plutonium 0.48.0 → 0.49.1

data/lib/plutonium/resource/policy.rb

@@ -67,16 +67,31 @@ module Plutonium
             raise ArgumentError, "parent and parent_association must both be provided together"
           end
 
-          # Parent association scoping (nested routes)
-          # The parent was already entity-scoped during authorization, so children
-          # accessed through the parent don't need additional entity scoping
+          # Parent association scoping (nested routes).
+          #
+          # The parent context is set on the policy for the whole request, so it
+          # leaks into sibling lookups too — e.g. a SecureAssociation field on
+          # the child's form authorizes an unrelated resource scope while
+          # parent/parent_association are still set. Only apply parent scoping
+          # when the relation actually corresponds to the parent's named
+          # association; otherwise fall through to entity scoping so we don't
+          # produce an incoherent (and silently empty) result.
           assoc_reflection = parent.class.reflect_on_association(parent_association)
-          if assoc_reflection.collection?
-            # has_many: merge with the association's scope
-            parent.public_send(parent_association).merge(relation)
+          if assoc_reflection && relation.klass <= assoc_reflection.klass
+            # The parent was already entity-scoped during authorization, so
+            # children accessed through the parent don't need additional
+            # entity scoping.
+            if assoc_reflection.collection?
+              # has_many: merge with the association's scope
+              parent.public_send(parent_association).merge(relation)
+            else
+              # has_one: scope by foreign key
+              relation.where(assoc_reflection.foreign_key => parent.id)
+            end
+          elsif entity_scope
+            relation.associated_with(entity_scope)
           else
-            # has_one: scope by foreign key
-            relation.where(assoc_reflection.foreign_key => parent.id)
+            relation
           end
         elsif entity_scope
           # Entity scoping (multi-tenancy)

data/lib/plutonium/rodauth/controller_methods.rb

@@ -15,7 +15,11 @@ module Plutonium
       private
 
       def root_path
-        rodauth.login_redirect
+        if main_app.routes.url_helpers.respond_to?(:root_path)
+          main_app.root_path
+        else
+          rodauth.login_redirect
+        end
       end
     end
   end

data/lib/plutonium/ui/color_mode_selector.rb

@@ -6,32 +6,21 @@ module Plutonium
     # @example Basic usage
     #   render ColorModeSelector.new
     class ColorModeSelector < Plutonium::UI::Component::Base
-      # Common CSS classes used across the component
-      COMMON_CLASSES = {
-        button: "inline-flex justify-center items-center p-2 text-[var(--pu-text-muted)] rounded-[var(--pu-radius-md)] cursor-pointer hover:text-[var(--pu-text)] hover:bg-[var(--pu-surface-alt)] transition-colors duration-200",
-        icon: "w-5 h-5"
-      }.freeze
+      BUTTON_CLASSES = "inline-flex justify-center items-center p-2 text-[var(--pu-text-muted)] rounded-[var(--pu-radius-md)] cursor-pointer hover:text-[var(--pu-text)] hover:bg-[var(--pu-surface-alt)] transition-colors duration-200"
+      ICON_SIZE = 18
+      ICON_STROKE = 1.5
 
-      # Available color modes with their associated icons and actions
-      COLOR_MODES = [
-        {mode: "light", icon: Phlex::TablerIcons::Sun, action: "setLightColorMode"},
-        {mode: "dark", icon: Phlex::TablerIcons::Moon, action: "setDarkColorMode"}
-      ].freeze
-
-      # Renders the color mode selector
-      # @return [void]
       def view_template
         button(
           type: "button",
-          class: COMMON_CLASSES[:button],
+          class: BUTTON_CLASSES,
           data_controller: "color-mode",
           data_action: "click->color-mode#toggleMode",
-          data_color_mode_current_value: "light", # Default to light mode
           title: "Toggle color mode"
         ) do
-          # Both icons rendered, only one visible at a time
-          render Phlex::TablerIcons::Sun.new(class: "#{COMMON_CLASSES[:icon]} color-mode-icon-light", data: {color_mode_icon: "light"})
-          render Phlex::TablerIcons::Moon.new(class: "#{COMMON_CLASSES[:icon]} color-mode-icon-dark", data: {color_mode_icon: "dark"})
+          render Phlex::TablerIcons::DeviceDesktop.new(size: ICON_SIZE, stroke: ICON_STROKE, class: "color-mode-icon-auto")
+          render Phlex::TablerIcons::Sun.new(size: ICON_SIZE, stroke: ICON_STROKE, class: "color-mode-icon-light hidden")
+          render Phlex::TablerIcons::Moon.new(size: ICON_SIZE, stroke: ICON_STROKE, class: "color-mode-icon-dark hidden")
         end
       end
     end

data/lib/plutonium/ui/layout/rodauth_layout.rb

@@ -15,6 +15,12 @@ module Plutonium
           class: "flex flex-col items-center justify-center gap-2 px-6 py-8 mx-auto lg:py-0"
         })
 
+        def render_before_main
+          div(class: "absolute top-4 right-4") {
+            render Plutonium::UI::ColorModeSelector.new
+          }
+        end
+
         def render_content(&)
           render_logo
 

data/lib/plutonium/ui/layout/sidebar.rb

@@ -35,7 +35,7 @@ module Plutonium
         def render_content(&)
           div(
             id: "sidebar-navigation-content",
-            data: {turbo_permanent: true},
+            data: {turbo_permanent: true, sidebar_target: "scroll"},
             class: "overflow-y-auto py-5 px-3 h-full bg-[var(--pu-surface)] border-r border-[var(--pu-border)]",
             &
           )

data/lib/plutonium/ui/table/components/pagy_info.rb

@@ -55,7 +55,7 @@ module Plutonium
           end
 
           def page_url(limit)
-            @pagy.page_url(@pagy.page, limit: limit, client_max_limit: limit)
+            @pagy.page_url(@pagy.page, limit: limit, max_limit: limit)
           end
         end
       end

data/lib/plutonium/version.rb

@@ -1,5 +1,5 @@
 module Plutonium
-  VERSION = "0.48.0"
+  VERSION = "0.49.1"
   NEXT_MAJOR_VERSION = VERSION.split(".").tap { |v|
     v[1] = v[1].to_i + 1
     v[2] = 0

data/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@radioactive-labs/plutonium",
-  "version": "0.48.0",
+  "version": "0.49.1",
   "description": "Build production-ready Rails apps in minutes, not days. Convention-driven, fully customizable, AI-ready.",
   "type": "module",
   "main": "src/js/core.js",

data/plutonium.gemspec

@@ -16,6 +16,22 @@ Gem::Specification.new do |spec|
 
   spec.metadata["allowed_push_host"] = "https://rubygems.org"
 
+  spec.post_install_message = <<~MSG
+    ⚠️  Plutonium #{Plutonium::VERSION} — breaking change
+
+    Entity-scoped URL helpers and path params have been renamed from
+    `<entity>_scope_*` to `<entity>_scoped_*`.
+
+    Examples:
+      organization_scope_widgets_path  →  organization_scoped_widgets_path
+      params[:organization_scope]      →  params[:organization_scoped]
+
+    If you reference these helpers or params directly (e.g. in tests, custom
+    redirects, or hand-written links), update them to the new names.
+
+    Apps that only use `resource_url_for` are unaffected.
+  MSG
+
   spec.metadata["homepage_uri"] = spec.homepage
   spec.metadata["source_code_uri"] = "https://github.com/radioactive-labs/plutonium-core"
   # spec.metadata["changelog_uri"] = "https://google.com"

data/src/js/controllers/color_mode_controller.js

@@ -1,66 +1,73 @@
 import { Controller } from "@hotwired/stimulus";
 
 // Connects to data-controller="color-mode"
+//
+// Shared theme state across the app. localStorage key 'theme' holds one of:
+//   'auto'  — follow prefers-color-scheme (default when unset)
+//   'light' — force light
+//   'dark'  — force dark
+const ORDER = ['auto', 'light', 'dark'];
+
 export default class extends Controller {
   static values = { current: String };
 
   connect() {
-    // Set initial mode from localStorage or default
-    const mode = localStorage.getItem('theme') || "light";
-    this.setMode(mode);
+    this.applyMode(this.readMode());
 
-    // Listen for cross-tab theme changes
     this.handleStorageChange = (e) => {
-      console.log('Storage event received in color-mode controller:', e.key, e.newValue, e.oldValue)
-      if (e.key === 'theme' && e.newValue) {
-        console.log('Updating color-mode theme to:', e.newValue)
-        this.setMode(e.newValue);
-      }
+      if (e.key === 'theme') this.applyMode(this.readMode());
     };
     window.addEventListener('storage', this.handleStorageChange);
+
+    this.mq = window.matchMedia('(prefers-color-scheme: dark)');
+    this.handleMqChange = () => {
+      if (this.readMode() === 'auto') this.applyMode('auto');
+    };
+    this.mq.addEventListener('change', this.handleMqChange);
   }
 
   disconnect() {
-    // Clean up event listener
     window.removeEventListener('storage', this.handleStorageChange);
+    if (this.mq) this.mq.removeEventListener('change', this.handleMqChange);
   }
 
   toggleMode() {
-    const current = this.currentValue || "light";
-    const next = current === "light" ? "dark" : "light";
+    const current = this.readMode();
+    const next = ORDER[(ORDER.indexOf(current) + 1) % ORDER.length];
     this.setMode(next);
   }
 
   setMode(mode) {
-    // Update html class
-    if (mode === "dark") {
-      document.documentElement.classList.add("dark");
-    } else {
-      document.documentElement.classList.remove("dark");
-    }
+    localStorage.setItem('theme', mode);
+    this.applyMode(mode);
+  }
 
-    // Update button state
+  applyMode(mode) {
+    const effective = this.effectiveMode(mode);
+    document.documentElement.classList.toggle('dark', effective === 'dark');
     this.currentValue = mode;
-
-    // Show/hide icons
     this.toggleIcons(mode);
+  }
 
-    // Store in localStorage to trigger storage events in other tabs
-    localStorage.setItem('theme', mode);
+  readMode() {
+    const saved = localStorage.getItem('theme');
+    return ORDER.includes(saved) ? saved : 'auto';
   }
 
-  toggleIcons(mode) {
-    const sun = this.element.querySelector(".color-mode-icon-light");
-    const moon = this.element.querySelector(".color-mode-icon-dark");
+  effectiveMode(mode) {
+    if (mode === 'light' || mode === 'dark') return mode;
+    return window.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light';
+  }
 
-    if (sun && moon) {
-      if (mode === "light") {
-        sun.classList.remove("hidden");
-        moon.classList.add("hidden");
-      } else {
-        sun.classList.add("hidden");
-        moon.classList.remove("hidden");
-      }
+  toggleIcons(mode) {
+    const icons = {
+      auto: this.element.querySelector(".color-mode-icon-auto"),
+      light: this.element.querySelector(".color-mode-icon-light"),
+      dark: this.element.querySelector(".color-mode-icon-dark"),
+    };
+    for (const [key, el] of Object.entries(icons)) {
+      if (!el) continue;
+      el.classList.toggle("hidden", key !== mode);
     }
   }
 }

data/src/js/controllers/flatpickr_controller.js

@@ -54,7 +54,30 @@ export default class extends Controller {
     }
 
     if (this.modal) {
+      // Inside a <dialog> opened via showModal(), the dialog establishes its
+      // own containing block in the top layer. flatpickr's default positioning
+      // computes document coordinates but the calendar (appended to the
+      // dialog) interprets them relative to the dialog's box, placing the
+      // calendar far from the input. Append to the modal and reposition
+      // manually relative to the modal's bounding rect.
       options.appendTo = this.modal;
+      options.position = (instance) => {
+        const input = instance.altInput || instance.input;
+        const inputRect = input.getBoundingClientRect();
+        const modalRect = this.modal.getBoundingClientRect();
+        const cal = instance.calendarContainer;
+        const calHeight = cal.offsetHeight;
+        const spaceBelow = window.innerHeight - inputRect.bottom;
+        const showAbove = spaceBelow < calHeight && inputRect.top > calHeight;
+        const top = showAbove
+          ? inputRect.top - modalRect.top - calHeight - 2
+          : inputRect.bottom - modalRect.top + 2;
+        cal.style.top = `${top}px`;
+        cal.style.left = `${inputRect.left - modalRect.left}px`;
+        cal.style.right = "auto";
+        cal.classList.toggle("arrowTop", !showAbove);
+        cal.classList.toggle("arrowBottom", showAbove);
+      };
     }
 
     return options;

data/src/js/controllers/sidebar_controller.js

@@ -1,3 +1,30 @@
 import { Controller } from "@hotwired/stimulus";
 
-export default class extends Controller {}
+// Persists across controller reconnects so the value saved on
+// turbo:before-render is still available on turbo:render, even though
+// the <aside> hosting this controller is replaced during navigation.
+let savedScrollTop = 0;
+
+export default class extends Controller {
+  static targets = ["scroll"];
+
+  connect() {
+    this.beforeRender = this.beforeRender.bind(this);
+    this.afterRender = this.afterRender.bind(this);
+    document.addEventListener("turbo:before-render", this.beforeRender);
+    document.addEventListener("turbo:render", this.afterRender);
+  }
+
+  disconnect() {
+    document.removeEventListener("turbo:before-render", this.beforeRender);
+    document.removeEventListener("turbo:render", this.afterRender);
+  }
+
+  beforeRender() {
+    if (this.hasScrollTarget) savedScrollTop = this.scrollTarget.scrollTop;
+  }
+
+  afterRender() {
+    if (this.hasScrollTarget) this.scrollTarget.scrollTop = savedScrollTop;
+  }
+}

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: plutonium
 version: !ruby/object:Gem::Version
-  version: 0.48.0
+  version: 0.49.1
 platform: ruby
 authors:
 - Stefan Froelich
 bindir: exe
 cert_chain: []
-date: 2026-04-16 00:00:00.000000000 Z
+date: 2026-05-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: zeitwerk
@@ -610,6 +610,8 @@ files:
 - docs/superpowers/plans/2026-04-08-plutonium-skills-overhaul.md
 - docs/superpowers/plans/2026-04-14-plutonium-testing.md
 - docs/superpowers/plans/2026-04-14-plutonium-testing.md.tasks.json
+- docs/superpowers/plans/2026-05-06-multi-invite-model-support.md
+- docs/superpowers/plans/2026-05-06-multi-invite-model-support.md.tasks.json
 - docs/superpowers/specs/2026-04-08-plutonium-skills-overhaul-design.md
 - docs/superpowers/specs/2026-04-14-plutonium-testing-design.md
 - esbuild.config.js
@@ -665,6 +667,7 @@ files:
 - lib/generators/pu/field/renderer/templates/renderer.rb.tt
 - lib/generators/pu/gem/active_shrine/active_shrine_generator.rb
 - lib/generators/pu/gem/active_shrine/templates/config/initializers/shrine.rb.tt
+- lib/generators/pu/gem/actual_db_schema/actual_db_schema_generator.rb
 - lib/generators/pu/gem/annotated/annotated_generator.rb
 - lib/generators/pu/gem/annotated/templates/.keep
 - lib/generators/pu/gem/annotated/templates/lib/tasks/auto_annotate_models.rake
@@ -1140,6 +1143,20 @@ metadata:
   allowed_push_host: https://rubygems.org
   homepage_uri: https://radioactive-labs.github.io/plutonium-core/
   source_code_uri: https://github.com/radioactive-labs/plutonium-core
+post_install_message: |
+  ⚠️  Plutonium 0.49.1 — breaking change
+
+  Entity-scoped URL helpers and path params have been renamed from
+  `<entity>_scope_*` to `<entity>_scoped_*`.
+
+  Examples:
+    organization_scope_widgets_path  →  organization_scoped_widgets_path
+    params[:organization_scope]      →  params[:organization_scoped]
+
+  If you reference these helpers or params directly (e.g. in tests, custom
+  redirects, or hand-written links), update them to the new names.
+
+  Apps that only use `resource_url_for` are unaffected.
 rdoc_options: []
 require_paths:
 - lib