inline_forms 8.1.47 → 8.1.53

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a4f5d1ebb432475fd4db2c7eb7e92962b408b30a602c387f06af0b64a338cc4b
-  data.tar.gz: ac8c2e604daa44def24c578fced85d308c2ab7fe1b4f8f023af11e470ed97a50
+  metadata.gz: 698cbe91c323804016404aed86eda2e03d171b2a5df33ab775d3cca68f3d4341
+  data.tar.gz: 7ea3231464409d606c023f4b34aeeb2212d293abeaefc7a876e5ec488f6dcc8b
 SHA512:
-  metadata.gz: 9717b909093e9b6c48db6a9325093bfbfc738b18f25d495a28095109b54e51e1671fa97df157570a85e55ef6f4ca278f340fbb7d1d58f6e73a05bf8cb7009f65
-  data.tar.gz: 3559bac6657e4ca87d33dc952d9031305db0682d6b1538e373c8193bc4e546f58d470949117d54a261676292f4fd48adb92f915cc096e76b4d69768e7de8fa92
+  metadata.gz: b2c7081ad209dcb79cc50ffa9cd61eaa920a9e44b609d4460a70df0aecfc65532ade283e4335836d0f824714e76107aa888931992d52f777e96868a28336ca4b
+  data.tar.gz: 0b7dc0db8f243a6d06467fa353d423252a97c8c33b14940f24264c99aa3d851253d8580a78e2ce0265d856925ae06753da1cb1d8b793c6716014262b03e093eb

data/.gitignore

@@ -6,6 +6,9 @@ rdoc
 
 # yard generated
 doc
+# ...but not the schema-edit gem's shipped docs: its install generator copies
+# doc/schema-apply-workflow.yml.example into the host app.
+!inline_forms_schema_edit/doc/
 .yardoc
 
 # bundler

data/CHANGELOG.md

@@ -4,6 +4,155 @@ All notable changes to this project are documented in this file.
 
 ## [Unreleased]
 
+## [8.1.53] - 2026-10-04
+
+### Fixed
+
+- **Page title in the `inline_forms` layout.** `layouts/inline_forms` rendered `t('application_name')` into `<title>`, and no en translation existed (not in the gem, not in the generated app), so every page of a fresh example app (`/apartments`, `/file_trash`, …) got the title `<span class="translation_missing" …>Application Name</span> v8.1.51`: a bare `t()` returns that html_safe span, which `<title>` shows as text. The layout now calls `t('application_name', default: application_name)`, falling back to the host's `ApplicationHelper#application_name` (which the header partial already needs). With a default, `t()` returns plain text that ERB escapes, so a missing translation can never put markup into `<title>`.
+- **Installer:** `config/locales/inline_forms_local.en.yml` now also defines `application_name: <app name>`, next to `inline_forms.general.application_title`.
+- **nl locale:** removed the placeholder `application_name: naam van de applicatie` from `inline_forms.nl.yml`. It was the only definition of the key, so nl users saw "naam van de applicatie v…" as the page title; they now get the app name.
+
+### Tests
+
+- Gem: `test/integration/layout_title_test.rb`: the title falls back to the helper, uses a host translation when present, ignores the old nl placeholder, and escapes markup in the translation.
+- Example app: `example_app_layout_title_test.rb`: the installer defines the en `application_name`; `/apartments` and `/file_trash` are titled "<app name> v<version>", in en and for an nl user.
+
+### Lockstep
+
+- validation_hints 8.1.53, inline_forms_installer 8.1.53, inline_forms_schema_edit 8.1.53.
+
+## [8.1.52] - 2026-10-04
+
+### Removed
+
+- **"+ field" link removed from the engine's model top bar.** Since 8.1.45 (`cfd0977`) every app with the `inline_forms_schema_edit` routes showed the dev-only schema GUI link on every page, production included. It was meant for the example app only. It now ships only in the example app, as `app/views/inline_forms/_model_top_bar_left.html.erb`. An app installed with `--schema-edit` alone gets the routes and tables, but no nav link.
+
+### Added
+
+- Model top bar hook: if the app has an `inline_forms/_model_top_bar_left` partial, it is rendered after the title, for app-specific `<li>` items. Nothing is rendered when the partial is absent.
+
+### Fixed
+
+- **Gem packaging:** `InlineFormsGemFiles` sweeps untracked files too, so a local build also packaged `.claude/launch.json`, `.claude/settings.local.json` and `CLAUDE.md`. They are now excluded hard, like `stuff/`.
+
+### Tests
+
+- Gem: the engine top bar has no schema GUI link even when the schema routes are drawn.
+- Example app: the top bar links the schema GUI.
+
+### Lockstep
+
+- validation_hints 8.1.52, inline_forms_installer 8.1.52, inline_forms_schema_edit 8.1.52.
+
+## [8.1.51] - 2026-10-04
+
+### Changed
+
+- **File trash link moved to the user menu.** `link_to_inline_forms_file_trash` now sits in the user (logout) menu of the top bar, in the gem's `_header` and the example app's. It is still shown only to users who may `:read_file_trash` on `:all`, and it no longer depends on the admin-only "More" menu.
+
+### Fixed
+
+- **Global trash page:** the "Delete selected permanently" button and the checkbox column are shown only when a row on the page can still be purged. Before, the Restored and Purged states showed the button with nothing to select. New `InlineForms::TrashedFile#purgeable?` (trashed, or expired and not yet swept).
+
+### Notes
+
+- Known issues, parked (local note `stuff/2026-10-04-carrierwave-file-elements-oddities.md`) with the CarrierWave file elements (`file_field`, `audio_field`, `image_field`, `multi_image_field`): submitting without a file erases the file, no empty-state icon on file_field, no type allowlist, the gallery replaces instead of appending. Parked; not changed in this release.
+
+### Tests
+
+- Gem: the global page offers bulk purge only when a listed row is purgeable.
+- Example app: the user menu links the trash next to logout.
+
+### Lockstep
+
+- validation_hints 8.1.51, inline_forms_installer 8.1.51, inline_forms_schema_edit 8.1.51.
+
+## [8.1.50] - 2026-10-03
+
+### Added
+
+- **Declared file slots with a file trash (`InlineForms::StoredFiles`).** A `:simple_file_field` whose bytes live in the record's own table can now be replaced, removed, restored (undo) and permanently deleted, with history. Opt-in per model:
+
+  ```ruby
+  class Client < ApplicationRecord
+    include InlineForms::StoredFiles
+    inline_forms_file :filename                   # data / content_type
+    inline_forms_file :begeleidingsplan_filename  # begeleidingsplan_data / _content_type
+  end
+  ```
+
+  The macro defines the upload setter (in a prepended module; a hand-written `<attr>=` for a declared slot raises outside production), adds the slot's three columns to PaperTrail's `skip:` on that model only (in either order with `has_paper_trail`), and trashes files on `destroy`. Removing or replacing never deletes bytes: they move to `inline_forms_trashed_files` and stay restorable for `InlineForms.file_trash_retention` (default 30 days; `nil` = never expire). Purge deletes the bytes and keeps a tombstone (filename, size, SHA-256, who/when); `InlineForms.file_trash_redact_on_purge` (default off) also blanks the filename. `InlineForms.max_file_size` (default nil) adds a size validation.
+- **Field UI for declared slots.** Download link (served by the gem: `disposition: attachment`, `Cache-Control: no-store`, 404 on an empty slot), a replace icon, a remove icon with a confirm dialog, an inline "removed · undo" notice, and on an empty slot a "restore removed file" link. Each control is shown only when the matching CanCan action is granted.
+- **Per-record trash panel** ("Removed files (n)") beside Versions, limited to the slots of the attribute list being shown (tabs): download, restore, delete permanently; restored and purged rows stay as greyed history with who/when and the expiry date.
+- **File events in the Versions panel** (uploaded / removed / replaced / restored / purged) via `inline_forms_history_for`, merged on top of `inline_forms_versions_for` (which hosts may still override). The restore link on a file event uses `restore_file`, not `revert`.
+- **Global trash page** (`/file_trash`, `InlineForms::FileTrashController`) for users who may `:read_file_trash` on `:all` (superadmin): filter by model and state, download / restore per row, bulk "delete permanently" (one transaction, every row authorized), files of deleted records, and the retention sweep's heartbeat with a warning when it is overdue (48 h). Header link via `link_to_inline_forms_file_trash`.
+- **CanCan actions**, all checked attribute-level on the server: `:replace_file` (upload over an occupied slot, on top of `:update`), `:remove_file`, `:restore_file` (+ `:replace_file` when the slot is occupied, `:update` when empty), `:purge_file`, `:download_trashed_file`, `:read_file_trash`. Nothing is granted by default when CanCanCan is loaded; `can :read, :all` does not grant any of them.
+- **Routes:** `InlineForms.file_routes(self)` inside a resource block (member routes `download_file`, `remove_file`, `restore_file`, `purge_file`, `trashed_file`, `file_trash`; order-independent), and `InlineForms.draw_file_trash_routes(self)` for the global page.
+- **Generator** `rails g inline_forms:file_trash`: migration for `inline_forms_trashed_files` (LONGBLOB on MySQL) and `inline_forms_file_trash_sweeps`.
+- **Rake tasks:** `inline_forms:file_trash:purge_expired` (daily from cron; records a heartbeat, exits non-zero on failure), `inline_forms:files:audit` (read-only: bytes without a filename, filenames without bytes), `inline_forms:files:trash_orphans CONFIRM=yes` (moves orphaned bytes into the trash).
+- `rails g inline_forms Model x:simple_file_field` and `rails g inline_forms_addto Model x:simple_file_field` now generate a declared slot: the three columns, `include InlineForms::StoredFiles` + `inline_forms_file :x`, and `InlineForms.file_routes(self)` in the resource block (addto: when the block can be found, otherwise a reminder). No values hash is needed for a declared slot.
+- en/nl translations under `inline_forms.files.*`; `errors.messages.inline_forms_file_too_large` / `inline_forms_file_missing`.
+
+### Changed
+
+- `InlineFormsController#revert` runs in one transaction. Undoing a `destroy` puts the record's `record_destroyed` files back onto it *before* `save!` (so presence validations on the filename pass) and marks those trash rows restored; a slot whose file was purged in the meantime comes back empty. Reverting an update restores the slot columns to their DB values, so pre-adoption version rows that still carry a filename can no longer put an old name on the current bytes.
+- Submitting the edit form of a declared slot without a file is a validation error ("no file chosen") instead of a silent success; a string param for a declared slot is never written.
+
+### Fixed
+
+- `version_modified_by` looked up `Devise.mappings[:users]`, but Devise keys mappings by the singular scope (`:user`), so every "Done by" in the Versions panel showed "Unknown".
+- Versions list header columns now line up with the rows (an "When" column was missing).
+
+### Upgrade notes (existing hosts)
+
+1. `rails g inline_forms:file_trash` + `db:migrate`.
+2. `rake inline_forms:files:audit` (and `trash_orphans CONFIRM=yes` if it reports orphaned bytes).
+3. Per model with raw-byte file columns: `include InlineForms::StoredFiles` + `inline_forms_file :attr`; delete the hand-written `attr=` setters and `sanitize_filename`.
+4. Routes: `InlineForms.file_routes(self)` in each such resource block, `InlineForms.draw_file_trash_routes(self)` once.
+5. Ability: grant the file actions per role (`:purge_file` typically superadmin only).
+6. Host download actions: `send_inline_forms_file(record.inline_forms_file_download(:attr))` after `authorize! :read, record, :attr` (or link to `download_file`).
+7. Initializer: `InlineForms.file_trash_retention = 30.days` (default) etc.
+8. Cron: `bin/rails inline_forms:file_trash:purge_expired` daily (inside the running container on Kamal hosts).
+9. Add the slot attribute names to `config.filter_parameters` (uploaded filenames are otherwise logged).
+
+Rolling back to 8.1.49 leaves the trash table in place (bytes nobody can see): purge or restore the trash first, and disable the cron job.
+
+### Tests
+
+- `test/integration/file_slots_test.rb` (dummy `Document` with two slots): upload/replace/identical re-upload, permissions per action, crafted string, size limit, failed save leaves no trash row, remove/restore/swap/purge/redact, IDOR, downloads, panel, destroy + undo (with a presence validation), update revert with an old filename in the version, retention sweep, global page incl. all-or-nothing bulk purge. Generator tests for both generators.
+- Example app: `FormElementShowcase#manual` is a declared slot; `example_app_showcase_file_slot_test.rb` covers the generated wiring end to end.
+
+### Lockstep
+
+- validation_hints 8.1.50, inline_forms_installer 8.1.50, inline_forms_schema_edit 8.1.50.
+
+## [8.1.49] - 2026-10-03
+
+### Security
+
+- **Attribute-level authorization is now enforced on single-field requests.** `edit`, `update` and the single-attribute `show` were guarded only by `load_and_authorize_resource`, which authorizes the record; CanCanCan passes attribute-scoped rules when no attribute is given, so `cannot :update, Client, [:secret]` only hid the edit link and a hand-made PATCH still overwrote the field (and an attribute-scoped `can :update, Client, [:a, :b]` allowed every attribute). These actions now call `authorize!(:update, object, attribute)` (`:read` for `show`) when CanCanCan is loaded. Denials raise `CanCan::AccessDenied` like the record-level check.
+- **`attribute` / `form_element` params are whitelisted** against the attribute list (`@inline_forms_attribute_list || object.inline_forms_attribute_list`) before use; anything else gets `400 Bad Request`. Previously `form_element` went straight into `send("#{form_element}_update")`, and `show` with `form_element=has_one` sent the `attribute` param to the record (`attribute=destroy` destroyed it on a GET). The edit links of the delegating elements (`plain_text_area` → `plain_text`, `text_area` → `rich_text`) are accepted via `InlineForms::FORM_ELEMENT_DELEGATES`; see `InlineForms.attribute_list_row_for`.
+
+### Tests
+
+- The dummy app now loads CanCanCan (`Ability` grants everything; tests narrow it with `Ability.restrictions`). New `test/integration/field_authorization_test.rb`: crafted PATCH on a `cannot :update` attribute, attribute-scoped `can`, edit/show denials, mismatched/unknown `form_element`, unlisted attribute, the `show` method-send.
+
+### Lockstep
+
+- validation_hints 8.1.49, inline_forms_installer 8.1.49, inline_forms_schema_edit 8.1.49.
+
+## [8.1.48] - 2026-10-03
+
+### Fixed
+
+- **Revert no longer wipes columns excluded from PaperTrail.** `InlineFormsController#revert` reified versions with PaperTrail's default `unversioned_attributes: :nil`, which sets every `has_paper_trail skip:` column to nil on the live record; the following `save!` persisted it. Hosts that keep file bytes in a skipped column (e.g. `skip: [:data]` with a versioned `filename`) lost the bytes on every revert of an unrelated edit while the filename stayed, so downloads returned empty files. All revert-path reifies (including `revert_authorization_subject`, which reifies the same cached `version.item` first, and the ActionText restore) now pass `unversioned_attributes: :preserve`. Replaying a `destroy` revert onto a row that already exists now copies only the columns stored in the version, instead of overwriting skipped columns with nil from the fresh reified record.
+- Regression tests: `test/integration/revert_skipped_columns_test.rb` (dummy `Dossier` model with `skip: [:data]`).
+- Note: bytes in a skipped column are never in a version, so undoing a `destroy` still cannot bring them back; and rows already damaged by earlier reverts are not repaired by this fix.
+
+### Lockstep
+
+- validation_hints 8.1.48, inline_forms_installer 8.1.48, inline_forms_schema_edit 8.1.48.
+
 ## [8.1.47] - 2026-07-25
 
 ### Fixed

data/Gemfile

@@ -13,6 +13,9 @@ group :test do
   gem "will_paginate", "~> 4.0"
   gem "paper_trail", "~> 17.0"
   gem "turbo-rails"
+  # Generated apps always authorize through CanCanCan; the dummy loads it so
+  # the controller's attribute-level checks run (test/dummy/app/models/ability.rb).
+  gem "cancancan", "~> 3.6"
   # The schema-GUI engine gem (same repo, own gemspec). Test group so the
   # dummy app's `Bundler.require(*Rails.groups)` loads it and the engine's
   # schema_edit integration tests exercise the extracted controller/views.

data/README.rdoc

@@ -263,6 +263,53 @@ In every case the Turbo wiring is the same: +link_options: { data: { turbo_frame
 
 New apps get +rails-i18n+ from RubyGems (+ '~> 8.1'+), not from the +svenfuchs/rails-i18n+ Git repository. The installer pins +rails ~> 8.1+ with +config.load_defaults 8.1+; the published +rails-i18n+ 8.x line matches that stack.
 
+== File slots with undo and a trash (+InlineForms::StoredFiles+)
+
+A +:simple_file_field+ can keep its bytes in the record's own table (a binary /
+LONGBLOB column plus a content-type column). Declare the slot on the model:
+
+  class Client < ApplicationRecord
+    include InlineForms::StoredFiles
+    inline_forms_file :filename                   # columns: filename, data, content_type
+    inline_forms_file :begeleidingsplan_filename  # begeleidingsplan_filename, _data, _content_type
+  end
+
+  # attribute list row: no values hash needed
+  [ :begeleidingsplan_filename, :simple_file_field ],
+
+  # routes.rb
+  resources :clients do
+    post 'revert', :on => :member
+    get 'list_versions', :on => :member
+    InlineForms.file_routes(self)
+  end
+  InlineForms.draw_file_trash_routes(self)   # global trash page, /file_trash
+
+Run <tt>rails g inline_forms:file_trash</tt> once for the trash tables, and
+schedule <tt>bin/rails inline_forms:file_trash:purge_expired</tt> daily.
+<tt>rails g inline_forms Model x:simple_file_field</tt> and
++inline_forms_addto+ generate all of this for you.
+
+Users then get replace / remove (to the trash) / undo / restore, a "Removed
+files" panel per record, file events in Versions, and (superadmin) a page with
+every trashed file. Removing or replacing never deletes bytes; they stay
+restorable for +InlineForms.file_trash_retention+ (30 days) until the sweep or
+a user purges them (bytes gone, a tombstone with name, size and SHA-256 kept).
+The slot columns are kept out of PaperTrail, so reverting a version never
+touches a file.
+
+Every action is a CanCan action, checked per attribute on the server, and none
+is granted by default: +:replace_file+ (on top of +:update+), +:remove_file+,
++:restore_file+, +:purge_file+, +:download_trashed_file+, +:read_file_trash+.
+The global page needs +:read_file_trash+ on +:all+.
+
+Settings: +InlineForms.file_trash_retention+ (nil = never expire),
++InlineForms.file_trash_redact_on_purge+ (blank the filename on purge),
++InlineForms.max_file_size+. Maintenance: <tt>rake inline_forms:files:audit</tt>
+(read-only consistency report) and <tt>inline_forms:files:trash_orphans
+CONFIRM=yes</tt>. Backups are outside the gem's reach: a purged file stays in
+database backups until their own rotation.
+
 == File uploads (CarrierWave)
 
 The +:image_field+ form element uses CarrierWave. Generated apps depend on +carrierwave '~> 3.1'+ from RubyGems, store uploads on the local filesystem under +public/uploads/+, and use the default uploader produced by +rails generate uploader Image+. CarrierWave 3.1 supports Rails 6.0 through 8.0 and is the upstream maintenance line.

data/app/assets/stylesheets/inline_forms/inline_forms.scss

@@ -514,3 +514,37 @@ turbo-frame {
 #input_search {
   border: none !important;
 }
+
+/* Declared file slots (InlineForms::StoredFiles): the filename may break
+   anywhere; the action icons never wrap apart. */
+.inline_forms-file-name {
+  overflow-wrap: anywhere;
+}
+.inline_forms-file-actions {
+  white-space: nowrap;
+  margin-left: 0.5em;
+  a + a {
+    margin-left: 0.6em;
+  }
+}
+.inline_forms-file-undo {
+  margin-left: 0.5em;
+  white-space: nowrap;
+}
+.inline_forms-file-hint,
+.inline_forms-file-meta {
+  display: block;
+  font-size: 0.85em;
+  opacity: 0.75;
+}
+.inline_forms-file-notice {
+  margin: 0.25em 0 0;
+  font-size: 0.9em;
+}
+.inline_forms-file-expiring {
+  color: var(--if-color-flash-accent);
+  font-weight: bold;
+}
+.inline_forms-file-trash-history {
+  opacity: 0.55;
+}

data/app/controllers/concerns/file_slots_concern.rb

@@ -0,0 +1,211 @@
+# -*- encoding : utf-8 -*-
+
+# Actions for declared file slots (InlineForms::StoredFiles) on a record:
+# download, remove, restore (undo), purge, download a trashed file, and the
+# per-record trash panel. Routed by InlineForms.file_routes(self) inside the
+# resource block.
+#
+# Every action is excluded from load_and_authorize_resource and authorizes
+# itself, attribute-level, because CanCanCan skips attribute-scoped rules
+# when no attribute is given:
+#
+#   download_file   :read            on the record + attribute
+#   remove_file     :remove_file     on the record + attribute
+#   restore_file    :restore_file    + :replace_file (slot occupied) or
+#                                      :update (slot empty) on the attribute
+#   purge_file      :purge_file      on the record + attribute
+#   trashed_file    :download_trashed_file on the record + attribute
+#   file_trash      :read_file_trash on the record (each slot filtered)
+#
+# The attribute must be a declared slot that the model's attribute list shows
+# as :simple_file_field (400 otherwise); a trash entry must belong to this
+# record and attribute (404 otherwise), so ids can't be guessed across records.
+module FileSlotsConcern
+  extend ActiveSupport::Concern
+
+  FILE_SLOT_ACTIONS = %i[download_file remove_file restore_file purge_file trashed_file file_trash].freeze
+
+  included do
+    before_action :set_inline_forms_current_user
+    helper_method :inline_forms_file_trash_slots_param
+  end
+
+  def download_file
+    @object = referenced_object
+    return unless file_slot_request_permitted?(:read)
+
+    file = @object.inline_forms_file_download(@attribute)
+    return render_missing_file unless file
+
+    send_inline_forms_file(file)
+  end
+
+  def remove_file
+    @object = referenced_object
+    return unless file_slot_request_permitted?(:remove_file)
+
+    @file_entry = @object.inline_forms_remove_file!(@attribute, by: inline_forms_current_user_id)
+    @file_notice = @file_entry ? :removed : :already_empty
+    render_file_slot_streams
+  end
+
+  def restore_file
+    @object = referenced_object
+    return unless file_slot_request_permitted?(:restore_file)
+
+    entry = find_file_entry
+    return head :not_found unless entry
+    authorize!(@object.inline_forms_file_present?(@attribute) ? :replace_file : :update, @object, @attribute.to_sym) if cancan_enabled?
+
+    begin
+      entry.restore!(by: inline_forms_current_user_id)
+      @object.reload
+      @file_notice = :restored
+    rescue InlineForms::TrashedFile::NotRestorable
+      @file_notice = :not_restorable
+    end
+    render_file_slot_streams
+  end
+
+  def purge_file
+    @object = referenced_object
+    return unless file_slot_request_permitted?(:purge_file)
+
+    entry = find_file_entry
+    return head :not_found unless entry
+
+    @file_notice = entry.purge!(by: inline_forms_current_user_id) ? :purged : :not_purgeable
+    render_file_slot_streams
+  end
+
+  def trashed_file
+    @object = referenced_object
+    return unless file_slot_request_permitted?(:download_trashed_file)
+
+    entry = find_file_entry
+    return head :not_found unless entry
+    return render_missing_file unless entry.trashed?
+
+    data = entry.file_data
+    return render_missing_file if data.nil?
+
+    # Access to possibly mis-filed personal data: log who opened what.
+    Rails.logger.info(
+      "inline_forms file_trash download entry=#{entry.id} #{entry.record_type}##{entry.record_id}." \
+      "#{entry.attribute_name} user=#{inline_forms_current_user_id.inspect}"
+    )
+    # Never render a trashed file inline (stored HTML/SVG would run on our
+    # origin): always an attachment, always octet-stream.
+    send_inline_forms_file({ data: data, filename: entry.filename.presence || "file", type: "application/octet-stream" })
+  end
+
+  def file_trash
+    @object = referenced_object
+    authorize!(:read_file_trash, @object) if cancan_enabled?
+    @update_span = params[:update]
+    @file_trash_slots = file_trash_slots_from_params
+    @file_trash_open = params[:close].blank?
+    render "inline_forms/file_trash_panel", layout: "turbo_rails/frame"
+  end
+
+  # For host download actions that predate download_file (e.g. a `dl` route
+  # already linked from elsewhere):
+  #   def dl
+  #     @client = Client.find(params[:id])
+  #     authorize! :read, @client, :filename
+  #     send_inline_forms_file(@client.inline_forms_file_download(:filename)) or head :not_found
+  #   end
+  def send_inline_forms_file(file)
+    return render_missing_file if file.nil?
+
+    response.headers["Cache-Control"] = "no-store"
+    send_data file[:data], filename: file[:filename], type: file[:type], disposition: :attachment
+  end
+
+  private
+
+  def set_inline_forms_current_user
+    InlineForms::Current.user_id = inline_forms_current_user_id
+  end
+
+  def inline_forms_current_user_id
+    user = respond_to?(:current_user, true) ? current_user : nil
+    user.respond_to?(:id) ? user.id : nil
+  end
+
+  # Validates the attribute (declared slot shown as :simple_file_field in the
+  # attribute list), then authorizes +action+ on it. Renders and returns false
+  # when refused.
+  def file_slot_request_permitted?(action)
+    @attribute = params[:attribute].to_s
+    @form_element = "simple_file_field"
+    @update_span = params[:update]
+    unless inline_forms_file_slot_listed?(@object, @attribute)
+      head :bad_request
+      return false
+    end
+    authorize!(action, @object, @attribute.to_sym) if cancan_enabled?
+    true
+  end
+
+  def inline_forms_file_slot_listed?(object, attribute)
+    klass = object.class
+    return false unless klass.respond_to?(:inline_forms_file_slot?) && klass.inline_forms_file_slot?(attribute)
+
+    attributes = @inline_forms_attribute_list || object.inline_forms_attribute_list
+    InlineForms.attribute_list_row_for(attributes, attribute, "simple_file_field").present?
+  end
+
+  def find_file_entry
+    InlineForms::TrashedFile.without_data.for_slot(@object, @attribute).trash_entries.find_by(id: params[:trash_id])
+  end
+
+  # The slots the trash panel lists: the ones the page passed (the current
+  # tab's), reduced to declared, listed, readable slots.
+  def file_trash_slots_from_params
+    requested = params[:slots].to_s.split(",").map(&:strip).reject(&:empty?)
+    requested = @object.class.inline_forms_file_slots.keys.map(&:to_s) if requested.empty? && @object.class.respond_to?(:inline_forms_file_slots)
+    requested.select do |attribute|
+      inline_forms_file_slot_listed?(@object, attribute) &&
+        (cancan_disabled? || can?(:read_file_trash, @object, attribute.to_sym))
+    end
+  end
+
+  def inline_forms_file_trash_slots_param
+    Array(@file_trash_slots).join(",")
+  end
+
+  def render_missing_file
+    render plain: t("inline_forms.files.missing"), status: :not_found
+  end
+
+  # The field, the record's trash panel and its versions panel all change
+  # after a file action; replace the three frames in one response.
+  def render_file_slot_streams
+    @file_trash_slots = file_trash_slots_from_params
+    @file_trash_open = params[:panel] == "open"
+    field_id = "#{@object.class.name.underscore}_#{@object.id}_#{@attribute}"
+    trash_id = helpers.inline_forms_file_trash_turbo_frame_id(@object)
+    versions_id = helpers.inline_forms_versions_turbo_frame_id(@object)
+    @inline_forms_turbo_field = true
+
+    field_html = render_to_string("inline_forms/file_field_frame", layout: false, formats: [ :html ],
+                                  locals: { frame_id: field_id })
+    streams = [ turbo_stream.replace(field_id, field_html) ]
+    # Only send the panels this user may see on the record page.
+    if cancan_disabled? || can?(:read_file_trash, @object)
+      trash_html = render_to_string("inline_forms/file_trash_panel", layout: false, formats: [ :html ],
+                                    locals: { update_span: trash_id })
+      streams << turbo_stream.replace(trash_id, trash_html)
+    end
+    if cancan_disabled? || can?(:list_versions, @object)
+      versions_html = render_to_string("inline_forms/versions_panel", layout: false, formats: [ :html ],
+                                       locals: { update_span: versions_id, object: @object })
+      streams << turbo_stream.replace(versions_id, versions_html)
+    end
+    respond_to do |format|
+      format.turbo_stream { render turbo_stream: streams }
+      format.html { render html: field_html, layout: "turbo_rails/frame" }
+    end
+  end
+end

data/app/controllers/inline_forms/file_trash_controller.rb

@@ -0,0 +1,115 @@
+# -*- encoding : utf-8 -*-
+
+# The cross-record file trash (superadmin): every trashed file of every model,
+# filterable, with download / restore / purge and a bulk purge. It is also the
+# only place to purge files whose record was deleted, and it shows the
+# retention sweep's heartbeat. Routed by InlineForms.draw_file_trash_routes.
+#
+# Access: authorize!(:read_file_trash, :all) -- granted by `can :manage, :all`
+# (superadmin), never by `can :read, :all` (a different action) or by
+# per-model grants. Each row action is authorized again against the file's
+# record (or, when the record is gone, its class) and attribute.
+class InlineForms::FileTrashController < ::ApplicationController
+  include CancanConcern
+
+  layout "inline_forms"
+
+  before_action { InlineForms::Current.user_id = current_user_id }
+  before_action { authorize!(:read_file_trash, :all) if cancan_enabled? }
+
+  STATES = %w[trashed expired restored purged all].freeze
+  PER_PAGE = 50
+
+  def index
+    @models = InlineForms::TrashedFile.trash_entries.distinct.pluck(:record_type).sort
+    @model = params[:model].presence_in(@models)
+    @state = params[:state].presence_in(STATES) || "trashed"
+    @entries = filtered_entries.paginate(page: params[:page], per_page: PER_PAGE)
+    @last_sweep = InlineForms::FileTrashSweep.last_run
+    @sweep_overdue = InlineForms::FileTrashSweep.overdue?
+  end
+
+  # Bulk purge of the checked rows: one transaction, every row authorized
+  # (any refusal rolls the whole request back).
+  def purge
+    ids = Array(params[:ids]).map(&:to_i).reject(&:zero?)
+    return redirect_to(back_to_index, alert: t("inline_forms.files.global.nothing_selected")) if ids.empty?
+
+    purged = 0
+    InlineForms::TrashedFile.transaction do
+      InlineForms::TrashedFile.without_data.trash_entries.where(id: ids).each do |entry|
+        authorize_entry!(:purge_file, entry)
+        purged += 1 if entry.purge!(by: current_user_id)
+      end
+    end
+    redirect_to back_to_index, notice: t("inline_forms.files.global.purged_count", count: purged)
+  end
+
+  def restore
+    entry = find_entry
+    record = entry.owner
+    return redirect_to(back_to_index, alert: t("inline_forms.files.notice_not_restorable")) unless record
+
+    authorize_entry!(:restore_file, entry, record)
+    if cancan_enabled?
+      authorize!(record.inline_forms_file_present?(entry.attribute_name) ? :replace_file : :update,
+                 record, entry.attribute_name.to_sym)
+    end
+    entry.restore!(by: current_user_id)
+    redirect_to back_to_index, notice: t("inline_forms.files.notice_restored")
+  rescue InlineForms::TrashedFile::NotRestorable
+    redirect_to back_to_index, alert: t("inline_forms.files.notice_not_restorable")
+  end
+
+  def download
+    entry = find_entry
+    authorize_entry!(:download_trashed_file, entry)
+    data = entry.trashed? ? entry.file_data : nil
+    return render(plain: t("inline_forms.files.missing"), status: :not_found) if data.nil?
+
+    Rails.logger.info(
+      "inline_forms file_trash download entry=#{entry.id} #{entry.record_type}##{entry.record_id}." \
+      "#{entry.attribute_name} user=#{current_user_id.inspect}"
+    )
+    response.headers["Cache-Control"] = "no-store"
+    send_data data, filename: entry.filename.presence || "file", type: "application/octet-stream", disposition: :attachment
+  end
+
+  private
+
+  def filtered_entries
+    scope = InlineForms::TrashedFile.without_data.trash_entries.newest_first
+    scope = scope.where(record_type: @model) if @model
+    case @state
+    when "trashed"  then scope.restorable
+    when "expired"  then scope.still_trashed.expired
+    when "restored" then scope.where.not(restored_at: nil)
+    when "purged"   then scope.where.not(purged_at: nil)
+    else scope
+    end
+  end
+
+  def find_entry
+    InlineForms::TrashedFile.without_data.trash_entries.find(params[:id])
+  end
+
+  # Against the record when it still exists, else its class: a grant like
+  # `can :purge_file, Client` then still covers files of deleted clients.
+  def authorize_entry!(action, entry, record = entry.owner)
+    return unless cancan_enabled?
+
+    subject = record || entry.owner_class
+    raise CanCan::AccessDenied.new(nil, action, entry) unless subject
+
+    authorize!(action, subject, entry.attribute_name.to_sym)
+  end
+
+  def back_to_index
+    inline_forms_file_trash_path(params.permit(:model, :state, :page).to_h.compact_blank)
+  end
+
+  def current_user_id
+    user = respond_to?(:current_user, true) ? current_user : nil
+    user.respond_to?(:id) ? user.id : nil
+  end
+end