glib-web 7.0.1 → 7.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 82ff8816e031f21b644701d78314fbba42562a8b29674a908f7f3d25932fcfdf
-  data.tar.gz: '00383eecb92f3f6b4e94f7929cc582261b31151911110bcee36f4e52a024e5e1'
+  metadata.gz: e178f9febdf54e054c6415f98e2dba1168d13ca1eea53c3a2e4c7aba62a434e9
+  data.tar.gz: f882a75e2b6c4c56b09b02419eb67b08e3d771958f5d3445f51ebbd93ffba806
 SHA512:
-  metadata.gz: 4520d660ffd5ff5b2098a14123a4f88623590ec83e34852117c7f9b531e2065d1373be29950db8b44599ef2a8b1ef29208bd3c46ed6c53c50fc2dbc63fc93ca0
-  data.tar.gz: 77f0fc4304dfc140ecdf4d40264d73562f49e2419f198dd0f90902e3c0083468e9801d06ad9e351621c8fc104292687cc54b35b5821c25dfa764e120a18baa63
+  metadata.gz: 5ad0e0bbe190e4e3c908561a379513b88d134cf2fafc454d8a843b0467a90d51577f9d1d40ab553774588ce23c454bccac19ba6608239fe5503ae2a5cf4ff4cd
+  data.tar.gz: 02f96c88f95bde1860894cb3e84d849b1a62bf35285178997ead4992ee4f9a8572ea9b48e7a5c73e0bf573cc3be56ee2dc056f2bce008792d180a286b8940813

data/app/controllers/concerns/glib/params/allowlist.rb

@@ -11,7 +11,8 @@ module Glib::Params
 
     # Resolve a stringly-typed request param (or any boundary string) to one
     # symbol drawn from a closed allow-list (+allowed_symbols+), returning
-    # +default+ when the value is missing, blank, or not recognised.
+    # +default+ when the value is missing, blank, or not recognised — with
+    # one default-config exception on mutating requests, spelled out below.
     #
     # This is the symbol-DoS-safe replacement for `params[:x].to_sym`. A bare
     # `.to_sym` on a raw value mints a symbol for every distinct string a client
@@ -30,16 +31,23 @@ module Glib::Params
     # Blank/missing values fall through to +default+ quietly on EVERY method
     # (forms legitimately post no value; no symbol's string form is blank).
     #
+    # +raise_on_unrecognized+ (default +true+) keeps that raise. Pass +false+
+    # for endpoints anyone can POST to — anonymous public endpoints where junk
+    # values are expected traffic: the present-but-unrecognised case then
+    # degrades to +default+ on every method instead of raising, so bot probes
+    # cannot 500 the endpoint. Endpoints whose only writers are the app's own
+    # UI keep the default — there the raise is the forgotten-entry detector.
+    #
     # +allowed_symbols+ may also contain strings (e.g. a Rails enum's `.keys`)
     # — the matched entry is symbolized on the way out, so the return value is
     # ALWAYS a symbol (or +default+). That `to_sym` runs only on the
     # developer-controlled list entry, never on +value+, so the DoS-safety
     # above is unaffected.
-    def glib_allowlist_symbol_param(value, allowed_symbols, default:)
+    def glib_allowlist_symbol_param(value, allowed_symbols, default:, raise_on_unrecognized: true)
       match = allowed_symbols.find { |symbol| symbol.to_s == value.to_s }&.to_sym
       return match if match
 
-      if value.present? && !request.get? && !request.head?
+      if raise_on_unrecognized && value.present? && !request.get? && !request.head?
         raise UnrecognizedValue,
               "Unrecognised #{request.request_method} param value #{value.to_s.truncate(80).inspect} " \
               "(allowed: #{allowed_symbols.map(&:to_sym).inspect})"

data/app/controllers/glib/errors_controller.rb

@@ -29,12 +29,18 @@ module Glib
       if defined?(Rollbar)
         # `GLib.log.warn` reports arrive with level=warning; everything else
         # (uncaught errors, `GLib.log.error`) is an error. Prefixed so
-        # browser-side reports are distinguishable from server exceptions;
+        # client-side reports are distinguishable from server exceptions;
         # the details ride along as custom data for grouping.
         rollbar_level = params[:level] == 'warning' ? :warning : :error
+        # The prefix names the reporting runtime: the npm client sends no
+        # platform and stays "JS"; the Android renderer sends "ANDROID"
+        # (spec: thread 174). A platform TAG, not free text -- truncated so
+        # a crafted value cannot smuggle a payload into the message, and
+        # absent/blank degrades to the historical JS label.
+        platform = params[:platform].to_s[0, 16].presence || 'JS'
         Rollbar.public_send(
           rollbar_level,
-          "JS: #{params[:message]}",
+          "#{platform}: #{params[:message]}",
           stack: params[:stack],
           url: params[:url],
           context: params[:context],

data/app/helpers/glib/json_ui/action_builder.rb

@@ -39,10 +39,10 @@ module Glib
           add_element_to_array 'action', m, *args
         else
           if !Rails.env.production? && @singleton_action_set
-            raise "Multiple actions called on a singleton ActionBuilder. " \
+            raise 'Multiple actions called on a singleton ActionBuilder. ' \
                   "Only one action is allowed. Previous action: '#{@singleton_action_name}', " \
                   "current action: '#{m}'. Use `run_multiple` with `childActions` or " \
-                  "chain actions using `onClose` callbacks."
+                  'chain actions using `onClose` callbacks.'
           end
           @singleton_action_set = true
           @singleton_action_name = m
@@ -170,13 +170,6 @@ module Glib
         end
       end
 
-      module Labels
-        class Set < Action
-          string :text
-          action :onSet
-        end
-      end
-
       module Lists
         class Append < Action
           hash :row

data/app/helpers/glib/json_ui/view_builder/panels.rb

@@ -452,47 +452,6 @@ class Glib::JsonUi::ViewBuilder
       end
     end
 
-    class Table2 < View
-      attr_reader :template
-
-      hash :nextPage
-      action :onScrollToTop
-      action :onScrollToBottom
-
-      def initialize(json, page)
-        super
-        @template = Glib::JsonUi::TableBuilders::Template.new(json, self)
-      end
-
-      def header(options = {})
-        json.header do
-          json.backgroundColor options.delete(:backgroundColor)
-          json.cellViews do
-            options.delete(:cellViews)&.call page.view_builder
-          end
-
-          json.colSpans options.delete(:colSpans)
-        end
-
-        raise "Invalid properties: #{options.keys}" if options.size > 0
-      end
-
-      def rows(options = {})
-        block = options.delete(:builder)
-        json.rows do
-          if (objects = options.delete(:objects))
-            objects.each_with_index do |object, index|
-              block&.call template, object, index
-            end
-          else
-            block&.call template
-          end
-        end
-
-        raise "Invalid properties: #{options.keys}" if options.size > 0
-      end
-    end
-
     # The generic bulk-edit table: form-peer submission, per-row POSTs,
     # viewCells/viewHeaders, plus the full parse/gate/dedup config so any
     # consumer can compose specialized import behavior (it replaced the

data/app/helpers/glib/json_ui/view_builder.rb

@@ -382,12 +382,6 @@ module Glib
         end
       end
 
-      class Datetime < View
-        date_time :value
-        string :format
-        bool :tick
-      end
-
       class ProgressBar < View
         float :value
         color :color

data/app/views/json_ui/garage/test_page/bottom_banners.json.jbuilder

@@ -0,0 +1,69 @@
+json.title 'Test Page (Bottom Banners)'
+
+page = json_ui_page json
+
+render 'json_ui/garage/test_page/header', json: json, page: page
+
+page.body(
+  childViews: ->(body) do
+    body.panels_responsive(
+      padding: glib_json_padding_body,
+      childViews: ->(res) do
+        res.h2 text: 'Bottom Banners'
+        res.spacer height: 8
+        res.button text: "bottomBanners/open targetId: 'dock1'", onClick: ->(action) do
+          action.bottomBanners_open targetId: 'dock1', newView: ->(view) do
+            view.panels_responsive(
+              styleClass: ['frameless'],
+              childViews: ->(panel) do
+                panel.label text: 'Upload in progress'
+                panel.spacer height: 4
+                panel.button text: 'Details', onClick: ->(subaction) do
+                  subaction.dialogs_alert message: 'Upload details'
+                end
+              end
+            )
+          end
+        end
+        res.spacer height: 4
+        res.button text: "bottomBanners/open targetId: 'dock2'", onClick: ->(action) do
+          action.bottomBanners_open targetId: 'dock2', newView: ->(view) do
+            view.panels_responsive(
+              styleClass: ['frameless'],
+              childViews: ->(panel) do
+                panel.banners_alert title: 'Background task', message: 'A long-running task is still active.'
+              end
+            )
+          end
+        end
+        res.spacer height: 4
+        res.button text: "bottomBanners/open replace 'dock1'", onClick: ->(action) do
+          action.bottomBanners_open targetId: 'dock1', newView: ->(view) do
+            view.panels_responsive(
+              styleClass: ['frameless'],
+              childViews: ->(panel) do
+                panel.label text: 'Upload complete'
+                panel.spacer height: 4
+                panel.button text: 'Dismiss', onClick: ->(subaction) do
+                  subaction.bottomBanners_close targetId: 'dock1'
+                end
+              end
+            )
+          end
+        end
+        res.spacer height: 4
+        res.button text: "bottomBanners/close targetId: 'dock1'", onClick: ->(action) do
+          action.bottomBanners_close targetId: 'dock1'
+        end
+        res.spacer height: 4
+        res.button text: "bottomBanners/close targetId: 'dock2'", onClick: ->(action) do
+          action.bottomBanners_close targetId: 'dock2'
+        end
+        res.spacer height: 4
+        res.button text: 'bottomBanners/close (no targetId)', onClick: ->(action) do
+          action.bottomBanners_close
+        end
+      end
+    )
+  end
+)

data/app/views/json_ui/garage/test_page/web.json.jbuilder

@@ -10,15 +10,20 @@ page.body childViews: ->(body) do
     res.h2 text: 'Overview'
     res.p text: 'Web panels embed external web content within a panel container.'
 
-    url_primary = 'https://www.w3.org/WAI/ER/tests/xhtml/testfiles/resources/pdf/dummy.pdf'
-    url_alt = 'https://example.com'
+    # Hermetic content on the serving host itself (spec 169, Decision 5):
+    # the recording host's public/ carries the two deterministic pages, so
+    # the emitted URLs bake an origin the cassette replay can rewrite and
+    # serve — an external URL would leave the emulator for the real network
+    # and no golden could depend on it.
+    url_content = "#{request.base_url}/g-web-panel.html"
+    url_alt = "#{request.base_url}/g-web-panel-alt.html"
 
     res.spacer height: 12
     res.hr width: 'matchParent'
 
     res.h2 text: 'Basic'
     res.spacer height: 8
-    res.panels_web id: 'web_main', width: 'matchParent', height: 300, url: url_primary
+    res.panels_web id: 'web_main', width: 'matchParent', height: 300, url: url_content
 
     res.spacer height: 12
     res.hr width: 'matchParent'
@@ -26,11 +31,11 @@ page.body childViews: ->(body) do
     res.h2 text: 'Variants and Props'
     res.spacer height: 8
     res.panels_flow innerPadding: { bottom: 0 }, childViews: ->(flow) do
-      flow.button text: 'PDF', onClick: ->(action) do
-        action.logics_set targetId: 'web_main', data: { url: url_primary }
+      flow.button text: 'Content A', onClick: ->(action) do
+        action.logics_set targetId: 'web_main', data: { url: url_content }
       end
       flow.spacer width: 4
-      flow.button text: 'Example.com', onClick: ->(action) do
+      flow.button text: 'Content B', onClick: ->(action) do
         action.logics_set targetId: 'web_main', data: { url: url_alt }
       end
       flow.spacer width: 4
@@ -60,6 +65,6 @@ page.body childViews: ->(body) do
     res.h2 text: 'Edge and Advanced'
     res.spacer height: 8
     res.label text: 'Small viewport'
-    res.panels_web width: 'matchParent', height: 120, url: url_primary
+    res.panels_web width: 'matchParent', height: 120, url: url_content
   end
 end

data/app/views/json_ui/garage/views/misc.json.jbuilder

@@ -14,12 +14,6 @@ json_ui_page json do |page|
     #   ul.label text: 'Label'
     # end
 
-    scroll.spacer height: 20
-    scroll.h2 text: 'Time'
-    scroll.spacer height: 6
-    scroll.datetime value: 1.week.ago, format: 'YYYY-MM-DD'
-    scroll.datetime value: DateTime.current, format: 'hh:mm:ss', tick: true
-
     # scroll.spacer height: 20
     # scroll.h2 text: 'Map'
     # scroll.spacer height: 6
@@ -30,5 +24,15 @@ json_ui_page json do |page|
     scroll.spacer height: 6
     scroll.calendar width: 'matchParent', height: 500, dataUrl: json_ui_garage_url(path: 'views/calendar_data')
 
+    # h5/h6 exercised here rather than views/texts: the texts page is pinned
+    # by the client suite's golden, and a non-corpus page covers the headings
+    # without shifting it (component inventory, thread 195).
+    scroll.spacer height: 20
+    scroll.h2 text: 'Sub-headings'
+    scroll.spacer height: 6
+    scroll.h5 text: 'Heading 5'
+    scroll.spacer height: 6
+    scroll.h6 text: 'Heading 6'
+
   end
 end

data/lib/glib/json_ui/config.rb

@@ -3,22 +3,21 @@ module Glib
     # Global JSON UI settings.
     #
     # `name_separator` controls the character that joins the namespace and the
-    # component/action name in the generated JSON, e.g. `panels/responsive`
-    # (default) vs `panels_responsive`.
+    # component/action name in the generated JSON, e.g. `panels_responsive`
+    # (default since 7.0) vs `panels/responsive`.
     #
-    # The default stays `/` for backwards compatibility; `_` becomes the default
-    # in the next major version. Apps opt in early via an initializer:
+    # Apps that need the legacy slash names opt back in via an initializer:
     #
     #   # config/initializers/glib.rb
-    #   Glib::JsonUi::Config.name_separator = '_'
+    #   Glib::JsonUi::Config.name_separator = '/'
     #
-    # Frontends built on glib-web-npm accept either form, so flipping this is a
-    # server-side-only change.
+    # Frontends built on glib-web-npm accept either form, so this is a
+    # server-side-only setting.
     class Config
       SEPARATORS = ['/', '_'].freeze
 
-      # The shipped default. Stays '/' until the next major version, when it
-      # becomes '_'. Apps opt in early via `Config.name_separator = '_'`.
+      # The shipped default since the 7.0 major version. Apps that need the
+      # legacy names opt back in via `Config.name_separator = '/'`.
       DEFAULT_NAME_SEPARATOR = '_'
 
       @@name_separator = DEFAULT_NAME_SEPARATOR

metadata

@@ -1,13 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: glib-web
 version: !ruby/object:Gem::Version
-  version: 7.0.1
+  version: 7.1.0
 platform: ruby
 authors:
 - ''
+autorequire:
 bindir: bin
 cert_chain: []
-date: 1980-01-02 00:00:00.000000000 Z
+date: 2026-10-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activestorage
@@ -191,6 +192,7 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+description:
 email: ''
 executables: []
 extensions: []
@@ -234,7 +236,6 @@ files:
 - app/helpers/glib/json_ui/action_builder/dialogs.rb
 - app/helpers/glib/json_ui/action_builder/fields.rb
 - app/helpers/glib/json_ui/action_builder/files.rb
-- app/helpers/glib/json_ui/action_builder/global_states.rb
 - app/helpers/glib/json_ui/action_builder/http.rb
 - app/helpers/glib/json_ui/action_builder/iap.rb
 - app/helpers/glib/json_ui/action_builder/logics.rb
@@ -438,6 +439,7 @@ files:
 - app/views/json_ui/garage/test_page/_header.json.jbuilder
 - app/views/json_ui/garage/test_page/auth.json.jbuilder
 - app/views/json_ui/garage/test_page/auto_validate.json.jbuilder
+- app/views/json_ui/garage/test_page/bottom_banners.json.jbuilder
 - app/views/json_ui/garage/test_page/browsers.json.jbuilder
 - app/views/json_ui/garage/test_page/calendar.json.jbuilder
 - app/views/json_ui/garage/test_page/calendar_empty_data.json.jbuilder
@@ -604,8 +606,10 @@ files:
 - lib/glib/time_returning_mailer.rb
 - lib/glib/value.rb
 - lib/tasks/db.rake
+homepage:
 licenses: []
 metadata: {}
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -620,7 +624,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.16
+rubygems_version: 3.4.6
+signing_key:
 specification_version: 4
 summary: ''
 test_files: []

data/app/helpers/glib/json_ui/action_builder/global_states.rb

@@ -1,14 +0,0 @@
-class Glib::JsonUi::ActionBuilder
-  module GlobalStates
-    # Experimental
-    class Watch < Action
-      string :state
-      action :onChange
-    end
-
-    class Set < Action
-      string :state
-      hash :data
-    end
-  end
-end