && !request.head?
+      if raise_on_unrecognized && value.present? && !request.get? && !request.head?
         raise UnrecognizedValue,
               "Unrecognised #{request.request_method} param value #{value.to_s.truncate(80).inspect} " \
               "(allowed: #{allowed_symbols.map(&:to_sym).inspect})"

data/app/controllers/glib/errors_controller.rb

@@ -29,12 +29,18 @@ module Glib
       if defined?(Rollbar)
         # `GLib.log.warn` reports arrive with level=warning; everything else
         # (uncaught errors, `GLib.log.error`) is an error. Prefixed so
-        # browser-side reports are distinguishable from server exceptions;
+        # client-side reports are distinguishable from server exceptions;
         # the details ride along as custom data for grouping.
         rollbar_level = params[:level] == 'warning' ? :warning : :error
+        # The prefix names the reporting runtime: the npm client sends no
+        # platform and stays "JS"; the Android renderer sends "ANDROID"
+        # (spec: thread 174). A platform TAG, not free text -- truncated so
+        # a crafted value cannot smuggle a payload into the message, and
+        # absent/blank degrades to the historical JS label.
+        platform = params[:platform].to_s[0, 16].presence || 'JS'
         Rollbar.public_send(
           rollbar_level,
-          "JS: #{params[:message]}",
+          "#{platform}: #{params[:message]}",
           stack: params[:stack],
           url: params[:url],
           context: params[:context],

data/app/helpers/glib/json_ui/action_builder.rb

@@ -39,10 +39,10 @@ module Glib
           add_element_to_array 'action', m, *args
         else
           if !Rails.env.production? && @singleton_action_set
-            raise "Multiple actions called on a singleton ActionBuilder. " \
+            raise 'Multiple actions called on a singleton ActionBuilder. ' \
                   "Only one action is allowed. Previous action: '#{@singleton_action_name}', " \
                   "current action: '#{m}'. Use `run_multiple` with `childActions` or " \
-                  "chain actions using `onClose` callbacks."
+                  'chain actions using `onClose` callbacks.'
           end
           @singleton_action_set = true
           @singleton_action_name = m
@@ -170,13 +170,6 @@ module Glib
         end
       end
 
-      module Labels
-        class Set < Action
-          string :text
-          action :onSet
-        end
-      end
-
       module Lists
         class Append < Action
           hash :row

data/app/helpers/glib/json_ui/view_builder/fields.rb

@@ -962,7 +962,7 @@ class Glib::JsonUi::ViewBuilder
     #   read-only preview instead of ink). An untouched field therefore
     #   re-submits that same signed id, so consumers should treat a
     #   same-signed-id re-attach as "no change". Resize it via
-    #   `components_set`/`logics_set` with `width`/`height`.
+    #   `logics_set` with `width`/`height`.
     #
     # @see app/views/json_ui/garage/test_page/fields_sign.json.jbuilder Garage examples
     class Sign < AbstractField

data/app/helpers/glib/json_ui/view_builder/panels.rb

@@ -452,170 +452,23 @@ class Glib::JsonUi::ViewBuilder
       end
     end
 
-    class Table2 < View
-      attr_reader :template
-
-      hash :nextPage
-      action :onScrollToTop
-      action :onScrollToBottom
-
-      def initialize(json, page)
-        super
-        @template = Glib::JsonUi::TableBuilders::Template.new(json, self)
-      end
-
-      def header(options = {})
-        json.header do
-          json.backgroundColor options.delete(:backgroundColor)
-          json.cellViews do
-            options.delete(:cellViews)&.call page.view_builder
-          end
-
-          json.colSpans options.delete(:colSpans)
-        end
-
-        raise "Invalid properties: #{options.keys}" if options.size > 0
-      end
-
-      def rows(options = {})
-        block = options.delete(:builder)
-        json.rows do
-          if (objects = options.delete(:objects))
-            objects.each_with_index do |object, index|
-              block&.call template, object, index
-            end
-          else
-            block&.call template
-          end
-        end
-
-        raise "Invalid properties: #{options.keys}" if options.size > 0
-      end
-    end
-
-    class BulkEdit2 < View
+    # The generic bulk-edit table: form-peer submission, per-row POSTs,
+    # viewCells/viewHeaders, plus the full parse/gate/dedup config so any
+    # consumer can compose specialized import behavior (it replaced the
+    # retired bulkEdit2 and bulkEditSg -- see the component's header comment
+    # for the full mapping).
+    class BulkEdit3 < View
       hash :import, required: [:submitUrl, :paramName]
 
       # Override
       def created
-        # bulkEdit2 is a form PEER, not a form child: it answers the same
+        # bulkEdit3 is a form PEER, not a form child: it answers the same
         # forms_submit action a form does (forms/directSubmit) and submits its
         # rows itself to `import.submitUrl`. Inside a form, its repeated
         # per-row input names would collide with the form's FormData scans
         # (duplicate-name warnings, dirty-baseline pollution) while adding
         # nothing to the form's submission -- so, like a nested form, reject
         # the arrangement at render time.
-        if page.current_form
-          raise 'panels_bulkEdit2 is not allowed inside a form; place it as a sibling and target it with forms_submit targetId'
-        end
-      end
-
-      # Maximum number of data rows an uploaded file may contain; files with
-      # more rows are rejected with an error dialog. No limit when unset.
-      int :maxRows
-
-      # string :statusViewIdPrefix
-      array :viewHeaders
-
-      # string :paramNameForFormData
-      string :paramNameForRowId
-      action :onCellChange
-      action :onRowsLoad
-      action :onRowsSelect
-      action :onRowsSucceed
-      action :onSubmitStart
-      action :onSubmitEnd
-
-      # Experimental
-      # panels_builder :accessory, :header, :footer
-
-      def viewCells(values)
-        json.set! 'viewCells' do
-          values.each do |value|
-            value.call(page.view_builder)
-          end
-        end
-      end
-
-      def dataRows(value)
-        json.dataRows value
-      end
-
-      def viewRows(value)
-        json.viewRows value
-      end
-
-    end
-
-    # The Surfguard members-import table: a fork of bulkEdit2's builder for
-    # glib-web-npm's bulkEditSg component (same skeleton — form-peer
-    # submission, per-row POSTs, viewCells/viewHeaders — plus the Surfguard
-    # parse inputs). Deliberately SG-specific; consolidate with BulkEdit2 when
-    # a second consumer proves which props generalize.
-    class BulkEditSg < View
-      hash :import, required: [:submitUrl, :paramName]
-
-      # Override
-      def created
-        # Same form-peer rule as bulkEdit2 (see its comment).
-        if page.current_form
-          raise 'panels_bulkEditSg is not allowed inside a form; place it as a sibling and target it with forms_submit targetId'
-        end
-      end
-
-      # Maximum number of data rows an uploaded file may contain; files with
-      # more rows are rejected with an error dialog. No limit when unset.
-      int :maxRows
-
-      array :viewHeaders
-
-      # string :paramNameForFormData
-      string :paramNameForRowId
-      action :onCellChange
-      action :onRowsLoad
-      action :onRowsSelect
-      action :onRowsSucceed
-      # Fires when non-importable rows drain out of the table on save (they
-      # never POST), so the page can keep its Loaded/Uploaded/Skipped
-      # arithmetic honest.
-      action :onRowsSkip
-      action :onSubmitStart
-      action :onSubmitEnd
-
-      # Surfguard file shape: CSV header => form field. The parser follows
-      # this map, so a header-spelling fix is a one-line server change.
-      hash :headerMap
-      array :requiredHeaders
-      string :statusFilter
-
-      def viewCells(values)
-        json.set! 'viewCells' do
-          values.each do |value|
-            value.call(page.view_builder)
-          end
-        end
-      end
-
-      def dataRows(value)
-        json.dataRows value
-      end
-
-      def viewRows(value)
-        json.viewRows value
-      end
-
-    end
-
-    # The generic bulk-edit table: bulkEdit2's skeleton plus everything
-    # bulkEditSg hard-coded for the Surfguard imports, expressed as config so
-    # any consumer can compose the same behavior (bulkEditSg's replacement --
-    # see the component's header comment for the full mapping).
-    class BulkEdit3 < View
-      hash :import, required: [:submitUrl, :paramName]
-
-      # Override
-      def created
-        # Same form-peer rule as bulkEdit2 (see its comment).
         if page.current_form
           raise 'panels_bulkEdit3 is not allowed inside a form; place it as a sibling and target it with forms_submit targetId'
         end
@@ -641,7 +494,7 @@ class Glib::JsonUi::ViewBuilder
       action :onSubmitEnd
 
       # The file shape. Without it the table takes plain CSVs (header row
-      # first, header names = field ids -- the bulkEdit2 shape):
+      # first, header names = field ids):
       #   detectHeader: { allOf: [...], anyOf: [...], scanRows: N } -- find
       #     the header row BY CONTENT (report preambles survive);
       #   headerMap: { csvHeader => field } -- header-keyed, order-independent
@@ -716,36 +569,6 @@ class Glib::JsonUi::ViewBuilder
 
     end
 
-    # deprecated
-    class BulkEdit < View
-      hash :nextPage
-      hash :export, required: [:label, :fileName]
-      hash :import, required: [:submitUrl, :paramName]
-      action :onScrollToTop
-      action :onScrollToBottom
-      string :statusViewIdPrefix
-      action :onLoadRows
-
-      # Experimental
-      panels_builder :accessory, :header, :footer
-
-      def firstSection(block)
-        json.sections [1] do
-          block.call page.table_section_builder
-        end
-      end
-
-      def sections(blocks)
-        json.sections do
-          blocks.each do |block|
-            json.child! do
-              block.call page.table_section_builder
-            end
-          end
-        end
-      end
-    end
-
     # Scrollable container panel for content that exceeds viewport height.
     #
     # Scroll panels automatically add scrollbars when content overflows.

data/app/helpers/glib/json_ui/view_builder.rb

@@ -382,12 +382,6 @@ module Glib
         end
       end
 
-      class Datetime < View
-        date_time :value
-        string :format
-        bool :tick
-      end
-
       class ProgressBar < View
         float :value
         color :color

data/app/models/concerns/glib/snapshot_v2.rb

@@ -12,7 +12,9 @@ require 'hashdiff'
 #   4. ActiveStorage in diff_associations (convert Attached::One/Many to attachment records).
 #   5. same_as_before? derives from the computed diff instead of the instance-local
 #      `snapshot_changed` flag (mapping-web's flag-gating silently dropped a target's
-#      snapshot when taken after the owner's -- see "Snapshot ordering" below, issue #481).
+#      snapshot when taken after the owner's -- see "Snapshot ordering" below, issue #481),
+#      with the flag re-entering as a NEGATIVE signal for first snapshots only (see
+#      `same_as_before?` for why an empty association baseline cannot decide those).
 #
 # ## Snapshot ordering: owner vs association targets
 #
@@ -27,7 +29,8 @@ require 'hashdiff'
 # reading the target back through the association snapshots the persisted state instead.
 #
 # `snapshot_changed` / `attributes_before_save` remain writable instance accessors for
-# call-site use, but they are no longer consulted for the skip decision.
+# call-site use; `snapshot_changed` is consulted by the skip decision only as a NEGATIVE
+# signal on first snapshots (see `same_as_before?`).
 #
 # To get all records of a model, you can use the following query:
 # MyModel.joins(:snapshots).distinct
@@ -60,7 +63,16 @@ module Glib
         # Only set snapshot_changed if not already set (handles case where before_save
         # is called multiple times - e.g., when associated records are saved before parent)
         if snapshot_changed.nil?
-          self.attributes_before_save = attributes_in_database
+          # For a save with no pending change `attributes_in_database` is empty -- an
+          # unchanged persisted record has no database-side delta -- which would make a
+          # first snapshot diff every attribute as an addition. Capture the full
+          # persisted state instead, so an unchanged save yields an empty item diff and
+          # the nil-guard keeps that baseline stable for later changes on the same
+          # instance. New records keep `attributes_in_database` (their all-nil
+          # originals): that non-empty baseline is exactly why a create's version 1
+          # records the full initial state. `unless` keeps the accessor nil, never
+          # `false`, for call-site nil-safety.
+          self.attributes_before_save = attributes_in_database.presence || (attributes unless new_record?)
           self.snapshot_changed = check_snapshot_changed
         end
       end
@@ -125,8 +137,10 @@ module Glib
               }
 
               # Don't create version if same as before. Reuses `calculated_diff` instead of
-              # recomputing it inside `same_as_before?`.
-              unless same_as_before?(calculated_diff)
+              # recomputing it inside `same_as_before?`. `version == 1` (no previous
+              # version exists) tells `same_as_before?` this is a FIRST snapshot, where the
+              # association baseline is empty and the flag carries decision weight.
+              unless same_as_before?(calculated_diff, first_snapshot: version == 1)
                 # No nil guard: active_snapshot's `create_snapshot!` raises on failure and
                 # always returns the snapshot.
                 snapshot = create_snapshot!(**snapshot_obj)
@@ -186,13 +200,28 @@ module Glib
     end
 
     # Decides whether `glib_create_snapshot!` should skip the version write. Derived from
-    # the computed diff (persisted state), never from the instance-local `snapshot_changed`
+    # the computed diff (persisted state), not from the instance-local `snapshot_changed`
     # flag: the flag dies with its instance, and an owner's snapshot replaces association
     # targets with fresh instances (`with_lock`'s reload clears the association cache, then
     # the diff walk re-reads the targets), so flag-gating used to silently drop a target's
-    # follow-up snapshot taken through the association (issue #481). For a first snapshot
-    # (no previous version) the diff runs current state against `attributes_before_save || {}`.
-    def same_as_before?(computed_diff = diff)
+    # follow-up snapshot taken through the association (issue #481).
+    #
+    # The one place the flag still decides: a FIRST snapshot whose association diff is
+    # meaningless. With no previous version, `fetch_snapshot_items(nil)` returns `{}`
+    # for associations, so every pre-existing child row reads as `+` and the diff alone
+    # can never prove a no-op — any never-snapshotted record with children would mint a
+    # version on every snapshot call (observed as spurious "Edited" audit entries on
+    # routine re-saves). There the flag is consulted as a NEGATIVE signal:
+    #   - `false` — this instance crossed the before_save boundary and
+    #     `check_snapshot_changed` found no item or child change, and the item diff is
+    #     net-zero against `attributes_before_save` => skip;
+    #   - `nil` — no save boundary on this instance (an owner-triggered snapshot of a
+    #     replaced association target, issue #481) => mint;
+    #   - `true` — a change was detected at the save boundary; falls through to the
+    #     diff-based decision (a reverted change still no-ops).
+    def same_as_before?(computed_diff = diff, first_snapshot: false)
+      return true if first_snapshot && snapshot_changed == false && computed_diff['item'].blank?
+
       item_unchanged = computed_diff['item'].blank?
       assoc_diff = computed_diff['associations']
       associations_unchanged = assoc_diff.nil? || assoc_diff.values.all?(&:blank?)

data/app/views/json_ui/garage/tables/bulk_edit.json.jbuilder

@@ -37,17 +37,17 @@ page.scroll childViews: ->(scroll) do
         displayed: false
     end
 
-    wres.panels_bulkEdit2 \
+    wres.panels_bulkEdit3 \
       id: 'import_table',
       width: 'matchParent',
       paramNameForRowId: 'row_id',
       import: { submitUrl: json_ui_garage_url(path: 'forms/bulk_edit_post2'), paramName: 'user' },
       viewHeaders: [
-        { text: 'Month', id: 'month', importable: true, tooltip: { text: 'Month', placement: 'top' } },
-        { text: 'Electricity usage', id: 'electricity_usage', importable: true },
-        { text: 'Gas usage', id: 'gas_usage', importable: true },
-        { text: 'Sources', id: 'sources', importable: true },
-        { text: 'Compliant', id: 'compliant', importable: true }
+        { text: 'Month', id: 'month', tooltip: { text: 'Month', placement: 'top' } },
+        { text: 'Electricity usage', id: 'electricity_usage' },
+        { text: 'Gas usage', id: 'gas_usage' },
+        { text: 'Sources', id: 'sources' },
+        { text: 'Compliant', id: 'compliant' }
       ],
       viewCells: [
         ->(view) do

data/app/views/json_ui/garage/test_page/_header.json.jbuilder

@@ -56,7 +56,6 @@ nav_groups = {
     'flow',
     'grid',
     'horizontal',
-    'panels_bulkEdit2',
     'pagination',
     'responsive',
     'scroll',

data/app/views/json_ui/garage/test_page/bottom_banners.json.jbuilder

@@ -0,0 +1,69 @@
+json.title 'Test Page (Bottom Banners)'
+
+page = json_ui_page json
+
+render 'json_ui/garage/test_page/header', json: json, page: page
+
+page.body(
+  childViews: ->(body) do
+    body.panels_responsive(
+      padding: glib_json_padding_body,
+      childViews: ->(res) do
+        res.h2 text: 'Bottom Banners'
+        res.spacer height: 8
+        res.button text: "bottomBanners/open targetId: 'dock1'", onClick: ->(action) do
+          action.bottomBanners_open targetId: 'dock1', newView: ->(view) do
+            view.panels_responsive(
+              styleClass: ['frameless'],
+              childViews: ->(panel) do
+                panel.label text: 'Upload in progress'
+                panel.spacer height: 4
+                panel.button text: 'Details', onClick: ->(subaction) do
+                  subaction.dialogs_alert message: 'Upload details'
+                end
+              end
+            )
+          end
+        end
+        res.spacer height: 4
+        res.button text: "bottomBanners/open targetId: 'dock2'", onClick: ->(action) do
+          action.bottomBanners_open targetId: 'dock2', newView: ->(view) do
+            view.panels_responsive(
+              styleClass: ['frameless'],
+              childViews: ->(panel) do
+                panel.banners_alert title: 'Background task', message: 'A long-running task is still active.'
+              end
+            )
+          end
+        end
+        res.spacer height: 4
+        res.button text: "bottomBanners/open replace 'dock1'", onClick: ->(action) do
+          action.bottomBanners_open targetId: 'dock1', newView: ->(view) do
+            view.panels_responsive(
+              styleClass: ['frameless'],
+              childViews: ->(panel) do
+                panel.label text: 'Upload complete'
+                panel.spacer height: 4
+                panel.button text: 'Dismiss', onClick: ->(subaction) do
+                  subaction.bottomBanners_close targetId: 'dock1'
+                end
+              end
+            )
+          end
+        end
+        res.spacer height: 4
+        res.button text: "bottomBanners/close targetId: 'dock1'", onClick: ->(action) do
+          action.bottomBanners_close targetId: 'dock1'
+        end
+        res.spacer height: 4
+        res.button text: "bottomBanners/close targetId: 'dock2'", onClick: ->(action) do
+          action.bottomBanners_close targetId: 'dock2'
+        end
+        res.spacer height: 4
+        res.button text: 'bottomBanners/close (no targetId)', onClick: ->(action) do
+          action.bottomBanners_close
+        end
+      end
+    )
+  end
+)

data/app/views/json_ui/garage/test_page/fields_sign.json.jbuilder

@@ -121,7 +121,7 @@ page.body(
                   text: 'Clear value',
                   onClick: ->(action) do
                     action.runMultiple childActions: ->(multiple) do
-                      multiple.logics_set targetId: 'signature_main', data: { value: nil }
+                      multiple.logics_set targetId: 'signature_main', data: { value: '' }
                       multiple.logics_set targetId: 'signature_status', data: { text: 'Status: cleared' }
                     end
                   end

data/app/views/json_ui/garage/test_page/panels_bulkEdit3.json.jbuilder

@@ -83,13 +83,13 @@ page.body(
       padding: glib_json_padding_body,
       childViews: ->(res) do
         res.h2 text: 'Overview'
-        res.p text: 'panels_bulkEdit3 is the generic bulk-edit table: bulkEdit2’s skeleton plus config-driven file parsing, row gates, read-only columns, view chips and submission extras.'
+        res.p text: 'panels_bulkEdit3 is the generic bulk-edit table: cells, pagination and one-POST-per-row submission, plus config-driven file parsing, row gates, read-only columns, view chips and submission extras.'
         res.spacer height: 12
         res.hr width: 'matchParent'
 
         res.h2 text: 'Basic example (plain CSV)'
         res.spacer height: 8
-        res.p text: 'Without parse config the table takes plain CSVs: header row first, header names as field ids (the bulkEdit2 shape). maxRows 3 rejects oversized files whole.'
+        res.p text: 'Without parse config the table takes plain CSVs: header row first, header names as field ids. maxRows 3 rejects oversized files whole.'
         res.spacer height: 8
         res.panels_horizontal(
           align: 'middle',

data/app/views/json_ui/garage/test_page/web.json.jbuilder

@@ -10,15 +10,20 @@ page.body childViews: ->(body) do
     res.h2 text: 'Overview'
     res.p text: 'Web panels embed external web content within a panel container.'
 
-    url_primary = 'https://www.w3.org/WAI/ER/tests/xhtml/testfiles/resources/pdf/dummy.pdf'
-    url_alt = 'https://example.com'
+    # Hermetic content on the serving host itself (spec 169, Decision 5):
+    # the recording host's public/ carries the two deterministic pages, so
+    # the emitted URLs bake an origin the cassette replay can rewrite and
+    # serve — an external URL would leave the emulator for the real network
+    # and no golden could depend on it.
+    url_content = "#{request.base_url}/g-web-panel.html"
+    url_alt = "#{request.base_url}/g-web-panel-alt.html"
 
     res.spacer height: 12
     res.hr width: 'matchParent'
 
     res.h2 text: 'Basic'
     res.spacer height: 8
-    res.panels_web id: 'web_main', width: 'matchParent', height: 300, url: url_primary
+    res.panels_web id: 'web_main', width: 'matchParent', height: 300, url: url_content
 
     res.spacer height: 12
     res.hr width: 'matchParent'
@@ -26,11 +31,11 @@ page.body childViews: ->(body) do
     res.h2 text: 'Variants and Props'
     res.spacer height: 8
     res.panels_flow innerPadding: { bottom: 0 }, childViews: ->(flow) do
-      flow.button text: 'PDF', onClick: ->(action) do
-        action.logics_set targetId: 'web_main', data: { url: url_primary }
+      flow.button text: 'Content A', onClick: ->(action) do
+        action.logics_set targetId: 'web_main', data: { url: url_content }
       end
       flow.spacer width: 4
-      flow.button text: 'Example.com', onClick: ->(action) do
+      flow.button text: 'Content B', onClick: ->(action) do
         action.logics_set targetId: 'web_main', data: { url: url_alt }
       end
       flow.spacer width: 4
@@ -60,6 +65,6 @@ page.body childViews: ->(body) do
     res.h2 text: 'Edge and Advanced'
     res.spacer height: 8
     res.label text: 'Small viewport'
-    res.panels_web width: 'matchParent', height: 120, url: url_primary
+    res.panels_web width: 'matchParent', height: 120, url: url_content
   end
 end

data/app/views/json_ui/garage/views/misc.json.jbuilder

@@ -14,12 +14,6 @@ json_ui_page json do |page|
     #   ul.label text: 'Label'
     # end
 
-    scroll.spacer height: 20
-    scroll.h2 text: 'Time'
-    scroll.spacer height: 6
-    scroll.datetime value: 1.week.ago, format: 'YYYY-MM-DD'
-    scroll.datetime value: DateTime.current, format: 'hh:mm:ss', tick: true
-
     # scroll.spacer height: 20
     # scroll.h2 text: 'Map'
     # scroll.spacer height: 6
@@ -30,5 +24,15 @@ json_ui_page json do |page|
     scroll.spacer height: 6
     scroll.calendar width: 'matchParent', height: 500, dataUrl: json_ui_garage_url(path: 'views/calendar_data')
 
+    # h5/h6 exercised here rather than views/texts: the texts page is pinned
+    # by the client suite's golden, and a non-corpus page covers the headings
+    # without shifting it (component inventory, thread 195).
+    scroll.spacer height: 20
+    scroll.h2 text: 'Sub-headings'
+    scroll.spacer height: 6
+    scroll.h5 text: 'Heading 5'
+    scroll.spacer height: 6
+    scroll.h6 text: 'Heading 6'
+
   end
 end

data/lib/glib/json_crawler/action_crawlers/forms_submit.rb

@@ -16,7 +16,7 @@ module Glib
         raise "Submit action needs to be inside a form: #{http.router.last_log}" unless form
 
         case Glib::JsonUi::Name.normalize(form['view'])
-        when 'panels/bulkEdit2', 'panels/bulkEdit3'
+        when 'panels/bulkEdit3'
           method = 'post'
           action = "forms/#{method}"
           url = form['import']['submitUrl']

data/lib/glib/json_ui/config.rb

@@ -3,22 +3,21 @@ module Glib
     # Global JSON UI settings.
     #
     # `name_separator` controls the character that joins the namespace and the
-    # component/action name in the generated JSON, e.g. `panels/responsive`
-    # (default) vs `panels_responsive`.
+    # component/action name in the generated JSON, e.g. `panels_responsive`
+    # (default since 7.0) vs `panels/responsive`.
     #
-    # The default stays `/` for backwards compatibility; `_` becomes the default
-    # in the next major version. Apps opt in early via an initializer:
+    # Apps that need the legacy slash names opt back in via an initializer:
     #
     #   # config/initializers/glib.rb
-    #   Glib::JsonUi::Config.name_separator = '_'
+    #   Glib::JsonUi::Config.name_separator = '/'
     #
-    # Frontends built on glib-web-npm accept either form, so flipping this is a
-    # server-side-only change.
+    # Frontends built on glib-web-npm accept either form, so this is a
+    # server-side-only setting.
     class Config
       SEPARATORS = ['/', '_'].freeze
 
-      # The shipped default. Stays '/' until the next major version, when it
-      # becomes '_'. Apps opt in early via `Config.name_separator = '_'`.
+      # The shipped default since the 7.0 major version. Apps that need the
+      # legacy names opt back in via `Config.name_separator = '/'`.
       DEFAULT_NAME_SEPARATOR = '_'
 
       @@name_separator = DEFAULT_NAME_SEPARATOR

data/lib/glib/test_helpers.rb

@@ -239,7 +239,6 @@ module Glib
         name = Glib::JsonUi::Name.normalize(view['view'])
         name&.start_with?('panels/form') ||
           name&.start_with?('panels/fullPageForm') ||
-          name == 'panels/bulkEdit2' ||
           name == 'panels/bulkEdit3' ||
           name == 'panels/splitForm'
       end

metadata

@@ -1,13 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: glib-web
 version: !ruby/object:Gem::Version
-  version: 7.0.1.beta1
+  version: 7.1.0
 platform: ruby
 authors:
 - ''
+autorequire:
 bindir: bin
 cert_chain: []
-date: 1980-01-02 00:00:00.000000000 Z
+date: 2026-10-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activestorage
@@ -191,6 +192,7 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+description:
 email: ''
 executables: []
 extensions: []
@@ -234,7 +236,6 @@ files:
 - app/helpers/glib/json_ui/action_builder/dialogs.rb
 - app/helpers/glib/json_ui/action_builder/fields.rb
 - app/helpers/glib/json_ui/action_builder/files.rb
-- app/helpers/glib/json_ui/action_builder/global_states.rb
 - app/helpers/glib/json_ui/action_builder/http.rb
 - app/helpers/glib/json_ui/action_builder/iap.rb
 - app/helpers/glib/json_ui/action_builder/logics.rb
@@ -438,6 +439,7 @@ files:
 - app/views/json_ui/garage/test_page/_header.json.jbuilder
 - app/views/json_ui/garage/test_page/auth.json.jbuilder
 - app/views/json_ui/garage/test_page/auto_validate.json.jbuilder
+- app/views/json_ui/garage/test_page/bottom_banners.json.jbuilder
 - app/views/json_ui/garage/test_page/browsers.json.jbuilder
 - app/views/json_ui/garage/test_page/calendar.json.jbuilder
 - app/views/json_ui/garage/test_page/calendar_empty_data.json.jbuilder
@@ -497,7 +499,6 @@ files:
 - app/views/json_ui/garage/test_page/multimedia_video.json.jbuilder
 - app/views/json_ui/garage/test_page/pagination.json.jbuilder
 - app/views/json_ui/garage/test_page/panels.json.jbuilder
-- app/views/json_ui/garage/test_page/panels_bulkEdit2.json.jbuilder
 - app/views/json_ui/garage/test_page/panels_bulkEdit3.json.jbuilder
 - app/views/json_ui/garage/test_page/popovers.json.jbuilder
 - app/views/json_ui/garage/test_page/progressCircle.json.jbuilder
@@ -605,8 +606,10 @@ files:
 - lib/glib/time_returning_mailer.rb
 - lib/glib/value.rb
 - lib/tasks/db.rake
+homepage:
 licenses: []
 metadata: {}
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -621,7 +624,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.16
+rubygems_version: 3.4.6
+signing_key:
 specification_version: 4
 summary: ''
 test_files: []

data/app/helpers/glib/json_ui/action_builder/global_states.rb

@@ -1,14 +0,0 @@
-class Glib::JsonUi::ActionBuilder
-  module GlobalStates
-    # Experimental
-    class Watch < Action
-      string :state
-      action :onChange
-    end
-
-    class Set < Action
-      string :state
-      hash :data
-    end
-  end
-end

data/app/views/json_ui/garage/test_page/panels_bulkEdit2.json.jbuilder

@@ -1,244 +0,0 @@
-json.title 'Test Page (Panels Bulk Edit 2)'
-
-page = json_ui_page json
-
-options = [{ text: 'yes', value: 'yes' }, { text: 'no', value: 'no' }]
-source_options = ['Generators', 'Power Station', 'Solar Panels'].map do |source|
-  { text: source, value: source }
-end
-
-default_headers = [
-  { text: 'Month', id: 'month', importable: true, tooltip: { text: 'Month', placement: 'top' } },
-  { text: 'Electricity usage', id: 'electricity_usage', importable: true },
-  { text: 'Gas usage', id: 'gas_usage', importable: true },
-  { text: 'Sources', id: 'sources', importable: true },
-  { text: 'Compliant', id: 'compliant', importable: true }
-]
-
-default_cells = [
-  ->(view) do
-    view.fields_number width: 'matchParent'
-  end,
-  ->(view) do
-    view.fields_number width: 'matchParent'
-  end,
-  ->(view) do
-    view.fields_number width: 'matchParent'
-  end,
-  ->(view) do
-    view.fields_select width: 'matchParent', options: source_options, multiple: true
-  end,
-  ->(view) do
-    view.fields_select width: 'matchParent', options: options
-  end
-]
-
-[
-  { text: 'Month', id: 'month', importable: true },
-  { text: 'Usage (kWh)', id: 'electricity_usage', importable: true },
-  { text: 'Usage (Therms)', id: 'gas_usage', importable: true }
-]
-
-[
-  ->(view) do
-    view.fields_number width: 120
-  end,
-  ->(view) do
-    view.fields_number width: 140
-  end,
-  ->(view) do
-    view.fields_number width: 140
-  end
-]
-
-import_settings = { submitUrl: json_ui_garage_url(path: 'forms/bulk_edit_post2'), paramName: 'user' }
-
-render 'json_ui/garage/test_page/header', json: json, page: page
-
-page.body(
-  childViews: ->(body) do
-    body.panels_responsive(
-      padding: glib_json_padding_body,
-      childViews: ->(res) do
-        res.h2 text: 'Overview'
-        res.p text: 'panels_bulkEdit2 renders an editable grid with import-backed rows and bulk submission events.'
-        res.spacer height: 12
-        res.hr width: 'matchParent'
-        res.h2 text: 'Basic example'
-        res.spacer height: 8
-        res.panels_horizontal(
-          align: 'middle',
-          childViews: ->(horizontal) do
-            horizontal.label text: 'Loaded: '
-            horizontal.label id: 'bulk_edit_loaded_count', text: '0'
-            horizontal.spacer width: 12
-            horizontal.label text: 'Selected: '
-            horizontal.label id: 'bulk_edit_selected_count', text: '0'
-            horizontal.spacer width: 12
-            horizontal.chip id: 'bulk_edit_succeeded_count', styleClass: 'success', text: 'Uploaded: 0', displayed: false
-          end
-        )
-        res.spacer height: 8
-        res.panels_bulkEdit2(
-          id: 'bulk_edit_main',
-          width: 'matchParent',
-          paramNameForRowId: 'row_id',
-          # Files with more data rows than this are rejected wholesale with an
-          # error dialog (the header row doesn't count).
-          maxRows: 3,
-          import: import_settings,
-          viewHeaders: default_headers,
-          viewCells: default_cells,
-          onCellChange: ->(action) do
-            action.snackbars_alert debug: true, paramName: 'message', fieldName: 'row'
-          end,
-          onSubmitStart: ->(action) do
-            action.runMultiple(
-              childActions: ->(multiple) do
-                multiple.logics_set targetId: 'bulk_edit_submit_top', data: { disabled: true }
-                multiple.logics_set targetId: 'bulk_edit_submit_bottom', data: { disabled: true }
-                multiple.logics_set targetId: 'bulk_edit_cancel', data: { displayed: true }
-              end
-            )
-          end,
-          onSubmitEnd: ->(action) do
-            action.runMultiple(
-              childActions: ->(multiple) do
-                multiple.logics_set targetId: 'bulk_edit_submit_top', data: { disabled: false }
-                multiple.logics_set targetId: 'bulk_edit_submit_bottom', data: { disabled: false }
-                multiple.logics_set targetId: 'bulk_edit_cancel', data: { displayed: false }
-              end
-            )
-          end,
-          onRowsLoad: ->(action) do
-            action.runMultiple(
-              debug: true,
-              fieldName: 'data',
-              childActions: ->(multiple) do
-                multiple.logics_set(
-                  targetId: 'bulk_edit_loaded_count',
-                  debug: true,
-                  paramName: 'variables',
-                  fieldName: 'data',
-                  conditionalData: {
-                  text: { "count": [{ "var": 'data.loadedRows' }] }
-                  }
-                )
-                multiple.logics_set targetId: 'bulk_edit_submit_top', data: { displayed: true }
-                multiple.logics_set targetId: 'bulk_edit_submit_bottom', data: { displayed: true }
-              end
-            )
-          end,
-          onRowsSelect: ->(action) do
-            action.logics_set(
-              targetId: 'bulk_edit_selected_count',
-              debug: true,
-              paramName: 'variables',
-              fieldName: 'data',
-              conditionalData: {
-              text: { "count": [{ "var": 'data.selectedRows' }] }
-              }
-            )
-          end,
-          onRowsSucceed: ->(action) do
-            action.logics_set(
-              targetId: 'bulk_edit_succeeded_count',
-              debug: true,
-              paramName: 'variables',
-              fieldName: 'data',
-              conditionalData: {
-              text: {
-              "printf": [
-              'Uploaded: {0}',
-              { "count": [{ "var": 'data.succeededRows' }] }
-              ]
-              },
-              displayed: true
-              }
-            )
-          end
-        )
-        res.spacer height: 12
-        res.panels_flow(
-          innerPadding: { bottom: 0 },
-          childViews: ->(flow) do
-            flow.button(
-              id: 'bulk_edit_submit_top',
-              text: 'Submit (top)',
-              displayed: false,
-              onClick: ->(action) do
-                action.forms_submit targetId: 'bulk_edit_main'
-              end
-            )
-            flow.spacer width: 8
-            flow.button(
-              id: 'bulk_edit_submit_bottom',
-              text: 'Submit (bottom)',
-              displayed: false,
-              onClick: ->(action) do
-                action.forms_submit targetId: 'bulk_edit_main'
-              end
-            )
-            flow.spacer width: 8
-            flow.button(
-              id: 'bulk_edit_cancel',
-              text: 'Cancel import',
-              displayed: false,
-              onClick: ->(action) do
-                action.components_invoke targetId: 'bulk_edit_main', name: 'cancelImport'
-              end
-            )
-          end
-        )
-        res.spacer height: 12
-        res.hr width: 'matchParent'
-        # res.h2 text: 'Variants/props'
-        # res.spacer height: 8
-        # res.panels_flow innerPadding: { bottom: 0 }, childViews: ->(flow) do
-        #   flow.button text: 'Default columns', onClick: ->(action) do
-        #     action.logics_set targetId: 'bulk_edit_main', data: { viewHeaders: default_headers, viewCells: default_cells }
-        #   end
-        #   flow.spacer width: 8
-        #   flow.button text: 'Compact columns', onClick: ->(action) do
-        #     action.logics_set targetId: 'bulk_edit_main', data: { viewHeaders: compact_headers, viewCells: compact_cells }
-        #   end
-        #   flow.spacer width: 8
-        #   flow.button text: 'Reset counts', onClick: ->(action) do
-        #     action.runMultiple childActions: ->(multiple) do
-        #       multiple.logics_set targetId: 'bulk_edit_loaded_count', data: { text: '0' }
-        #       multiple.logics_set targetId: 'bulk_edit_selected_count', data: { text: '0' }
-        #       multiple.logics_set targetId: 'bulk_edit_succeeded_count', data: { text: 'Uploaded: 0', displayed: false }
-        #     end
-        #   end
-        # end
-        # res.spacer height: 12
-        # res.hr width: 'matchParent'
-        res.h2 text: 'Actions/events'
-        res.spacer height: 8
-        res.panels_flow(
-          innerPadding: { bottom: 0 },
-          childViews: ->(flow) do
-            flow.button(
-              text: 'Submit (forms_submit)',
-              onClick: ->(action) do
-                action.forms_submit targetId: 'bulk_edit_main'
-              end
-            )
-            flow.spacer width: 8
-            flow.button(
-              text: 'Cancel import (invoke)',
-              onClick: ->(action) do
-                action.components_invoke targetId: 'bulk_edit_main', name: 'cancelImport'
-              end
-            )
-          end
-        )
-        res.spacer height: 12
-        res.hr width: 'matchParent'
-        res.h2 text: 'Edge/advanced'
-        res.spacer height: 8
-        res.label text: 'Swap to compact headers then try editing rows before submitting.'
-      end
-    )
-  end
-)