plutonium 0.49.0 → 0.50.0

data/lib/plutonium/resource/controllers/interactive_actions.rb

@@ -29,7 +29,7 @@ module Plutonium
         # GET /resources/1/record_actions/:interactive_action
         def interactive_record_action
           build_interactive_record_action_interaction
-          render :interactive_record_action, layout: modal_layout, formats: [:html]
+          render :interactive_record_action, formats: [:html], **modal_render_options
         end
 
         # POST /resources/1/record_actions/:interactive_action
@@ -62,7 +62,7 @@ module Plutonium
                 end
               else
                 format.any(:html, :turbo_stream) do
-                  render :interactive_record_action, layout: modal_layout, formats: [:html], status: :unprocessable_content
+                  render :interactive_record_action, formats: [:html], content_type: "text/html", **modal_render_options, status: :unprocessable_content
                 end
                 format.any do
                   @errors = @interaction.errors
@@ -77,7 +77,7 @@ module Plutonium
         def interactive_resource_action
           skip_verify_current_authorized_scope!
           build_interactive_resource_action_interaction
-          render :interactive_resource_action, layout: modal_layout, formats: [:html]
+          render :interactive_resource_action, formats: [:html], **modal_render_options
         end
 
         # POST /resources/resource_actions/:interactive_action
@@ -111,7 +111,7 @@ module Plutonium
                 end
               else
                 format.any(:html, :turbo_stream) do
-                  render :interactive_resource_action, layout: modal_layout, formats: [:html], status: :unprocessable_content
+                  render :interactive_resource_action, formats: [:html], content_type: "text/html", **modal_render_options, status: :unprocessable_content
                 end
                 format.any do
                   @errors = @interaction.errors
@@ -125,7 +125,7 @@ module Plutonium
         # GET /resources/bulk_actions/:interactive_action?ids[]=1&ids[]=2
         def interactive_bulk_action
           build_interactive_bulk_action_interaction
-          render :interactive_bulk_action, layout: modal_layout, formats: [:html]
+          render :interactive_bulk_action, formats: [:html], **modal_render_options
         end
 
         # POST /resources/bulk_actions/:interactive_action?ids[]=1&ids[]=2
@@ -158,7 +158,7 @@ module Plutonium
                 end
               else
                 format.any(:html, :turbo_stream) do
-                  render :interactive_bulk_action, layout: modal_layout, formats: [:html], status: :unprocessable_content
+                  render :interactive_bulk_action, formats: [:html], content_type: "text/html", **modal_render_options, status: :unprocessable_content
                 end
                 format.any do
                   @errors = @interaction.errors
@@ -171,9 +171,13 @@ module Plutonium
 
         private
 
-        # Returns false for modal requests (skip layout), nil otherwise (use default layout)
-        def modal_layout
-          helpers.current_turbo_frame.present? ? false : nil
+        # Render options for modal-aware actions. Returns `{ layout: false }` for
+        # turbo-frame requests so the bare frame is rendered, and an empty hash
+        # for top-level requests so the controller's default layout proc applies.
+        # (Passing `layout: nil` explicitly is treated as "no layout" by Rails,
+        # which is why we omit the key entirely on the default path.)
+        def modal_render_options
+          helpers.current_turbo_frame.present? ? {layout: false} : {}
         end
 
         def current_interactive_action

data/lib/plutonium/resource/controllers/presentable.rb

@@ -5,7 +5,7 @@ module Plutonium
         extend ActiveSupport::Concern
 
         included do
-          helper_method :build_form, :build_detail, :build_collection
+          helper_method :build_form, :build_detail, :build_collection, :build_grid_collection
         end
 
         private
@@ -82,8 +82,17 @@ module Plutonium
           current_definition.collection_class.new(@resource_records, resource_fields: presentable_attributes, resource_definition: current_definition)
         end
 
+        def build_grid_collection
+          current_definition.grid_class.new(@resource_records, resource_fields: presentable_attributes, resource_definition: current_definition)
+        end
+
         def build_detail
-          current_definition.detail_class.new(resource_record!, resource_fields: presentable_attributes, resource_associations: permitted_associations, resource_definition: current_definition)
+          current_definition.detail_class.new(
+            resource_record!,
+            resource_fields: presentable_attributes,
+            resource_associations: permitted_associations,
+            resource_definition: current_definition
+          )
         end
 
         def build_form(record = resource_record!, action: action_name, form_action: nil, **)

data/lib/plutonium/resource/definition.rb

@@ -1,6 +1,48 @@
 module Plutonium
   module Resource
     class Definition < Plutonium::Definition::Base
+      class_attribute :modal_mode, default: :slideover, instance_accessor: false
+
+      VALID_MODAL_MODES = [:centered, :slideover, false].freeze
+
+      # Sets how :new / :edit actions render.
+      # - :slideover (default) — slide-in panel from the right
+      # - :centered — centered dialog
+      # - false — no modal; new/edit are full standalone pages
+      def self.modal(mode)
+        unless VALID_MODAL_MODES.include?(mode)
+          raise ArgumentError, "modal must be one of #{VALID_MODAL_MODES.inspect}, got #{mode.inspect}"
+        end
+        self.modal_mode = mode
+        configure_crud_modal_targets!
+      end
+
+      # Re-derives the default :new / :edit actions so their turbo_frame
+      # matches the current `modal_mode`. Called when `.modal` is set
+      # and once at Resource::Definition load (so the default
+      # :slideover state propagates to the action records). Subclasses
+      # inherit those records via DefineableProps#inherited (deep_dup);
+      # calling `.modal` on a subclass re-runs this method locally.
+      def self.configure_crud_modal_targets!
+        target = (modal_mode == false) ? nil : Plutonium::REMOTE_MODAL_FRAME
+        [:new, :edit].each do |name|
+          action = defined_actions[name]
+          next unless action
+          next if action.turbo_frame == target
+          defined_actions[name] = action.with(turbo_frame: target)
+        end
+      end
+
+      def modal
+        self.class.modal_mode
+      end
+
+      # Apply the default modal target ("remote_modal") to :new / :edit
+      # so resources that never call `.modal` still get the slideover
+      # behavior. Subclasses inherit the configured actions via
+      # DefineableProps' deep_dup; calling `.modal` on a subclass
+      # re-runs the configuration locally.
+      configure_crud_modal_targets!
     end
   end
 end

data/lib/plutonium/resource/policy.rb

@@ -67,16 +67,31 @@ module Plutonium
             raise ArgumentError, "parent and parent_association must both be provided together"
           end
 
-          # Parent association scoping (nested routes)
-          # The parent was already entity-scoped during authorization, so children
-          # accessed through the parent don't need additional entity scoping
+          # Parent association scoping (nested routes).
+          #
+          # The parent context is set on the policy for the whole request, so it
+          # leaks into sibling lookups too — e.g. a SecureAssociation field on
+          # the child's form authorizes an unrelated resource scope while
+          # parent/parent_association are still set. Only apply parent scoping
+          # when the relation actually corresponds to the parent's named
+          # association; otherwise fall through to entity scoping so we don't
+          # produce an incoherent (and silently empty) result.
           assoc_reflection = parent.class.reflect_on_association(parent_association)
-          if assoc_reflection.collection?
-            # has_many: merge with the association's scope
-            parent.public_send(parent_association).merge(relation)
+          if assoc_reflection && relation.klass <= assoc_reflection.klass
+            # The parent was already entity-scoped during authorization, so
+            # children accessed through the parent don't need additional
+            # entity scoping.
+            if assoc_reflection.collection?
+              # has_many: merge with the association's scope
+              parent.public_send(parent_association).merge(relation)
+            else
+              # has_one: scope by foreign key
+              relation.where(assoc_reflection.foreign_key => parent.id)
+            end
+          elsif entity_scope
+            relation.associated_with(entity_scope)
           else
-            # has_one: scope by foreign key
-            relation.where(assoc_reflection.foreign_key => parent.id)
+            relation
           end
         elsif entity_scope
           # Entity scoping (multi-tenancy)

data/lib/plutonium/resource/query_object.rb

@@ -63,6 +63,7 @@ module Plutonium
       # Builds a URL with the given options for search and sorting.
       #
       # @param options [Hash] The options for building the URL.
+      # @option options [Boolean] :replace When true, clears all existing sorts before applying the new one
       # @return [String] The constructed URL with query parameters.
       def build_url(**options)
         q = {}
@@ -74,11 +75,19 @@ module Plutonium
           selected_scope_filter
         end
 
-        q[:sort_directions] = selected_sort_directions.dup
-        q[:sort_fields] = selected_sort_fields.dup
+        if options.delete(:replace)
+          q[:sort_directions] = {}
+          q[:sort_fields] = []
+        else
+          q[:sort_directions] = selected_sort_directions.dup
+          q[:sort_fields] = selected_sort_fields.dup
+        end
         handle_sort_options!(q, options)
 
-        q.merge! params.slice(*filter_definitions.keys)
+        filter_keys = filter_definitions.keys.map(&:to_sym)
+        filter_overrides = options.slice(*filter_keys).stringify_keys
+        q.merge! params.with_indifferent_access.slice(*filter_definitions.keys)
+        q.merge!(filter_overrides)
         compacted = deep_compact({q: q})
 
         # Preserve explicit "All" selection (scope: nil in options means show all)
@@ -119,18 +128,67 @@ module Plutonium
 
       def sort_definitions = @sort_definitions ||= {}.with_indifferent_access
 
+      # Returns an array of hashes describing each currently active filter.
+      # Each hash has: name, label, value_label, clear_url
+      def active_filter_descriptions
+        filter_definitions.filter_map do |name, filter|
+          name = name.to_sym
+          filter_params = params[name]
+          next unless filter_params.present?
+
+          value_label = case filter_params
+          when Hash, ActionController::Parameters
+            entries = filter_params.to_h.reject { |_, v| v.blank? }
+            next if entries.empty?
+            # Single-input filters defer to the filter's `humanize_value`
+            # (e.g. Association resolves ids to labels, Boolean translates
+            # "true" -> "Yes"). Multi-input filters keep input-name
+            # qualifiers (e.g. "from 2024, to 2025").
+            if entries.size == 1
+              humanized = filter.humanize_value(entries.values.first)
+              next if humanized.blank?
+              humanized
+            else
+              entries.map { |k, v| "#{k.to_s.humanize.downcase} #{v}" }.join(", ")
+            end
+          when Array
+            entries = filter_params.reject(&:blank?)
+            next if entries.empty?
+            humanized = filter.humanize_value(entries)
+            next if humanized.blank?
+            humanized
+          else
+            next if filter_params.to_s.blank?
+            humanized = filter.humanize_value(filter_params)
+            next if humanized.blank?
+            humanized
+          end
+
+          {
+            name: name,
+            label: name.to_s.humanize,
+            value_label: value_label,
+            clear_url: build_url(name => nil)
+          }
+        end
+      end
+
       # Provides sorting parameters for the given field name.
       #
       # @param name [Symbol, String] The name of the field to sort.
-      # @return [Hash, nil] The sorting parameters including URL and direction.
+      # @return [Hash, nil] The sorting parameters including URL, multi_url, direction, position and multi flag.
       def sort_params_for(name)
         return unless sort_definitions[name]
 
+        multi = selected_sort_fields.size > 1 && selected_sort_fields.include?(name.to_s)
+
         {
-          url: build_url(sort: name),
+          url: build_url(sort: name, replace: true),
+          multi_url: build_url(sort: name),
           reset_url: build_url(sort: name, reset: true),
           position: selected_sort_fields.index(name.to_s),
-          direction: selected_sort_directions[name]
+          direction: selected_sort_directions[name],
+          multi: multi
         }
       end
 

data/lib/plutonium/testing/resource_definition.rb

@@ -33,8 +33,8 @@ module Plutonium
             klass.defined_fields.each_key do |field_name|
               next if field_name == :id
               assert resource_class.column_names.include?(field_name.to_s) ||
-                     resource_class.method_defined?(field_name) ||
-                     resource_class.reflect_on_association(field_name),
+                resource_class.method_defined?(field_name) ||
+                resource_class.reflect_on_association(field_name),
                 "Field :#{field_name} declared in #{klass} but not defined on #{resource_class}"
             end
           end

data/lib/plutonium/ui/action_button.rb

@@ -24,10 +24,11 @@ module Plutonium
 
       DROPDOWN_DEFAULT_COLOR = "text-[var(--pu-text)] hover:bg-[var(--pu-surface-alt)]"
 
-      def initialize(action, url:, variant: :default)
+      def initialize(action, url:, variant: :default, data: {})
         @action = action
         @url = url
         @variant = variant
+        @extra_data = data
       end
 
       def view_template
@@ -49,7 +50,7 @@ module Plutonium
         link_to(
           url_with_return_to,
           class: button_classes,
-          data: {turbo_frame: @action.turbo_frame}
+          data: {turbo_frame: @action.turbo_frame}.merge(@extra_data)
         ) do
           render_button_content
         end
@@ -61,6 +62,7 @@ module Plutonium
           method: @action.route_options.method,
           name: :return_to, value: return_to_url,
           class: "inline-block",
+          data: @extra_data,
           form: {
             data: {
               turbo: @action.turbo,

data/lib/plutonium/ui/component/kit.rb

@@ -78,6 +78,8 @@ module Plutonium
 
         def BuildTableScopesBar(...) = Plutonium::UI::Table::Components::ScopesBar.new(...)
 
+        def BuildTableScopesPills(...) = Plutonium::UI::Table::Components::ScopesPills.new(...)
+
         def BuildTableInfo(...) = Plutonium::UI::Table::Components::PagyInfo.new(...)
 
         def BuildTablePagination(...) = Plutonium::UI::Table::Components::PagyPagination.new(...)
@@ -86,7 +88,17 @@ module Plutonium
 
         def BuildBulkActionsToolbar(...) = Plutonium::UI::Table::Components::BulkActionsToolbar.new(...)
 
+        def BuildTableToolbar(...) = Plutonium::UI::Table::Components::Toolbar.new(...)
+
+        def BuildTableFilterPills(...) = Plutonium::UI::Table::Components::FilterPills.new(...)
+
+        def BuildTableViewSwitcher(...) = Plutonium::UI::Table::Components::ViewSwitcher.new(...)
+
         def BuildColorModeSelector(...) = Plutonium::UI::ColorModeSelector.new(...)
+
+        def BuildModalCentered(...) = Plutonium::UI::Modal::Centered.new(...)
+
+        def BuildModalSlideover(...) = Plutonium::UI::Modal::Slideover.new(...)
       end
     end
   end

data/lib/plutonium/ui/display/base.rb

@@ -46,7 +46,9 @@ module Plutonium
 
         def fields_wrapper(&)
           div(class: themed(:fields_wrapper)) {
-            yield
+            div(class: themed(:fields_inner)) {
+              yield
+            }
           }
         end
       end

data/lib/plutonium/ui/display/resource.rb

@@ -13,56 +13,93 @@ module Plutonium
           @resource_definition = resource_definition
         end
 
+        # Metadata fields the user is permitted to see — intersection of
+        # the definition's declared metadata with the policy-filtered
+        # `resource_fields`. Computed lazily so we don't run the
+        # intersection when the resource doesn't declare any metadata.
+        def metadata_fields
+          @metadata_fields ||= resource_definition.defined_metadata_fields & resource_fields
+        end
+
         def display_template
-          render_fields
-          render_associations if present_associations?
+          if associations_present?
+            render_tablist_with_details
+          else
+            render_fields
+          end
         end
 
         private
 
+        def associations_present?
+          present_associations? && resource_associations.present?
+        end
+
         def render_fields
+          if metadata_fields.any?
+            div(class: "grid grid-cols-1 lg:grid-cols-[minmax(0,1fr)_320px] gap-6 items-start") do
+              div { render_main_field_card }
+              aside { render_metadata_panel }
+            end
+          else
+            render_main_field_card
+          end
+        end
+
+        def render_main_field_card
           Block do
             fields_wrapper do
-              resource_fields.each do |name|
+              # Skip fields claimed by the metadata panel — rendering
+              # them in both places duplicates information.
+              (resource_fields - metadata_fields).each do |name|
                 render_resource_field name
               end
             end
           end
         end
 
-        def render_associations
-          return unless resource_associations.present?
+        # Renders the declared metadata fields as a vertical stack beside
+        # the main field card. Reuses render_resource_field (same path
+        # the main details use) so labels/values match in style; the
+        # only difference from the main card is the wrapper — a single
+        # column of fields instead of the form's multi-column grid.
+        def render_metadata_panel
+          Block do
+            div(class: "pu-card-body flex flex-col gap-6") do
+              metadata_fields.each { |name| render_resource_field(name) }
+            end
+          end
+        end
 
+        def render_tablist_with_details
           tablist = BuildTabList()
 
+          # Build an inner display component for the Details tab.
+          # It must be a standalone Phlex component so that TabList can call
+          # `render(details_display)` from within its own context. Phlex propagates
+          # @_state through render calls, so the inner component writes to the same
+          # buffer as the outer Resource display even though self changes.
+          details_display = build_details_display
+
+          tablist.with_tab(
+            identifier: "details",
+            title: -> { plain "Details" }
+          ) do
+            render details_display
+          end
+
           resource_associations.each do |name|
             reflection = object.class.reflect_on_association name
-
-            if !reflection
-              raise ArgumentError,
-                "unknown association #{object.class}##{name} defined in #permitted_associations"
-            elsif !registered_resources.include?(reflection.klass)
-              raise ArgumentError,
-                "#{object.class}##{name} defined in #permitted_associations, but #{reflection.klass} is not a registered resource"
-            end
+            raise_unknown_association(name) unless reflection
+            raise_unregistered_association(name, reflection) unless registered_resources.include?(reflection.klass)
 
             title = object.class.human_attribute_name(name)
-            src = case reflection.macro
-            when :belongs_to
-              associated = object.public_send name
-              resource_url_for(associated, parent: nil) if associated
-            when :has_one
-              associated = object.public_send name
-              resource_url_for(associated, parent: object, association: name)
-            when :has_many
-              resource_url_for(reflection.klass, parent: object, association: name)
-            end
-
+            src = association_src(name, reflection)
             next unless src
 
             tablist.with_tab(
               identifier: title.parameterize,
-              title: -> { h5(class: "text-2xl font-bold tracking-tight text-[var(--pu-text)]") { title } }
+              title: -> { plain title }
             ) do
               FrameNavigatorPanel(title: "", src:, panel_id: "association-panel-#{title.parameterize}")
             end
@@ -71,6 +108,53 @@ module Plutonium
           render tablist
         end
 
+        # Builds a standalone Phlex component whose sole job is to render the
+        # resource fields. Having a distinct component lets TabList call
+        # `render(details_display)` so that Phlex propagates its @_state correctly,
+        # while avoiding the `instance_exec` context-switch problem that would
+        # occur if we put `render_fields` directly inside the `with_tab` block.
+        #
+        # The anonymous subclass overrides `view_template` to skip the outer
+        # `display_wrapper` div (which would duplicate the dom id already emitted
+        # by the parent Resource display) and renders just the fields content.
+        def build_details_display
+          resource = self
+
+          klass = Class.new(self.class) do
+            define_method(:view_template) do
+              resource.send(:render_fields)
+            end
+          end
+
+          klass.new(
+            object,
+            resource_fields: resource_fields,
+            resource_associations: [],
+            resource_definition: resource_definition
+          )
+        end
+
+        def association_src(name, reflection)
+          case reflection.macro
+          when :belongs_to
+            associated = object.public_send name
+            resource_url_for(associated, parent: nil) if associated
+          when :has_one
+            associated = object.public_send name
+            resource_url_for(associated, parent: object, association: name)
+          when :has_many
+            resource_url_for(reflection.klass, parent: object, association: name)
+          end
+        end
+
+        def raise_unknown_association(name)
+          raise ArgumentError, "unknown association #{object.class}##{name} defined in #permitted_associations"
+        end
+
+        def raise_unregistered_association(name, reflection)
+          raise ArgumentError, "#{object.class}##{name} defined in #permitted_associations, but #{reflection.klass} is not a registered resource"
+        end
+
         def render_resource_field(name)
           when_permitted(name) do
             # field :name, as: :string

data/lib/plutonium/ui/display/theme.rb

@@ -8,7 +8,8 @@ module Plutonium
           super.merge({
             base: "",
             value_wrapper: "max-h-[300px] overflow-y-auto",
-            fields_wrapper: "p-8 grid grid-cols-1 md:grid-cols-2 2xl:grid-cols-4 gap-x-8 gap-y-8 grid-flow-row-dense",
+            fields_wrapper: "pu-card",
+            fields_inner: "pu-card-body grid grid-cols-1 md:grid-cols-2 2xl:grid-cols-4 gap-x-8 gap-y-6 grid-flow-row-dense",
 
             # Labels and descriptions
             label: "text-sm font-semibold uppercase tracking-wide text-[var(--pu-text-muted)] mb-2",

data/lib/plutonium/ui/dyna_frame/content.rb

@@ -1,29 +1,23 @@
 module Plutonium
   module UI
     module DynaFrame
+      # Conditionally wraps its content in a turbo-frame matching the inbound
+      # request's `Turbo-Frame` header. In frame mode adds the flash partial
+      # so toast/alert messages still surface inside frames; in non-frame
+      # mode renders the block as-is.
       class Content < Plutonium::UI::Component::Base
         include Phlex::Rails::Helpers::TurboFrameTag
 
-        def initialize(content = nil)
-          @content = content
-        end
-
-        def view_template
+        def view_template(&block)
           if current_turbo_frame.present?
-            # Frame request: render only the turbo-frame with content
             turbo_frame_tag(current_turbo_frame) do
               render partial("flash")
-              @content&.call
+              yield if block_given?
             end
-          else
-            # Regular request: yield self so caller can call frame.render_content
-            yield(self)
+          elsif block_given?
+            yield
           end
         end
-
-        def render_content
-          @content&.call
-        end
       end
     end
   end

data/lib/plutonium/ui/empty_card.rb

@@ -8,7 +8,7 @@ module Plutonium
       end
 
       def view_template
-        div(class: "pu-card") do
+        div(class: "pu-card mt-4") do
           div(class: "pu-empty-state") do
             p(class: "pu-empty-state-description") { message }
             yield if block_given?

data/lib/plutonium/ui/form/base.rb

@@ -10,6 +10,28 @@ module Plutonium
           include Phlexi::Field::Common::Tokens
           include Plutonium::UI::Form::Options::InferredTypes
 
+          # Consume `:as` here so it doesn't land in Phlexi's `@options` —
+          # `:as` is a Plutonium-internal concept (it picks the tag method),
+          # not a Phlexi field option.
+          def initialize(*args, as: nil, **kwargs, &block)
+            @as = as
+            super(*args, **kwargs, &block)
+          end
+
+          attr_reader :as
+
+          def hidden?
+            as.to_s == "hidden"
+          end
+
+          # Hidden fields (`form.field(name, as: :hidden)`) skip the label /
+          # hint / error chrome and render inside a `<div hidden>` so they're
+          # also excluded from CSS Grid / Flex layout.
+          def wrapped(**, &)
+            return Plutonium::UI::Form::Components::HiddenWrapper.new(self, &) if hidden?
+            super
+          end
+
           def textarea_tag(**attributes, &)
             attributes[:data_controller] = tokens(attributes[:data_controller], "textarea-autogrow")
             super
@@ -45,7 +67,13 @@ module Plutonium
           end
 
           def resource_select_tag(**attributes, &)
-            create_component(Components::ResourceSelect, :select, **attributes, &)
+            attributes[:data_controller] = tokens(attributes[:data_controller], "slim-select")
+            # class!: "" clears the underlying <select>'s themed classes
+            # (pu-input etc.) — the visible element is slim-select's
+            # generated .ss-main, so leaving Tailwind input chrome on the
+            # native select can leak into chip layout (e.g. forcing
+            # flex-direction: column or w-full on multi-mode chips).
+            create_component(Components::ResourceSelect, :select, class!: "", **attributes, &)
           end
 
           def secure_association_tag(**attributes, &)