inline_forms 8.1.55 → 8.1.57

data/app/views/layouts/inline_forms.html.erb

@@ -14,6 +14,9 @@
     <%= stylesheet_link_tag "trix" %>
     <%= inline_forms_user_color_overrides_style %>
     <%= csrf_meta_tags %>
+    <%# Publishes the CSP nonce (nothing without a nonce generator) for the %>
+    <%# scripts Turbo inserts. %>
+    <%= csp_meta_tag %>
   </head>
 
   <body class="<%= inline_forms_body_theme_class %>">
@@ -40,10 +43,14 @@
     <%# Turbo (Hotwire) is loaded as an ES module so it does not collide with %>
     <%# the classic-script Sprockets bundle above. Drive stays at the default %>
     <%# (enabled); inline interactions use `<turbo-frame>` + HTML responses. %>
-    <script type="module">
+    <%# The nonce: hosts run a CSP with script-src 'nonce-…' (nil, so no %>
+    <%# attribute, without a nonce generator). data-turbo-eval="false": Turbo %>
+    <%# Drive must not re-run it on visits (Turbo is loaded; a re-inserted %>
+    <%# copy would carry a newer nonce the page's policy rejects). %>
+    <%= tag.script type: "module", nonce: content_security_policy_nonce, data: { turbo_eval: false } do %>
       import { Turbo } from "<%= asset_path('turbo.min.js') %>"
       window.Turbo = Turbo
-    </script>
+    <% end %>
     <%# Trix 2 (vendored; no CDN). Self-registers its custom elements on load. %>
     <%= javascript_include_tag "trix.min" %>
   </body>

data/lib/inline_forms/form_elements/file_field_helper.rb

@@ -9,7 +9,9 @@ module InlineForms
       o = object.send(attribute)
       msg = o.to_s
       if o.send(:present?)
-        msg = "replace | <a href='#{o.send(:url)}'>#{o.send(:path).gsub(/^.*\//,'')}</a>".html_safe
+        # The stored file name and url are data: escape them before the
+        # string is marked html_safe.
+        msg = "replace | <a href='#{ERB::Util.h(o.send(:url))}'>#{ERB::Util.h(o.send(:path).gsub(/^.*\//,''))}</a>".html_safe
       end
         link_to_inline_edit object, attribute, msg, from_callee: __callee__
     end

data/lib/inline_forms/form_elements/info_list_helper.rb

@@ -11,7 +11,9 @@ module InlineForms
       out = "<div class='row #{cycle('odd', 'even')}'>--</div>" if object.send(attribute).empty? 
       object.send(attribute).sort.each do | item |
         out << "<div class='row #{cycle('odd', 'even')}'>"
-        out << item._presentation
+        # _presentation is model data (e.g. a User's name listed on a Role):
+        # escape it, the whole string is marked html_safe below.
+        out << ERB::Util.h(item._presentation)
         out << '</div>'
       end
       out.html_safe

data/lib/inline_forms/gem_files.rb

@@ -27,8 +27,9 @@ module InlineFormsGemFiles
   # the token leaked into `gem build` on the release machine. Exclude it hard,
   # independent of any ignore configuration.
   #
-  # Same for local Claude Code files (untracked, per checkout): .claude/
-  # (launch.json, settings.local.json) and CLAUDE.md.
+  # Same for Claude Code files: .claude/ (untracked, per checkout:
+  # launch.json, settings.local.json, worktrees) and CLAUDE.md (committed so
+  # worktrees see it, but repo instructions, not gem content).
   EXCLUDED_FILE_PREFIXES = %w[
     stuff/
     .claude/

data/lib/inline_forms/version.rb

@@ -1,5 +1,5 @@
 # -*- encoding : utf-8 -*-
 
 module InlineForms
-  VERSION = "8.1.55"
+  VERSION = "8.1.57"
 end

data/lib/locales/inline_forms.en.yml

@@ -14,6 +14,7 @@ en:
       sign_up: sign up
       login_with_email_and_password: login with email and password
       sign_in: sign in
+      login: login
       links:
         no_unlock_instructions: did you not receive unlock instructions?
         sign_up: sign up
@@ -31,6 +32,20 @@ en:
       trash: trash
       list_versions: List versions
       close_versions_list: Close versions list
+      undelete: undelete
+      versions: Versions (%{count})
+      versions_event: Event
+      versions_when: When
+      versions_done_by: Done by
+      versions_changeset: Changeset
+      versions_old_value: old value
+      versions_new_value: new value
+      versions_empty: empty
+      versions_rich_text: rich text
+      version_events:
+        create: create
+        update: update
+        destroy: destroy
     files:
       download: download
       replace: replace file
@@ -116,7 +131,13 @@ en:
           expired: expired
     pending_migration:
       notice: "pending migration \u2014 run rails db:migrate"
-  succes: success.
+  # The create flash (InlineFormsController#create). Was misspelled
+  # `succes`, so t("success") was missing in every app.
+  success: "%{message} created."
+  # The engine header (inline_forms/_header): the More menu and logout.
+  common:
+    more: more...
+    logout: logout
   activerecord:
     models:
       language: language

data/lib/locales/inline_forms.nl.yml

@@ -14,6 +14,7 @@ nl:
       sign_up: inschrijven
       login_with_email_and_password: aanmelden door email-adres en wachtwoord in te voeren.
       sign_in: aanmelden
+      login: inloggen
       links:
         no_unlock_instructions: geen instructies ontvangen om blokkade op te heffen?
         sign_up: inschrijven
@@ -27,7 +28,24 @@ nl:
       close: sluiten
       add_new: Maak een nieuw %{model}
       undo: terughalen
+      restore: terugzetten
       trash: weggooien
+      undelete: terughalen
+      list_versions: versies tonen
+      close_versions_list: versies verbergen
+      versions: Versies (%{count})
+      versions_event: Gebeurtenis
+      versions_when: Wanneer
+      versions_done_by: Door
+      versions_changeset: Wijzigingen
+      versions_old_value: oude waarde
+      versions_new_value: nieuwe waarde
+      versions_empty: leeg
+      versions_rich_text: opgemaakte tekst
+      version_events:
+        create: aangemaakt
+        update: gewijzigd
+        destroy: verwijderd
     files:
       download: downloaden
       replace: bestand vervangen
@@ -113,7 +131,13 @@ nl:
           expired: verlopen
     pending_migration:
       notice: "migratie in afwachting \u2014 draai rails db:migrate"
-  succes: het ding is aangemaakt.
+  # The create flash (InlineFormsController#create). Was misspelled
+  # `succes`, so t("success") was missing in every app.
+  success: "%{message} is aangemaakt."
+  # The engine header (inline_forms/_header): the More menu and logout.
+  common:
+    more: meer...
+    logout: uitloggen
   activerecord:
     models:
       language: taal

data/test/dummy/app/controllers/application_controller.rb

@@ -5,10 +5,13 @@ class ApplicationController < ActionController::Base
   # create/new HTML responses) calls `current_user.name` and
   # `current_user.role?`, so a nil current_user cannot render it. The stub is
   # superadmin so `destroy_permitted?` allows hard destroy, matching the
-  # generated apps' test user.
+  # generated apps' test user. A test can switch that off with
+  # dummy_user_superadmin (reset in InlineFormsIntegrationTestCase#setup).
+  mattr_accessor :dummy_user_superadmin, default: true
+
   DummyUser = Struct.new(:id, :name) do
     def role?(role)
-      role.to_sym == :superadmin
+      role.to_sym == :superadmin && ApplicationController.dummy_user_superadmin
     end
   end
 

data/test/dummy/app/controllers/daily_reports_controller.rb

@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+
+class DailyReportsController < InlineFormsController
+end

data/test/dummy/app/models/daily_report.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+# Child of Machine that has no top-level HTML surface: it is only shown
+# nested in its machine (like StProject's Dagrapportage inside a Client tab).
+class DailyReport < ApplicationRecord
+  belongs_to :machine, optional: true
+
+  def self.not_accessible_through_html?
+    true
+  end
+
+  def _presentation
+    "#{name}"
+  end
+
+  def inline_forms_attribute_list
+    @inline_forms_attribute_list ||= [
+      [ :name, :text_field ]
+    ]
+  end
+end

data/test/dummy/app/models/machine.rb

@@ -5,6 +5,7 @@
 # open-after-create flow (InlineFormsController#render_created_row_open_streams).
 class Machine < ApplicationRecord
   has_many :parts
+  has_many :daily_reports
 
   validates :name, presence: true
 

data/test/dummy/config/application.rb

@@ -17,6 +17,9 @@ require "action_view/railtie"
 Bundler.require(*Rails.groups)
 
 require "inline_forms"
+# Host apps list rails-i18n in their Gemfile (the installer writes it): the
+# Rails strings for nl (time/date formats, ...) the gem's views localize with.
+require "rails-i18n"
 # The schema-GUI engine (separate gem, same repo; on the load path via the
 # Gemfile's test group). Its integration tests live in test/integration/.
 require "inline_forms_schema_edit"
@@ -34,5 +37,13 @@ module Dummy
     config.active_record.maintain_test_schema = false
     # Raise in-place so integration failures carry the real backtrace.
     config.action_dispatch.show_exceptions = :none
+    # A nonce-based CSP like StProject's (report-only): the layouts' inline
+    # script must carry the per-request nonce (test/integration/csp_nonce_test.rb).
+    config.content_security_policy do |policy|
+      policy.script_src :self
+    end
+    config.content_security_policy_nonce_generator = ->(_request) { SecureRandom.base64(16) }
+    config.content_security_policy_nonce_directives = %w[script-src]
+    config.content_security_policy_report_only = true
   end
 end

data/test/dummy/config/routes.rb

@@ -20,6 +20,11 @@ Rails.application.routes.draw do
     get "list_versions", on: :member
   end
 
+  resources :daily_reports do
+    post "revert", on: :member
+    get "list_versions", on: :member
+  end
+
   resources :gizmos do
     post "revert", on: :member
     get "list_versions", on: :member

data/test/gem_package_modes_test.rb

@@ -56,7 +56,7 @@ class GemPackageModesTest < Minitest::Test
           s.name = "modes_probe"
           s.version = "0.0.1"
           s.summary = "probe"
-          s.authors = ["probe"]
+          s.authors = [ "probe" ]
           s.files = %w[plain.rb tool]
         end
 

data/test/integration/csp_nonce_test.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+require_relative "../integration_test_helper"
+
+# Host apps run a CSP with script-src 'nonce-…' (StProject; the dummy app is
+# configured the same way, report-only). Every inline <script> the gem's
+# layouts render carries the request's nonce, and the nonce is published in
+# a csp-nonce meta tag for the scripts Turbo inserts. The unused
+# inline_forms/_flash partial (an inline jQuery <script>) is gone.
+class CspNonceTest < InlineFormsIntegrationTestCase
+  def header_nonce
+    policy = response.headers["Content-Security-Policy-Report-Only"].to_s
+    policy[/'nonce-([^']+)'/, 1]
+  end
+
+  def inline_scripts(html)
+    html.scan(/<script\b[^>]*>/).reject { |tag| tag.include?(" src=") }
+  end
+
+  def assert_inline_scripts_nonced(html, nonce)
+    scripts = inline_scripts(html)
+    assert_predicate scripts, :any?, "the layout's Turbo module script"
+    scripts.each { |tag| assert_includes tag, %(nonce="#{nonce}"), tag }
+  end
+
+  test "the inline_forms layout nonces its inline script and publishes the nonce" do
+    get widgets_path
+
+    assert_response :success
+    nonce = header_nonce
+    assert nonce, "precondition: the dummy sends a nonce-based CSP"
+    assert_inline_scripts_nonced(response.body, nonce)
+    assert_match %r{<script type="module" nonce="#{Regexp.escape(nonce)}" data-turbo-eval="false">\s*import \{ Turbo \}}, response.body
+    assert_includes response.body, %(<meta name="csp-nonce" content="#{nonce}" />)
+  end
+
+  test "the application layout nonces its inline script too" do
+    get widgets_path
+    nonce = header_nonce
+    html = controller.render_to_string(template: "stats/show", layout: "application")
+
+    assert_inline_scripts_nonced(html, nonce)
+    assert_includes html, %(<meta name="csp-nonce" content="#{nonce}" />)
+  end
+
+  test "the unused inline_forms/_flash partial with its inline script is gone" do
+    get widgets_path
+    refute controller.lookup_context.exists?("flash", [ "inline_forms" ], true)
+  end
+end

data/test/integration/file_slots_test.rb

@@ -299,6 +299,44 @@ class FileSlotsTest < InlineFormsIntegrationTestCase
     assert_nil @doc.reload.data
   end
 
+  # The stored SHA-256 is checked before bytes go back into a slot: a
+  # tampered (or corrupted) trash row is refused, nothing is written, and the
+  # row stays in the trash.
+  test "restore refuses a trash row whose bytes do not match its checksum" do
+    with_file
+    entry = @doc.inline_forms_remove_file!(:filename, by: 1)
+    InlineForms::TrashedFile.where(id: entry.id).update_all(data: OTHER)
+
+    post restore_file_document_path(@doc, attribute: "filename", trash_id: entry.id, update: @frame),
+         headers: stream_headers(@frame)
+
+    assert_response :success
+    assert_includes response.body, "can no longer be restored"
+    @doc.reload
+    assert_nil @doc.filename
+    assert_nil @doc.data
+    assert entry.reload.trashed?, "not marked restored"
+    assert_equal OTHER, entry.file_data, "the row is left as it is, for a look"
+  end
+
+  test "restore! raises and logs on a checksum mismatch, writing nothing" do
+    with_file
+    entry = @doc.inline_forms_remove_file!(:filename, by: 1)
+    InlineForms::TrashedFile.where(id: entry.id).update_all(checksum: Digest::SHA256.hexdigest("something else"))
+    log = StringIO.new
+    original_logger = Rails.logger
+    Rails.logger = ActiveSupport::Logger.new(log)
+
+    assert_raises(InlineForms::TrashedFile::NotRestorable) { entry.reload.restore!(by: 1) }
+
+    assert_includes log.string, "checksum mismatch entry=#{entry.id}"
+    assert_nil @doc.reload.data
+    assert entry.reload.trashed?
+    assert_equal 0, trash.where(reason: "replaced").count
+  ensure
+    Rails.logger = original_logger
+  end
+
   test "a trash entry of another record is not found" do
     other = Document.create!(title: "Dossier B", filename: upload(PLAN))
     entry = other.inline_forms_remove_file!(:filename, by: 1)
@@ -414,6 +452,43 @@ class FileSlotsTest < InlineFormsIntegrationTestCase
     assert_includes response.body, "restorable until"
   end
 
+  # FileSlotsConcern has no per-tab attribute list, so the field it
+  # re-renders used to build its links' slots= from the model's full list:
+  # after a restore on one tab, the next action's panel (and the versions
+  # panel) listed the other tabs' slots. The page's own slots param now
+  # carries through.
+  test "a file action re-renders with the page's slots only" do
+    with_file
+    @doc.update!(plan_filename: upload(OTHER, "other-tab.pdf"))
+    @doc.inline_forms_remove_file!(:plan_filename, by: 1)
+    entry = @doc.inline_forms_remove_file!(:filename, by: 1)
+
+    post restore_file_document_path(@doc, attribute: "filename", trash_id: entry.id, update: @frame,
+                                          slots: "filename", panel: "open"),
+         headers: stream_headers(@frame)
+
+    assert_response :success
+    assert_equal PLAN, @doc.reload.data
+    remove_link = response.body[%r{href="([^"]*/remove_file\?[^"]*)"}, 1]
+    assert remove_link, "the restored field offers remove"
+    assert_equal "filename", Rack::Utils.parse_query(URI.parse(CGI.unescapeHTML(remove_link)).query)["slots"]
+    refute_includes response.body, "other-tab.pdf", "neither the trash panel nor the versions panel lists the other slot"
+  end
+
+  test "a file action's slots param is reduced to declared, listed slots" do
+    with_file
+    @doc.update!(plan_filename: upload(OTHER, "other-tab.pdf"))
+    @doc.inline_forms_remove_file!(:plan_filename, by: 1)
+    entry = @doc.inline_forms_remove_file!(:filename, by: 1)
+
+    post restore_file_document_path(@doc, attribute: "filename", trash_id: entry.id, update: @frame,
+                                          slots: "filename,title,data", panel: "open"),
+         headers: stream_headers(@frame)
+
+    remove_link = response.body[%r{href="([^"]*/remove_file\?[^"]*)"}, 1]
+    assert_equal "filename", Rack::Utils.parse_query(URI.parse(CGI.unescapeHTML(remove_link)).query)["slots"]
+  end
+
   test "the panel needs :read_file_trash" do
     Ability.restrictions = -> { cannot :read_file_trash, Document }
     panel = "document_#{@doc.id}_file_trash"
@@ -456,6 +531,22 @@ class FileSlotsTest < InlineFormsIntegrationTestCase
     assert_nil restored.data
   end
 
+  test "undoing a destroy refuses a tampered trash row: nothing is restored" do
+    with_file
+    row = "document_#{@doc.id}"
+    delete document_path(@doc, update: row), headers: frame_headers(row)
+    entry = trash.where(reason: "record_destroyed").sole
+    InlineForms::TrashedFile.where(id: entry.id).update_all(data: OTHER)
+
+    version = PaperTrail::Version.where(item_type: "Document", item_id: @doc.id, event: "destroy").last
+    post revert_document_path(version.id, update: "documents_list"), headers: stream_headers("documents_list")
+
+    assert_response :unprocessable_entity
+    refute Document.exists?(@doc.id), "the revert rolled back"
+    assert entry.reload.trashed?
+    assert_equal OTHER, entry.file_data
+  end
+
   test "reverting an update never touches a slot, even from an old version carrying a filename" do
     with_file
     @doc.update!(title: "Renamed")

data/test/integration/html_refusal_test.rb

@@ -0,0 +1,152 @@
+# frozen_string_literal: true
+
+require_relative "../integration_test_helper"
+
+# Every HTML request the engine decides not to serve gets an explicit answer:
+# a top-level list of a not_accessible_through_html? model is a 404, a
+# new/create/show/destroy/revert without the frame context the gem needs is a
+# 400. Before, the format.html block rendered nothing (or was not registered),
+# so Rails fell through to implicit rendering: ActionController::
+# MissingExactTemplate (500; StProject's GET /dagrapportages) or UnknownFormat
+# (406). create, destroy and revert also refuse before writing anything.
+#
+# DailyReport is the not_accessible_through_html? child of Machine; Machine is
+# a normal (accessible) model.
+class HtmlRefusalTest < InlineFormsIntegrationTestCase
+  setup do
+    @machine = Machine.create!(name: "Press")
+    @report = DailyReport.create!(name: "Monday", machine: @machine)
+    @list_frame = "machine_#{@machine.id}_daily_reports"
+    @row_frame = "machine_#{@machine.id}_daily_report_#{@report.id}"
+  end
+
+  def nested_params(update = @list_frame)
+    { update: update, parent_class: "Machine", parent_id: @machine.id }
+  end
+
+  def stream_headers(frame_id)
+    frame_headers(frame_id).merge("Accept" => "text/vnd.turbo-stream.html")
+  end
+
+  # The refusal ran after authorization, so CanCan's check_authorization (an
+  # after_action in host apps) is satisfied.
+  def assert_refused(status)
+    assert_response status
+    assert controller.instance_variable_defined?(:@_authorized),
+      "the refused request must still count as authorized (check_authorization)"
+  end
+
+  # ---- not_accessible_through_html? model, top level -----------------------
+
+  test "the top-level list of a not_accessible_through_html? model is a 404" do
+    get daily_reports_path
+    assert_refused :not_found
+  end
+
+  test "show without a nested row frame is a 400" do
+    get daily_report_path(@report)
+    assert_refused :bad_request
+  end
+
+  test "new without update and parent_class is a 400" do
+    get new_daily_report_path
+    assert_refused :bad_request
+  end
+
+  test "create without update and parent_class is a 400 and creates nothing" do
+    assert_no_difference -> { DailyReport.count } do
+      post daily_reports_path, params: { name: "Tuesday" }
+    end
+    assert_refused :bad_request
+  end
+
+  test "destroy without a nested row frame is a 400 and keeps the record" do
+    delete daily_report_path(@report)
+    assert_refused :bad_request
+    assert DailyReport.exists?(@report.id)
+  end
+
+  test "revert without a nested row frame is a 400 and changes nothing" do
+    @report.update!(name: "Changed")
+    version = @report.versions.where(event: "update").last
+
+    post revert_daily_report_path(version.id, update: "daily_report_#{@report.id}"),
+         headers: stream_headers("daily_report_#{@report.id}")
+    assert_refused :bad_request
+    assert_equal "Changed", @report.reload.name
+  end
+
+  # ---- the nested forms still work (regression guard) ----------------------
+
+  test "the nested list, new form, create, row and destroy still render" do
+    get daily_reports_path(nested_params), headers: frame_headers(@list_frame)
+    assert_response :success
+    assert_includes response.body, "Monday"
+
+    get new_daily_report_path(nested_params), headers: frame_headers(@list_frame)
+    assert_response :success
+
+    assert_difference -> { DailyReport.count }, +1 do
+      post daily_reports_path(nested_params), params: { name: "Tuesday" }, headers: frame_headers(@list_frame)
+    end
+    assert_response :success
+    assert_equal @machine.id, DailyReport.find_by!(name: "Tuesday").machine_id
+
+    get daily_report_path(@report, update: @row_frame), headers: frame_headers(@row_frame)
+    assert_response :success
+    assert_includes response.body, %(<turbo-frame id="#{@row_frame}">)
+
+    delete daily_report_path(@report, update: @row_frame), headers: frame_headers(@row_frame)
+    assert_response :success
+    refute DailyReport.exists?(@report.id)
+  end
+
+  test "a nested revert still restores the record" do
+    @report.update!(name: "Changed")
+    version = @report.versions.where(event: "update").last
+
+    post revert_daily_report_path(version.id, update: @row_frame), headers: stream_headers(@row_frame)
+    assert_response :success
+    assert_equal "Monday", @report.reload.name
+  end
+
+  # ---- accessible model ------------------------------------------------------
+
+  test "an accessible model's list and row still render" do
+    get machines_path
+    assert_response :success
+    assert_includes response.body, "Press"
+
+    get machine_path(@machine)
+    assert_response :success
+  end
+
+  test "an accessible model's new and create without update are a 400; nothing is created" do
+    get new_machine_path
+    assert_refused :bad_request
+
+    assert_no_difference -> { Machine.count } do
+      post machines_path, params: { name: "Lathe" }
+    end
+    assert_refused :bad_request
+  end
+
+  test "destroy by a user who may not hard-destroy is a 403 and keeps the record" do
+    ApplicationController.dummy_user_superadmin = false
+    frame = "machine_#{@machine.id}"
+
+    delete machine_path(@machine, update: frame), headers: frame_headers(frame)
+    assert_refused :forbidden
+    assert Machine.exists?(@machine.id)
+  end
+
+  # ---- file slots ------------------------------------------------------------
+
+  test "a refused file-slot request still counts as authorized" do
+    document = Document.create!(title: "Plan")
+    frame = "document_#{document.id}_filename"
+
+    post remove_file_document_path(document, attribute: "title", update: frame), headers: stream_headers(frame)
+    assert_refused :bad_request
+  end
+end