glib-web 7.0.1 → 7.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 82ff8816e031f21b644701d78314fbba42562a8b29674a908f7f3d25932fcfdf
-  data.tar.gz: '00383eecb92f3f6b4e94f7929cc582261b31151911110bcee36f4e52a024e5e1'
+  metadata.gz: f04f2fbd4180b48a75af32ed8bd22321fc818224ecfb00802edc88b04992c287
+  data.tar.gz: a5340d00dee67cacb6175428130344910c8ddbeaf69e73a64e0b8bfd8f13f639
 SHA512:
-  metadata.gz: 4520d660ffd5ff5b2098a14123a4f88623590ec83e34852117c7f9b531e2065d1373be29950db8b44599ef2a8b1ef29208bd3c46ed6c53c50fc2dbc63fc93ca0
-  data.tar.gz: 77f0fc4304dfc140ecdf4d40264d73562f49e2419f198dd0f90902e3c0083468e9801d06ad9e351621c8fc104292687cc54b35b5821c25dfa764e120a18baa63
+  metadata.gz: fbe295ea4776d69d9b07f9bf554be771195f1296f5a61c690274c28a72432b43d7f7093884b2fc20cf3d12502880590d86856cb965318c1b0d62383d7952801b
+  data.tar.gz: 7cbfcda693f301216d38735f7a288b6d0006f38f1bb59a1a5db6a6837d4ea1dbdea43f1663314b214bbdee046245e40c0a4126cceb4c7b35c2956b1541cd3140

data/app/controllers/concerns/glib/params/allowlist.rb

@@ -11,7 +11,8 @@ module Glib::Params
 
     # Resolve a stringly-typed request param (or any boundary string) to one
     # symbol drawn from a closed allow-list (+allowed_symbols+), returning
-    # +default+ when the value is missing, blank, or not recognised.
+    # +default+ when the value is missing, blank, or not recognised — with
+    # one default-config exception on mutating requests, spelled out below.
     #
     # This is the symbol-DoS-safe replacement for `params[:x].to_sym`. A bare
     # `.to_sym` on a raw value mints a symbol for every distinct string a client
@@ -30,16 +31,23 @@ module Glib::Params
     # Blank/missing values fall through to +default+ quietly on EVERY method
     # (forms legitimately post no value; no symbol's string form is blank).
     #
+    # +raise_on_unrecognized+ (default +true+) keeps that raise. Pass +false+
+    # for endpoints anyone can POST to — anonymous public endpoints where junk
+    # values are expected traffic: the present-but-unrecognised case then
+    # degrades to +default+ on every method instead of raising, so bot probes
+    # cannot 500 the endpoint. Endpoints whose only writers are the app's own
+    # UI keep the default — there the raise is the forgotten-entry detector.
+    #
     # +allowed_symbols+ may also contain strings (e.g. a Rails enum's `.keys`)
     # — the matched entry is symbolized on the way out, so the return value is
     # ALWAYS a symbol (or +default+). That `to_sym` runs only on the
     # developer-controlled list entry, never on +value+, so the DoS-safety
     # above is unaffected.
-    def glib_allowlist_symbol_param(value, allowed_symbols, default:)
+    def glib_allowlist_symbol_param(value, allowed_symbols, default:, raise_on_unrecognized: true)
       match = allowed_symbols.find { |symbol| symbol.to_s == value.to_s }&.to_sym
       return match if match
 
-      if value.present? && !request.get? && !request.head?
+      if raise_on_unrecognized && value.present? && !request.get? && !request.head?
         raise UnrecognizedValue,
               "Unrecognised #{request.request_method} param value #{value.to_s.truncate(80).inspect} " \
               "(allowed: #{allowed_symbols.map(&:to_sym).inspect})"

data/app/controllers/glib/errors_controller.rb

@@ -29,12 +29,18 @@ module Glib
       if defined?(Rollbar)
         # `GLib.log.warn` reports arrive with level=warning; everything else
         # (uncaught errors, `GLib.log.error`) is an error. Prefixed so
-        # browser-side reports are distinguishable from server exceptions;
+        # client-side reports are distinguishable from server exceptions;
         # the details ride along as custom data for grouping.
         rollbar_level = params[:level] == 'warning' ? :warning : :error
+        # The prefix names the reporting runtime: the npm client sends no
+        # platform and stays "JS"; the Android renderer sends "ANDROID"
+        # (spec: thread 174). A platform TAG, not free text -- truncated so
+        # a crafted value cannot smuggle a payload into the message, and
+        # absent/blank degrades to the historical JS label.
+        platform = params[:platform].to_s[0, 16].presence || 'JS'
         Rollbar.public_send(
           rollbar_level,
-          "JS: #{params[:message]}",
+          "#{platform}: #{params[:message]}",
           stack: params[:stack],
           url: params[:url],
           context: params[:context],

data/app/helpers/glib/json_ui/action_builder.rb

@@ -39,10 +39,10 @@ module Glib
           add_element_to_array 'action', m, *args
         else
           if !Rails.env.production? && @singleton_action_set
-            raise "Multiple actions called on a singleton ActionBuilder. " \
+            raise 'Multiple actions called on a singleton ActionBuilder. ' \
                   "Only one action is allowed. Previous action: '#{@singleton_action_name}', " \
                   "current action: '#{m}'. Use `run_multiple` with `childActions` or " \
-                  "chain actions using `onClose` callbacks."
+                  'chain actions using `onClose` callbacks.'
           end
           @singleton_action_set = true
           @singleton_action_name = m
@@ -170,13 +170,6 @@ module Glib
         end
       end
 
-      module Labels
-        class Set < Action
-          string :text
-          action :onSet
-        end
-      end
-
       module Lists
         class Append < Action
           hash :row

data/app/helpers/glib/json_ui/view_builder/panels.rb

@@ -452,47 +452,6 @@ class Glib::JsonUi::ViewBuilder
       end
     end
 
-    class Table2 < View
-      attr_reader :template
-
-      hash :nextPage
-      action :onScrollToTop
-      action :onScrollToBottom
-
-      def initialize(json, page)
-        super
-        @template = Glib::JsonUi::TableBuilders::Template.new(json, self)
-      end
-
-      def header(options = {})
-        json.header do
-          json.backgroundColor options.delete(:backgroundColor)
-          json.cellViews do
-            options.delete(:cellViews)&.call page.view_builder
-          end
-
-          json.colSpans options.delete(:colSpans)
-        end
-
-        raise "Invalid properties: #{options.keys}" if options.size > 0
-      end
-
-      def rows(options = {})
-        block = options.delete(:builder)
-        json.rows do
-          if (objects = options.delete(:objects))
-            objects.each_with_index do |object, index|
-              block&.call template, object, index
-            end
-          else
-            block&.call template
-          end
-        end
-
-        raise "Invalid properties: #{options.keys}" if options.size > 0
-      end
-    end
-
     # The generic bulk-edit table: form-peer submission, per-row POSTs,
     # viewCells/viewHeaders, plus the full parse/gate/dedup config so any
     # consumer can compose specialized import behavior (it replaced the

data/app/helpers/glib/json_ui/view_builder.rb

@@ -382,12 +382,6 @@ module Glib
         end
       end
 
-      class Datetime < View
-        date_time :value
-        string :format
-        bool :tick
-      end
-
       class ProgressBar < View
         float :value
         color :color

data/app/models/g_log.rb

@@ -0,0 +1,92 @@
+# Top-level (NOT namespaced under Glib::) by design — same constraint as
+# SnapshotBlobReference: a top-level name keeps the facade's call-site
+# ergonomics (`DLog.error` → `GLog.error`, one character per site), and the
+# engine's autoloader resolves app/models files as top-level constants anyway.
+#
+# A routing facade, nothing more. The value is the seam: one place where
+# destination, level policy, and (later) redaction live, and call sites that
+# name their destination (`GLog.local_info` vs `GLog.error`).
+module GLog
+  # Use this to log functional errors that should not happen, but could happen
+  # since it is dependent on external factors.
+  def self.error(*args)
+    remote(:error, *args)
+  end
+
+  def self.warn(*args)
+    remote(:warn, *args)
+  end
+
+  def self.info(*args)
+    remote(:info, *args)
+  end
+
+  def self.error_excluding_test(*args)
+    if Rails.env.test?
+      warn(*args)
+    else
+      error(*args)
+    end
+  end
+
+  def self.local_debug(*args)
+    Rails.logger.debug(*args)
+  end
+
+  def self.local_info(*args)
+    Rails.logger.info(*args)
+  end
+
+  def self.local_warn(*args)
+    Rails.logger.warn(*args)
+  end
+
+  def self.local_error(*args)
+    Rails.logger.error(*args)
+  end
+
+  # Remote methods route to Rollbar when the host defines it. The gem itself
+  # declares no rollbar dependency (see glib-web.gemspec), so without it they
+  # fall through to the local logger tagged [GLog:remote] — non-Rollbar
+  # consumers still see the message, and tests can exercise both modes.
+  # Tagged receives the bare tag (tagged adds its own brackets), and a logger
+  # without `tagged` (a plain BroadcastLogger, no TaggedLogging) gets a
+  # prefixed message instead: the fallback must never raise on the logger
+  # shape the host configured.
+  def self.remote(level, *args)
+    if defined?(Rollbar)
+      Rollbar.public_send(level, *args)
+    else
+      log_remotely_locally(level, args)
+    end
+  end
+
+  def self.log_remotely_locally(level, args)
+    message = format_remote_args(args)
+    logger = Rails.logger
+    if logger.respond_to?(:tagged)
+      logger.tagged('GLog:remote') { |tagged_logger| tagged_logger.public_send(level, message) }
+    else
+      logger.public_send(level, "[GLog:remote] #{message}")
+    end
+  end
+
+  # Rollbar's API is variadic (`Rollbar.error(e, 'msg', extra)`), and the
+  # facade inherits that shape; the local logger's level methods take ONE
+  # message. Render the argument list into a single line: exceptions as
+  # `Class: message`, strings as-is, everything else (context hashes, kwargs
+  # collected into a trailing hash) via inspect, joined with ' | '.
+  def self.format_remote_args(args)
+    args.map do |arg|
+      if arg.is_a?(Exception)
+        "#{arg.class}: #{arg.message}"
+      elsif arg.is_a?(String)
+        arg
+      else
+        arg.inspect
+      end
+    end.join(' | ')
+  end
+
+  private_class_method :remote, :log_remotely_locally, :format_remote_args
+end

data/app/views/json_ui/garage/test_page/bottom_banners.json.jbuilder

@@ -0,0 +1,69 @@
+json.title 'Test Page (Bottom Banners)'
+
+page = json_ui_page json
+
+render 'json_ui/garage/test_page/header', json: json, page: page
+
+page.body(
+  childViews: ->(body) do
+    body.panels_responsive(
+      padding: glib_json_padding_body,
+      childViews: ->(res) do
+        res.h2 text: 'Bottom Banners'
+        res.spacer height: 8
+        res.button text: "bottomBanners/open targetId: 'dock1'", onClick: ->(action) do
+          action.bottomBanners_open targetId: 'dock1', newView: ->(view) do
+            view.panels_responsive(
+              styleClass: ['frameless'],
+              childViews: ->(panel) do
+                panel.label text: 'Upload in progress'
+                panel.spacer height: 4
+                panel.button text: 'Details', onClick: ->(subaction) do
+                  subaction.dialogs_alert message: 'Upload details'
+                end
+              end
+            )
+          end
+        end
+        res.spacer height: 4
+        res.button text: "bottomBanners/open targetId: 'dock2'", onClick: ->(action) do
+          action.bottomBanners_open targetId: 'dock2', newView: ->(view) do
+            view.panels_responsive(
+              styleClass: ['frameless'],
+              childViews: ->(panel) do
+                panel.banners_alert title: 'Background task', message: 'A long-running task is still active.'
+              end
+            )
+          end
+        end
+        res.spacer height: 4
+        res.button text: "bottomBanners/open replace 'dock1'", onClick: ->(action) do
+          action.bottomBanners_open targetId: 'dock1', newView: ->(view) do
+            view.panels_responsive(
+              styleClass: ['frameless'],
+              childViews: ->(panel) do
+                panel.label text: 'Upload complete'
+                panel.spacer height: 4
+                panel.button text: 'Dismiss', onClick: ->(subaction) do
+                  subaction.bottomBanners_close targetId: 'dock1'
+                end
+              end
+            )
+          end
+        end
+        res.spacer height: 4
+        res.button text: "bottomBanners/close targetId: 'dock1'", onClick: ->(action) do
+          action.bottomBanners_close targetId: 'dock1'
+        end
+        res.spacer height: 4
+        res.button text: "bottomBanners/close targetId: 'dock2'", onClick: ->(action) do
+          action.bottomBanners_close targetId: 'dock2'
+        end
+        res.spacer height: 4
+        res.button text: 'bottomBanners/close (no targetId)', onClick: ->(action) do
+          action.bottomBanners_close
+        end
+      end
+    )
+  end
+)

data/app/views/json_ui/garage/test_page/web.json.jbuilder

@@ -10,15 +10,20 @@ page.body childViews: ->(body) do
     res.h2 text: 'Overview'
     res.p text: 'Web panels embed external web content within a panel container.'
 
-    url_primary = 'https://www.w3.org/WAI/ER/tests/xhtml/testfiles/resources/pdf/dummy.pdf'
-    url_alt = 'https://example.com'
+    # Hermetic content on the serving host itself (spec 169, Decision 5):
+    # the recording host's public/ carries the two deterministic pages, so
+    # the emitted URLs bake an origin the cassette replay can rewrite and
+    # serve — an external URL would leave the emulator for the real network
+    # and no golden could depend on it.
+    url_content = "#{request.base_url}/g-web-panel.html"
+    url_alt = "#{request.base_url}/g-web-panel-alt.html"
 
     res.spacer height: 12
     res.hr width: 'matchParent'
 
     res.h2 text: 'Basic'
     res.spacer height: 8
-    res.panels_web id: 'web_main', width: 'matchParent', height: 300, url: url_primary
+    res.panels_web id: 'web_main', width: 'matchParent', height: 300, url: url_content
 
     res.spacer height: 12
     res.hr width: 'matchParent'
@@ -26,11 +31,11 @@ page.body childViews: ->(body) do
     res.h2 text: 'Variants and Props'
     res.spacer height: 8
     res.panels_flow innerPadding: { bottom: 0 }, childViews: ->(flow) do
-      flow.button text: 'PDF', onClick: ->(action) do
-        action.logics_set targetId: 'web_main', data: { url: url_primary }
+      flow.button text: 'Content A', onClick: ->(action) do
+        action.logics_set targetId: 'web_main', data: { url: url_content }
       end
       flow.spacer width: 4
-      flow.button text: 'Example.com', onClick: ->(action) do
+      flow.button text: 'Content B', onClick: ->(action) do
         action.logics_set targetId: 'web_main', data: { url: url_alt }
       end
       flow.spacer width: 4
@@ -60,6 +65,6 @@ page.body childViews: ->(body) do
     res.h2 text: 'Edge and Advanced'
     res.spacer height: 8
     res.label text: 'Small viewport'
-    res.panels_web width: 'matchParent', height: 120, url: url_primary
+    res.panels_web width: 'matchParent', height: 120, url: url_content
   end
 end

data/app/views/json_ui/garage/views/misc.json.jbuilder

@@ -14,12 +14,6 @@ json_ui_page json do |page|
     #   ul.label text: 'Label'
     # end
 
-    scroll.spacer height: 20
-    scroll.h2 text: 'Time'
-    scroll.spacer height: 6
-    scroll.datetime value: 1.week.ago, format: 'YYYY-MM-DD'
-    scroll.datetime value: DateTime.current, format: 'hh:mm:ss', tick: true
-
     # scroll.spacer height: 20
     # scroll.h2 text: 'Map'
     # scroll.spacer height: 6
@@ -30,5 +24,15 @@ json_ui_page json do |page|
     scroll.spacer height: 6
     scroll.calendar width: 'matchParent', height: 500, dataUrl: json_ui_garage_url(path: 'views/calendar_data')
 
+    # h5/h6 exercised here rather than views/texts: the texts page is pinned
+    # by the client suite's golden, and a non-corpus page covers the headings
+    # without shifting it (component inventory, thread 195).
+    scroll.spacer height: 20
+    scroll.h2 text: 'Sub-headings'
+    scroll.spacer height: 6
+    scroll.h5 text: 'Heading 5'
+    scroll.spacer height: 6
+    scroll.h6 text: 'Heading 6'
+
   end
 end

data/lib/glib/json_ui/config.rb

@@ -3,22 +3,21 @@ module Glib
     # Global JSON UI settings.
     #
     # `name_separator` controls the character that joins the namespace and the
-    # component/action name in the generated JSON, e.g. `panels/responsive`
-    # (default) vs `panels_responsive`.
+    # component/action name in the generated JSON, e.g. `panels_responsive`
+    # (default since 7.0) vs `panels/responsive`.
     #
-    # The default stays `/` for backwards compatibility; `_` becomes the default
-    # in the next major version. Apps opt in early via an initializer:
+    # Apps that need the legacy slash names opt back in via an initializer:
     #
     #   # config/initializers/glib.rb
-    #   Glib::JsonUi::Config.name_separator = '_'
+    #   Glib::JsonUi::Config.name_separator = '/'
     #
-    # Frontends built on glib-web-npm accept either form, so flipping this is a
-    # server-side-only change.
+    # Frontends built on glib-web-npm accept either form, so this is a
+    # server-side-only setting.
     class Config
       SEPARATORS = ['/', '_'].freeze
 
-      # The shipped default. Stays '/' until the next major version, when it
-      # becomes '_'. Apps opt in early via `Config.name_separator = '_'`.
+      # The shipped default since the 7.0 major version. Apps that need the
+      # legacy names opt back in via `Config.name_separator = '/'`.
       DEFAULT_NAME_SEPARATOR = '_'
 
       @@name_separator = DEFAULT_NAME_SEPARATOR

metadata

@@ -1,13 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: glib-web
 version: !ruby/object:Gem::Version
-  version: 7.0.1
+  version: 7.2.0
 platform: ruby
 authors:
 - ''
+autorequire:
 bindir: bin
 cert_chain: []
-date: 1980-01-02 00:00:00.000000000 Z
+date: 2026-10-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activestorage
@@ -191,6 +192,7 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+description:
 email: ''
 executables: []
 extensions: []
@@ -234,7 +236,6 @@ files:
 - app/helpers/glib/json_ui/action_builder/dialogs.rb
 - app/helpers/glib/json_ui/action_builder/fields.rb
 - app/helpers/glib/json_ui/action_builder/files.rb
-- app/helpers/glib/json_ui/action_builder/global_states.rb
 - app/helpers/glib/json_ui/action_builder/http.rb
 - app/helpers/glib/json_ui/action_builder/iap.rb
 - app/helpers/glib/json_ui/action_builder/logics.rb
@@ -271,6 +272,7 @@ files:
 - app/models/concerns/glib/nilify_blanks.rb
 - app/models/concerns/glib/snapshot_v2.rb
 - app/models/concerns/glib/soft_deletable.rb
+- app/models/g_log.rb
 - app/models/glib/active_storage/attachment.rb
 - app/models/glib/active_storage/blob.rb
 - app/models/glib/application_record.rb
@@ -438,6 +440,7 @@ files:
 - app/views/json_ui/garage/test_page/_header.json.jbuilder
 - app/views/json_ui/garage/test_page/auth.json.jbuilder
 - app/views/json_ui/garage/test_page/auto_validate.json.jbuilder
+- app/views/json_ui/garage/test_page/bottom_banners.json.jbuilder
 - app/views/json_ui/garage/test_page/browsers.json.jbuilder
 - app/views/json_ui/garage/test_page/calendar.json.jbuilder
 - app/views/json_ui/garage/test_page/calendar_empty_data.json.jbuilder
@@ -604,8 +607,10 @@ files:
 - lib/glib/time_returning_mailer.rb
 - lib/glib/value.rb
 - lib/tasks/db.rake
+homepage:
 licenses: []
 metadata: {}
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -620,7 +625,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.16
+rubygems_version: 3.4.6
+signing_key:
 specification_version: 4
 summary: ''
 test_files: []

data/app/helpers/glib/json_ui/action_builder/global_states.rb

@@ -1,14 +0,0 @@
-class Glib::JsonUi::ActionBuilder
-  module GlobalStates
-    # Experimental
-    class Watch < Action
-      string :state
-      action :onChange
-    end
-
-    class Set < Action
-      string :state
-      hash :data
-    end
-  end
-end