phlex-reactive 0.16.13 → 0.16.14

data/app/javascript/phlex/reactive/runtime.js

@@ -1416,6 +1416,12 @@ const CLIENT_OPS = Object.freeze({
   show_modal: (el) => showModal(el),
   close_dialog: (el) => closeDialog(el),
 
+  // Click op (issue #471): HTMLElement#click(), the browser's own activation
+  // (a link visit through Turbo Drive, a form submit, a checkbox toggle).
+  // FIRST match only (FIRST_MATCH_OPS). Gesture-only: the server refuses it in
+  // every pushed op (JS::GESTURE_OPS).
+  click: (el) => el.click?.(),
+
   // Text op (issue #159): set textContent — XSS-safe by construction (never
   // innerHTML), strictly less powerful than set_attr. Change-guarded like
   // #mirrorText. With global: true it is the cross-root text escape: paint a
@@ -2114,6 +2120,10 @@ function bindingsAlreadyRan(event, controller) {
   return false
 }
 
+// Ops that act on the first match only (issue #471): clicking every match
+// would follow several links or submit several forms.
+const FIRST_MATCH_OPS = new Set(["click"])
+
 // Interpret a [[name, args], ...] op list against the frozen CLIENT_OPS
 // whitelist (issues #95/#96/#97). `resolveTargets(args)` returns the element(s)
 // an op applies to — the controller scopes to its root (excluding nested
@@ -2130,8 +2140,9 @@ function applyOps(list, resolveTargets, onZeroTargets) {
       console.warn(`[phlex-reactive] unknown client op ${JSON.stringify(name)} — skipped`)
       continue
     }
-    const targets = resolveTargets(args)
+    let targets = resolveTargets(args)
     if (targets.length === 0 && onZeroTargets) onZeroTargets(name, args)
+    if (targets.length > 1 && FIRST_MATCH_OPS.has(name)) targets = targets.slice(0, 1)
     if (targets.length > 0) args = readArgs(name, args, resolveTargets, onZeroTargets)
     if (!args) continue
     for (const el of targets) {

data/lib/phlex/reactive/component/editable.rb

@@ -64,6 +64,9 @@ module Phlex
           end
           raise ArgumentError, "reactive_editable on_enter: got a JS chain with no ops — a dead Enter" if on_enter.empty?
 
+          # Issue #471: the Enter runs root-scoped, with no trigger element —
+          # js.click's default (:trigger) would resolve to nothing.
+          Phlex::Reactive::JS.refuse_trigger!(on_enter, "a reactive_editable on_enter: chain")
           on_enter.ops.to_json
         end
 

data/lib/phlex/reactive/component/helpers.rb

@@ -547,6 +547,15 @@ module Phlex
               "submit event this trigger is bound to. Bind the submit op to another event " \
               "(change/input), or gate it behind a reducer's $ops / reactive_on_complete."
           end
+          # Issue #471: el.click() dispatches the very click this trigger is
+          # bound to, and the binding prevents its default — the activation
+          # would be lost.
+          if event == "click" && self_click?(ops)
+            raise ArgumentError,
+              "on_client(:click, js.click) on its own trigger cancels itself — the synthetic click " \
+              "re-enters this binding, which prevents its default. Bind it to another event " \
+              "(\"keydown.space\"), or click another element (js.click(\"#target\"))."
+          end
           shortcut = client_shortcut!(event, shortcut, window:, outside:)
           keeps_default!("on_client(#{event.inspect})", prevent, shortcut) unless prevent == true
           window_bound = window || outside || !shortcut.nil?
@@ -1660,6 +1669,15 @@ module Phlex
           record
         end
 
+        # Issue #471: a click op aimed at the trigger. A hand-built chain may
+        # carry Symbol names and keys, or no args Hash.
+        def self_click?(ops)
+          ops.ops.any? do |name, args|
+            name.to_s == "click" && args.is_a?(Hash) &&
+              (args["to"] || args[:to]) == Phlex::Reactive::JS::TRIGGER_SENTINEL
+          end
+        end
+
         # Issue #442: validate on_client's within: — a non-empty CSS selector,
         # on an element-bound binding that can survive a miss.
         def client_within!(event, within, window:, outside:, shortcut:, once:)

data/lib/phlex/reactive/js.rb

@@ -145,6 +145,29 @@ module Phlex
         end
       end
 
+      # Ops the server never pushes (issue #471): click activates an element
+      # (follows a link, submits a form), so a reply or a broadcast that lands
+      # later must not carry it. Stricter than the broadcast-only refusal of
+      # focus/submit (Streamable::BROADCAST_REFUSED_OPS).
+      GESTURE_OPS = %w[click].freeze
+
+      # Raise when `list` (a JS chain or a raw [[op, args]] list) carries a
+      # gesture-only op. Called for every op the server pushes
+      # (Response.js_ops_json: reply.js, a settle's js and broadcast_to(js:)).
+      # A pushed dispatch("click") stays allowed (it may run an on(:action)
+      # click binding, as it always could), so it can reach a :click binding
+      # that holds js.click — the developer's wiring, like set_value's input.
+      def self.refuse_gesture_ops!(list)
+        pairs = list.is_a?(JS) ? list.ops : Array(list)
+        refused = pairs.filter_map { |op, _| op.to_s if GESTURE_OPS.include?(op.to_s) }.uniq
+        return if refused.empty?
+
+        raise ArgumentError,
+          "#{self}: a server-pushed op (reply.js, broadcast_to(js:)) refuses #{refused.join(", ")} — " \
+          "click activates an element (follows a link, submits a form), so the server never pushes " \
+          "it. Answer with reply.redirect for a visit, or bind js.click with on_client."
+      end
+
       # Raise when an op in `list` (a JS chain or a raw [[op, args]] list)
       # names @trigger (a target, from:, or dispatch's detail_from:, which
       # reads off it). Called for every op the server pushes
@@ -322,6 +345,34 @@ module Phlex
         append("blur", target_args(to, global:))
       end
 
+      # --- Click (issue #471) ---
+      #
+      # click(to = :trigger) — HTMLElement#click() on the FIRST match: the
+      # browser's own activation, as a user click would run it. A link follows
+      # its href (through Turbo Drive, with its own data-turbo-* attributes), a
+      # submit button submits its form, a checkbox toggles. The default target
+      # is the trigger, so a link that should also answer Space reads
+      #   a(href: item_path(item), **on_client("keydown.space", js.click)) { item.name }
+      # (the binding prevents the keydown's default, so Space does not scroll).
+      #
+      # The synthetic click bubbles like a real one: a click binding on the
+      # target or an ancestor prevents its default (and so the activation)
+      # unless it was bound with prevent: false. on_client(:click, js.click) on
+      # its own trigger is refused at render for that reason.
+      #
+      # NEVER SERVER-PUSHED, stricter than focus: refused in every server-pushed
+      # op (reply.js, a settle's js, broadcast_to(js:)) — a reply that lands
+      # later would navigate without a gesture. on_client, a raw ["click", …] pair in a reducer's $ops and
+      # reactive_on_complete may carry it. The last two run on an input event,
+      # and a reply's set_value fires one too, so a reply can reach a click
+      # there — the same exposure submit has; so can a pushed
+      # dispatch("click") reaching a :click binding that holds it. A held key repeats its keydown,
+      # and each repeat clicks again.
+
+      def click(to = :trigger, global: false)
+        append("click", target_args(to, global:))
+      end
+
       # --- Modal dialogs (issue #365) ---
       #
       # show_modal(to)   — HTMLDialogElement#showModal(): the top layer, a

data/lib/phlex/reactive/response.rb

@@ -304,12 +304,14 @@ data-reactive-ops="#{ERB::Util.html_escape(json)}"></turbo-stream>).html_safe
         # site), so fail loudly rather than emit an inert tag.
         # Every op the server pushes (reply.js, broadcast_to(js:)) passes here,
         # so this is where @trigger is refused for a chain too (issue #442): a
-        # pushed op has no element whose binding fired.
+        # pushed op has no element whose binding fired. So is a gesture-only op
+        # (click, issue #471).
         def js_ops_json(ops)
           if ops.is_a?(Phlex::Reactive::JS)
             raise ArgumentError, "js(...) got no ops — a dead reactive:js stream" if ops.empty?
 
             Phlex::Reactive::JS.refuse_trigger!(ops)
+            Phlex::Reactive::JS.refuse_gesture_ops!(ops)
             ops.to_json
           else
             list = Array(ops)
@@ -319,6 +321,7 @@ data-reactive-ops="#{ERB::Util.html_escape(json)}"></turbo-stream>).html_safe
             # list skips that, so re-apply the allowlist here (defense in depth —
             # the client interpreter also refuses on*/URL/style attrs).
             Phlex::Reactive::JS.assert_ops_allowed!(list)
+            Phlex::Reactive::JS.refuse_gesture_ops!(list)
             list.to_json
           end
         end

data/lib/phlex/reactive/streamable.rb

@@ -44,14 +44,19 @@ module Phlex
       # and close_dialog (issue #365) would open or close a modal, and move
       # focus, on every screen at once; set_value (issue #374) would overwrite
       # every subscriber's field; preview_file (issue #375) would read every
-      # subscriber's file input. They
+      # subscriber's file input; click (issue #471) would follow a link or
+      # submit a form on every subscriber's page. They
       # belong to the actor's own reply (reply.js) or gesture (on_client / a
-      # reducer's $ops), never a broadcast. Names mirror Phlex::Reactive::JS's verbs.
+      # reducer's $ops), never a broadcast — except click, which reply.js
+      # refuses too (Phlex::Reactive::JS::GESTURE_OPS): bind it with on_client
+      # (or a raw ["click", …] pair in a reducer's $ops).
+      # Names mirror Phlex::Reactive::JS's verbs.
       BROADCAST_REFUSED_OPS = %w[
         focus focus_first blur submit paste_into persist_state persist_clear check_group presence
         show_modal close_dialog
         preview_file
         set_value
+        click
       ].freeze
       # Refused as a FLAG, on any op (issue #369): keep: records client state in
       # the tab that ran the op, so a broadcast carrying it would plant that
@@ -241,7 +246,9 @@ module Phlex
               "broadcasting show_modal or close_dialog opens or closes a modal (and moves focus) on " \
               "every screen — render the dialog open or closed, with data: { reactive_modal: true }, instead. " \
               "Broadcasting preview_file reads every subscriber's chosen file onto their page. " \
-              "These are actor concerns (reply.js / on_client / $ops)."
+              "Broadcasting click follows a link or submits a form on every subscriber's page. " \
+              "These are actor concerns (reply.js / on_client / $ops); click is never server-pushed — " \
+              "reply.js refuses it too: bind it with on_client (or a raw [\"click\", …] pair in a reducer's $ops)."
           end
           refuse_kept_broadcast_ops!(pairs)
 

data/lib/phlex/reactive/version.rb

@@ -2,6 +2,6 @@
 
 module Phlex
   module Reactive
-    VERSION = "0.16.13"
+    VERSION = "0.16.14"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: phlex-reactive
 version: !ruby/object:Gem::Version
-  version: 0.16.13
+  version: 0.16.14
 platform: ruby
 authors:
 - Mikael Henriksson