inline_forms 8.1.53 → 8.1.56

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 698cbe91c323804016404aed86eda2e03d171b2a5df33ab775d3cca68f3d4341
-  data.tar.gz: 7ea3231464409d606c023f4b34aeeb2212d293abeaefc7a876e5ec488f6dcc8b
+  metadata.gz: 7ecd64e62be7265a5989cc6012533cdac80dbd62f82ab8b009c17bd4c12343dd
+  data.tar.gz: fb677f7996a52a2a8d571f65264f22225a9ff9ed8c451657a2ac59c268d396d5
 SHA512:
-  metadata.gz: b2c7081ad209dcb79cc50ffa9cd61eaa920a9e44b609d4460a70df0aecfc65532ade283e4335836d0f824714e76107aa888931992d52f777e96868a28336ca4b
-  data.tar.gz: 0b7dc0db8f243a6d06467fa353d423252a97c8c33b14940f24264c99aa3d851253d8580a78e2ce0265d856925ae06753da1cb1d8b793c6716014262b03e093eb
+  metadata.gz: a5d4ed8bbb6569904df70ebbbd30b57c4847bb478088dfe70419363c58caf11d19dc6dfb5c67da2fbdaad8a85555c5b74b68847d19484f272d7c5fcbebcc30cf
+  data.tar.gz: a5b41fd5b309e7fd73bec6c652609f775493c1b3efdf977d3aed1503c6e6656d4e8d7e695bac99ca751b914bb2a47be64bdb244233820253d2426e87240515ee

data/CHANGELOG.md

@@ -4,6 +4,61 @@ All notable changes to this project are documented in this file.
 
 ## [Unreleased]
 
+## [8.1.56] - 2026-10-05
+
+### Fixed
+
+- **HTML requests the engine refuses get an explicit answer instead of falling through to implicit rendering.** Several `InlineFormsController` actions registered `format.html` only behind a guard, or registered it with a block that rendered nothing on the refused path. Rails then rendered implicitly: `ActionController::MissingExactTemplate` (a 500 for browser requests), `UnknownFormat` (406) or a bare 204. That meant error pages and exception-notifier noise. StProject hit it as a 500 on `GET /dagrapportages` by a normal user: `Dagrapportage` is `not_accessible_through_html?` and only exists nested in a Client tab. Now:
+  - `index` of a `not_accessible_through_html?` model without `parent_class` → **404**. The resource has no top-level page.
+  - `new`, `create`, row `show`, `destroy`, `soft_delete`, `soft_restore` and `revert` without the frame context the gem needs (`update`, plus `parent_class` or a nested row frame for `not_accessible_through_html?` models) → **400**. The request is malformed for this UI rather than aimed at a missing resource, so 400 rather than 404. A guard that does not match the request is a refusal of the request.
+  - `destroy` by a user who may not hard-destroy (`destroy_permitted?`, i.e. not superadmin) → **403**, the same answer `revert` already gave. It used to render nothing.
+  - `create`, `destroy`, `soft_delete`, `soft_restore` and `revert` now refuse **before writing**. Before, `create` saved the record, and `destroy`/`revert` changed data, and only then failed to respond.
+  - The refusals happen after `load_and_authorize_resource` / `authorize!`, so a host's CanCan `check_authorization` stays satisfied. The working paths are unchanged, including the turbo_stream responses (open-after-create, revert), nested lists, forms and rows, and accessible models' lists and rows.
+- **File-slot actions under `check_authorization`.** `file_slot_request_permitted?` answered 400 for an unlisted attribute before any `authorize!`, so a host with CanCan's `check_authorization` raised `CanCan::AuthorizationNotPerformed` (500) instead. It now authorizes the record first, then the attribute.
+
+### Tests
+
+- `test/integration/html_refusal_test.rb`, using new dummy model `DailyReport` (a `not_accessible_through_html?` child of `Machine`):
+  - top-level index → 404; show, new and revert without a nested frame → 400; create → 400 with nothing created; destroy → 400 with the record kept;
+  - nested list, new, create, row, destroy and revert still work;
+  - an accessible model's list and row still render, and its new/create without `update` → 400;
+  - a non-superadmin destroy → 403;
+  - a refused file-slot request still counts as authorized.
+  - Every refusal also asserts that authorization ran.
+
+### Lockstep
+
+- validation_hints 8.1.56, inline_forms_installer 8.1.56, inline_forms_schema_edit 8.1.56.
+
+## [8.1.55] - 2026-10-04
+
+### Fixed
+
+- **Published gems were unreadable for other users.** RubyGems packages each file with its on-disk mode, and `gem install` restores it. The release checkout is group-only (`rw-rw----`), so every file in the published 8.1.53 gems was `0660`. After `gem install` only the installing user and group could read them: for anyone else `require "inline_forms"` failed silently (Bundler swallows that LoadError), so the app died at boot with `uninitialized constant InlineForms`. A Docker image that installs gems as root and runs as another user could not boot at all. Gem builds now package every file as `0644`, or `0755` when the owner may execute it, whatever the checkout's modes: `InlineFormsGemFiles` wraps `Gem::Package#add_files`, and all three gemspecs in this repo load it, so `gem build`, `rake build` and the CI full gate are all covered. validation_hints 8.1.55 has the same fix. 8.1.53 cannot be republished (RubyGems never accepts a version twice), so apps on 8.1.53 should move to 8.1.55.
+
+### Tests
+
+- Gem: `test/gem_package_modes_test.rb`: group-only files on disk are packaged `0644`/`0755`, and the inline_forms, inline_forms_installer and inline_forms_schema_edit gemspecs build with every file world-readable.
+
+### Lockstep
+
+- validation_hints 8.1.55, inline_forms_installer 8.1.55, inline_forms_schema_edit 8.1.55.
+
+## [8.1.54] - 2026-10-04
+
+### Fixed
+
+- **"Forgot your password?" and the password reset page raised.** Devise 5 removed `devise_error_messages!`, and the gem's `devise/passwords/new` and `devise/passwords/edit` still called it, so both pages failed with `undefined method 'devise_error_messages!'` in every generated app. They now render Devise's own `devise/shared/error_messages` partial (`render "devise/shared/error_messages", resource: resource`).
+- **`devise/shared/_header_and_errors`** (not rendered by the gem's own views; kept for host apps that render it). It looked up a translation named after the app (`t application_name`, which renders a translation_missing span), called the removed `devise_error_messages!`, and looked up `inline_forms.devise.` when `@default_message` was unset. It now shows `t('application_name', default: application_name)` like the `inline_forms` layout's title, Devise's error list when the resource has errors, and the `inline_forms.devise.<@default_message>` text only when `@default_message` is set.
+
+### Tests
+
+- Example app: `example_app_devise_passwords_test.rb`: the forgot-password and reset-password pages render, an unknown email re-renders the form with Devise's error list, and `_header_and_errors` shows the app name and the resource errors. The engine's dummy app has no Devise, so these tests live in the example app only.
+
+### Lockstep
+
+- validation_hints 8.1.54, inline_forms_installer 8.1.54, inline_forms_schema_edit 8.1.54.
+
 ## [8.1.53] - 2026-10-04
 
 ### Fixed

data/app/controllers/concerns/file_slots_concern.rb

@@ -136,10 +136,16 @@ module FileSlotsConcern
   # Validates the attribute (declared slot shown as :simple_file_field in the
   # attribute list), then authorizes +action+ on it. Renders and returns false
   # when refused.
+  #
+  # The record is authorized first (these actions skip
+  # load_and_authorize_resource): a 400 for an unlisted attribute must still
+  # count as an authorization check, or a host with CanCan's
+  # +check_authorization+ raises AuthorizationNotPerformed (500) instead.
   def file_slot_request_permitted?(action)
     @attribute = params[:attribute].to_s
     @form_element = "simple_file_field"
     @update_span = params[:update]
+    authorize!(action, @object) if cancan_enabled?
     unless inline_forms_file_slot_listed?(@object, @attribute)
       head :bad_request
       return false

data/app/controllers/inline_forms_controller.rb

@@ -84,6 +84,11 @@ class InlineFormsController < ApplicationController
         format.html do
           if @parent_class.present?
             render_nested_associated_list_html
+          else
+            # No top-level page for this resource. An explicit answer: an
+            # empty block would fall through to implicit rendering and raise
+            # MissingExactTemplate (500).
+            head :not_found
           end
         end
       else
@@ -116,7 +121,7 @@ class InlineFormsController < ApplicationController
 
     @object.inline_forms_attribute_list = @inline_forms_attribute_list if @inline_forms_attribute_list
     respond_to do |format|
-      format.html { render_turbo_new } if html_list_flow_allowed?
+      format.html { html_list_flow_allowed? ? render_turbo_new : head(:bad_request) }
     end
   end
 
@@ -139,6 +144,11 @@ class InlineFormsController < ApplicationController
   def create
     @object ||= @Klass.new
     @update_span = params[:update]
+    @parent_class = params[:parent_class]
+    # Refuse before anything is written: the responses below only exist for
+    # a request from a list or nested-list frame.
+    return head :bad_request unless html_list_flow_allowed?
+
     attributes = @inline_forms_attribute_list || @object.inline_forms_attribute_list
     attributes.each do | attribute, form_element |
       # Skip a row whose column is not migrated yet (model edited, migration
@@ -149,7 +159,6 @@ class InlineFormsController < ApplicationController
       InlineForms.assert_plain_text_column!(object: @object, attribute: attribute, form_element: form_element)
       send("#{form_element}_update", @object, attribute) unless form_element == :associated || (cancan_enabled? && cannot?(:read, @object, attribute))
     end
-    @parent_class = params[:parent_class]
     @parent_id = params[:parent_id]
     # See #index for the order/search/parent-fk decomposition.
     fk_conditions = nil
@@ -171,19 +180,17 @@ class InlineFormsController < ApplicationController
       created_object = @object
       @object = nil
       respond_to do |format|
-        if html_list_flow_allowed?
-          if open_created_row?(created_object, attributes)
-            format.turbo_stream { render_created_row_open_streams(created_object) }
-          end
-          format.html { render_list_frame_after_save }
+        if open_created_row?(created_object, attributes)
+          format.turbo_stream { render_created_row_open_streams(created_object) }
         end
+        format.html { render_list_frame_after_save }
       end
     else
       flash.now[:header] = [ "Kan #{@object.class.to_s.underscore} niet aanmaken." ]
       flash.now[:error] = @object.errors.to_a
       respond_to do |format|
         @object.inline_forms_attribute_list = attributes
-        format.html { render_turbo_new } if html_list_flow_allowed?
+        format.html { render_turbo_new }
       end
     end
   end
@@ -257,10 +264,10 @@ class InlineFormsController < ApplicationController
     if @attribute.nil?
       respond_to do |format|
         @attributes = @object.inline_forms_attribute_list
-        if close
-          format.html { render_row_turbo(:close) } if row_html_turbo_allowed?
-        else
-          format.html { render_row_turbo(:show) } if row_html_turbo_allowed?
+        format.html do
+          next head(:bad_request) unless row_html_turbo_allowed?
+
+          render_row_turbo(close ? :close : :show)
         end
       end
     else
@@ -274,9 +281,11 @@ class InlineFormsController < ApplicationController
   def soft_delete
     @update_span = params[:update]
     @object = referenced_object
+    return head :bad_request unless row_html_turbo_allowed?
+
     @object.soft_delete(current_user)
     respond_to do |format|
-      format.html { render_row_turbo(:close) } if row_html_turbo_allowed?
+      format.html { render_row_turbo(:close) }
     end
   end
 
@@ -284,9 +293,11 @@ class InlineFormsController < ApplicationController
   def soft_restore
     @update_span = params[:update]
     @object = referenced_object
+    return head :bad_request unless row_html_turbo_allowed?
+
     @object.soft_restore
     respond_to do |format|
-      format.html { render_row_turbo(:close) } if row_html_turbo_allowed?
+      format.html { render_row_turbo(:close) }
     end
   end
 
@@ -294,14 +305,17 @@ class InlineFormsController < ApplicationController
   def destroy
     @update_span = params[:update]
     @object = referenced_object
-    if destroy_permitted?
-      @object.destroy
-      # Capture after destroy: `.last` before destroy was the latest *update*
-      # (e.g. a plain_text_area edit), so undo reified the pre-edit state.
-      @undo_version = @object.versions.last
-      respond_to do |format|
-        format.html { render_row_turbo_destroyed } if row_html_turbo_allowed?
-      end
+    # Both refusals answer before anything is destroyed (they used to render
+    # nothing and fall through to implicit rendering: a 500).
+    return head :forbidden unless destroy_permitted?
+    return head :bad_request unless row_html_turbo_allowed?
+
+    @object.destroy
+    # Capture after destroy: `.last` before destroy was the latest *update*
+    # (e.g. a plain_text_area edit), so undo reified the pre-edit state.
+    @undo_version = @object.versions.last
+    respond_to do |format|
+      format.html { render_row_turbo_destroyed }
     end
   end
 
@@ -327,6 +341,7 @@ class InlineFormsController < ApplicationController
     # has the Devise+roles system, otherwise no extra gate beyond CanCan.
     return head :forbidden unless destroy_permitted?
     return head :not_found unless @parent
+    return head :bad_request unless row_html_turbo_allowed?
 
     @object = reify_for_revert(@version)
     # PaperTrail::Version#reify returns nil for `create` events because
@@ -354,8 +369,7 @@ class InlineFormsController < ApplicationController
         @parent = item || @parent
         return head :not_found unless @parent
       end
-      return render_revert_response if row_html_turbo_allowed?
-      return
+      return render_revert_response
     end
     if defined?(ActionText::RichText) && @object.is_a?(ActionText::RichText)
       @rich_text_record = @object
@@ -374,7 +388,7 @@ class InlineFormsController < ApplicationController
       end
       @parent.reload
     end
-    render_revert_response if row_html_turbo_allowed?
+    render_revert_response
   end
 
   private

data/app/views/devise/passwords/edit.html.erb

@@ -18,7 +18,7 @@
                                   }
                 ) do |f| %>
 
-      <%= devise_error_messages! %>
+      <%= render "devise/shared/error_messages", resource: resource %>
       <%= f.hidden_field :reset_password_token %>
 
       <div class="row">

data/app/views/devise/passwords/new.html.erb

@@ -18,7 +18,7 @@
                                   }
                 ) do |f| %>
 
-      <%= devise_error_messages! %>
+      <%= render "devise/shared/error_messages", resource: resource %>
 
       <div class="row">
         <div class="columns">

data/app/views/devise/shared/_header_and_errors.html.erb

@@ -1,4 +1,11 @@
-<div id="large_title"><%= t application_name -%></div>
+<%# Unused by the gem's own devise views; kept for host apps that render it. %>
+<%# Same title source as layouts/inline_forms; Devise 5 dropped %>
+<%# devise_error_messages!, so errors use Devise's own error_messages partial. %>
+<div id="large_title"><%= t('application_name', default: application_name) %></div>
 <div id="flash_message">
-  <%= devise_error_messages!.empty? ? t("inline_forms.devise.#{@default_message}") : devise_error_messages! -%>
+  <% if resource.errors.any? %>
+    <%= render "devise/shared/error_messages", resource: resource %>
+  <% elsif @default_message.present? %>
+    <%= t("inline_forms.devise.#{@default_message}") %>
+  <% end %>
 </div>

data/lib/inline_forms/gem_files.rb

@@ -1,5 +1,8 @@
 # -*- encoding: utf-8 -*-
 
+require "delegate"
+require "rubygems/package"
+
 module InlineFormsGemFiles
   INSTALLER_FILE_PREFIXES = %w[
     bin/inline_forms
@@ -24,8 +27,9 @@ module InlineFormsGemFiles
   # the token leaked into `gem build` on the release machine. Exclude it hard,
   # independent of any ignore configuration.
   #
-  # Same for local Claude Code files (untracked, per checkout): .claude/
-  # (launch.json, settings.local.json) and CLAUDE.md.
+  # Same for Claude Code files: .claude/ (untracked, per checkout:
+  # launch.json, settings.local.json, worktrees) and CLAUDE.md (committed so
+  # worktrees see it, but repo instructions, not gem content).
   EXCLUDED_FILE_PREFIXES = %w[
     stuff/
     .claude/
@@ -68,4 +72,33 @@ module InlineFormsGemFiles
       include_installer ? !installer_file : installer_file
     end
   end
+
+  # Mode a file gets inside the .gem: 0755 if the owner may execute it,
+  # else 0644. RubyGems packages each file's on-disk mode (File.lstat) and
+  # `gem install` restores it, and this checkout is group-only (rw-rw----),
+  # so 8.1.53 shipped every file as 0660: only the installing user and group
+  # could read the installed gem, `require "inline_forms"` failed silently
+  # for anyone else (Bundler swallows the LoadError), and a Docker image that
+  # installs as root and runs as another user could not boot.
+  def packaged_mode(mode)
+    (mode & 0o100).zero? ? 0o644 : 0o755
+  end
+
+  # Wraps the tar writer Gem::Package#add_files writes to, so every file
+  # goes in with packaged_mode instead of its on-disk mode.
+  class ReadableTar < SimpleDelegator
+    def add_file_simple(name, mode, size, &block)
+      __getobj__.add_file_simple(name, InlineFormsGemFiles.packaged_mode(mode), size, &block)
+    end
+  end
+
+  module ReadablePackage
+    def add_files(tar)
+      super(ReadableTar.new(tar))
+    end
+  end
 end
+
+# Loaded by every gemspec in this repo, so `gem build`, `rake build` and the
+# CI full gate all package world-readable files whatever the checkout's modes.
+Gem::Package.prepend(InlineFormsGemFiles::ReadablePackage) unless Gem::Package <= InlineFormsGemFiles::ReadablePackage

data/lib/inline_forms/version.rb

@@ -1,5 +1,5 @@
 # -*- encoding : utf-8 -*-
 
 module InlineForms
-  VERSION = "8.1.53"
+  VERSION = "8.1.56"
 end

data/test/dummy/app/controllers/application_controller.rb

@@ -5,10 +5,13 @@ class ApplicationController < ActionController::Base
   # create/new HTML responses) calls `current_user.name` and
   # `current_user.role?`, so a nil current_user cannot render it. The stub is
   # superadmin so `destroy_permitted?` allows hard destroy, matching the
-  # generated apps' test user.
+  # generated apps' test user. A test can switch that off with
+  # dummy_user_superadmin (reset in InlineFormsIntegrationTestCase#setup).
+  mattr_accessor :dummy_user_superadmin, default: true
+
   DummyUser = Struct.new(:id, :name) do
     def role?(role)
-      role.to_sym == :superadmin
+      role.to_sym == :superadmin && ApplicationController.dummy_user_superadmin
     end
   end
 

data/test/dummy/app/controllers/daily_reports_controller.rb

@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+
+class DailyReportsController < InlineFormsController
+end

data/test/dummy/app/models/daily_report.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+# Child of Machine that has no top-level HTML surface: it is only shown
+# nested in its machine (like StProject's Dagrapportage inside a Client tab).
+class DailyReport < ApplicationRecord
+  belongs_to :machine, optional: true
+
+  def self.not_accessible_through_html?
+    true
+  end
+
+  def _presentation
+    "#{name}"
+  end
+
+  def inline_forms_attribute_list
+    @inline_forms_attribute_list ||= [
+      [ :name, :text_field ]
+    ]
+  end
+end

data/test/dummy/app/models/machine.rb

@@ -5,6 +5,7 @@
 # open-after-create flow (InlineFormsController#render_created_row_open_streams).
 class Machine < ApplicationRecord
   has_many :parts
+  has_many :daily_reports
 
   validates :name, presence: true
 

data/test/dummy/config/routes.rb

@@ -20,6 +20,11 @@ Rails.application.routes.draw do
     get "list_versions", on: :member
   end
 
+  resources :daily_reports do
+    post "revert", on: :member
+    get "list_versions", on: :member
+  end
+
   resources :gizmos do
     post "revert", on: :member
     get "list_versions", on: :member

data/test/gem_package_modes_test.rb

@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+
+$LOAD_PATH.unshift File.expand_path("../lib", __dir__)
+
+require "minitest/autorun"
+require "tmpdir"
+require "zlib"
+require "inline_forms/gem_files"
+
+# 8.1.53 shipped every file as 0660 (the checkout's group-only modes), so an
+# installed gem was unreadable for anyone outside the installing user and
+# group. Gem builds now package 0644 / 0755 whatever the on-disk modes.
+class GemPackageModesTest < Minitest::Test
+  REPO_ROOT = File.expand_path("..", __dir__)
+
+  def packaged_modes(gem_path)
+    modes = {}
+    File.open(gem_path, "rb") do |io|
+      Gem::Package::TarReader.new(io).each do |entry|
+        next unless entry.full_name == "data.tar.gz"
+
+        Gem::Package::TarReader.new(Zlib::GzipReader.new(entry)).each do |file|
+          modes[file.full_name] = file.header.mode & 0o777
+        end
+      end
+    end
+    modes
+  end
+
+  def build(spec, dir, gem_dir)
+    gem_path = File.join(gem_dir, "#{spec.full_name}.gem")
+    Dir.chdir(dir) do
+      package = Gem::Package.new(gem_path)
+      package.spec = spec
+      Gem::DefaultUserInteraction.use_ui(Gem::SilentUI.new) { package.build(true) }
+    end
+    gem_path
+  end
+
+  def test_packaged_mode_keeps_only_the_owner_execute_bit
+    assert_equal 0o644, InlineFormsGemFiles.packaged_mode(0o100660)
+    assert_equal 0o644, InlineFormsGemFiles.packaged_mode(0o100600)
+    assert_equal 0o755, InlineFormsGemFiles.packaged_mode(0o100770)
+    assert_equal 0o755, InlineFormsGemFiles.packaged_mode(0o100700)
+  end
+
+  def test_group_only_files_are_packaged_world_readable
+    Dir.mktmpdir do |src|
+      Dir.mktmpdir do |out|
+        File.write(File.join(src, "plain.rb"), "# plain\n")
+        File.write(File.join(src, "tool"), "#!/bin/sh\n")
+        File.chmod(0o660, File.join(src, "plain.rb"))
+        File.chmod(0o700, File.join(src, "tool"))
+
+        spec = Gem::Specification.new do |s|
+          s.name = "modes_probe"
+          s.version = "0.0.1"
+          s.summary = "probe"
+          s.authors = [ "probe" ]
+          s.files = %w[plain.rb tool]
+        end
+
+        modes = packaged_modes(build(spec, src, out))
+
+        assert_equal({ "plain.rb" => 0o644, "tool" => 0o755 }, modes)
+      end
+    end
+  end
+
+  def test_every_gemspec_in_the_repo_packages_world_readable_files
+    %w[inline_forms.gemspec inline_forms_installer.gemspec
+       inline_forms_schema_edit/inline_forms_schema_edit.gemspec].each do |gemspec|
+      path = File.join(REPO_ROOT, gemspec)
+      spec = Gem::Specification.load(path)
+      refute_nil spec, gemspec
+
+      Dir.mktmpdir do |out|
+        modes = packaged_modes(build(spec, File.dirname(path), out))
+
+        refute_empty modes, gemspec
+        unreadable = modes.reject { |_, mode| (mode & 0o444) == 0o444 }
+        assert_empty unreadable, "#{gemspec}: not world-readable in the .gem"
+      end
+    end
+  end
+end

data/test/integration/html_refusal_test.rb

@@ -0,0 +1,152 @@
+# frozen_string_literal: true
+
+require_relative "../integration_test_helper"
+
+# Every HTML request the engine decides not to serve gets an explicit answer:
+# a top-level list of a not_accessible_through_html? model is a 404, a
+# new/create/show/destroy/revert without the frame context the gem needs is a
+# 400. Before, the format.html block rendered nothing (or was not registered),
+# so Rails fell through to implicit rendering: ActionController::
+# MissingExactTemplate (500; StProject's GET /dagrapportages) or UnknownFormat
+# (406). create, destroy and revert also refuse before writing anything.
+#
+# DailyReport is the not_accessible_through_html? child of Machine; Machine is
+# a normal (accessible) model.
+class HtmlRefusalTest < InlineFormsIntegrationTestCase
+  setup do
+    @machine = Machine.create!(name: "Press")
+    @report = DailyReport.create!(name: "Monday", machine: @machine)
+    @list_frame = "machine_#{@machine.id}_daily_reports"
+    @row_frame = "machine_#{@machine.id}_daily_report_#{@report.id}"
+  end
+
+  def nested_params(update = @list_frame)
+    { update: update, parent_class: "Machine", parent_id: @machine.id }
+  end
+
+  def stream_headers(frame_id)
+    frame_headers(frame_id).merge("Accept" => "text/vnd.turbo-stream.html")
+  end
+
+  # The refusal ran after authorization, so CanCan's check_authorization (an
+  # after_action in host apps) is satisfied.
+  def assert_refused(status)
+    assert_response status
+    assert controller.instance_variable_defined?(:@_authorized),
+      "the refused request must still count as authorized (check_authorization)"
+  end
+
+  # ---- not_accessible_through_html? model, top level -----------------------
+
+  test "the top-level list of a not_accessible_through_html? model is a 404" do
+    get daily_reports_path
+    assert_refused :not_found
+  end
+
+  test "show without a nested row frame is a 400" do
+    get daily_report_path(@report)
+    assert_refused :bad_request
+  end
+
+  test "new without update and parent_class is a 400" do
+    get new_daily_report_path
+    assert_refused :bad_request
+  end
+
+  test "create without update and parent_class is a 400 and creates nothing" do
+    assert_no_difference -> { DailyReport.count } do
+      post daily_reports_path, params: { name: "Tuesday" }
+    end
+    assert_refused :bad_request
+  end
+
+  test "destroy without a nested row frame is a 400 and keeps the record" do
+    delete daily_report_path(@report)
+    assert_refused :bad_request
+    assert DailyReport.exists?(@report.id)
+  end
+
+  test "revert without a nested row frame is a 400 and changes nothing" do
+    @report.update!(name: "Changed")
+    version = @report.versions.where(event: "update").last
+
+    post revert_daily_report_path(version.id, update: "daily_report_#{@report.id}"),
+         headers: stream_headers("daily_report_#{@report.id}")
+    assert_refused :bad_request
+    assert_equal "Changed", @report.reload.name
+  end
+
+  # ---- the nested forms still work (regression guard) ----------------------
+
+  test "the nested list, new form, create, row and destroy still render" do
+    get daily_reports_path(nested_params), headers: frame_headers(@list_frame)
+    assert_response :success
+    assert_includes response.body, "Monday"
+
+    get new_daily_report_path(nested_params), headers: frame_headers(@list_frame)
+    assert_response :success
+
+    assert_difference -> { DailyReport.count }, +1 do
+      post daily_reports_path(nested_params), params: { name: "Tuesday" }, headers: frame_headers(@list_frame)
+    end
+    assert_response :success
+    assert_equal @machine.id, DailyReport.find_by!(name: "Tuesday").machine_id
+
+    get daily_report_path(@report, update: @row_frame), headers: frame_headers(@row_frame)
+    assert_response :success
+    assert_includes response.body, %(<turbo-frame id="#{@row_frame}">)
+
+    delete daily_report_path(@report, update: @row_frame), headers: frame_headers(@row_frame)
+    assert_response :success
+    refute DailyReport.exists?(@report.id)
+  end
+
+  test "a nested revert still restores the record" do
+    @report.update!(name: "Changed")
+    version = @report.versions.where(event: "update").last
+
+    post revert_daily_report_path(version.id, update: @row_frame), headers: stream_headers(@row_frame)
+    assert_response :success
+    assert_equal "Monday", @report.reload.name
+  end
+
+  # ---- accessible model ------------------------------------------------------
+
+  test "an accessible model's list and row still render" do
+    get machines_path
+    assert_response :success
+    assert_includes response.body, "Press"
+
+    get machine_path(@machine)
+    assert_response :success
+  end
+
+  test "an accessible model's new and create without update are a 400; nothing is created" do
+    get new_machine_path
+    assert_refused :bad_request
+
+    assert_no_difference -> { Machine.count } do
+      post machines_path, params: { name: "Lathe" }
+    end
+    assert_refused :bad_request
+  end
+
+  test "destroy by a user who may not hard-destroy is a 403 and keeps the record" do
+    ApplicationController.dummy_user_superadmin = false
+    frame = "machine_#{@machine.id}"
+
+    delete machine_path(@machine, update: frame), headers: frame_headers(frame)
+    assert_refused :forbidden
+    assert Machine.exists?(@machine.id)
+  end
+
+  # ---- file slots ------------------------------------------------------------
+
+  test "a refused file-slot request still counts as authorized" do
+    document = Document.create!(title: "Plan")
+    frame = "document_#{document.id}_filename"
+
+    post remove_file_document_path(document, attribute: "title", update: frame), headers: stream_headers(frame)
+    assert_refused :bad_request
+  end
+end

data/test/integration_test_helper.rb

@@ -49,6 +49,15 @@ ActiveRecord::Schema.define do
   end
   add_index :parts, :machine_id
 
+  # DailyReport: a not_accessible_through_html? child of Machine (shaped like
+  # StProject's Dagrapportage). See test/integration/html_refusal_test.rb.
+  create_table :daily_reports, force: true do |t|
+    t.string  :name
+    t.integer :machine_id
+    t.timestamps
+  end
+  add_index :daily_reports, :machine_id
+
   # Gizmo intentionally has NO `pending_note` column: its attribute_list
   # references one, modeling the inline_forms_addto pre-migrate window that
   # InlineForms.attribute_pending_migration? gates. See
@@ -163,9 +172,11 @@ class InlineFormsIntegrationTestCase < ActionDispatch::IntegrationTest
 
   setup do
     Ability.restrictions = nil
+    ApplicationController.dummy_user_superadmin = true
     Widget.delete_all
     Kind.delete_all
     Part.delete_all
+    DailyReport.delete_all
     Machine.delete_all
     Gizmo.delete_all
     Dossier.delete_all

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: inline_forms
 version: !ruby/object:Gem::Version
-  version: 8.1.53
+  version: 8.1.56
 platform: ruby
 authors:
 - Ace Suares
@@ -282,6 +282,7 @@ files:
 - test/archived_form_elements_test.rb
 - test/attribute_list_test.rb
 - test/dummy/app/controllers/application_controller.rb
+- test/dummy/app/controllers/daily_reports_controller.rb
 - test/dummy/app/controllers/documents_controller.rb
 - test/dummy/app/controllers/dossiers_controller.rb
 - test/dummy/app/controllers/gizmos_controller.rb
@@ -292,6 +293,7 @@ files:
 - test/dummy/app/helpers/application_helper.rb
 - test/dummy/app/models/ability.rb
 - test/dummy/app/models/application_record.rb
+- test/dummy/app/models/daily_report.rb
 - test/dummy/app/models/document.rb
 - test/dummy/app/models/dossier.rb
 - test/dummy/app/models/gizmo.rb
@@ -308,11 +310,13 @@ files:
 - test/dummy/config/initializers/paper_trail_yaml_safe_load.rb
 - test/dummy/config/routes.rb
 - test/form_element_from_callee_test.rb
+- test/gem_package_modes_test.rb
 - test/inline_edit_polymorphic_path_test.rb
 - test/inline_forms_addto_generator_test.rb
 - test/inline_forms_generator_test.rb
 - test/integration/field_authorization_test.rb
 - test/integration/file_slots_test.rb
+- test/integration/html_refusal_test.rb
 - test/integration/inline_forms_crud_test.rb
 - test/integration/layout_title_test.rb
 - test/integration/legacy_elements_test.rb
@@ -362,6 +366,7 @@ test_files:
 - test/archived_form_elements_test.rb
 - test/attribute_list_test.rb
 - test/dummy/app/controllers/application_controller.rb
+- test/dummy/app/controllers/daily_reports_controller.rb
 - test/dummy/app/controllers/documents_controller.rb
 - test/dummy/app/controllers/dossiers_controller.rb
 - test/dummy/app/controllers/gizmos_controller.rb
@@ -372,6 +377,7 @@ test_files:
 - test/dummy/app/helpers/application_helper.rb
 - test/dummy/app/models/ability.rb
 - test/dummy/app/models/application_record.rb
+- test/dummy/app/models/daily_report.rb
 - test/dummy/app/models/document.rb
 - test/dummy/app/models/dossier.rb
 - test/dummy/app/models/gizmo.rb
@@ -388,11 +394,13 @@ test_files:
 - test/dummy/config/initializers/paper_trail_yaml_safe_load.rb
 - test/dummy/config/routes.rb
 - test/form_element_from_callee_test.rb
+- test/gem_package_modes_test.rb
 - test/inline_edit_polymorphic_path_test.rb
 - test/inline_forms_addto_generator_test.rb
 - test/inline_forms_generator_test.rb
 - test/integration/field_authorization_test.rb
 - test/integration/file_slots_test.rb
+- test/integration/html_refusal_test.rb
 - test/integration/inline_forms_crud_test.rb
 - test/integration/layout_title_test.rb
 - test/integration/legacy_elements_test.rb