inline_forms 8.1.47 → 8.1.53

data/app/controllers/inline_forms_controller.rb

@@ -26,10 +26,12 @@ class InlineFormsController < ApplicationController
   include InlineForms::FormElements::HelperIncludes
   include CancanConcern
   include VersionsConcern
+  include FileSlotsConcern
 
   before_action :getKlass
 
-  load_and_authorize_resource except: :revert, no_params: true if cancan_enabled?
+  # +revert+ and the file-slot actions authorize themselves (attribute-level).
+  load_and_authorize_resource except: [ :revert, *FileSlotsConcern::FILE_SLOT_ACTIONS ], no_params: true if cancan_enabled?
   # :index shows a list of all objects from class @Klass, using will_paginate,
   # including a link to 'new', that allows you to create a new record.
   def index
@@ -125,6 +127,8 @@ class InlineFormsController < ApplicationController
     @form_element = params[:form_element]
     @sub_id = params[:sub_id]
     @update_span = params[:update]
+    return unless field_request_permitted?(:update)
+    return unless file_replace_permitted?
     respond_to do |format|
       format.html { render_turbo_field(:field_edit) }
     end
@@ -191,6 +195,8 @@ class InlineFormsController < ApplicationController
     @form_element = params[:form_element]
     @sub_id = params[:sub_id]
     @update_span = params[:update]
+    return unless field_request_permitted?(:update)
+    return unless file_replace_permitted?
     # Defense-in-depth: the UI renders a pending field as a read-only
     # placeholder (never links to edit/update), but a hand-crafted request
     # could still target a column that is not migrated yet. Refuse cleanly
@@ -232,6 +238,10 @@ class InlineFormsController < ApplicationController
     @attribute = params[:attribute]
     @form_element = params[:form_element]
     close = params[:close] || false
+    # Single-field show (cancel link, post-update render): same whitelist as
+    # edit/update -- the associated/has_one branches below `send` the
+    # attribute name to the record.
+    return if @attribute && !field_request_permitted?(:read)
     if @form_element == "associated"
       @sub_id = params[:sub_id]
       if @sub_id.to_i > 0
@@ -318,11 +328,7 @@ class InlineFormsController < ApplicationController
     return head :forbidden unless destroy_permitted?
     return head :not_found unless @parent
 
-    @object = @version.reify(
-      has_many: true,
-      has_and_belongs_to_many: true,
-      belongs_to: true
-    )
+    @object = reify_for_revert(@version)
     # PaperTrail::Version#reify returns nil for `create` events because
     # there is no prior state to roll back to. The versions list view
     # hides the Restore link for `create` rows, but guard here too in
@@ -358,8 +364,14 @@ class InlineFormsController < ApplicationController
       @rich_text_record.save!
       @parent.touch if @parent.respond_to?(:touch)
     else
-      @parent = persist_reverted_primary!(@object)
-      restore_rich_texts_for_reverted_parent!(@parent)
+      # One transaction: the record, its files coming back out of the trash
+      # (undo of a destroy) and its rich texts are restored together or not.
+      @object.class.transaction do
+        file_entries = InlineForms::StoredFiles.prepare_revert!(@object)
+        @parent = persist_reverted_primary!(@object, @version)
+        InlineForms::StoredFiles.finish_revert!(file_entries, by: inline_forms_current_user_id)
+        restore_rich_texts_for_reverted_parent!(@parent)
+      end
       @parent.reload
     end
     render_revert_response if row_html_turbo_allowed?
@@ -367,6 +379,39 @@ class InlineFormsController < ApplicationController
 
   private
 
+  # Single-field requests (edit, update, show with an attribute) name the
+  # field and its form element in params, and both are client-controlled.
+  # +load_and_authorize_resource+ only authorizes the record: CanCanCan's
+  # Rule#matches_attributes? passes any attribute-scoped rule when no
+  # attribute is given, so `cannot :update, Client, [:secret]` was never
+  # applied server-side (only the edit link was hidden), and the form
+  # element went straight into `send("#{form_element}_update")`.
+  #
+  # Refuse (400) unless attribute + form_element name a row of the model's
+  # attribute list (as the UI's links do), then authorize the attribute
+  # itself. Renders and returns false when the request is refused.
+  def field_request_permitted?(action)
+    attributes = @inline_forms_attribute_list || @object.inline_forms_attribute_list
+    unless InlineForms.attribute_list_row_for(attributes, @attribute, @form_element)
+      head :bad_request
+      return false
+    end
+    authorize!(action, @object, @attribute.to_sym) if cancan_enabled?
+    true
+  end
+
+  # Uploading over a file that is already in a declared slot is a replace:
+  # the old file goes to the trash, i.e. it is removed. That needs
+  # :replace_file on top of :update (an empty slot only needs :update).
+  def file_replace_permitted?
+    return true unless @form_element.to_s == "simple_file_field"
+    return true unless @object.class.respond_to?(:inline_forms_file_slot?) && @object.class.inline_forms_file_slot?(@attribute)
+    return true unless @object.inline_forms_file_present?(@attribute)
+
+    authorize!(:replace_file, @object, @attribute.to_sym) if cancan_enabled?
+    true
+  end
+
   # Hard-destroy gate. Generated apps restrict destroy to a Devise user with
   # `role?(:superadmin)` (Role model + roles HABTM). Hosts without that role
   # system (e.g. the engine's test/dummy harness, or apps using a different
@@ -380,6 +425,23 @@ class InlineFormsController < ApplicationController
     user.role?(:superadmin)
   end
 
+  # Every reify on the revert path goes through here. +unversioned_attributes:
+  # :preserve+ is essential: PaperTrail's default (+:nil+) sets every column
+  # missing from the version's +object+ -- i.e. each +has_paper_trail skip:+
+  # column, typically file bytes like +data+ -- to nil on the live record, and
+  # the following +save!+ would persist that (filename kept, bytes gone).
+  # +revert_authorization_subject+ reifies the same version first and
+  # +version.item+ is cached, so it must use these options too or it nils the
+  # in-memory record before the real reify runs.
+  def reify_for_revert(version)
+    version.reify(
+      has_many: true,
+      has_and_belongs_to_many: true,
+      belongs_to: true,
+      unversioned_attributes: :preserve
+    )
+  end
+
   # Persist a reified *primary* record (Apartment, Photo, ...) for +revert+.
   #
   # +reify+ on a +destroy+ version returns a record with +new_record? == true+
@@ -392,13 +454,21 @@ class InlineFormsController < ApplicationController
   # photos.id+). Mirror the rich-text upsert (8.1.16): when a row with that PK
   # already exists, copy the reified column values onto it and +save!+ that
   # instead, so reverting is idempotent across repeated delete/undo cycles.
-  def persist_reverted_primary!(object)
+  #
+  # Copy only the columns the version actually stored: a +destroy+ reify is a
+  # fresh +klass.new+, so columns in +has_paper_trail skip:+ (file bytes such
+  # as +data+) are nil on it and must not overwrite the live row's values.
+  def persist_reverted_primary!(object, version)
     klass = object.class
     primary_key = klass.primary_key
 
     if object.new_record? && object.id.present? && klass.exists?(object.id)
       existing = klass.find(object.id)
-      existing.assign_attributes(object.attributes.except(primary_key))
+      versioned = (version.object_deserialized || {}).keys
+      # Declared file slots are never reverted through versions (old version
+      # rows may still carry a filename): the live row keeps its file.
+      versioned -= klass.inline_forms_file_columns if klass.respond_to?(:inline_forms_file_columns)
+      existing.assign_attributes(object.attributes.slice(*versioned).except(primary_key))
       existing.save!
       existing
     else
@@ -442,7 +512,7 @@ class InlineFormsController < ApplicationController
       end
 
     versions_by_name.each_value do |version|
-      reified = version.reify
+      reified = version.reify(unversioned_attributes: :preserve)
       next unless reified
 
       name = reified.name.to_s
@@ -459,11 +529,7 @@ class InlineFormsController < ApplicationController
   # +revert+ is excluded from +load_and_authorize_resource+; +authorize!+ runs in the
   # action. +check_authorization+ on ApplicationController still requires that flag.
   def revert_authorization_subject(version)
-    reified = version.reify(
-      has_many: true,
-      has_and_belongs_to_many: true,
-      belongs_to: true
-    )
+    reified = reify_for_revert(version)
     if defined?(ActionText::RichText) && reified.is_a?(ActionText::RichText)
       return reified.record
     end

data/app/helpers/inline_forms_file_trash_helper.rb

@@ -0,0 +1,131 @@
+# -*- encoding : utf-8 -*-
+
+# View helpers for declared file slots (InlineForms::StoredFiles): the field's
+# file actions, the per-record trash panel and file events in the versions
+# history. Every permission check fails closed: with CanCan on, nothing is
+# offered unless the Ability grants it.
+module InlineFormsFileTrashHelper
+  # True when +attribute+ is a declared slot AND the host routed the file
+  # actions for this resource (InlineForms.file_routes). Without the routes
+  # the field renders exactly as before (legacy download link, no actions).
+  def inline_forms_file_slot_active?(object, attribute)
+    klass = object.class
+    klass.respond_to?(:inline_forms_file_slot?) &&
+      klass.inline_forms_file_slot?(attribute) &&
+      object.persisted? &&
+      respond_to?("download_file_#{object.model_name.singular_route_key}_path")
+  end
+
+  def inline_forms_file_can?(action, object, attribute = nil)
+    return true if inline_forms_cancan_off?
+
+    attribute ? can?(action, object, attribute.to_sym) : can?(action, object)
+  end
+
+  # Declared, routed slots among the rows of the attribute list being shown
+  # (a Client tab shows only its own slots).
+  def inline_forms_file_trash_slots(object, attributes = nil)
+    attributes ||= @inline_forms_attribute_list || object.inline_forms_attribute_list
+    attributes.filter_map do |attribute, form_element, *|
+      next unless form_element.to_s == "simple_file_field"
+      next unless inline_forms_file_slot_active?(object, attribute)
+      next unless inline_forms_file_can?(:read_file_trash, object, attribute)
+
+      attribute.to_s
+    end
+  end
+
+  # Menu link to the global trash page, for hosts with their own header.
+  # Renders nothing unless the routes exist and the user may read all trash.
+  def link_to_inline_forms_file_trash(label = nil, **options)
+    return unless respond_to?(:inline_forms_file_trash_path)
+    return unless inline_forms_cancan_off? || can?(:read_file_trash, :all)
+
+    link_to(label || t("inline_forms.files.global.title"), inline_forms_file_trash_path, options)
+  end
+
+  # cancan_disabled? is a helper of the engine's controllers only; a layout
+  # rendered by any other controller still has CanCan's can? when CanCan is on.
+  def inline_forms_cancan_off?
+    return cancan_disabled? if respond_to?(:cancan_disabled?)
+
+    !respond_to?(:can?)
+  end
+
+  def inline_forms_file_field_frame_id(object, attribute)
+    "#{object.class.name.underscore}_#{object.id}_#{attribute}"
+  end
+
+  def inline_forms_file_trash_turbo_frame_id(object)
+    "#{inline_forms_row_turbo_frame_id(object)}_file_trash"
+  end
+
+  def inline_forms_file_size(bytes)
+    bytes ? number_to_human_size(bytes) : ""
+  end
+
+  # Icon-only link: the label goes to title and aria-label, the icon is
+  # hidden from assistive tech.
+  def inline_forms_file_icon_link(icon, label, path, options = {})
+    options = options.merge(title: label, "aria-label": label)
+    link_to tag.i(class: icon, "aria-hidden": "true"), path, options
+  end
+
+  # data-* for a POST link that answers with turbo streams (field, trash
+  # panel and versions frames are replaced together), with a confirm dialog.
+  def inline_forms_file_post_data(frame_id, confirm: nil)
+    data = inline_forms_turbo_link_data(frame_id, method: :post, turbo_stream: true)
+    data[:data][:turbo_confirm] = confirm if confirm
+    data
+  end
+
+  def inline_forms_file_retention_days
+    retention = InlineForms.file_trash_retention
+    retention && (retention / 1.day).round
+  end
+
+  def inline_forms_file_user_name(id)
+    return t("inline_forms.files.by_system") if id.blank?
+
+    version_modified_by(id)
+  rescue StandardError
+    id.to_s
+  end
+
+  # The filename to show for a trash row (a redacted row shows a label).
+  def inline_forms_file_entry_name(entry)
+    entry.redacted? ? t("inline_forms.files.redacted_name") : entry.filename.to_s
+  end
+
+  # Newest restorable trash entry for each slot, keyed by attribute name.
+  def inline_forms_restorable_file_entries(object, slots)
+    return {} if slots.empty?
+
+    InlineForms::TrashedFile.without_data.for_record(object).where(attribute_name: slots)
+      .restorable.newest_first.each_with_object({}) do |entry, by_slot|
+        by_slot[entry.attribute_name] ||= entry
+      end
+  end
+
+  # The versions history: PaperTrail versions (inline_forms_versions_for,
+  # which hosts may override) plus file events from the trash table, each
+  # entry carrying :at for sorting. File events show only to users who may
+  # read the trash.
+  def inline_forms_history_for(object)
+    entries = inline_forms_versions_for(object).map { |entry| entry.merge(at: entry[:version].created_at) }
+    entries.concat(inline_forms_file_history_entries(object))
+    entries.sort_by { |entry| entry[:at] }
+  end
+
+  def inline_forms_file_history_entries(object)
+    slots = inline_forms_file_trash_slots(object)
+    return [] if slots.empty?
+
+    InlineForms::TrashedFile.without_data.for_record(object).where(attribute_name: slots).flat_map do |row|
+      events = [ { kind: :file, file_event: row.reason.to_sym, at: row.trashed_at, by: row.trashed_by_id, entry: row } ]
+      events << { kind: :file, file_event: :restored, at: row.restored_at, by: row.restored_by_id, entry: row } if row.restored?
+      events << { kind: :file, file_event: :purged, at: row.purged_at, by: row.purged_by_id, entry: row } if row.purged?
+      events
+    end
+  end
+end

data/app/helpers/inline_forms_helper.rb

@@ -397,7 +397,11 @@ module InlineFormsHelper
   def version_modified_by(id)
     return "Unknown" if id.blank?
 
-    user_class = Devise.mappings[:users]&.to
+    # Devise keys mappings by the singular scope (`devise_for :users` ->
+    # :user); the old `[:users]` lookup never matched, so every name was
+    # "Unknown".
+    mapping = Devise.mappings[:user] || Devise.mappings[:users] || Devise.mappings.values.first
+    user_class = mapping&.to
     return "Unknown" unless user_class
 
     user = user_class.find_by(id: id)

data/app/models/concerns/inline_forms/stored_files.rb

@@ -0,0 +1,350 @@
+# -*- encoding : utf-8 -*-
+
+require "digest"
+
+# Declared file slots for :simple_file_field: raw bytes in the record's own
+# table (a binary/LONGBLOB column), with a content-type and a filename column.
+# Replaces the hand-written `<attr>=` setters hosts used to write per model.
+#
+#   class Client < ApplicationRecord
+#     include InlineForms::StoredFiles
+#     inline_forms_file :filename                    # data / content_type
+#     inline_forms_file :begeleidingsplan_filename   # begeleidingsplan_data / _content_type
+#     inline_forms_file :manual, data: :manual_bytes # explicit column names
+#   end
+#
+# Column names default from the attribute: `filename` -> `data` and
+# `content_type`; `<base>_filename` and any other `<base>` -> `<base>_data` and
+# `<base>_content_type`.
+#
+# What a declared slot gets:
+# * a setter that accepts an uploaded file (ignores nil, like the hand-written
+#   ones; a String is a plain filename write for seeds/console code). The
+#   setter lives in a prepended module, so it wins over a `def <attr>=` in the
+#   class body regardless of order -- and such a def raises outside
+#   production, because it would be dead code that looks live.
+# * replace = the old bytes go to the trash (InlineForms::TrashedFile) in the
+#   same transaction as the save; remove/restore/purge never lose bytes except
+#   through an explicit purge or the retention sweep.
+# * the three slot columns are added to PaperTrail's `skip:` (whichever order
+#   `has_paper_trail` and `inline_forms_file` run in): file history lives in
+#   the trash table, never in `versions`, so a revert never touches a file.
+# * destroying the record trashes its files first (reason record_destroyed);
+#   reverting that destroy brings them back.
+#
+# Requires the `inline_forms_trashed_files` table (`rails g
+# inline_forms:file_trash`). Models without `inline_forms_file` are untouched.
+module InlineForms::StoredFiles
+  extend ActiveSupport::Concern
+
+  class HandWrittenSetterError < StandardError; end
+
+  # Strips any client path (IE sends C:\...\x.pdf) and replaces everything
+  # but word characters, dots and dashes -- the rule StProject's hand-written
+  # setters used, so existing filenames keep their shape.
+  def self.sanitize_filename(name)
+    name.to_s.split(/[\\\/]/).last.to_s.gsub(/[^\w.\-]/, "_")
+  end
+
+  # Revert support (InlineFormsController#revert), called before the reified
+  # record is saved, inside the revert's transaction. Returns the trash
+  # entries to mark restored after the save (finish_revert!).
+  #
+  # * revert of an update (record persisted): put the slot columns back to
+  #   their DB values -- a pre-adoption version row may still carry an old
+  #   filename, and must not land on the current bytes.
+  # * undo of a destroy (row gone): copy each slot's newest restorable
+  #   record_destroyed entry onto the record BEFORE the save, so presence
+  #   validations on the filename pass; a slot whose file was purged in the
+  #   meantime comes back empty (never a name without bytes).
+  # * row exists already (replayed undo): nothing; persist_reverted_primary!
+  #   leaves the slot columns alone.
+  def self.prepare_revert!(record)
+    klass = record.class
+    return [] unless klass.respond_to?(:inline_forms_file_slots) && klass.inline_forms_file_slots.any?
+
+    if record.persisted?
+      record.restore_attributes(klass.inline_forms_file_columns)
+      return []
+    end
+    return [] if record.id.nil? || klass.unscoped.exists?(klass.primary_key => record.id)
+
+    klass.inline_forms_file_slots.filter_map do |attribute, slot|
+      entry = InlineForms::TrashedFile.lock.for_slot(record, attribute)
+                .where(reason: "record_destroyed").restorable.newest_first.first
+      if entry
+        record.send(:write_attribute, slot[:data], entry.data)
+        record.send(:write_attribute, attribute.to_s, entry.filename)
+        record.send(:write_attribute, slot[:content_type], entry.content_type)
+      else
+        [ slot[:data], attribute.to_s, slot[:content_type] ].each { |column| record.send(:write_attribute, column, nil) }
+      end
+      entry
+    end
+  end
+
+  # Marks the entries prepare_revert! put back as restored. Raises (rolling
+  # the revert back) if one was purged or restored concurrently.
+  def self.finish_revert!(entries, by: nil)
+    entries.each do |entry|
+      now = Time.current
+      count = InlineForms::TrashedFile.where(id: entry.id).restorable
+                .update_all(data: nil, restored_at: now, restored_by_id: by, updated_at: now)
+      raise InlineForms::TrashedFile::NotRestorable, "file #{entry.id} changed during revert" unless count == 1
+    end
+  end
+
+  # Re-merges the slot columns into PaperTrail's skip list when
+  # `has_paper_trail` runs after `inline_forms_file` (it replaces the options).
+  module PaperTrailSkipHook
+    def has_paper_trail(*args, **kwargs, &block)
+      result = super
+      inline_forms_merge_paper_trail_skip!
+      result
+    end
+  end
+
+  included do
+    class_attribute :inline_forms_file_slots, instance_writer: false, default: {}.freeze
+
+    validate :inline_forms_validate_staged_files
+    before_save :inline_forms_trash_replaced_files
+    after_save :inline_forms_record_uploaded_files
+    before_destroy :inline_forms_trash_files_on_destroy, prepend: true
+
+    singleton_class.prepend(PaperTrailSkipHook)
+  end
+
+  class_methods do
+    def inline_forms_file(attribute, data: nil, content_type: nil)
+      attribute = attribute.to_sym
+      defaults = InlineForms.file_slot_columns(attribute)
+      data ||= defaults[:data]
+      content_type ||= defaults[:content_type]
+      slot = { data: data.to_s, content_type: content_type.to_s }.freeze
+      self.inline_forms_file_slots = inline_forms_file_slots.merge(attribute => slot).freeze
+
+      inline_forms_file_setters.define_method("#{attribute}=") do |value|
+        inline_forms_assign_file(attribute, value) { super(value) }
+      end
+
+      inline_forms_hand_written_setter!(attribute) if method_defined?(:"#{attribute}=", false)
+      inline_forms_merge_paper_trail_skip!
+      attribute
+    end
+
+    def inline_forms_file_slot?(attribute)
+      inline_forms_file_slots.key?(attribute.to_s.to_sym)
+    end
+
+    def inline_forms_file_slot(attribute)
+      inline_forms_file_slots.fetch(attribute.to_s.to_sym) do
+        raise ArgumentError, "#{name}##{attribute} is not a declared file slot (inline_forms_file)"
+      end
+    end
+
+    # All slot columns (filename, data, content_type of every slot), strings.
+    def inline_forms_file_columns
+      inline_forms_file_slots.flat_map { |attribute, slot| [ attribute.to_s, slot[:data], slot[:content_type] ] }
+    end
+
+    def inline_forms_merge_paper_trail_skip!
+      return unless respond_to?(:paper_trail_options) && paper_trail_options.is_a?(Hash)
+
+      skip = Array(paper_trail_options[:skip]).map(&:to_s)
+      missing = inline_forms_file_columns - skip
+      return if missing.empty?
+
+      # Assign a new hash on this class: the options may be inherited from
+      # ApplicationRecord (generated apps call has_paper_trail there), and
+      # mutating that shared hash would skip these columns on every model.
+      self.paper_trail_options = paper_trail_options.merge(skip: skip + missing)
+    end
+
+    def method_added(name)
+      super
+      return unless name.to_s.end_with?("=")
+
+      attribute = name.to_s.delete_suffix("=").to_sym
+      inline_forms_hand_written_setter!(attribute) if inline_forms_file_slot?(attribute)
+    end
+
+    private
+
+    def inline_forms_file_setters
+      @inline_forms_file_setters ||= Module.new.tap { |setters| prepend(setters) }
+    end
+
+    def inline_forms_hand_written_setter!(attribute)
+      message = "#{name} defines its own `#{attribute}=` but #{attribute} is a declared file slot " \
+                "(inline_forms_file); remove the hand-written setter (and its sanitize_filename) -- " \
+                "the slot's setter replaces it."
+      raise HandWrittenSetterError, message unless defined?(Rails) && Rails.env.production?
+
+      Rails.logger&.warn("inline_forms: #{message}")
+    end
+  end
+
+  # ---- reading --------------------------------------------------------------
+
+  def inline_forms_file_present?(attribute)
+    self[attribute.to_s].present?
+  end
+
+  # { data:, filename:, type: } read fresh from the DB, or nil when the slot
+  # holds no bytes (an empty slot must 404, never send an empty file).
+  def inline_forms_file_download(attribute)
+    slot = self.class.inline_forms_file_slot(attribute)
+    row = inline_forms_file_row(slot, attribute)
+    return nil if row.nil? || row[0].nil?
+
+    { data: row[0], filename: row[1].presence || "download", type: row[2].presence || "application/octet-stream" }
+  end
+
+  # ---- writing --------------------------------------------------------------
+
+  # The edit form was submitted without a file: fail validation so the user
+  # sees "no file chosen" instead of a silent no-op.
+  def inline_forms_file_missing!(attribute)
+    inline_forms_file_errors[attribute.to_sym] = [ :inline_forms_file_missing ]
+  end
+
+  # Moves the current file to the trash and clears the slot. Returns the
+  # trash entry, or nil when the slot was already empty (double click, stale
+  # page). Writes with update_columns: an unrelated invalid column on an old
+  # record must not block taking a wrong file out.
+  def inline_forms_remove_file!(attribute, by: InlineForms::Current.user_id, reason: :removed)
+    slot = self.class.inline_forms_file_slot(attribute)
+    self.class.transaction do
+      row = inline_forms_file_row(slot, attribute, lock: true)
+      if row && (row[0] || row[1].present?)
+        entry = InlineForms::TrashedFile.trash!(
+          record: self, attribute: attribute, data: row[0], filename: row[1],
+          content_type: row[2], reason: reason, by: by
+        )
+        inline_forms_write_slot!(slot, attribute, nil, nil, nil)
+        entry
+      end
+    end
+  end
+
+  # Writes bytes into the slot directly (restore, revert of a destroy). A file
+  # already in the slot goes to the trash first. Caller holds the row lock.
+  def inline_forms_put_file!(attribute, data:, filename:, content_type:, by: InlineForms::Current.user_id)
+    slot = self.class.inline_forms_file_slot(attribute)
+    current = inline_forms_file_row(slot, attribute)
+    if current && current[0]
+      InlineForms::TrashedFile.trash!(
+        record: self, attribute: attribute, data: current[0], filename: current[1],
+        content_type: current[2], reason: :replaced, by: by
+      )
+    end
+    inline_forms_write_slot!(slot, attribute, data, filename, content_type)
+  end
+
+  private
+
+  def inline_forms_staged_files
+    @inline_forms_staged_files ||= {}
+  end
+
+  def inline_forms_file_errors
+    @inline_forms_file_errors ||= {}
+  end
+
+  # The setter body. Yields for a String (a plain attribute write).
+  def inline_forms_assign_file(attribute, value)
+    return if value.nil?
+    return yield if value.is_a?(String)
+
+    unless value.respond_to?(:read) && value.respond_to?(:original_filename)
+      inline_forms_file_errors[attribute] = [ :invalid ]
+      return
+    end
+
+    bytes = value.read.to_s.b
+    value.rewind if value.respond_to?(:rewind)
+    max = InlineForms.max_file_size
+    if max && bytes.bytesize > max
+      inline_forms_file_errors[attribute] = [ :inline_forms_file_too_large, { count: max / 1.megabyte } ]
+      return
+    end
+
+    inline_forms_file_errors.delete(attribute)
+    slot = self.class.inline_forms_file_slot(attribute)
+    write_attribute(slot[:data], bytes)
+    write_attribute(slot[:content_type], value.respond_to?(:content_type) ? value.content_type.to_s.presence : nil)
+    write_attribute(attribute, InlineForms::StoredFiles.sanitize_filename(value.original_filename))
+    inline_forms_staged_files[attribute] = { checksum: Digest::SHA256.hexdigest(bytes), byte_size: bytes.bytesize }
+  end
+
+  def inline_forms_validate_staged_files
+    inline_forms_file_errors.each do |attribute, (type, options)|
+      errors.add(attribute, type, **(options || {}))
+    end
+  end
+
+  # before_save, inside the save's transaction: the file being replaced goes
+  # to the trash. Read from the DB under a row lock (not from memory, which
+  # may be stale). An identical re-upload changes nothing and is not logged.
+  def inline_forms_trash_replaced_files
+    return if new_record? || inline_forms_staged_files.empty?
+
+    inline_forms_staged_files.each do |attribute, staged|
+      slot = self.class.inline_forms_file_slot(attribute)
+      old = inline_forms_file_row(slot, attribute, lock: true)
+      next if old.nil? || old[0].nil?
+
+      if Digest::SHA256.hexdigest(old[0]) == staged[:checksum]
+        staged[:unchanged] = true
+        next
+      end
+      InlineForms::TrashedFile.trash!(
+        record: self, attribute: attribute, data: old[0], filename: old[1],
+        content_type: old[2], reason: :replaced, by: InlineForms::Current.user_id
+      )
+    end
+  end
+
+  def inline_forms_record_uploaded_files
+    staged = inline_forms_staged_files
+    @inline_forms_staged_files = {}
+    staged.each do |attribute, info|
+      next if info[:unchanged]
+
+      slot = self.class.inline_forms_file_slot(attribute)
+      InlineForms::TrashedFile.record_upload!(
+        record: self, attribute: attribute, filename: self[attribute.to_s],
+        content_type: self[slot[:content_type]], byte_size: info[:byte_size],
+        checksum: info[:checksum], by: InlineForms::Current.user_id
+      )
+    end
+  end
+
+  def inline_forms_trash_files_on_destroy
+    self.class.inline_forms_file_slots.each do |attribute, slot|
+      data = attribute_in_database(slot[:data])
+      next if data.nil?
+
+      InlineForms::TrashedFile.trash!(
+        record: self, attribute: attribute, data: data,
+        filename: attribute_in_database(attribute.to_s),
+        content_type: attribute_in_database(slot[:content_type]),
+        reason: :record_destroyed, by: InlineForms::Current.user_id
+      )
+    end
+  end
+
+  # [data, filename, content_type] from the DB, or nil when the row is gone.
+  def inline_forms_file_row(slot, attribute, lock: false)
+    scope = self.class.unscoped.where(self.class.primary_key => id)
+    scope = scope.lock if lock
+    scope.pluck(slot[:data], attribute.to_s, slot[:content_type]).first
+  end
+
+  def inline_forms_write_slot!(slot, attribute, data, filename, content_type)
+    columns = { slot[:data] => data, attribute.to_s => filename, slot[:content_type] => content_type }
+    columns["updated_at"] = Time.current if has_attribute?(:updated_at)
+    update_columns(columns)
+  end
+end

data/app/models/inline_forms/current.rb

@@ -0,0 +1,8 @@
+# -*- encoding : utf-8 -*-
+
+# Per-request actor for model-level file bookkeeping (InlineForms::StoredFiles
+# records who uploaded / removed / replaced a file). Set by the engine's
+# controllers; nil in the console, seeds and the retention sweep.
+class InlineForms::Current < ActiveSupport::CurrentAttributes
+  attribute :user_id
+end