inline_forms 8.1.55 → 8.1.56

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7fff4c0c21d69de2e6836a1a6a16e1e293b8c740fe0615a429ab6775f89fd59a
-  data.tar.gz: 479db5cb0c201625bc4c5561f1a3188d3e87ce128387c6a7e08c708d749600b2
+  metadata.gz: 7ecd64e62be7265a5989cc6012533cdac80dbd62f82ab8b009c17bd4c12343dd
+  data.tar.gz: fb677f7996a52a2a8d571f65264f22225a9ff9ed8c451657a2ac59c268d396d5
 SHA512:
-  metadata.gz: 20499e3a0edf5819e20dc5a2d6893835acb72a08039df25190f184136c93d8c8904de2c5f6def7d3746dd7a1804eb01f51cc3560bd70d5d196e4a95be62911bf
-  data.tar.gz: 809595fc167bab2e5c9015fb034dcc10be2ff6d5dde3b958d24cdf2ae96ed027ed56577342e5e56f4d5e3f6a02311cb7662a736dfe89636456f96961442bb5bb
+  metadata.gz: a5d4ed8bbb6569904df70ebbbd30b57c4847bb478088dfe70419363c58caf11d19dc6dfb5c67da2fbdaad8a85555c5b74b68847d19484f272d7c5fcbebcc30cf
+  data.tar.gz: a5b41fd5b309e7fd73bec6c652609f775493c1b3efdf977d3aed1503c6e6656d4e8d7e695bac99ca751b914bb2a47be64bdb244233820253d2426e87240515ee

data/CHANGELOG.md

@@ -4,6 +4,32 @@ All notable changes to this project are documented in this file.
 
 ## [Unreleased]
 
+## [8.1.56] - 2026-10-05
+
+### Fixed
+
+- **HTML requests the engine refuses get an explicit answer instead of falling through to implicit rendering.** Several `InlineFormsController` actions registered `format.html` only behind a guard, or registered it with a block that rendered nothing on the refused path. Rails then rendered implicitly: `ActionController::MissingExactTemplate` (a 500 for browser requests), `UnknownFormat` (406) or a bare 204. That meant error pages and exception-notifier noise. StProject hit it as a 500 on `GET /dagrapportages` by a normal user: `Dagrapportage` is `not_accessible_through_html?` and only exists nested in a Client tab. Now:
+  - `index` of a `not_accessible_through_html?` model without `parent_class` → **404**. The resource has no top-level page.
+  - `new`, `create`, row `show`, `destroy`, `soft_delete`, `soft_restore` and `revert` without the frame context the gem needs (`update`, plus `parent_class` or a nested row frame for `not_accessible_through_html?` models) → **400**. The request is malformed for this UI rather than aimed at a missing resource, so 400 rather than 404. A guard that does not match the request is a refusal of the request.
+  - `destroy` by a user who may not hard-destroy (`destroy_permitted?`, i.e. not superadmin) → **403**, the same answer `revert` already gave. It used to render nothing.
+  - `create`, `destroy`, `soft_delete`, `soft_restore` and `revert` now refuse **before writing**. Before, `create` saved the record, and `destroy`/`revert` changed data, and only then failed to respond.
+  - The refusals happen after `load_and_authorize_resource` / `authorize!`, so a host's CanCan `check_authorization` stays satisfied. The working paths are unchanged, including the turbo_stream responses (open-after-create, revert), nested lists, forms and rows, and accessible models' lists and rows.
+- **File-slot actions under `check_authorization`.** `file_slot_request_permitted?` answered 400 for an unlisted attribute before any `authorize!`, so a host with CanCan's `check_authorization` raised `CanCan::AuthorizationNotPerformed` (500) instead. It now authorizes the record first, then the attribute.
+
+### Tests
+
+- `test/integration/html_refusal_test.rb`, using new dummy model `DailyReport` (a `not_accessible_through_html?` child of `Machine`):
+  - top-level index → 404; show, new and revert without a nested frame → 400; create → 400 with nothing created; destroy → 400 with the record kept;
+  - nested list, new, create, row, destroy and revert still work;
+  - an accessible model's list and row still render, and its new/create without `update` → 400;
+  - a non-superadmin destroy → 403;
+  - a refused file-slot request still counts as authorized.
+  - Every refusal also asserts that authorization ran.
+
+### Lockstep
+
+- validation_hints 8.1.56, inline_forms_installer 8.1.56, inline_forms_schema_edit 8.1.56.
+
 ## [8.1.55] - 2026-10-04
 
 ### Fixed

data/app/controllers/concerns/file_slots_concern.rb

@@ -136,10 +136,16 @@ module FileSlotsConcern
   # Validates the attribute (declared slot shown as :simple_file_field in the
   # attribute list), then authorizes +action+ on it. Renders and returns false
   # when refused.
+  #
+  # The record is authorized first (these actions skip
+  # load_and_authorize_resource): a 400 for an unlisted attribute must still
+  # count as an authorization check, or a host with CanCan's
+  # +check_authorization+ raises AuthorizationNotPerformed (500) instead.
   def file_slot_request_permitted?(action)
     @attribute = params[:attribute].to_s
     @form_element = "simple_file_field"
     @update_span = params[:update]
+    authorize!(action, @object) if cancan_enabled?
     unless inline_forms_file_slot_listed?(@object, @attribute)
       head :bad_request
       return false

data/app/controllers/inline_forms_controller.rb

@@ -84,6 +84,11 @@ class InlineFormsController < ApplicationController
         format.html do
           if @parent_class.present?
             render_nested_associated_list_html
+          else
+            # No top-level page for this resource. An explicit answer: an
+            # empty block would fall through to implicit rendering and raise
+            # MissingExactTemplate (500).
+            head :not_found
           end
         end
       else
@@ -116,7 +121,7 @@ class InlineFormsController < ApplicationController
 
     @object.inline_forms_attribute_list = @inline_forms_attribute_list if @inline_forms_attribute_list
     respond_to do |format|
-      format.html { render_turbo_new } if html_list_flow_allowed?
+      format.html { html_list_flow_allowed? ? render_turbo_new : head(:bad_request) }
     end
   end
 
@@ -139,6 +144,11 @@ class InlineFormsController < ApplicationController
   def create
     @object ||= @Klass.new
     @update_span = params[:update]
+    @parent_class = params[:parent_class]
+    # Refuse before anything is written: the responses below only exist for
+    # a request from a list or nested-list frame.
+    return head :bad_request unless html_list_flow_allowed?
+
     attributes = @inline_forms_attribute_list || @object.inline_forms_attribute_list
     attributes.each do | attribute, form_element |
       # Skip a row whose column is not migrated yet (model edited, migration
@@ -149,7 +159,6 @@ class InlineFormsController < ApplicationController
       InlineForms.assert_plain_text_column!(object: @object, attribute: attribute, form_element: form_element)
       send("#{form_element}_update", @object, attribute) unless form_element == :associated || (cancan_enabled? && cannot?(:read, @object, attribute))
     end
-    @parent_class = params[:parent_class]
     @parent_id = params[:parent_id]
     # See #index for the order/search/parent-fk decomposition.
     fk_conditions = nil
@@ -171,19 +180,17 @@ class InlineFormsController < ApplicationController
       created_object = @object
       @object = nil
       respond_to do |format|
-        if html_list_flow_allowed?
-          if open_created_row?(created_object, attributes)
-            format.turbo_stream { render_created_row_open_streams(created_object) }
-          end
-          format.html { render_list_frame_after_save }
+        if open_created_row?(created_object, attributes)
+          format.turbo_stream { render_created_row_open_streams(created_object) }
         end
+        format.html { render_list_frame_after_save }
       end
     else
       flash.now[:header] = [ "Kan #{@object.class.to_s.underscore} niet aanmaken." ]
       flash.now[:error] = @object.errors.to_a
       respond_to do |format|
         @object.inline_forms_attribute_list = attributes
-        format.html { render_turbo_new } if html_list_flow_allowed?
+        format.html { render_turbo_new }
       end
     end
   end
@@ -257,10 +264,10 @@ class InlineFormsController < ApplicationController
     if @attribute.nil?
       respond_to do |format|
         @attributes = @object.inline_forms_attribute_list
-        if close
-          format.html { render_row_turbo(:close) } if row_html_turbo_allowed?
-        else
-          format.html { render_row_turbo(:show) } if row_html_turbo_allowed?
+        format.html do
+          next head(:bad_request) unless row_html_turbo_allowed?
+
+          render_row_turbo(close ? :close : :show)
         end
       end
     else
@@ -274,9 +281,11 @@ class InlineFormsController < ApplicationController
   def soft_delete
     @update_span = params[:update]
     @object = referenced_object
+    return head :bad_request unless row_html_turbo_allowed?
+
     @object.soft_delete(current_user)
     respond_to do |format|
-      format.html { render_row_turbo(:close) } if row_html_turbo_allowed?
+      format.html { render_row_turbo(:close) }
     end
   end
 
@@ -284,9 +293,11 @@ class InlineFormsController < ApplicationController
   def soft_restore
     @update_span = params[:update]
     @object = referenced_object
+    return head :bad_request unless row_html_turbo_allowed?
+
     @object.soft_restore
     respond_to do |format|
-      format.html { render_row_turbo(:close) } if row_html_turbo_allowed?
+      format.html { render_row_turbo(:close) }
     end
   end
 
@@ -294,14 +305,17 @@ class InlineFormsController < ApplicationController
   def destroy
     @update_span = params[:update]
     @object = referenced_object
-    if destroy_permitted?
-      @object.destroy
-      # Capture after destroy: `.last` before destroy was the latest *update*
-      # (e.g. a plain_text_area edit), so undo reified the pre-edit state.
-      @undo_version = @object.versions.last
-      respond_to do |format|
-        format.html { render_row_turbo_destroyed } if row_html_turbo_allowed?
-      end
+    # Both refusals answer before anything is destroyed (they used to render
+    # nothing and fall through to implicit rendering: a 500).
+    return head :forbidden unless destroy_permitted?
+    return head :bad_request unless row_html_turbo_allowed?
+
+    @object.destroy
+    # Capture after destroy: `.last` before destroy was the latest *update*
+    # (e.g. a plain_text_area edit), so undo reified the pre-edit state.
+    @undo_version = @object.versions.last
+    respond_to do |format|
+      format.html { render_row_turbo_destroyed }
     end
   end
 
@@ -327,6 +341,7 @@ class InlineFormsController < ApplicationController
     # has the Devise+roles system, otherwise no extra gate beyond CanCan.
     return head :forbidden unless destroy_permitted?
     return head :not_found unless @parent
+    return head :bad_request unless row_html_turbo_allowed?
 
     @object = reify_for_revert(@version)
     # PaperTrail::Version#reify returns nil for `create` events because
@@ -354,8 +369,7 @@ class InlineFormsController < ApplicationController
         @parent = item || @parent
         return head :not_found unless @parent
       end
-      return render_revert_response if row_html_turbo_allowed?
-      return
+      return render_revert_response
     end
     if defined?(ActionText::RichText) && @object.is_a?(ActionText::RichText)
       @rich_text_record = @object
@@ -374,7 +388,7 @@ class InlineFormsController < ApplicationController
       end
       @parent.reload
     end
-    render_revert_response if row_html_turbo_allowed?
+    render_revert_response
   end
 
   private

data/lib/inline_forms/gem_files.rb

@@ -27,8 +27,9 @@ module InlineFormsGemFiles
   # the token leaked into `gem build` on the release machine. Exclude it hard,
   # independent of any ignore configuration.
   #
-  # Same for local Claude Code files (untracked, per checkout): .claude/
-  # (launch.json, settings.local.json) and CLAUDE.md.
+  # Same for Claude Code files: .claude/ (untracked, per checkout:
+  # launch.json, settings.local.json, worktrees) and CLAUDE.md (committed so
+  # worktrees see it, but repo instructions, not gem content).
   EXCLUDED_FILE_PREFIXES = %w[
     stuff/
     .claude/

data/lib/inline_forms/version.rb

@@ -1,5 +1,5 @@
 # -*- encoding : utf-8 -*-
 
 module InlineForms
-  VERSION = "8.1.55"
+  VERSION = "8.1.56"
 end

data/test/dummy/app/controllers/application_controller.rb

@@ -5,10 +5,13 @@ class ApplicationController < ActionController::Base
   # create/new HTML responses) calls `current_user.name` and
   # `current_user.role?`, so a nil current_user cannot render it. The stub is
   # superadmin so `destroy_permitted?` allows hard destroy, matching the
-  # generated apps' test user.
+  # generated apps' test user. A test can switch that off with
+  # dummy_user_superadmin (reset in InlineFormsIntegrationTestCase#setup).
+  mattr_accessor :dummy_user_superadmin, default: true
+
   DummyUser = Struct.new(:id, :name) do
     def role?(role)
-      role.to_sym == :superadmin
+      role.to_sym == :superadmin && ApplicationController.dummy_user_superadmin
     end
   end
 

data/test/dummy/app/controllers/daily_reports_controller.rb

@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+
+class DailyReportsController < InlineFormsController
+end

data/test/dummy/app/models/daily_report.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+# Child of Machine that has no top-level HTML surface: it is only shown
+# nested in its machine (like StProject's Dagrapportage inside a Client tab).
+class DailyReport < ApplicationRecord
+  belongs_to :machine, optional: true
+
+  def self.not_accessible_through_html?
+    true
+  end
+
+  def _presentation
+    "#{name}"
+  end
+
+  def inline_forms_attribute_list
+    @inline_forms_attribute_list ||= [
+      [ :name, :text_field ]
+    ]
+  end
+end

data/test/dummy/app/models/machine.rb

@@ -5,6 +5,7 @@
 # open-after-create flow (InlineFormsController#render_created_row_open_streams).
 class Machine < ApplicationRecord
   has_many :parts
+  has_many :daily_reports
 
   validates :name, presence: true
 

data/test/dummy/config/routes.rb

@@ -20,6 +20,11 @@ Rails.application.routes.draw do
     get "list_versions", on: :member
   end
 
+  resources :daily_reports do
+    post "revert", on: :member
+    get "list_versions", on: :member
+  end
+
   resources :gizmos do
     post "revert", on: :member
     get "list_versions", on: :member

data/test/gem_package_modes_test.rb

@@ -56,7 +56,7 @@ class GemPackageModesTest < Minitest::Test
           s.name = "modes_probe"
           s.version = "0.0.1"
           s.summary = "probe"
-          s.authors = ["probe"]
+          s.authors = [ "probe" ]
           s.files = %w[plain.rb tool]
         end
 

data/test/integration/html_refusal_test.rb

@@ -0,0 +1,152 @@
+# frozen_string_literal: true
+
+require_relative "../integration_test_helper"
+
+# Every HTML request the engine decides not to serve gets an explicit answer:
+# a top-level list of a not_accessible_through_html? model is a 404, a
+# new/create/show/destroy/revert without the frame context the gem needs is a
+# 400. Before, the format.html block rendered nothing (or was not registered),
+# so Rails fell through to implicit rendering: ActionController::
+# MissingExactTemplate (500; StProject's GET /dagrapportages) or UnknownFormat
+# (406). create, destroy and revert also refuse before writing anything.
+#
+# DailyReport is the not_accessible_through_html? child of Machine; Machine is
+# a normal (accessible) model.
+class HtmlRefusalTest < InlineFormsIntegrationTestCase
+  setup do
+    @machine = Machine.create!(name: "Press")
+    @report = DailyReport.create!(name: "Monday", machine: @machine)
+    @list_frame = "machine_#{@machine.id}_daily_reports"
+    @row_frame = "machine_#{@machine.id}_daily_report_#{@report.id}"
+  end
+
+  def nested_params(update = @list_frame)
+    { update: update, parent_class: "Machine", parent_id: @machine.id }
+  end
+
+  def stream_headers(frame_id)
+    frame_headers(frame_id).merge("Accept" => "text/vnd.turbo-stream.html")
+  end
+
+  # The refusal ran after authorization, so CanCan's check_authorization (an
+  # after_action in host apps) is satisfied.
+  def assert_refused(status)
+    assert_response status
+    assert controller.instance_variable_defined?(:@_authorized),
+      "the refused request must still count as authorized (check_authorization)"
+  end
+
+  # ---- not_accessible_through_html? model, top level -----------------------
+
+  test "the top-level list of a not_accessible_through_html? model is a 404" do
+    get daily_reports_path
+    assert_refused :not_found
+  end
+
+  test "show without a nested row frame is a 400" do
+    get daily_report_path(@report)
+    assert_refused :bad_request
+  end
+
+  test "new without update and parent_class is a 400" do
+    get new_daily_report_path
+    assert_refused :bad_request
+  end
+
+  test "create without update and parent_class is a 400 and creates nothing" do
+    assert_no_difference -> { DailyReport.count } do
+      post daily_reports_path, params: { name: "Tuesday" }
+    end
+    assert_refused :bad_request
+  end
+
+  test "destroy without a nested row frame is a 400 and keeps the record" do
+    delete daily_report_path(@report)
+    assert_refused :bad_request
+    assert DailyReport.exists?(@report.id)
+  end
+
+  test "revert without a nested row frame is a 400 and changes nothing" do
+    @report.update!(name: "Changed")
+    version = @report.versions.where(event: "update").last
+
+    post revert_daily_report_path(version.id, update: "daily_report_#{@report.id}"),
+         headers: stream_headers("daily_report_#{@report.id}")
+    assert_refused :bad_request
+    assert_equal "Changed", @report.reload.name
+  end
+
+  # ---- the nested forms still work (regression guard) ----------------------
+
+  test "the nested list, new form, create, row and destroy still render" do
+    get daily_reports_path(nested_params), headers: frame_headers(@list_frame)
+    assert_response :success
+    assert_includes response.body, "Monday"
+
+    get new_daily_report_path(nested_params), headers: frame_headers(@list_frame)
+    assert_response :success
+
+    assert_difference -> { DailyReport.count }, +1 do
+      post daily_reports_path(nested_params), params: { name: "Tuesday" }, headers: frame_headers(@list_frame)
+    end
+    assert_response :success
+    assert_equal @machine.id, DailyReport.find_by!(name: "Tuesday").machine_id
+
+    get daily_report_path(@report, update: @row_frame), headers: frame_headers(@row_frame)
+    assert_response :success
+    assert_includes response.body, %(<turbo-frame id="#{@row_frame}">)
+
+    delete daily_report_path(@report, update: @row_frame), headers: frame_headers(@row_frame)
+    assert_response :success
+    refute DailyReport.exists?(@report.id)
+  end
+
+  test "a nested revert still restores the record" do
+    @report.update!(name: "Changed")
+    version = @report.versions.where(event: "update").last
+
+    post revert_daily_report_path(version.id, update: @row_frame), headers: stream_headers(@row_frame)
+    assert_response :success
+    assert_equal "Monday", @report.reload.name
+  end
+
+  # ---- accessible model ------------------------------------------------------
+
+  test "an accessible model's list and row still render" do
+    get machines_path
+    assert_response :success
+    assert_includes response.body, "Press"
+
+    get machine_path(@machine)
+    assert_response :success
+  end
+
+  test "an accessible model's new and create without update are a 400; nothing is created" do
+    get new_machine_path
+    assert_refused :bad_request
+
+    assert_no_difference -> { Machine.count } do
+      post machines_path, params: { name: "Lathe" }
+    end
+    assert_refused :bad_request
+  end
+
+  test "destroy by a user who may not hard-destroy is a 403 and keeps the record" do
+    ApplicationController.dummy_user_superadmin = false
+    frame = "machine_#{@machine.id}"
+
+    delete machine_path(@machine, update: frame), headers: frame_headers(frame)
+    assert_refused :forbidden
+    assert Machine.exists?(@machine.id)
+  end
+
+  # ---- file slots ------------------------------------------------------------
+
+  test "a refused file-slot request still counts as authorized" do
+    document = Document.create!(title: "Plan")
+    frame = "document_#{document.id}_filename"
+
+    post remove_file_document_path(document, attribute: "title", update: frame), headers: stream_headers(frame)
+    assert_refused :bad_request
+  end
+end

data/test/integration_test_helper.rb

@@ -49,6 +49,15 @@ ActiveRecord::Schema.define do
   end
   add_index :parts, :machine_id
 
+  # DailyReport: a not_accessible_through_html? child of Machine (shaped like
+  # StProject's Dagrapportage). See test/integration/html_refusal_test.rb.
+  create_table :daily_reports, force: true do |t|
+    t.string  :name
+    t.integer :machine_id
+    t.timestamps
+  end
+  add_index :daily_reports, :machine_id
+
   # Gizmo intentionally has NO `pending_note` column: its attribute_list
   # references one, modeling the inline_forms_addto pre-migrate window that
   # InlineForms.attribute_pending_migration? gates. See
@@ -163,9 +172,11 @@ class InlineFormsIntegrationTestCase < ActionDispatch::IntegrationTest
 
   setup do
     Ability.restrictions = nil
+    ApplicationController.dummy_user_superadmin = true
     Widget.delete_all
     Kind.delete_all
     Part.delete_all
+    DailyReport.delete_all
     Machine.delete_all
     Gizmo.delete_all
     Dossier.delete_all

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: inline_forms
 version: !ruby/object:Gem::Version
-  version: 8.1.55
+  version: 8.1.56
 platform: ruby
 authors:
 - Ace Suares
@@ -282,6 +282,7 @@ files:
 - test/archived_form_elements_test.rb
 - test/attribute_list_test.rb
 - test/dummy/app/controllers/application_controller.rb
+- test/dummy/app/controllers/daily_reports_controller.rb
 - test/dummy/app/controllers/documents_controller.rb
 - test/dummy/app/controllers/dossiers_controller.rb
 - test/dummy/app/controllers/gizmos_controller.rb
@@ -292,6 +293,7 @@ files:
 - test/dummy/app/helpers/application_helper.rb
 - test/dummy/app/models/ability.rb
 - test/dummy/app/models/application_record.rb
+- test/dummy/app/models/daily_report.rb
 - test/dummy/app/models/document.rb
 - test/dummy/app/models/dossier.rb
 - test/dummy/app/models/gizmo.rb
@@ -314,6 +316,7 @@ files:
 - test/inline_forms_generator_test.rb
 - test/integration/field_authorization_test.rb
 - test/integration/file_slots_test.rb
+- test/integration/html_refusal_test.rb
 - test/integration/inline_forms_crud_test.rb
 - test/integration/layout_title_test.rb
 - test/integration/legacy_elements_test.rb
@@ -363,6 +366,7 @@ test_files:
 - test/archived_form_elements_test.rb
 - test/attribute_list_test.rb
 - test/dummy/app/controllers/application_controller.rb
+- test/dummy/app/controllers/daily_reports_controller.rb
 - test/dummy/app/controllers/documents_controller.rb
 - test/dummy/app/controllers/dossiers_controller.rb
 - test/dummy/app/controllers/gizmos_controller.rb
@@ -373,6 +377,7 @@ test_files:
 - test/dummy/app/helpers/application_helper.rb
 - test/dummy/app/models/ability.rb
 - test/dummy/app/models/application_record.rb
+- test/dummy/app/models/daily_report.rb
 - test/dummy/app/models/document.rb
 - test/dummy/app/models/dossier.rb
 - test/dummy/app/models/gizmo.rb
@@ -395,6 +400,7 @@ test_files:
 - test/inline_forms_generator_test.rb
 - test/integration/field_authorization_test.rb
 - test/integration/file_slots_test.rb
+- test/integration/html_refusal_test.rb
 - test/integration/inline_forms_crud_test.rb
 - test/integration/layout_title_test.rb
 - test/integration/legacy_elements_test.rb