glib-web 6.10.3 → 6.10.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4466ade33c7e7109a75befa19d22951379a4b57f0c20608b26ba80a9e539901b
-  data.tar.gz: 9d05610c2feda72d878a64a44dec1f3cf8aa48c7f9237d2b3ce769d89beb9c8a
+  metadata.gz: af62a06f4071bb5b2779e61b2dfa771d9984d4f2f15bd6ed121fd71a676d7918
+  data.tar.gz: f5100fe92e6d2959a4479b82887e0009c0aaea1a2ef419f1ae6205c8fbda427b
 SHA512:
-  metadata.gz: b2bbafdaaa9ddc994cafe76cc6520a3b8b7dd07e0ae456d666fe62ec061efd8f854f3e719d297d39146e6c0f259c80074f5b28655e2f898b5dbdc2ae243eb4aa
-  data.tar.gz: aed913d8a8aeb19d81e0b01bde95480efe12ddbec54acd2095aed02fcb05e2753d57068c586faba341a2e6f282be41ec9b0e353951e881b853130e292d5a4ddd
+  metadata.gz: b0e19fa8b04dc2a7d44826f0c28eefe5411610d26226180dbd20079af4287177d44967331c56dd1c0dc7ebf0b3f01df08f1a38939958fe58c37a08183e8d10c0
+  data.tar.gz: 3c717ab4989d1e67f712d7d118d77cc6e99d136e0b1ed2e4e403a0974d0c364f705d064bad706b5f1bbfeca295333c523708e76f259a78cba969e958f6a494de

data/app/controllers/concerns/glib/json/libs.rb

@@ -96,6 +96,18 @@ module Glib::Json::Libs
 
         json_ui_redirect_to url, status: status
       end
+      # Any other request format (e.g. a browser tab opening a protected file link
+      # `/temp_blobs/:id/report.pdf`, where the filename sets the format) used to raise
+      # ActionController::UnknownFormat -> a bare 406 with an empty body. Mirror the html
+      # branch instead: whatever opened the URL (browser tab, iframe, img) is redirected
+      # to the target, which the browser follows natively.
+      #
+      # MUST stay the LAST block. `negotiate_mime` answers `Accept: */*` requests with
+      # the FIRST declared format, so an `any` block placed before html would capture
+      # ordinary browser page loads and leave request.format as `*/*` for the action.
+      format.any do
+        redirect_to url
+      end
     end
   end
 
@@ -142,6 +154,17 @@ module Glib::Json::Libs
           redirect_to sign_in_url, **redirect_options
         end
       end
+      # Other non-HTML/JSON formats (a protected file link whose filename sets the
+      # request format, an XML export, ...) used to raise UnknownFormat -> a bare 406.
+      # Mirrors the csv branch: a clean gate status in test, a redirect in production.
+      # MUST stay the LAST block -- see glib_redirect_to.
+      format.any do
+        if Rails.env.test?
+          head :unauthorized
+        else
+          redirect_to sign_in_url, **redirect_options
+        end
+      end
     end
   end
 
@@ -185,6 +208,16 @@ module Glib::Json::Libs
           redirect_to user_default_url
         end
       end
+      # Other non-HTML/JSON formats -- mirrors the csv branch (clean gate status in
+      # test, redirect in production); previously raised UnknownFormat -> a bare 406.
+      # MUST stay the LAST block -- see glib_redirect_to.
+      format.any do
+        if Rails.env.test?
+          head :forbidden
+        else
+          redirect_to user_default_url
+        end
+      end
     end
   end
 

data/app/models/concerns/glib/snapshot_v2.rb

@@ -12,7 +12,9 @@ require 'hashdiff'
 #   4. ActiveStorage in diff_associations (convert Attached::One/Many to attachment records).
 #   5. same_as_before? derives from the computed diff instead of the instance-local
 #      `snapshot_changed` flag (mapping-web's flag-gating silently dropped a target's
-#      snapshot when taken after the owner's -- see "Snapshot ordering" below, issue #481).
+#      snapshot when taken after the owner's -- see "Snapshot ordering" below, issue #481),
+#      with the flag re-entering as a NEGATIVE signal for first snapshots only (see
+#      `same_as_before?` for why an empty association baseline cannot decide those).
 #
 # ## Snapshot ordering: owner vs association targets
 #
@@ -27,7 +29,8 @@ require 'hashdiff'
 # reading the target back through the association snapshots the persisted state instead.
 #
 # `snapshot_changed` / `attributes_before_save` remain writable instance accessors for
-# call-site use, but they are no longer consulted for the skip decision.
+# call-site use; `snapshot_changed` is consulted by the skip decision only as a NEGATIVE
+# signal on first snapshots (see `same_as_before?`).
 #
 # To get all records of a model, you can use the following query:
 # MyModel.joins(:snapshots).distinct
@@ -60,7 +63,16 @@ module Glib
         # Only set snapshot_changed if not already set (handles case where before_save
         # is called multiple times - e.g., when associated records are saved before parent)
         if snapshot_changed.nil?
-          self.attributes_before_save = attributes_in_database
+          # For a save with no pending change `attributes_in_database` is empty -- an
+          # unchanged persisted record has no database-side delta -- which would make a
+          # first snapshot diff every attribute as an addition. Capture the full
+          # persisted state instead, so an unchanged save yields an empty item diff and
+          # the nil-guard keeps that baseline stable for later changes on the same
+          # instance. New records keep `attributes_in_database` (their all-nil
+          # originals): that non-empty baseline is exactly why a create's version 1
+          # records the full initial state. `unless` keeps the accessor nil, never
+          # `false`, for call-site nil-safety.
+          self.attributes_before_save = attributes_in_database.presence || (attributes unless new_record?)
           self.snapshot_changed = check_snapshot_changed
         end
       end
@@ -125,8 +137,10 @@ module Glib
               }
 
               # Don't create version if same as before. Reuses `calculated_diff` instead of
-              # recomputing it inside `same_as_before?`.
-              unless same_as_before?(calculated_diff)
+              # recomputing it inside `same_as_before?`. `version == 1` (no previous
+              # version exists) tells `same_as_before?` this is a FIRST snapshot, where the
+              # association baseline is empty and the flag carries decision weight.
+              unless same_as_before?(calculated_diff, first_snapshot: version == 1)
                 # No nil guard: active_snapshot's `create_snapshot!` raises on failure and
                 # always returns the snapshot.
                 snapshot = create_snapshot!(**snapshot_obj)
@@ -186,13 +200,28 @@ module Glib
     end
 
     # Decides whether `glib_create_snapshot!` should skip the version write. Derived from
-    # the computed diff (persisted state), never from the instance-local `snapshot_changed`
+    # the computed diff (persisted state), not from the instance-local `snapshot_changed`
     # flag: the flag dies with its instance, and an owner's snapshot replaces association
     # targets with fresh instances (`with_lock`'s reload clears the association cache, then
     # the diff walk re-reads the targets), so flag-gating used to silently drop a target's
-    # follow-up snapshot taken through the association (issue #481). For a first snapshot
-    # (no previous version) the diff runs current state against `attributes_before_save || {}`.
-    def same_as_before?(computed_diff = diff)
+    # follow-up snapshot taken through the association (issue #481).
+    #
+    # The one place the flag still decides: a FIRST snapshot whose association diff is
+    # meaningless. With no previous version, `fetch_snapshot_items(nil)` returns `{}`
+    # for associations, so every pre-existing child row reads as `+` and the diff alone
+    # can never prove a no-op — any never-snapshotted record with children would mint a
+    # version on every snapshot call (observed as spurious "Edited" audit entries on
+    # routine re-saves). There the flag is consulted as a NEGATIVE signal:
+    #   - `false` — this instance crossed the before_save boundary and
+    #     `check_snapshot_changed` found no item or child change, and the item diff is
+    #     net-zero against `attributes_before_save` => skip;
+    #   - `nil` — no save boundary on this instance (an owner-triggered snapshot of a
+    #     replaced association target, issue #481) => mint;
+    #   - `true` — a change was detected at the save boundary; falls through to the
+    #     diff-based decision (a reverted change still no-ops).
+    def same_as_before?(computed_diff = diff, first_snapshot: false)
+      return true if first_snapshot && snapshot_changed == false && computed_diff['item'].blank?
+
       item_unchanged = computed_diff['item'].blank?
       assoc_diff = computed_diff['associations']
       associations_unchanged = assoc_diff.nil? || assoc_diff.values.all?(&:blank?)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: glib-web
 version: !ruby/object:Gem::Version
-  version: 6.10.3
+  version: 6.10.4
 platform: ruby
 authors:
 - ''
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-16 00:00:00.000000000 Z
+date: 2026-09-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activestorage