phlex-reactive 0.16.0 → 0.16.1

data/lib/phlex/reactive/held_fields.rb

@@ -14,9 +14,15 @@ module Phlex
     #
     #   def save(title: nil)
     #     authorize!(@note, to: :update?)
-    #     return conflict! if reactive_held_fields.include?("title") && title != @note.title
+    #     return reply.morph.refused("title") if reactive_held_fields.include?("title") && title != @note.title
     #     ...
     #
+    # A reply to the root's own request releases its marks: it answers exactly
+    # those values. A refusal (`reply.morph.refused`, issue #413) is sent back
+    # in the X-Reactive-Refused header, and the client keeps the marks it names,
+    # so the user's next keystroke is refused too until the action stores the
+    # field or the user takes the other value.
+    #
     # The header is UNTRUSTED input, like every request field: it carries names
     # only, never values, and is read as data — capped in bytes, count and
     # length, non-strings dropped, and filtered to the names the running action
@@ -26,6 +32,8 @@ module Phlex
     # It is a hint about what the user saw, not authorization.
     module HeldFields
       HEADER = "X-Reactive-Held"
+      # The response header a refusing reply sends (issue #413).
+      REFUSED_HEADER = "X-Reactive-Refused"
 
       # A raw header longer than this is ignored unparsed.
       MAX_BYTES = 4_096
@@ -62,6 +70,18 @@ module Phlex
           EMPTY
         end
 
+        # The X-Reactive-Refused value for Response#refused_fields: "*" keeps
+        # every mark, a JSON list keeps those names. ASCII only (a header is a
+        # byte string), as the client escapes X-Reactive-Held. A list past
+        # MAX_BYTES (a header a proxy may refuse) widens to "*": keeping more
+        # marks than named is safe, losing the refusal is not.
+        def refused_header(fields)
+          return "*" if fields == :all
+
+          json = JSON.generate(fields, ascii_only: true)
+          json.bytesize > MAX_BYTES ? "*" : json
+        end
+
         # Keep the strings among `names` that `action_def` declares as params.
         def filter(names, action_def)
           declared = declared_names(action_def)

data/lib/phlex/reactive/response.rb

@@ -19,6 +19,7 @@ module Phlex
     #   reply.remove                           # drop the element (e.g. moderation queue)
     #   reply.redirect(article_url(@article))  # slug changed -> Turbo.visit the new URL
     #   reply.replace.stream(Totals.update(@order))  # multi-stream
+    #   reply.morph.refused("title")           # answered, not stored: keep the field held
     class Response
       attr_reader :streams, :redirect_url, :token_component, :subject_component
 
@@ -351,8 +352,11 @@ data-reactive-ops="#{ERB::Util.html_escape(json)}"></turbo-stream>).html_safe
       # reply never allocates an empty array per Response.
       NO_SEGMENTS = [].freeze
 
+      # refused: what #refused recorded (issue #413) — nil, :all, or a frozen
+      # list of field names.
       def initialize(streams: [], redirect_url: nil, render_self: true, token_component: nil,
-                     subject_component: nil, deferred_segments: NO_SEGMENTS, pending_segments: NO_SEGMENTS)
+                     subject_component: nil, deferred_segments: NO_SEGMENTS, pending_segments: NO_SEGMENTS,
+                     refused: nil)
         @streams = streams.freeze
         @redirect_url = redirect_url
         @render_self = render_self
@@ -360,9 +364,14 @@ data-reactive-ops="#{ERB::Util.html_escape(json)}"></turbo-stream>).html_safe
         @subject_component = subject_component
         @deferred_segments = deferred_segments.freeze
         @pending_segments = pending_segments.freeze
+        @refused_fields = refused
         freeze
       end
 
+      # What the reply refused (issue #413): :all, the field names, or nil when
+      # it refused nothing.
+      attr_reader :refused_fields
+
       # The recorded reply.defer segments (issue #165), in call order. The
       # Response only RECORDS them; the endpoint (via the Defer module) builds
       # the placeholder + directive streams AFTER the action's transaction
@@ -388,7 +397,8 @@ data-reactive-ops="#{ERB::Util.html_escape(json)}"></turbo-stream>).html_safe
           token_component: @token_component,
           subject_component: @subject_component,
           deferred_segments: @deferred_segments,
-          pending_segments: @pending_segments
+          pending_segments: @pending_segments,
+          refused: @refused_fields
         )
       end
 
@@ -420,7 +430,8 @@ data-reactive-ops="#{ERB::Util.html_escape(json)}"></turbo-stream>).html_safe
           subject_component: @subject_component,
           deferred_segments: @deferred_segments +
             [Phlex::Reactive::Defer::Segment.new(component:, placeholder:, morph:)],
-          pending_segments: @pending_segments
+          pending_segments: @pending_segments,
+          refused: @refused_fields
         )
       end
 
@@ -464,10 +475,50 @@ data-reactive-ops="#{ERB::Util.html_escape(json)}"></turbo-stream>).html_safe
           token_component: @token_component || built.token_component,
           subject_component: @subject_component,
           deferred_segments: @deferred_segments,
-          pending_segments: @pending_segments + built.pending_segments
+          pending_segments: @pending_segments + built.pending_segments,
+          refused: @refused_fields
+        )
+      end
+
+      # Answer the posted values without storing them (issue #413). Every reply
+      # to a root's own request releases the fields a morph held (issue #370),
+      # because it answers exactly those values. A reply that refused them says
+      # so, and the client keeps the marks: the root's next action names the
+      # same fields in X-Reactive-Held again, instead of saving over the other
+      # change on the user's next keystroke.
+      #
+      #   if reactive_held_fields.include?("title") && title != @note.title
+      #     @conflict = title
+      #     return reply.morph.refused("title")
+      #   end
+      #
+      # No names keeps every mark the root holds; names (the fields' `name`
+      # attributes, as reactive_held_fields reports them) keep only those, and
+      # the root's other marks release as usual. Nothing else about the reply
+      # changes: it is a 200, with no error marker and no reactive:error.
+      # Returns a NEW Response (immutable). Dead on a redirect, like #defer.
+      def refused(*names)
+        if redirect?
+          raise Phlex::Reactive::Error,
+            "reply.refused on a redirect reply is dead — the client is navigating away, " \
+            "so there is no held field left to keep"
+        end
+
+        names = names.flatten.map { -it.to_s }.uniq.freeze
+        self.class.new(
+          streams: @streams,
+          redirect_url: @redirect_url,
+          render_self: @render_self,
+          token_component: @token_component,
+          subject_component: @subject_component,
+          deferred_segments: @deferred_segments,
+          pending_segments: @pending_segments,
+          refused: names.empty? ? :all : names
         )
       end
 
+      def refused? = !@refused_fields.nil?
+
       # Chain a `reactive:js` op stream — server-pushed client DOM ops (issue
       # #97) — onto this reply, so a focus/dispatch/class toggle runs on the
       # client after the render applies:

data/lib/phlex/reactive/test_helpers.rb

@@ -271,6 +271,12 @@ module Phlex
           @response&.redirect_url
         end
 
+        # The action answered without storing (reply.morph.refused, issue #413):
+        # the client keeps the fields it held.
+        def refused?
+          !@response.nil? && @response.refused?
+        end
+
         # The actor's turbo-stream strings, exactly as the endpoint would render
         # them (response_streams) — a legacy return is the single self-replace; a
         # Response is honored, with the same token-refresh streams appended.

data/lib/phlex/reactive/version.rb

@@ -2,6 +2,6 @@
 
 module Phlex
   module Reactive
-    VERSION = "0.16.0"
+    VERSION = "0.16.1"
   end
 end

data/sig/phlex/reactive/response.rbs

@@ -9,6 +9,7 @@ module Phlex
       attr_reader subject_component: untyped
       attr_reader deferred_segments: Array[untyped]
       attr_reader pending_segments: Array[untyped]
+      attr_reader refused_fields: (:all | Array[String])?
 
       # --- chaining ---
       def stream: (*String more) -> Response
@@ -17,6 +18,7 @@ module Phlex
       def also: (?untyped companion, ?morph: bool, **untyped targets) -> Response
       def defer: (untyped component, ?placeholder: untyped, ?morph: bool) -> Response
       def pending: (untyped records, ?peers: bool, ?job: untyped, ?args: untyped, **untyped opts) ?{ (?) -> untyped } -> Response
+      def refused: (*(String | Symbol | Array[String | Symbol]) names) -> Response
 
       # Removed: each raises a guided error naming its replacement.
       def also_update: (untyped target, **untyped) -> bot
@@ -28,6 +30,7 @@ module Phlex
       def refresh_token?: () -> bool
       def deferred?: () -> bool
       def pending?: () -> bool
+      def refused?: () -> bool
 
       # --- the builders `reply` delegates to ---
       def self.build_replace: (untyped component, ?morph: bool, ?effect: untyped) -> Response

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: phlex-reactive
 version: !ruby/object:Gem::Version
-  version: 0.16.0
+  version: 0.16.1
 platform: ruby
 authors:
 - Mikael Henriksson
@@ -149,6 +149,9 @@ files:
 - app/javascript/phlex/reactive/features/devtools.js
 - app/javascript/phlex/reactive/features/devtools.min.js
 - app/javascript/phlex/reactive/features/devtools.min.js.map
+- app/javascript/phlex/reactive/features/drag.js
+- app/javascript/phlex/reactive/features/drag.min.js
+- app/javascript/phlex/reactive/features/drag.min.js.map
 - app/javascript/phlex/reactive/features/effects.js
 - app/javascript/phlex/reactive/features/effects.min.js
 - app/javascript/phlex/reactive/features/effects.min.js.map
@@ -197,6 +200,8 @@ files:
 - lib/phlex/reactive/collections.rb
 - lib/phlex/reactive/component.rb
 - lib/phlex/reactive/component/countdown_binding.rb
+- lib/phlex/reactive/component/css_vars_binding.rb
+- lib/phlex/reactive/component/drag.rb
 - lib/phlex/reactive/component/dsl.rb
 - lib/phlex/reactive/component/editable.rb
 - lib/phlex/reactive/component/field_references.rb