phlex-reactive 0.4.0 → 0.4.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8811ee6a3c0f044fd7c9d16843a641296b33b8fcb5872f5bc8822257f837148e
-  data.tar.gz: 9398a1c088680e83b8bed3398342345ceb817703183df0985a1948e29df021cf
+  metadata.gz: 8ec8a731ff4ae0e729288d805070e04c8860b7a51591a69b946ed42bd4996d97
+  data.tar.gz: '018dafe55b68a05a46ef52c4e896803a9933beecf50e87f1d428073065fd3205'
 SHA512:
-  metadata.gz: b17a5d83f62e801d0f8673f824f929a82d1c7efc2d0aa2274034639ed94b2c8c4723f11484427f051c7be15d523a0b99cd11594bed0d701e4ff2e07604a1edd8
-  data.tar.gz: b5990726c0531bd2d6bc2da23df8bb2dbf5220ee702306c86f8094690da8c4a1752fa8ffb7949261050858256e5fd70854491603ac2306221c9f7bf2078f943c
+  metadata.gz: 949549bc92c39def933aea8d83cf61db41ad686c8184c8a284657bdd99e1178dece129258e0e874ec1dd157748f69fcd11dc77fe140557c20d7dab217500a46b
+  data.tar.gz: ab245aa3bf1a4f65f392ae2c4b3e98cf20a6d45064375a2c2168b2c7214ed4d27bc78c6cd0f069d2ef82cad771ee233376742de6e22636f5b0efb81390f5b8ea

data/CHANGELOG.md

@@ -72,6 +72,52 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ### Fixed
 
+- **Collections of *reactive* rows were still add-once-only — a prepended/appended
+  row's OWN token suppressed the container's token refresh (#44).** When an action
+  appended/prepended a *reactive* child row into a container whose `#id` equals the
+  append target (the most common collection shape — rows go directly into the
+  container element), that single `append`/`prepend` stream carried BOTH
+  `target="<container>"` and the row's own `data-reactive-token-value` (embedded in
+  the `<template>`). `carries_token_for?` matched
+  `include?("data-reactive-token-value") && include?(target)` in that one string →
+  both true → it concluded the container's token was already fresh and **skipped**
+  the container's `reactive:token` refresh. So the container (which owns the
+  add/remove trigger) never rolled its token forward, and the second dispatch was
+  rejected with the stale token — the list silently stopped after the first add.
+  This hit both the hand-rolled `reply.streams(Row.prepend(...), …)` form **and**
+  the `reactive_collection` / `reply.append`/`reply.prepend` helper, since they
+  share the gate. Fixed by tightening `carries_token_for?`: a stream "carries the
+  token for C" only when its action RE-RENDERS C itself (`replace`/`update`/
+  `reactive:token` at C's target) — `append`/`prepend` (which insert *children*
+  into C) never count, because a reactive child's token is not the container's. The
+  idempotency the gate provided is preserved (a caller's own self-replace still
+  suppresses the duplicate token) and the #30 sibling case still refreshes
+  correctly. Covered at the request level: a reactive row appended twice in a row
+  (the second using the token the first rolled forward) now succeeds, and each
+  response carries a `reactive:token` stream targeting the container with a
+  non-empty token. Refs cosmos#1939, #35, #30.
+
+- **0.4.0 regression: re-renders lost the `request`, crashing `form_authenticity_token`
+  and other request-dependent helpers (#42).** The 0.4.0 render-path perf rework
+  built the cached off-request view context from a bare
+  `ActionController::Base.new.view_context`, whose controller has `request == nil`.
+  Any reactive component whose `view_template` calls `form_authenticity_token`,
+  `protect_against_forgery?`, or a host-aware URL helper (all of which read
+  `request.env`) then raised `NoMethodError: undefined method 'env' for nil` on
+  **every** re-render — through the action endpoint AND on broadcasts — so any app
+  with a reactive component rendering a Rails CSRF form could not adopt 0.4.0. Fixed
+  by building the cached view context through a request-bound controller
+  (`Phlex::Reactive.request_bound_view_context`), replicating exactly what
+  `ActionController::Renderer#render` does to set up its mock request: an
+  `ActionDispatch::Request` whose host is derived from the routes'
+  `default_url_options`. The 0.4.0 `render_in` speedup is kept — the request is set
+  up once when the per-thread context is built (not per render), and steady-state
+  render throughput/allocations are unchanged (retained-per-render stays 0). Covered
+  at the request level (a reactive `save` re-rendering a CSRF form returns 200, not
+  500), the broadcast level (the form component broadcasts without crashing), and the
+  unit level (a request is present on the cached context; host-aware `*_url` helpers
+  resolve when the renderer carries routes).
+
 - **Multipart path silently dropped an explicit nested-hash / array param (#39).**
   When an action declared a `:file` param alongside an explicit nested (hash/array)
   param, the nested param was dropped on the multipart path while the JSON path

data/app/controllers/phlex/reactive/actions_controller.rb

@@ -107,15 +107,49 @@ module Phlex
         streams
       end
 
-      # True when one of `streams` already carries a fresh token TARGETING this
-      # component — i.e. the caller hand-built the actor's own token-bearing
-      # stream, so appending to_stream_token would double it. Scoped to the
-      # component's target id (not a global substring) so a sibling component's
-      # stream, which carries its OWN token for a DIFFERENT target, doesn't fool
-      # us into skipping this component's refresh.
+      # Actions that RE-RENDER the component's own root (so the root's fresh
+      # data-reactive-token-value rolls the signed token forward). `append`/
+      # `prepend` are deliberately excluded: they insert CHILDREN into the
+      # component, and a reactive child carries its OWN token — that child token is
+      # not the component's (issue #44). reactive:token is our inert token-only
+      # refresh; replace/update re-render the root.
+      SELF_RENDER_ACTIONS = %w[replace update reactive:token].freeze
+      private_constant :SELF_RENDER_ACTIONS
+
+      # True when one of `streams` already carries a fresh token by RE-RENDERING
+      # this component itself — i.e. the caller hand-built the actor's own
+      # token-bearing stream, so appending to_stream_token would double it.
+      #
+      # The match requires BOTH (a) the stream's action re-renders the component's
+      # ROOT (replace/update/reactive:token — never append/prepend, which insert
+      # children) AND (b) it targets the component's id AND (c) it actually carries
+      # a token. This is stricter than a same-string substring check on purpose:
+      #   * A sibling component's replace targets a DIFFERENT id → (b) fails, so we
+      #     still refresh ours (issue #30).
+      #   * A reactive child row appended/prepended INTO the component carries its
+      #     own token at the component's target, but the action is append/prepend →
+      #     (a) fails, so we still refresh the CONTAINER's token (issue #44). Before
+      #     this, the child's token at the container target suppressed the
+      #     container's refresh and the list was add-once-only.
       def carries_token_for?(streams, component)
         target = %(target="#{ERB::Util.html_escape(component.id)}")
-        streams.any? {  it.include?("data-reactive-token-value") && it.include?(target) }
+        streams.any? do
+          it.include?("data-reactive-token-value") &&
+            it.include?(target) &&
+            self_render_stream_for?(it, target)
+        end
+      end
+
+      # Does this turbo-stream's OPENING tag re-render `target` itself? Matches a
+      # `<turbo-stream action="<self-render>" ... target="<id>">` opening tag — the
+      # action and target on the SAME tag — so a child row's token embedded in an
+      # append/prepend `<template>` can never count as the container's own refresh.
+      def self_render_stream_for?(stream, target)
+        open_tag = stream[/<turbo-stream\b[^>]*>/]
+        return false unless open_tag&.include?(target)
+
+        action = open_tag[/\baction="([^"]+)"/, 1]
+        SELF_RENDER_ACTIONS.include?(action)
       end
 
       # A 200 turbo-stream carrying a namespaced custom action the client turns

data/lib/phlex/reactive/streamable.rb

@@ -83,7 +83,10 @@ module Phlex
 
         # Turbo::Streams::TagBuilder needs a real VIEW CONTEXT (it calls
         # `.formats` on it), not a controller class. Build one off-request from
-        # the configured renderer controller. Memoized PER THREAD — building a
+        # the configured renderer controller, bound to a real request so
+        # request-dependent helpers (form_authenticity_token, host-aware URL
+        # helpers) work during a re-render/broadcast (issue #42). Memoized PER
+        # THREAD — building a
         # view context instantiates the renderer controller and assembles its
         # whole helper module set, so doing it per render/broadcast was the
         # hottest server-side allocation in the action round trip. The builder
@@ -260,7 +263,7 @@ module Phlex
           cached = store[self]
 
           unless cached && cached.renderer.equal?(current) && cached.generation == generation
-            view_context = current.new.view_context
+            view_context = Phlex::Reactive.request_bound_view_context(current)
             cached = ThreadViewContext.new(
               view_context,
               ::Turbo::Streams::TagBuilder.new(view_context),

data/lib/phlex/reactive/version.rb

@@ -2,6 +2,6 @@
 
 module Phlex
   module Reactive
-    VERSION = "0.4.0"
+    VERSION = "0.4.2"
   end
 end

data/lib/phlex/reactive.rb

@@ -78,6 +78,30 @@ module Phlex
         @renderer ||= defined?(::ActionController::Base) ? ::ActionController::Base : nil
       end
 
+      # Build an off-request view context whose controller has a REAL `request`.
+      #
+      # A bare `controller.new.view_context` (the naive off-request context) has
+      # `request == nil`, so any request-dependent helper raises
+      # `undefined method 'env' for nil` — form_authenticity_token,
+      # protect_against_forgery?, and host-aware URL helpers all read
+      # `request.env` (issue #42). We replicate exactly what
+      # ActionController::Renderer#render does to set up its mock request — build
+      # an ActionDispatch::Request from the renderer's env (which derives the host
+      # from the routes' default_url_options), bind the routes, and attach it —
+      # then return the controller's view context instead of rendering a template.
+      # The result keeps the 0.4.0 render_in speedup (no renderer.render
+      # machinery) while restoring the request those helpers need.
+      def request_bound_view_context(controller_class)
+        ar_renderer = controller_class.renderer
+        request = ::ActionDispatch::Request.new(ar_renderer.send(:env_for_request))
+        request.routes = controller_class._routes
+
+        instance = controller_class.new
+        instance.set_request!(request)
+        instance.set_response!(controller_class.make_response!(request))
+        instance.view_context
+      end
+
       # DOM id of the host-app container a Response#flash appends into.
       # Default "flash"; override to match your layout's flash region.
       def flash_target
@@ -136,7 +160,7 @@ module Phlex
         generation = off_request_view_context_generation
 
         unless cache && cache[:renderer].equal?(current) && cache[:generation] == generation
-          view_context = current.new.view_context
+          view_context = request_bound_view_context(current)
           cache = {
             view_context: view_context,
             builder: ::Turbo::Streams::TagBuilder.new(view_context),

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: phlex-reactive
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.4.2
 platform: ruby
 authors:
 - Mikael Henriksson