inline_forms 8.1.47 → 8.1.53

data/test/dummy/app/models/ability.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+# Grants everything (the generated superadmin branch). A test narrows it by
+# setting Ability.restrictions to a block of `cannot` rules, evaluated after
+# the grant so they win; InlineFormsIntegrationTestCase resets it.
+class Ability
+  include CanCan::Ability
+
+  cattr_accessor :restrictions
+
+  def initialize(_user)
+    can :manage, :all
+    instance_exec(&restrictions) if restrictions
+  end
+end

data/test/dummy/app/models/document.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+# Declared file slots (InlineForms::StoredFiles), shaped like StProject's
+# Client: two slots with the default column naming (`filename` -> data /
+# content_type, `plan_filename` -> plan_data / plan_content_type). An
+# ApplicationRecord subclass on purpose: has_paper_trail is inherited, so the
+# slot columns' skip must be set on Document without leaking to Widget.
+# See test/integration/file_slots_test.rb.
+class Document < ApplicationRecord
+  include InlineForms::StoredFiles
+
+  inline_forms_file :filename
+  inline_forms_file :plan_filename
+
+  # StProject's Attachment/Incident/Zorgformulier validate the filename; a
+  # test switches this on to prove undo-of-destroy puts files back BEFORE save.
+  cattr_accessor :require_filename, default: false
+  validates :filename, presence: true, if: -> { self.class.require_filename }
+
+  validates :title, presence: true
+
+  def _presentation
+    "#{title}"
+  end
+
+  def inline_forms_attribute_list
+    @inline_forms_attribute_list ||= [
+      [ :title, :text_field ],
+      [ :filename, :simple_file_field ],
+      [ :plan_filename, :simple_file_field ]
+    ]
+  end
+end

data/test/dummy/app/models/dossier.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+# Models StProject's Client/Attachment: file bytes stored in a binary column
+# that is excluded from PaperTrail (`skip:`), filename kept versioned. Reverting
+# an unrelated edit must not touch `data`. See
+# test/integration/revert_skipped_columns_test.rb.
+#
+# Not an ApplicationRecord: that already calls has_paper_trail, which PaperTrail
+# allows only once per hierarchy. StProject likewise declares it per model, so
+# this repeats the rest of the ApplicationRecord host contract inline.
+class Dossier < ActiveRecord::Base
+  include InlineForms::Searchable
+
+  has_paper_trail on: [ :create, :update, :destroy ], skip: [ :data ]
+
+  attr_writer :inline_forms_attribute_list
+
+  self.per_page = 7
+
+  scope :inline_forms_list, -> { order(:name, :id) }
+
+  validates :name, presence: true
+
+  def self.not_accessible_through_html?
+    false
+  end
+
+  def _presentation
+    "#{name}"
+  end
+
+  def inline_forms_attribute_list
+    @inline_forms_attribute_list ||= [
+      [ :name, :text_field ],
+      [ :data_filename, :info ]
+    ]
+  end
+end

data/test/dummy/config/application.rb

@@ -2,9 +2,10 @@
 
 # Minimal host app for the engine's integration tests (test/integration/).
 # Boots the inline_forms engine against an in-memory SQLite database with the
-# host-side gems the engine expects (will_paginate, paper_trail, turbo-rails)
-# but without Devise, CanCanCan, Sprockets or ActionText: authorization is
-# optional in the engine (cancan_enabled? rescues NameError), tests drive the
+# host-side gems the engine expects (will_paginate, paper_trail, turbo-rails,
+# cancancan) but without Devise, Sprockets or ActionText. CanCanCan is on so
+# load_and_authorize_resource and the attribute-level checks run; the dummy
+# Ability grants everything unless a test narrows it. Tests drive the
 # UI through Turbo-Frame requests (the frame layout never renders the
 # current_user header), and the asset-precompile initializer skips hosts
 # without a pipeline.

data/test/dummy/config/routes.rb

@@ -25,6 +25,19 @@ Rails.application.routes.draw do
     get "list_versions", on: :member
   end
 
+  resources :dossiers do
+    post "revert", on: :member
+    get "list_versions", on: :member
+  end
+
+  resources :documents do
+    post "revert", on: :member
+    get "list_versions", on: :member
+    InlineForms.file_routes(self)
+  end
+
+  InlineForms.draw_file_trash_routes(self)
+
   get "stats", to: "stats#show"
 
   # Schema-change GUI (opt-in in real installs; routed here for the engine's

data/test/inline_forms_addto_generator_test.rb

@@ -386,6 +386,53 @@ class InlineFormsAddtoGeneratorTest < Minitest::Test
     teardown_sqlite
   end
 
+  def test_simple_file_field_adds_a_declared_slot_columns_and_routes
+    write_model("widget.rb", GENERATOR_SHAPED_MODEL)
+    mkdir_p("config")
+    File.write(File.join(@destination_root, "config/routes.rb"), <<~RUBY)
+      Rails.application.routes.draw do
+        resources :widgets do
+          post 'revert', :on => :member
+          get 'list_versions', :on => :member
+        end
+      end
+    RUBY
+
+    capture_io { run_generator("Widget", "manual:simple_file_field") }
+    capture_io { run_generator("Widget", "plan_filename:simple_file_field") }
+
+    model = read("app/models/widget.rb")
+    assert_equal(1, model.scan("include InlineForms::StoredFiles").size)
+    assert_includes(model, "inline_forms_file :manual")
+    assert_includes(model, "inline_forms_file :plan_filename")
+    assert_operator(model.index("include InlineForms::StoredFiles"), :<, model.index("inline_forms_file :manual"))
+    assert_operator(model.index("include InlineForms::StoredFiles"), :<, model.index("inline_forms_file :plan_filename"))
+    assert_includes(model, "[ :manual, :simple_file_field ]")
+    routes = read("config/routes.rb")
+    assert_equal(1, routes.scan("InlineForms.file_routes(self)").size)
+    assert_match(/resources :widgets do\n\s+InlineForms\.file_routes\(self\)/, routes)
+
+    migration_file = Dir.glob(File.join(@destination_root, "db/migrate/*_inline_forms_add_to_widgets_*.rb")).min
+    conn = apply_migration_to_memory_sqlite(migration_file, tables: %i[widgets])
+    %i[manual manual_data manual_content_type].each do |column|
+      assert(conn.column_exists?(:widgets, column), "#{column} should exist after migrate")
+    end
+  ensure
+    teardown_sqlite
+  end
+
+  def test_simple_file_field_without_a_resource_block_reminds_about_routes
+    write_model("widget.rb", GENERATOR_SHAPED_MODEL)
+    mkdir_p("config")
+    File.write(File.join(@destination_root, "config/routes.rb"), "Rails.application.routes.draw do\n  MODELS.each { |m| resources m }\nend\n")
+
+    stdout, = capture_io { run_generator("Widget", "manual:simple_file_field") }
+
+    assert_includes(read("app/models/widget.rb"), "inline_forms_file :manual")
+    refute_includes(read("config/routes.rb"), "file_routes")
+    assert_includes(stdout, "InlineForms.file_routes(self)")
+  end
+
   private
 
   def run_generator(*args)

data/test/inline_forms_generator_test.rb

@@ -171,6 +171,30 @@ class InlineFormsGeneratorTest < Minitest::Test
     assert_includes(migration, "t.text :description")
   end
 
+  def test_simple_file_field_declares_a_file_slot_with_its_columns_and_routes
+    run_generator("Folder", "title:string", "plan_filename:simple_file_field", "_enabled:yes")
+
+    model = read("app/models/folder.rb")
+    routes = read("config/routes.rb")
+    migration = read_single_migration_for("folders")
+
+    assert_includes(model, "include InlineForms::StoredFiles")
+    assert_includes(model, "inline_forms_file :plan_filename")
+    assert_operator(model.index("include InlineForms::StoredFiles"), :<, model.index("inline_forms_file :plan_filename"))
+    assert_includes(model, "[ :plan_filename, :simple_file_field ]")
+    assert_includes(migration, "t.string :plan_filename")
+    assert_includes(migration, "t.binary :plan_data")
+    assert_includes(migration, "t.string :plan_content_type")
+    assert_includes(routes, "InlineForms.file_routes(self)")
+  end
+
+  def test_no_file_routes_without_a_file_field
+    run_generator("Thing", "name:string", "_enabled:yes")
+
+    refute_includes(read("config/routes.rb"), "file_routes")
+    refute_includes(read("app/models/thing.rb"), "StoredFiles")
+  end
+
   private
 
   def build_destination_skeleton!

data/test/integration/field_authorization_test.rb

@@ -0,0 +1,131 @@
+# frozen_string_literal: true
+
+require_relative "../integration_test_helper"
+
+# Server-side guard on the single-field actions (edit / update / show with an
+# attribute). The UI only hides the edit link for an attribute the user may
+# not update; before 8.1.48 a hand-made request still went through, because
+# load_and_authorize_resource authorizes the record only (CanCanCan passes
+# attribute-scoped rules when no attribute is given) and `form_element` was
+# dispatched as `send("#{form_element}_update")` unchecked.
+class FieldAuthorizationTest < InlineFormsIntegrationTestCase
+  setup do
+    @widget = Widget.create!(name: "Alpha", accent: "#112233")
+    @frame = "widget_#{@widget.id}_accent"
+  end
+
+  def patch_field(attribute, form_element, params = {})
+    patch widget_path(@widget, attribute: attribute, form_element: form_element,
+                               update: "widget_#{@widget.id}_#{attribute}"),
+          params: params, headers: frame_headers("widget_#{@widget.id}_#{attribute}")
+  end
+
+  test "the dummy runs with CanCanCan enabled" do
+    assert InlineFormsController.cancan_enabled?
+  end
+
+  test "crafted PATCH on an attribute-scoped `cannot :update` is refused" do
+    Ability.restrictions = -> { cannot :update, Widget, [ :accent ] }
+
+    patch_field "accent", "color_field", accent: "#ff0000"
+
+    assert_response :forbidden
+    assert_equal "#112233", @widget.reload.accent
+  end
+
+  test "other attributes of the same record stay updatable" do
+    Ability.restrictions = -> { cannot :update, Widget, [ :accent ] }
+
+    patch_field "name", "text_field", name: "Renamed"
+
+    assert_response :success
+    assert_equal "Renamed", @widget.reload.name
+  end
+
+  test "an attribute-scoped `can :update` only covers the listed attributes" do
+    Ability.restrictions = lambda do
+      cannot :update, Widget
+      can :update, Widget, [ :name ]
+    end
+
+    patch_field "accent", "color_field", accent: "#ff0000"
+    assert_response :forbidden
+    assert_equal "#112233", @widget.reload.accent
+
+    patch_field "name", "text_field", name: "Renamed"
+    assert_response :success
+    assert_equal "Renamed", @widget.reload.name
+  end
+
+  test "edit of a `cannot :update` attribute is refused" do
+    Ability.restrictions = -> { cannot :update, Widget, [ :accent ] }
+
+    get edit_widget_path(@widget, attribute: "accent", form_element: "color_field", update: @frame),
+        headers: frame_headers(@frame)
+
+    assert_response :forbidden
+  end
+
+  test "single-field show of a `cannot :read` attribute is refused" do
+    Ability.restrictions = -> { cannot :read, Widget, [ :accent ] }
+
+    get widget_path(@widget, attribute: "accent", form_element: "color_field", update: @frame),
+        headers: frame_headers(@frame)
+
+    assert_response :forbidden
+  end
+
+  test "a form_element that does not match the attribute's row is rejected" do
+    patch_field "accent", "text_field", accent: "not a color"
+
+    assert_response :bad_request
+    assert_equal "#112233", @widget.reload.accent
+  end
+
+  test "an unknown form_element is rejected before it is dispatched" do
+    patch_field "name", "nonexistent", name: "Renamed"
+
+    assert_response :bad_request
+    assert_equal "Alpha", @widget.reload.name
+  end
+
+  test "an attribute outside the attribute list is rejected" do
+    patch_field "kind_id", "text_field", kind_id: "42"
+
+    assert_response :bad_request
+    assert_nil @widget.reload.kind_id
+  end
+
+  test "missing attribute or form_element is rejected" do
+    patch widget_path(@widget, update: @frame), params: { name: "x" }, headers: frame_headers(@frame)
+    assert_response :bad_request
+
+    get edit_widget_path(@widget, attribute: "name", update: @frame), headers: frame_headers(@frame)
+    assert_response :bad_request
+  end
+
+  test "show cannot be used to send an arbitrary method to the record" do
+    get widget_path(@widget, attribute: "destroy", form_element: "has_one", update: @frame),
+        headers: frame_headers(@frame)
+
+    assert_response :bad_request
+    assert Widget.exists?(@widget.id)
+  end
+
+  test "a delegating element's link name (plain_text_area -> plain_text) is accepted" do
+    patch_field "notes", "plain_text", notes: "Long enough notes"
+
+    assert_response :success
+    assert_equal "Long enough notes", @widget.reload.notes
+  end
+
+  test "attribute_list_row_for honours the declared element and its delegate only" do
+    list = Widget.new.inline_forms_attribute_list
+
+    assert_equal [ :notes, :plain_text_area ], InlineForms.attribute_list_row_for(list, "notes", "plain_text_area")
+    assert_equal [ :notes, :plain_text_area ], InlineForms.attribute_list_row_for(list, "notes", "plain_text")
+    assert_nil InlineForms.attribute_list_row_for(list, "notes", "rich_text")
+    assert_nil InlineForms.attribute_list_row_for(list, "name", nil)
+    assert_nil InlineForms.attribute_list_row_for(list, nil, "text_field")
+  end
+end