glib-web 5.1.5 → 6.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9663b2eb594fba65030c257cc3e343228a2d3a32857e11db73310a5ae12a264b
-  data.tar.gz: 577f3c5be804d1efd40e2e9de4bfa629216f4514a3bd14ca92beef6cfbd6cedb
+  metadata.gz: 52b6b62180ee0cd668652772110774bc915d8789f1fd65e9ef22fadd781977a4
+  data.tar.gz: 3d47de6a06859cce937834478bbef460e2cac999bbfbdf72cef10a781399e68f
 SHA512:
-  metadata.gz: 37260aff5b03ad55ed5ffd904bc349d8a256d11ceb824380b4c541db0765237b82b05d376cb0835d8d83948460be97bacbfe176b6a442603496626d7ddf2fd83
-  data.tar.gz: ff4072d9f930e5a8da3ee7084c6a4be66da62d06b9fe49e3160876564c5ea3b251671832d68d44b9551b046b1182f3e7e3e3edabba9c07879b58a59026f23c96
+  metadata.gz: c6537178f38fa7703d8c3e0436f1c3d4ac1171c340bcda27d18aad936a7ff40e329488c0cbf618dd0974e4e7a7926a3b209eb3c88f29447416b1000db9fee37d
+  data.tar.gz: c532e338ce8890c52a5efc9c07c734fd99f4adba46f244f5a5c9c160b188b7630d0d18b080ad599a528ad9bb9a68fc5697c84137ec5383524308fc58b53c512b

data/app/controllers/concerns/glib/json/ui.rb

@@ -32,6 +32,16 @@ module Glib::Json::Ui
     @__json_ui_activated
   end
 
+  # Call this after `render`-ing a json_ui response from a HALTING callback,
+  # e.g. a `rate_limit` handler or any before_action that renders. Halting
+  # skips the rest of the callback chain, including the after_action that
+  # swaps the JSON body for the HTML shell on browser page loads — without
+  # this, an HTML request would receive raw JSON. Safe to call
+  # unconditionally: the swap is a no-op for JSON/XHR requests.
+  def json_ui_commit_now
+    __json_ui_commit(self.class.__json_libs_init_options)
+  end
+
   def __json_ui_rendering?
     @__json_ui_rendering != nil
   end

data/app/controllers/glib/errors_controller.rb

@@ -1,7 +1,63 @@
 module Glib
+  # Receives browser-side JS error reports (see the npm package's
+  # `useGlibErrorReporter`) and forwards them to the app's error tracker
+  # server-side -- no client-side token or SDK needed. The client dedupes and
+  # caps reports per page load, so this endpoint is not expected to see
+  # sustained traffic.
   class ErrorsController < ::ActionController::Base
+    # The reporter sends the CSRF token when available, but a stale token
+    # must not turn error reporting itself into an error source (and a forged
+    # report is harmless telemetry).
+    skip_forgery_protection
+
+    # Abuse ceilings (Rails' built-in limiter, backed by the host app's cache
+    # store), TIERED by whether the report's CSRF token verifies: a valid
+    # token proves the report came from a page this app served to this
+    # session, so crafted floods live in the low tier while real browsers get
+    # headroom. Stale tabs (expired sessions -- often the very tabs that are
+    # erroring) also land in the low tier, which is SIZED TOGETHER with the
+    # client's self-caps (glib-web-npm utils/log.js budgets: 10 errors + 10
+    # warnings per page load, deduped) -- change them together or stale-tab
+    # reports get dropped. Excess reports are DROPPED with the same 204 as accepted ones,
+    # so an abuser learns nothing about the threshold or the tiers. NOTE:
+    # inert where the cache store is :null_store (typical test envs).
+    rate_limit to: 10, within: 1.minute, name: 'untrusted', with: -> { head :no_content }, unless: :trusted_report?
+    rate_limit to: 60, within: 1.minute, name: 'trusted', with: -> { head :no_content }, if: :trusted_report?
+    rate_limit to: 300, within: 1.hour, name: 'hourly', with: -> { head :no_content }
+
     def create
-      Rollbar.error(params[:stack], params[:message])
+      if defined?(Rollbar)
+        # `GLib.log.warn` reports arrive with level=warning; everything else
+        # (uncaught errors, `GLib.log.error`) is an error. Prefixed so
+        # browser-side reports are distinguishable from server exceptions;
+        # the details ride along as custom data for grouping.
+        rollbar_level = params[:level] == 'warning' ? :warning : :error
+        Rollbar.public_send(
+          rollbar_level,
+          "JS: #{params[:message]}",
+          stack: params[:stack],
+          url: params[:url],
+          context: params[:context],
+          user_agent: request.user_agent
+        )
+      end
+      head :no_content
     end
+
+    private
+      # CSRF enforcement stays skipped (stale tabs must still be able to
+      # report), but VERIFYING the token it sends anyway upgrades the
+      # rate-limit tier. Must never raise: a malformed token is simply
+      # untrusted.
+      def trusted_report?
+        return @trusted_report if defined?(@trusted_report)
+
+        @trusted_report =
+          begin
+            valid_authenticity_token?(session, params[:authenticity_token].to_s)
+          rescue StandardError
+            false
+          end
+      end
   end
 end

data/app/helpers/glib/json_ui/action_builder/logics.rb

@@ -10,6 +10,14 @@ class Glib::JsonUi::ActionBuilder
       bool :cacheData
       bool :skipOnChange
 
+      # Wrap the generated setter to lint the JsonLogic rules at render
+      # time (see JsonLogicLint). The rules are hashes keyed by target prop.
+      alias_method :conditionalData_without_lint, :conditionalData
+      def conditionalData(value)
+        Glib::JsonUi::JsonLogicLint.validate!(value) unless Rails.env.production?
+        conditionalData_without_lint(value)
+      end
+
       def dataBuilder(block)
         json.data do
           block.call(page.sview_builder)
@@ -22,6 +30,12 @@ class Glib::JsonUi::ActionBuilder
       hash :variables
       action :onTrue
       action :onFalse
+
+      alias_method :condition_without_lint, :condition
+      def condition(value)
+        Glib::JsonUi::JsonLogicLint.validate!(value) unless Rails.env.production?
+        condition_without_lint(value)
+      end
     end
 
     # Under consideration, likely not a good idea.

data/app/helpers/glib/json_ui/action_builder/windows.rb

@@ -9,6 +9,13 @@ class Glib::JsonUi::ActionBuilder
       action :onClose
     end
 
+    # "You OPEN a page you're not on; you RELOAD the page you're on" (see
+    # Reload below for the other half of the rule). `updateExisting: true`
+    # REPLACES the current history entry instead of pushing (matching
+    # `dialogs_open updateExisting`) -- for forward moves that should
+    # collapse history, e.g. wizard steps and post-filter landings. Landing
+    # is always fresh: scroll resets to the top, and `loaderViews` skeletons
+    # can cover the fetch.
     class Open < Action
       string :url, cache: true
       bool :updateExisting
@@ -46,13 +53,21 @@ class Glib::JsonUi::ActionBuilder
         end
     end
 
+    # Contract (see the npm package's actions/windows/reload.js): re-renders
+    # the current page from the server in place. User input is discarded
+    # (guarded by the dirty prompt), scroll position is preserved, and the
+    # history entry is REPLACED, never pushed. Partial updates that must
+    # keep user input belong to `logics_set`.
     class Reload < Action
-      string :url, cache: true # deprecated
-      bool :disableDirtyCheck
+      # "You RELOAD the page you're on; you OPEN a page you're not on":
+      # `url` is for reloading a VARIANT of the current page (sort order,
+      # active tab, tweaked params) while the user stays where they are --
+      # Back skips the pre-reload state, so sorting/tab-switching doesn't
+      # pollute history. To navigate to a DIFFERENT page while replacing
+      # history (wizard steps, post-filter landings), use `windows_open
+      # updateExisting: true`, which lands fresh at the top.
+      string :url, cache: true
       action :onReload
-
-      # deprecated
-      bool :skipUpdateKey
     end
 
     class CloseWithReload < Action

data/app/helpers/glib/json_ui/json_logic_lint.rb

@@ -0,0 +1,82 @@
+# Render-time sanity check for JsonLogic rules that compare form-field values.
+#
+# Form values always travel as strings (or arrays of strings for multi-value
+# fields), so a rule that compares a form-field `var` against a typed constant
+# (integer, date, boolean, ...) depends on client-side coercion at best and
+# silently never matches at worst -- e.g. JsonLogic's `==` cannot equate
+# arrays at all. These bugs don't crash anything; the affected condition just
+# evaluates wrongly forever.
+#
+# This lint runs while the rule is being rendered into the page JSON (outside
+# production), so any page exercised by tests -- including crawler-style tests
+# that visit every route -- surfaces the mistake as a hard failure.
+#
+# A `var` is treated as a form field when its name uses the nested-param
+# convention (`model[attr]`), which is how form inputs are named. Ordering
+# operators (>, <, ...) and vars without that shape are left alone: numeric
+# comparisons against action variables or computed values are legitimate.
+module Glib
+  module JsonUi
+    module JsonLogicLint
+      EQUALITY_OPS = %w[== != === !== setEq in].freeze
+
+      def self.validate!(rule)
+        walk(rule)
+      end
+
+      def self.walk(node)
+        case node
+        when Array
+          node.each { |child| walk(child) }
+        when Hash
+          node.each do |op, operands|
+            check_comparison(op.to_s, operands) if EQUALITY_OPS.include?(op.to_s) && operands.is_a?(Array)
+            walk(operands)
+          end
+        end
+      end
+
+      def self.check_comparison(op, operands)
+        return unless operands.any? { |operand| form_field_var?(operand) }
+
+        operands.each do |operand|
+          next unless non_string_constant?(operand)
+
+          field = operands.find { |o| form_field_var?(o) }
+          raise "JsonLogic rule compares form field #{var_name(field).inspect} against " \
+                "non-string constant #{operand.inspect} (`#{op}`).\n" \
+                'Why strings: rules never read the field spec (which may legitimately carry ' \
+                'integers); a `var` reads the LIVE form data, which the client collects from ' \
+                'DOM inputs -- and DOM input values are always strings (arrays of strings for ' \
+                "multi-value fields). The comparison would rely on JS coercion or fail outright.\n" \
+                'Fix: serialize the constant as a string, e.g. `record.id.to_s`, arrays via ' \
+                '`.map(&:to_s)`. For array comparisons, prefer the `setEq` operator, which ' \
+                'string-normalizes both sides.'
+        end
+      end
+
+      def self.form_field_var?(operand)
+        operand.is_a?(Hash) && (name = var_name(operand)) && name.include?('[')
+      end
+
+      def self.var_name(operand)
+        value = operand['var'] || operand[:var]
+        value&.to_s
+      end
+
+      # What matters is the JSON wire type, not the Ruby type: symbols and
+      # dates serialize to JSON strings and compare fine, but numerics and
+      # booleans stay typed in JSON while form values are always strings.
+      def self.non_string_constant?(operand)
+        case operand
+        when Numeric, TrueClass, FalseClass
+          true
+        when Array
+          operand.flatten.any? { |element| non_string_constant?(element) }
+        else
+          false
+        end
+      end
+    end
+  end
+end

data/app/helpers/glib/json_ui/view_builder/panels.rb

@@ -47,6 +47,16 @@ class Glib::JsonUi::ViewBuilder
       # Use this when field changes require server-side processing.
       action :onChangeAndLoad
 
+      # Actions executed when the form's dirty state TRANSITIONS (per the same
+      # tracking that powers the unsaved-changes prompts): `onDirty` fires
+      # when the form first deviates from its initial values, `onPristine`
+      # when it returns to them — plus once on mount, since forms always start
+      # pristine. Because each hook corresponds to a known state, the actions
+      # can use plain static `data` (e.g. a `logics_set` disabling the submit
+      # button while pristine) — no conditional rules needed.
+      action :onDirty
+      action :onPristine
+
       # Custom parameter name for form data when submitting.
       # By default, uses the model name as the parameter namespace.
       string :paramNameForFormData
@@ -486,6 +496,10 @@ class Glib::JsonUi::ViewBuilder
     class BulkEdit2 < View
       hash :import, required: [:submitUrl, :paramName]
 
+      # Maximum number of data rows an uploaded file may contain; files with
+      # more rows are rejected with an error dialog. No limit when unset.
+      int :maxRows
+
       # string :statusViewIdPrefix
       array :viewHeaders
 

data/app/views/json_ui/garage/test_page/fields_upload.json.jbuilder

@@ -28,7 +28,7 @@ page.body(
       value: image&.signed_id
     }
 
-    base_props[:onFinishUpload] = ->(action) do # rubocop:disable Glib/MultilineMethodCallStyle
+    base_props[:onFinishUpload] = ->(action) do
       action.snackbars_alert message: 'Get the signed ids!'
     end
 

data/app/views/json_ui/garage/test_page/form_dirty_hooks.json.jbuilder

@@ -0,0 +1,31 @@
+json.title 'Test Page (Form dirty hooks)'
+
+page = json_ui_page json
+
+render 'json_ui/garage/test_page/header', json: json, page: page
+
+page.body childViews: ->(body) do
+  body.panels_form \
+    padding: glib_json_padding_body,
+    # `onDirty`/`onPristine` fire on dirty-state TRANSITIONS (plus `onPristine`
+    # once on mount), so plain static `data` is enough -- no conditional rules.
+    onDirty: ->(action) do
+      action.logics_set targetId: 'dirty_hooks_submit', data: { disabled: false, tooltip: nil }
+    end,
+    onPristine: ->(action) do
+      action.logics_set targetId: 'dirty_hooks_submit', data: { disabled: true, tooltip: 'No changes to save' }
+    end,
+    childViews: ->(form) do
+      form.h2 text: 'Form dirty hooks'
+      form.spacer height: 8
+
+      form.fields_text name: 'user[name]', width: 'matchParent', label: 'Name', value: 'Initial'
+      form.spacer height: 14
+
+      # Excluded from dirty tracking -- edits here must not fire `onDirty`.
+      form.fields_text name: 'user[ignored]', width: 'matchParent', label: 'Ignored', disableDirtyCheck: true
+      form.spacer height: 14
+
+      form.fields_submit id: 'dirty_hooks_submit', text: 'Save'
+    end
+end

data/app/views/json_ui/garage/test_page/form_dynamic_dirty.json.jbuilder

@@ -0,0 +1,41 @@
+json.title 'Test Page (Form Dynamic Dirty)'
+
+page = json_ui_page json
+
+render 'json_ui/garage/test_page/header', json: json, page: page
+
+# A deliberately MINIMAL dynamic group -- no onLoad/conditionalData writes --
+# so the dirty tracker's late-registration handling is observable in
+# isolation: entries added after the initial mount join the baseline with
+# their mount-time values (see form_dynamic for the fully-featured demo).
+page.body childViews: ->(body) do
+  body.panels_responsive padding: glib_json_padding_body, childViews: ->(res) do
+    res.h2 text: 'Dynamic group dirty tracking'
+    res.spacer height: 8
+    res.panels_form \
+      url: json_ui_garage_url(path: 'forms/generic_post'),
+      method: 'post',
+      childViews: ->(form) do
+        form.fields_text width: 'matchParent', name: 'user[name]', label: 'Name', value: 'Initial'
+        form.spacer height: 8
+
+        form.fields_dynamicGroup id: 'dirty_dynamic_group', width: 'matchParent', name: 'user[items]', groupFieldProperties: [
+          [{ name: 'label', value: 'First' }]
+        ], content: ->(group) do
+          group.template childViews: ->(template) do
+            template.fields_text width: 'matchParent', name: 'label', label: 'Label', styleClass: 'item_label'
+          end
+        end
+
+        form.spacer height: 8
+        form.button \
+          text: 'Add item',
+          onClick: ->(action) do
+            action.components_invoke targetId: 'dirty_dynamic_group', name: 'addGroupEntry'
+          end
+
+        form.spacer height: 20
+        form.fields_submit text: 'Submit'
+      end
+  end
+end

data/app/views/json_ui/garage/test_page/form_removed_field.json.jbuilder

@@ -0,0 +1,55 @@
+json.title 'Test Page (Form Removed Field)'
+
+page = json_ui_page json
+
+render 'json_ui/garage/test_page/header', json: json, page: page
+
+# Probes how dirty tracking treats fields REMOVED from the DOM after they
+# have registered (`displayed: false` drives `loadIf`/v-if, so hidden fields
+# genuinely unmount and leave the form data). This page covers USER-triggered
+# hide/show; the onLoad-hidden flavor lives on form_removed_field_onload so
+# its baseline effect cannot contaminate these scenarios.
+page.body childViews: ->(body) do
+  body.panels_responsive padding: glib_json_padding_body, childViews: ->(res) do
+    res.h2 text: 'Removed-field dirty tracking'
+    res.spacer height: 8
+    res.panels_form \
+      url: json_ui_garage_url(path: 'forms/generic_post'),
+      method: 'post',
+      childViews: ->(form) do
+        form.fields_text width: 'matchParent', name: 'user[name]', label: 'Name', value: 'Initial'
+        form.fields_text width: 'matchParent', id: 'extra_field', name: 'user[extra]', label: 'Extra', value: 'Extra'
+
+        # Hiding this PANEL unmounts its child field's component subtree --
+        # the other removal flavor (a self-hidden field keeps its component
+        # mounted and only unmounts its inner v-if).
+        form.panels_vertical width: 'matchParent', id: 'extra_panel', childViews: ->(panel) do
+          panel.fields_text width: 'matchParent', name: 'user[grouped]', label: 'Grouped', value: 'Grouped'
+        end
+
+        form.spacer height: 8
+        form.panels_flow innerPadding: { bottom: 0 }, width: 'matchParent', childViews: ->(flow) do
+          flow.button \
+            text: 'Hide extra',
+            onClick: ->(action) do
+              action.logics_set targetId: 'extra_field', data: { displayed: false }
+            end
+          flow.spacer width: 8
+          flow.button \
+            text: 'Show extra',
+            onClick: ->(action) do
+              action.logics_set targetId: 'extra_field', data: { displayed: true }
+            end
+          flow.spacer width: 8
+          flow.button \
+            text: 'Hide panel',
+            onClick: ->(action) do
+              action.logics_set targetId: 'extra_panel', data: { displayed: false }
+            end
+        end
+
+        form.spacer height: 20
+        form.fields_submit text: 'Submit'
+      end
+  end
+end

data/app/views/json_ui/garage/test_page/form_removed_field_onload.json.jbuilder

@@ -0,0 +1,34 @@
+json.title 'Test Page (Form Removed Field Onload)'
+
+page = json_ui_page json
+
+render 'json_ui/garage/test_page/header', json: json, page: page
+
+# Companion to form_removed_field: here the field is hidden by PAGE LOGIC at
+# load (the onLoad conditionalData pattern, e.g. a conditional section
+# reflecting current values), after it has already registered with the dirty
+# tracker.
+page.body childViews: ->(body) do
+  body.panels_responsive padding: glib_json_padding_body, childViews: ->(res) do
+    res.h2 text: 'Removed-field dirty tracking (onLoad)'
+    res.spacer height: 8
+    res.panels_form \
+      url: json_ui_garage_url(path: 'forms/generic_post'),
+      method: 'post',
+      childViews: ->(form) do
+        form.fields_text width: 'matchParent', name: 'user[name]', label: 'Name', value: 'Initial'
+        form.fields_text \
+          width: 'matchParent',
+          id: 'preloaded_field',
+          name: 'user[preloaded]',
+          label: 'Preloaded',
+          value: 'P',
+          onLoad: ->(action) do
+            action.logics_set targetId: 'preloaded_field', data: { displayed: false }
+          end
+
+        form.spacer height: 20
+        form.fields_submit text: 'Submit'
+      end
+  end
+end

data/app/views/json_ui/garage/test_page/form_touched_validation.json.jbuilder

@@ -0,0 +1,35 @@
+json.title 'Test Page (Form Touched Validation)'
+
+page = json_ui_page json
+
+render 'json_ui/garage/test_page/header', json: json, page: page
+
+# Mirrors a sign-in-style form: the first field is empty, required, and
+# autofocused (panels_form defaults autofocus on). Untouched fields must stay
+# silent on blur/navigation; validation surfaces on submit, or on blur once
+# the user has actually typed.
+page.body childViews: ->(body) do
+  body.panels_responsive padding: glib_json_padding_body, childViews: ->(res) do
+    res.h2 text: 'Touched-field validation'
+    res.spacer height: 8
+    res.panels_form \
+      url: json_ui_garage_url(path: 'forms/generic_post'),
+      method: 'post',
+      childViews: ->(form) do
+        form.fields_email \
+          width: 'matchParent',
+          name: 'user[email]',
+          label: 'Email',
+          validation: { presence: { message: "can't be blank" } }
+        form.spacer height: 8
+        form.fields_text \
+          width: 'matchParent',
+          name: 'user[nickname]',
+          label: 'Nickname',
+          validation: { presence: { message: "can't be blank" } }
+
+        form.spacer height: 20
+        form.fields_submit text: 'Submit'
+      end
+  end
+end

data/app/views/json_ui/garage/test_page/logics_run.json.jbuilder

@@ -0,0 +1,79 @@
+json.title 'Test Page (Logics Run)'
+
+page = json_ui_page json
+
+page.form(
+  childViews: ->(body) do
+    body.panels_responsive(
+      padding: glib_json_padding_body,
+      childViews: ->(res) do
+        res.h2 text: 'Logics Run - form field condition'
+        res.spacer height: 8
+        # Form values are strings at the DOM boundary, so the condition
+        # compares against a string constant.
+        res.fields_text label: 'Status', name: 'user[status]', width: 300, value: 'active'
+        res.spacer height: 8
+        res.button(
+          text: 'Check status',
+          onClick: ->(action) do
+            action.logics_run(
+              condition: { '==': [{ 'var': 'user[status]' }, 'active'] },
+              onTrue: ->(subaction) do
+                subaction.logics_set targetId: 'run_status', data: { text: 'MATCH' }
+              end,
+              onFalse: ->(subaction) do
+                subaction.logics_set targetId: 'run_status', data: { text: 'NO MATCH' }
+              end
+            )
+          end
+        )
+        res.spacer height: 8
+        res.label id: 'run_status', text: 'PENDING'
+
+        res.spacer height: 16
+        res.hr width: 'matchParent'
+        res.spacer height: 16
+
+        res.h2 text: 'Logics Run - variables'
+        res.spacer height: 8
+        # Server-provided `variables` keep their JSON types (unlike form
+        # values), so a numeric comparison is legitimate here. They are also
+        # merged OVER the form data, so a variable that shares a form field's
+        # name takes precedence.
+        res.button(
+          text: 'Check variables',
+          onClick: ->(action) do
+            action.logics_run(
+              condition: { '==': [{ 'var': 'level' }, 5] },
+              variables: { level: 5 },
+              onTrue: ->(subaction) do
+                subaction.logics_set targetId: 'run_variables_status', data: { text: 'MATCH' }
+              end,
+              onFalse: ->(subaction) do
+                subaction.logics_set targetId: 'run_variables_status', data: { text: 'NO MATCH' }
+              end
+            )
+          end
+        )
+        res.spacer width: 8
+        res.button(
+          text: 'Check variable precedence',
+          onClick: ->(action) do
+            action.logics_run(
+              condition: { '==': [{ 'var': 'user[status]' }, 'override'] },
+              variables: { 'user[status]': 'override' },
+              onTrue: ->(subaction) do
+                subaction.logics_set targetId: 'run_variables_status', data: { text: 'PRECEDENCE' }
+              end,
+              onFalse: ->(subaction) do
+                subaction.logics_set targetId: 'run_variables_status', data: { text: 'FORM VALUE' }
+              end
+            )
+          end
+        )
+        res.spacer height: 8
+        res.label id: 'run_variables_status', text: 'PENDING'
+      end
+    )
+  end
+)

data/app/views/json_ui/garage/test_page/logics_run_multi_form.json.jbuilder

@@ -0,0 +1,45 @@
+json.title 'Test Page (Logics Run Multi Form)'
+
+page = json_ui_page json
+
+render 'json_ui/garage/test_page/header', json: json, page: page
+
+# Two mounted forms deliberately sharing a field name: actions that read
+# merged form data (logics/run, logics/set conditions, fields/getValues) use
+# the LAST form's value and warn about the collision.
+page.body childViews: ->(body) do
+  body.panels_responsive padding: glib_json_padding_body, childViews: ->(res) do
+    res.h2 text: 'Cross-form field-name collision'
+    res.spacer height: 8
+    res.panels_form \
+      url: json_ui_garage_url(path: 'forms/generic_post'),
+      method: 'post',
+      childViews: ->(form) do
+        form.fields_text width: 'matchParent', name: 'user[status]', label: 'First form status', value: 'first'
+      end
+    res.spacer height: 8
+    res.panels_form \
+      url: json_ui_garage_url(path: 'forms/generic_post'),
+      method: 'post',
+      childViews: ->(form) do
+        form.fields_text width: 'matchParent', name: 'user[status]', label: 'Second form status', value: 'second'
+      end
+
+    res.spacer height: 8
+    res.button \
+      text: 'Check status',
+      onClick: ->(action) do
+        action.logics_run(
+          condition: { '==': [{ 'var': 'user[status]' }, 'second'] },
+          onTrue: ->(subaction) do
+            subaction.logics_set targetId: 'collision_status', data: { text: 'LAST FORM WINS' }
+          end,
+          onFalse: ->(subaction) do
+            subaction.logics_set targetId: 'collision_status', data: { text: 'FIRST FORM WINS' }
+          end
+        )
+      end
+    res.spacer height: 8
+    res.label id: 'collision_status', text: 'PENDING'
+  end
+end

data/app/views/json_ui/garage/test_page/logics_set.json.jbuilder

@@ -134,6 +134,25 @@ page.form(
         )
         res.spacer height: 8
         res.label id: 'say_label', text: 'Visible label text'
+
+        res.spacer height: 16
+        res.h2 text: 'Logics Set - setEq'
+        res.spacer height: 8
+        # `setEq` treats both sides as sets of strings (order-insensitive;
+        # scalar and single-element array compare equal), which makes it safe
+        # for multi-value form fields whose DOM values are always strings.
+        set_eq_check = ->(action) do
+          action.logics_set(
+            targetId: 'set_eq_status',
+            conditionalData: {
+              text: { 'if': [{ 'setEq': [{ 'var': 'user[tags][]' }, %w[a b]] }, 'MATCH', 'NO MATCH'] }
+            }
+          )
+        end
+        res.fields_check name: 'user[tags][]', checkValue: 'a', label: 'Tag A', onChange: set_eq_check
+        res.fields_check name: 'user[tags][]', checkValue: 'b', label: 'Tag B', onChange: set_eq_check
+        res.spacer height: 8
+        res.label id: 'set_eq_status', text: 'PENDING'
       end
     )
   end

data/app/views/json_ui/garage/test_page/panels_bulkEdit2.json.jbuilder

@@ -83,6 +83,9 @@ page.body(
           id: 'bulk_edit_main',
           width: 'matchParent',
           paramNameForRowId: 'row_id',
+          # Files with more data rows than this are rejected wholesale with an
+          # error dialog (the header row doesn't count).
+          maxRows: 3,
           import: import_settings,
           viewHeaders: default_headers,
           viewCells: default_cells,

data/app/views/json_ui/garage/test_page/run_multiple.json.jbuilder

@@ -0,0 +1,31 @@
+json.title 'Test Page (Run Multiple)'
+
+page = json_ui_page json
+
+render 'json_ui/garage/test_page/header', json: json, page: page
+
+page.body childViews: ->(body) do
+  body.panels_responsive padding: glib_json_padding_body, childViews: ->(res) do
+    res.h2 text: 'runMultiple ordering'
+    res.spacer height: 8
+    res.button \
+      text: 'Run sequence',
+      onClick: ->(action) do
+        action.runMultiple childActions: ->(multiple) do
+          # Two writes to the SAME target: the final text proves in-order,
+          # sequential execution (last write wins).
+          multiple.logics_set targetId: 'sequence_status', data: { text: 'STEP 1' }
+          multiple.logics_set targetId: 'sequence_status', data: { text: 'STEP 2' }
+          # Nested runMultiple must execute within the outer sequence.
+          multiple.runMultiple childActions: ->(nested) do
+            nested.logics_set targetId: 'nested_status', data: { text: 'NESTED DONE' }
+          end
+          multiple.logics_set targetId: 'sequence_status', data: { text: 'STEP 3' }
+          multiple.snackbars_alert message: 'Sequence finished'
+        end
+      end
+    res.spacer height: 8
+    res.label id: 'sequence_status', text: 'PENDING'
+    res.label id: 'nested_status', text: 'PENDING'
+  end
+end

data/app/views/json_ui/garage/test_page/windows_reload.json.jbuilder

@@ -0,0 +1,57 @@
+json.title 'Test Page (Windows Reload)'
+
+page = json_ui_page json
+
+render 'json_ui/garage/test_page/header', json: json, page: page
+
+# Contract page for `windows_reload` (see the npm package's
+# actions/windows/reload.js): reload re-renders the CURRENT page from the
+# server in place -- user input is discarded (guarded by the dirty prompt),
+# scroll position is preserved, and the history entry is REPLACED, so Back
+# skips the pre-reload state.
+page.body childViews: ->(body) do
+  body.panels_responsive padding: glib_json_padding_body, childViews: ->(res) do
+    res.h2 text: 'Windows reload contract'
+
+    # Changes on every render so specs can detect that a reload completed
+    # (a bare reload keeps the same URL, so the URL proves nothing).
+    res.label text: "Render stamp: #{SecureRandom.hex(8)}"
+    res.label text: "Step: #{params[:step] || 'initial'}"
+    res.spacer height: 8
+
+    res.panels_form \
+      url: json_ui_garage_url(path: 'forms/generic_post'),
+      method: 'post',
+      childViews: ->(form) do
+        form.fields_text width: 'matchParent', name: 'user[nickname]', label: 'Nickname'
+      end
+
+    res.spacer height: 8
+    res.button \
+      text: 'windows/reload',
+      onClick: ->(action) do
+        action.windows_reload
+      end
+    res.spacer height: 8
+    res.button \
+      text: 'windows/open (step two)',
+      onClick: ->(action) do
+        action.windows_open url: json_ui_garage_url(path: 'test_page/windows_reload', step: 'two')
+      end
+    res.spacer height: 8
+    res.button \
+      text: 'windows/reload (step three)',
+      onClick: ->(action) do
+        action.windows_reload url: json_ui_garage_url(path: 'test_page/windows_reload', step: 'three')
+      end
+
+    # Tall filler so the page scrolls; the bottom button lets specs trigger a
+    # reload without Cypress scrolling back up to reach a button.
+    res.spacer height: 2000
+    res.button \
+      text: 'windows/reload (from bottom)',
+      onClick: ->(action) do
+        action.windows_reload
+      end
+  end
+end

data/lib/glib/rubocop.rb

@@ -1,5 +1,4 @@
 require_relative 'rubocop/cops/localize'
-require_relative 'rubocop/cops/multiline_method_call_style'
 require_relative 'rubocop/cops/json_ui/base_nested_parameter'
 require_relative 'rubocop/cops/json_ui/nested_block_parameter'
 require_relative 'rubocop/cops/json_ui/nested_action_parameter'

data/lib/glib/snapshot.rb

@@ -155,7 +155,7 @@ module Glib
         'item' => ::Hashdiff.diff(item.attributes.except(*ignore_keys), attributes.except(*ignore_keys))
       }
 
-      obj['associations'] = associations_for_snapshot.reduce({}) do |prev, curr| # rubocop:disable Glib/MultilineMethodCallStyle
+      obj['associations'] = associations_for_snapshot.reduce({}) do |prev, curr|
         association_records = records_for_snapshot(curr)
         first_record_off_same_collection = association_records.first
 

data/lib/glib/test/parallel_coverage.rb

@@ -14,6 +14,7 @@ module Glib
     #   end
     #
     # This will:
+    # - Build Vite assets (if the app uses Vite) once, before workers fork
     # - Enable parallel test execution using all available processors
     # - Configure SimpleCov to track each worker separately
     # - Automatically merge coverage results from all workers
@@ -21,6 +22,21 @@ module Glib
       extend ActiveSupport::Concern
 
       included do
+        # Vite's lazy autoBuild is not fork-safe: its build mutex is a thread
+        # Mutex, so when the test manifest is stale, every parallel worker's
+        # first asset lookup spawns its own full `vite build` (a node process
+        # using several hundred MB). With :number_of_processors workers that
+        # is enough concurrent builds to exhaust RAM and swap and OOM the
+        # machine. Build once here, in the parent process before forking, so
+        # the workers' freshness checks all pass without building. The guard
+        # mirrors the lazy path's own `should_build?` so this stays a no-op
+        # wherever the workers would never have built either (autoBuild off,
+        # or a dev server serving the test mode).
+        if defined?(ViteRuby) && ViteRuby.config.auto_build && !ViteRuby.instance.dev_server_running?
+          ViteRuby.commands.build ||
+            raise('vite build failed (a cached failed build also lands here; see log or run bin/vite build)')
+        end
+
         # Set threshold for force parallelization.
         parallelize(workers: :number_of_processors, threshold: 1)
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: glib-web
 version: !ruby/object:Gem::Version
-  version: 5.1.5
+  version: 6.2.0
 platform: ruby
 authors:
 - ''
@@ -206,6 +206,7 @@ files:
 - app/helpers/glib/json_ui/default.rb
 - app/helpers/glib/json_ui/dynamic_field_builders.rb
 - app/helpers/glib/json_ui/generic_builders.rb
+- app/helpers/glib/json_ui/json_logic_lint.rb
 - app/helpers/glib/json_ui/list_builders.rb
 - app/helpers/glib/json_ui/menu_builder.rb
 - app/helpers/glib/json_ui/page_helper.rb
@@ -420,7 +421,12 @@ files:
 - app/views/json_ui/garage/test_page/fields_url_fragment.json.jbuilder
 - app/views/json_ui/garage/test_page/flow.json.jbuilder
 - app/views/json_ui/garage/test_page/form.json.jbuilder
+- app/views/json_ui/garage/test_page/form_dirty_hooks.json.jbuilder
 - app/views/json_ui/garage/test_page/form_dynamic.json.jbuilder
+- app/views/json_ui/garage/test_page/form_dynamic_dirty.json.jbuilder
+- app/views/json_ui/garage/test_page/form_removed_field.json.jbuilder
+- app/views/json_ui/garage/test_page/form_removed_field_onload.json.jbuilder
+- app/views/json_ui/garage/test_page/form_touched_validation.json.jbuilder
 - app/views/json_ui/garage/test_page/forms.json.jbuilder
 - app/views/json_ui/garage/test_page/grid.json.jbuilder
 - app/views/json_ui/garage/test_page/horizontal.json.jbuilder
@@ -429,6 +435,8 @@ files:
 - app/views/json_ui/garage/test_page/lifecycle.json.jbuilder
 - app/views/json_ui/garage/test_page/list.json.jbuilder
 - app/views/json_ui/garage/test_page/list_editable.json.jbuilder
+- app/views/json_ui/garage/test_page/logics_run.json.jbuilder
+- app/views/json_ui/garage/test_page/logics_run_multi_form.json.jbuilder
 - app/views/json_ui/garage/test_page/logics_set.json.jbuilder
 - app/views/json_ui/garage/test_page/multimedia_video.json.jbuilder
 - app/views/json_ui/garage/test_page/pagination.json.jbuilder
@@ -437,6 +445,7 @@ files:
 - app/views/json_ui/garage/test_page/popovers.json.jbuilder
 - app/views/json_ui/garage/test_page/progressCircle.json.jbuilder
 - app/views/json_ui/garage/test_page/responsive.json.jbuilder
+- app/views/json_ui/garage/test_page/run_multiple.json.jbuilder
 - app/views/json_ui/garage/test_page/scroll.json.jbuilder
 - app/views/json_ui/garage/test_page/selectable.json.jbuilder
 - app/views/json_ui/garage/test_page/sheets.json.jbuilder
@@ -453,6 +462,7 @@ files:
 - app/views/json_ui/garage/test_page/web.json.jbuilder
 - app/views/json_ui/garage/test_page/window.json.jbuilder
 - app/views/json_ui/garage/test_page/windows.json.jbuilder
+- app/views/json_ui/garage/test_page/windows_reload.json.jbuilder
 - app/views/json_ui/garage/views/_chart_data.json.jbuilder
 - app/views/json_ui/garage/views/_checkbox_expand.json.jbuilder
 - app/views/json_ui/garage/views/_expand_shrink_ex.json.jbuilder
@@ -522,7 +532,6 @@ files:
 - lib/glib/rubocop/cops/json_ui/nested_action_parameter.rb
 - lib/glib/rubocop/cops/json_ui/nested_block_parameter.rb
 - lib/glib/rubocop/cops/localize.rb
-- lib/glib/rubocop/cops/multiline_method_call_style.rb
 - lib/glib/rubocop/cops/test_name_parentheses.rb
 - lib/glib/snapshot.rb
 - lib/glib/test/changed_files_rubocop.rb

data/lib/glib/rubocop/cops/multiline_method_call_style.rb

@@ -1,250 +0,0 @@
-# frozen_string_literal: true
-
-module RuboCop
-  module Cop
-    module Glib
-      # Enforces parentheses style for multi-line method calls with arguments.
-      #
-      # @example
-      #   # bad
-      #   page.footer padding: glib_json_padding_body, backgroundColor: '#b3bac2', childViews: ->(footer) do
-      #     footer.h1 text: 'Footer'
-      #   end
-      #
-      #   # bad
-      #   page.footer \
-      #     padding: glib_json_padding_body,
-      #     backgroundColor: '#b3bac2',
-      #     childViews: ->(footer) do
-      #       footer.h1 text: 'Footer'
-      #     end
-      #
-      #   # good
-      #   page.footer(
-      #     padding: glib_json_padding_body,
-      #     backgroundColor: '#b3bac2',
-      #     childViews: ->(footer) do
-      #       footer.h1 text: 'Footer'
-      #     end
-      #   )
-      class MultilineMethodCallStyle < Base
-        extend AutoCorrector
-
-        MSG = 'Use parentheses style for multi-line method calls: ' \
-              'wrap arguments in parentheses and place each argument on its own line.'
-
-        def on_send(node)
-          return unless multi_line_call_with_args?(node)
-          return if proper_parentheses_style?(node)
-          return if proper_backslash_style?(node) && allow_backslash?
-          return if inside_correctable_parent?(node)
-
-          add_offense(node) do |corrector|
-            autocorrect(corrector, node)
-          end
-        end
-
-        alias on_csend on_send
-
-        private
-
-        def multi_line_call_with_args?(node)
-          node.multiline? && node.arguments.any?
-        end
-
-        def allow_backslash?
-          # Allow backslash style without warnings when configured
-          # Set to true to allow both styles (but auto-correct will still convert to parentheses)
-          # Set to false to enforce parentheses style always
-          cop_config.fetch('AllowBackslashStyle', true)
-        end
-
-        def proper_backslash_style?(node)
-          source = processed_source.buffer.source
-          method_end_pos = node.loc.selector.end_pos
-
-          # Check if there's a backslash right after the method name
-          next_char_pos = method_end_pos
-          while next_char_pos < source.length && source[next_char_pos] == ' '
-            next_char_pos += 1
-          end
-
-          return false unless source[next_char_pos] == '\\'
-
-          # Check that each argument is on its own line
-          args = collect_arguments(node)
-          return false if args.empty?
-
-          args.each_cons(2) do |arg1, arg2|
-            return false if arg1.loc.line == arg2.loc.line
-          end
-
-          true
-        end
-
-        def proper_parentheses_style?(node)
-          return false unless node.parenthesized?
-
-          # Check that first argument is on a new line after opening paren
-          first_arg = node.first_argument
-          return false if first_arg.loc.line == node.loc.selector.line
-
-          # Check that each argument is on its own line
-          args = collect_arguments(node)
-          return false if args.empty?
-
-          args.each_cons(2) do |arg1, arg2|
-            return false if arg1.loc.line == arg2.loc.line
-          end
-
-          # Check that closing paren is on its own line
-          source = processed_source.buffer.source
-          close_paren_pos = node.loc.end.begin_pos
-          line_start = source.rindex("\n", close_paren_pos) || 0
-          line_content = source[line_start...close_paren_pos].strip
-
-          return false unless line_content.empty?
-
-          true
-        end
-
-        def collect_arguments(node)
-          args = []
-
-          node.arguments.each do |arg|
-            if arg.hash_type?
-              # For hash arguments, treat each pair as a separate argument
-              arg.pairs.each { |pair| args << pair }
-            else
-              args << arg
-            end
-          end
-
-          args
-        end
-
-        def inside_correctable_parent?(node)
-          # Check if this node is inside a block that belongs to a multi-line call
-          # that will also be corrected. If so, skip this node to avoid conflicts.
-          current = node.parent
-
-          while current
-            if current.send_type? || current.csend_type?
-              if multi_line_call_with_args?(current) && !proper_parentheses_style?(current)
-                return true
-              end
-            end
-            current = current.parent
-          end
-
-          false
-        end
-
-        def autocorrect(corrector, node)
-          method_end_pos = node.loc.selector.end_pos
-
-          # Calculate indentation based on the node's actual column position
-          base_indent = node.loc.column
-          arg_indent = ' ' * (base_indent + 2)
-
-          # Build the new argument list
-          arg_parts = []
-          node.arguments.each do |arg|
-            next if arg.block_pass_type? # Skip block arguments like &block
-
-            if arg.hash_type?
-              arg.pairs.each do |pair|
-                # Re-indent pair if it contains a block
-                pair_source = reindent_pair_with_block(pair, arg_indent)
-                arg_parts << pair_source
-              end
-            else
-              arg_parts << arg.source
-            end
-          end
-
-          # Build the replacement with parentheses style
-          if arg_parts.any?
-            # Opening paren on same line as method, arguments on separate lines
-            replacement = "(\n#{arg_indent}" + arg_parts.join(",\n#{arg_indent}")
-
-            # If there's a block, add it on the last argument line
-            if node.block_literal?
-              block_source = reindent_block(node.block_literal, arg_indent)
-              replacement += " #{block_source}"
-            end
-
-            # Closing paren on its own line at base indentation
-            replacement += "\n#{' ' * base_indent})"
-          else
-            # No arguments, just the block (shouldn't happen for multi-line, but handle it)
-            replacement = if node.block_literal?
-                           " #{node.block_literal.source}"
-                         else
-                           '()'
-                         end
-          end
-
-          # Remove everything from method name to end of node
-          range = Parser::Source::Range.new(
-            processed_source.buffer,
-            method_end_pos,
-            node.source_range.end_pos
-          )
-
-          corrector.replace(range, replacement)
-        end
-
-        def reindent_pair_with_block(pair, base_indent)
-          # Check if the pair's value is a block
-          return pair.source unless pair.value.block_type?
-
-          # Format: "key: ->(param) do ... end"
-          key_source = pair.key.source
-          block_source = reindent_block(pair.value, base_indent)
-
-          "#{key_source}: #{block_source}"
-        end
-
-        def reindent_block(block_node, base_indent)
-          # Get block source lines
-          source = block_node.source
-          lines = source.lines
-
-          return source if lines.length == 1 # Single line block, no reindent needed
-
-          # Find the current indentation of the block's first line
-          # (this is usually where "do" appears)
-          first_line = lines[0]
-
-          # Process the block:
-          # Line 0: "->(param) do" - keep as is
-          # Lines 1..-2: block body - re-indent to base_indent + 2
-          # Last line: "end" - indent to base_indent
-
-          result_lines = []
-          block_body_indent = base_indent + ' ' * 2
-
-          lines.each_with_index do |line, index|
-            if index == 0
-              # First line: "->(param) do"
-              result_lines << line.rstrip
-            elsif index == lines.length - 1
-              # Last line: "end"
-              result_lines << "#{base_indent}#{line.strip}"
-            else
-              # Body lines: re-indent
-              # Remove existing indentation and add new indentation
-              stripped = line.lstrip
-              next if stripped.empty? # Skip blank lines
-
-              result_lines << "#{block_body_indent}#{stripped.rstrip}"
-            end
-          end
-
-          result_lines.join("\n")
-        end
-      end
-    end
-  end
-end