plutonium 0.49.1 → 0.51.0

data/lib/plutonium/ui/form/components/secure_association.rb

@@ -6,6 +6,9 @@ module Plutonium
       module Components
         class SecureAssociation < Phlexi::Form::Components::AssociationBase
           include Plutonium::UI::Component::Methods
+          include Plutonium::UI::Form::Concerns::TypeaheadAttributes
+
+          DEFAULT_CHOICE_LIMIT = Plutonium::UI::Form::Components::ResourceSelect::DEFAULT_CHOICE_LIMIT
 
           def view_template
             div(class: "flex items-center space-x-1") do
@@ -19,50 +22,102 @@ module Plutonium
           delegate :association_reflection, to: :field
 
           def render_add_button
-            return if @add_action == false || add_url.nil?
+            return if @add_action == false
+
+            url, turbo_frame = add_url_and_frame
+            return unless url
+
+            # When the parent form is already inside a modal, route the
+            # "+" to the secondary frame so the stacked dialog opens on
+            # top of the original form rather than replacing it. The
+            # crud controller mirrors this on success — closing the
+            # secondary modal and reloading the primary so the
+            # association select picks up the new record.
+            if turbo_frame == Plutonium::REMOTE_MODAL_FRAME && in_modal?
+              turbo_frame = Plutonium::REMOTE_MODAL_SECONDARY_FRAME
+            end
+
+            attrs = {
+              href: url,
+              class: "inline-flex items-center justify-center w-9 h-9 shrink-0 bg-[var(--pu-surface-alt)] hover:bg-[var(--pu-border)] border border-[var(--pu-border)] rounded-[var(--pu-radius-md)] focus:ring-2 focus:ring-[var(--pu-border)] focus:outline-none text-[var(--pu-text-muted)] hover:text-[var(--pu-text)] transition-colors"
+            }
+            attrs[:data] = {turbo_frame: turbo_frame} if turbo_frame
 
-            a(
-              href: add_url,
-              class: "bg-[var(--pu-surface-alt)] hover:bg-[var(--pu-border)] border border-[var(--pu-border)] rounded-[var(--pu-radius-md)] px-4 py-3 focus:ring-2 focus:ring-[var(--pu-border)] focus:outline-none text-[var(--pu-text-muted)] hover:text-[var(--pu-text)] transition-colors"
-            ) do
-              render Phlex::TablerIcons::Plus.new(class: "w-6 h-6")
+            a(**attrs) do
+              render Phlex::TablerIcons::Plus.new(class: "w-4 h-4")
             end
           end
 
-          def add_url
-            @add_url ||= begin
-              return unless @skip_authorization || allowed_to?(:create?, association_reflection.klass)
+          # Resolves the destination for the inline "+" button alongside
+          # the association select. We go through the target resource's
+          # `:new` action (rather than building a URL by hand) so the
+          # button inherits whatever modal/slideover frame the target
+          # resource is configured for — same path table/grid use for
+          # their own "New" button. A custom string `add_action:` skips
+          # the frame lookup since we can't infer the target's modal
+          # mode from an arbitrary URL.
+          def add_url_and_frame
+            klass = association_reflection.klass
+
+            if @add_action.is_a?(String)
+              return [with_return_to(@add_action), nil] if @skip_authorization || allowed_to?(:create?, klass)
+              return
+            end
 
-              url = @add_action || (registered_resources.include?(association_reflection.klass) && resource_url_for(association_reflection.klass, action: :new, parent: nil))
-              return unless url
+            return unless registered_resources.include?(klass)
+            action = resource_definition(klass).defined_actions[:new]
+            return unless action
+            return unless @skip_authorization || action.permitted_by?(policy_for(record: klass))
 
-              uri = URI(url)
-              uri.query = URI.encode_www_form({return_to: request.original_url})
-              uri.to_s
-            end
+            url = route_options_to_url(action.route_options, klass)
+            [with_return_to(url), action.turbo_frame]
+          end
+
+          def with_return_to(url)
+            uri = URI(url)
+            params = Rack::Utils.parse_nested_query(uri.query)
+            params["return_to"] = request.original_url
+            uri.query = params.to_query
+            uri.to_s
           end
 
           def choices
             @choices ||= begin
-              collection = if @raw_choices
-                @raw_choices
-              elsif @skip_authorization
-                choices_from_association(association_reflection.klass)
-              else
-                authorized_resource_scope(association_reflection.klass, relation: choices_from_association(association_reflection.klass))
-              end
+              collection = @raw_choices || authorized_relation
+              collection = collection.limit(@choice_limit) if @choice_limit && collection.respond_to?(:limit)
               build_choice_mapper(collection)
             end
           end
 
+          # Builds the authorized association relation. Shared by `choices`
+          # (which then applies `choice_limit`) and `normalize_simple_input`
+          # (which validates against the full set so typeahead picks beyond
+          # the rendered subset still survive submit).
+          def authorized_relation
+            klass = association_reflection.klass
+            relation = choices_from_association(klass)
+            return relation if @skip_authorization
+            authorized_resource_scope(klass, relation: relation)
+          end
+
           def build_attributes
             build_association_attributes
             super
+            # Stash; the URL helper needs view_context which only exists
+            # once we're rendering.
+            @typeahead_option = attributes.delete(:typeahead)
+          end
+
+          def before_template
+            super
+            configure_typeahead_attributes!(@typeahead_option)
           end
 
           def build_association_attributes
             @skip_authorization = attributes.delete(:skip_authorization)
             @add_action = attributes.delete(:add_action)
+            @choice_limit = attributes.fetch(:choice_limit) { DEFAULT_CHOICE_LIMIT }
+            attributes.delete(:choice_limit)
 
             attributes.fetch(:value_method) { attributes[:value_method] = :to_signed_global_id }
 
@@ -74,6 +129,20 @@ module Plutonium
             end
           end
 
+          private
+
+          # Polymorphic reflections raise NameError on #klass — they
+          # have no single target class to search, so opt out.
+          def typeahead_target_class
+            return nil unless association_reflection
+            return nil if association_reflection.respond_to?(:polymorphic?) && association_reflection.polymorphic?
+            association_reflection.klass
+          end
+
+          def typeahead_kind_and_name(_typeahead_option)
+            [:input, association_reflection.name]
+          end
+
           def build_singluar_association_attributes
             attributes.fetch(:input_param) { attributes[:input_param] = :"#{association_reflection.name}_sgid" }
           end
@@ -83,9 +152,21 @@ module Plutonium
             attributes[:multiple] = true
           end
 
+          # Validates a submitted SGID against the authorized association scope
+          # (not against `choices`, which is capped at `choice_limit` and may
+          # not include records reachable via typeahead). For explicit
+          # `@raw_choices`, fall back to membership in the rendered list.
           def normalize_simple_input(input_value)
-            @signed_global_ids ||= choices.values.map { |choice| SignedGlobalID.parse(choice) }
-            ([SignedGlobalID.parse(input_value.presence)].compact & @signed_global_ids)[0]
+            sgid = SignedGlobalID.parse(input_value.presence)
+            return nil unless sgid
+
+            if @raw_choices
+              @signed_global_ids ||= choices.values.map { |choice| SignedGlobalID.parse(choice) }
+              return @signed_global_ids.include?(sgid) ? sgid : nil
+            end
+
+            return nil unless sgid.model_class <= association_reflection.klass
+            authorized_relation.exists?(id: sgid.model_id) ? sgid : nil
           end
 
           def selected?(option)

data/lib/plutonium/ui/form/components/sticky_footer.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module Plutonium
+  module UI
+    module Form
+      module Components
+        class StickyFooter < Plutonium::UI::Component::Base
+          def view_template(&block)
+            div(class: "fixed bottom-0 left-0 right-0 lg:left-14 z-20 " \
+                       "h-14 bg-[var(--pu-surface)] border-t border-[var(--pu-border)] " \
+                       "px-6 flex items-center justify-end gap-2", &block)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/plutonium/ui/form/concerns/typeahead_attributes.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+module Plutonium
+  module UI
+    module Form
+      module Concerns
+        # Shared typeahead wiring for association/resource select components.
+        #
+        # Hosts must implement two hooks:
+        #
+        #   typeahead_target_class      -> the associated model class, or nil
+        #                                  (returns nil for polymorphic/unknown)
+        #   typeahead_kind_and_name(opt) -> [:input | :filter, Symbol], used when
+        #                                  the consumer didn't pass an explicit
+        #                                  `typeahead: {kind:, name:}` hash
+        #
+        # The concern owns:
+        #   - `configure_typeahead_attributes!` — call from `before_template`
+        #   - `typeahead_searchable?` — registry + fallback-column check
+        #   - `typeahead_url_for` — engine route helper lookup
+        module TypeaheadAttributes
+          extend ActiveSupport::Concern
+
+          private
+
+          # Adds the typeahead URL data attr so the slim-select Stimulus
+          # controller delegates to the backend via events.search.
+          # Default-on (opt out with `typeahead: false`). Pass a Hash to
+          # override kind/name (e.g. `typeahead: {kind: :filter, name: :status}`).
+          #
+          # Auto opt-out: if the associated resource has neither a `search`
+          # block nor a fallback search column on the model, fall back to
+          # slim-select's eager list + client-side filter — the backend
+          # would just return unfiltered records.
+          def configure_typeahead_attributes!(typeahead_option)
+            return if typeahead_option == false
+            return unless typeahead_searchable?
+            url = typeahead_url_for(typeahead_option)
+            return unless url
+            attributes[:data_slim_select_typeahead_url_value] = url
+          end
+
+          def typeahead_searchable?
+            klass = typeahead_target_class
+            return false unless klass
+
+            # Go through `resource_definition` so portal/package namespacing
+            # is honored — a portal can ship its own definition with a
+            # different `search` block than the base.
+            return true if resource_definition(klass).class._search_definition.present?
+
+            Plutonium::Resource::Controllers::Typeahead
+              .searchable_column_for(klass, label_method: @label_method).present?
+          rescue NameError
+            false
+          end
+
+          def typeahead_url_for(typeahead_option)
+            kind, name = if typeahead_option.is_a?(Hash)
+              [typeahead_option[:kind] || :input, typeahead_option[:name]]
+            else
+              typeahead_kind_and_name(typeahead_option)
+            end
+            return nil unless name
+
+            route_key = resource_class.model_name.route_key
+            helper = (kind == :filter) ? :"typeahead_filter_#{route_key}_path" : :"typeahead_input_#{route_key}_path"
+
+            # Engine route helpers are the source of truth for routes
+            # mounted under a Plutonium portal — phlex-rails' `helpers`
+            # proxy is deprecated and not the right entry point here.
+            # Helper may be absent if a consumer removed the typeahead
+            # route from the resource — fall back to no URL, slim-select
+            # uses its eager list.
+            url_helpers = current_engine.routes.url_helpers
+            return nil unless url_helpers.respond_to?(helper)
+            url_helpers.public_send(helper, name: name)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/plutonium/ui/form/resource.rb

@@ -18,10 +18,23 @@ module Plutonium
         end
 
         def form_template
-          render_fields
+          if in_modal?
+            # In modal: form is the flex container that fills the modal
+            # body. Fields region scrolls; action strip sits flush at the
+            # bottom edge of the modal.
+            div(class: "flex-1 min-h-0 overflow-y-auto px-6 py-5") do
+              render_fields
+            end
+          else
+            render_fields
+          end
           render_actions
         end
 
+        def form_class
+          in_modal? ? "flex-1 flex flex-col min-h-0" : super
+        end
+
         private
 
         def render_fields
@@ -33,18 +46,39 @@ module Plutonium
         end
 
         def render_actions
-          input name: "return_to", value: request.params[:return_to], type: :hidden, hidden: true
-
-          actions_wrapper {
-            render_submit_and_continue_button if show_submit_and_continue?
-
-            render submit_button
-          }
+          # capture-url controller sets this element's value to
+          # window.location.href on connect, so URL fragments (#tab-id)
+          # survive the redirect after submit (the server never sees them).
+          input name: "return_to",
+            value: request.params[:return_to] || request.original_url,
+            type: :hidden,
+            hidden: true,
+            data: {controller: "capture-url"}
+
+          if in_modal?
+            div(class: "shrink-0 px-6 py-3 " \
+                       "bg-[var(--pu-surface)] border-t border-[var(--pu-border)] " \
+                       "flex items-center justify-end gap-2") do
+              render_submit_and_continue_button if show_submit_and_continue?
+              render submit_button
+            end
+          else
+            render Plutonium::UI::Form::Components::StickyFooter.new do
+              render_submit_and_continue_button if show_submit_and_continue?
+              render submit_button
+            end
+          end
         end
 
         def show_submit_and_continue?
           return false unless object.respond_to?(:new_record?)
 
+          # Continue / add-another lands on the form's standalone URL —
+          # which breaks the experience when the form is inside a frame
+          # (modal or association tab) since the redirect can't keep the
+          # user in that frame context.
+          return false if current_turbo_frame.present?
+
           # Check explicit configuration first
           configured = resource_definition.submit_and_continue
           return configured unless configured.nil?
@@ -60,7 +94,7 @@ module Plutonium
             type: :submit,
             name: "return_to",
             value: request.url,
-            class: "px-4 py-2 bg-secondary-600 text-white rounded-md hover:bg-secondary-700 focus:outline-none focus:ring-2 focus:ring-secondary-500"
+            class: "pu-btn pu-btn-md pu-btn-outline"
           ) { label }
         end
 
@@ -116,7 +150,8 @@ module Plutonium
             end
           end
 
-          field_options = field_options.except(:as, :condition)
+          # Keep `:as` so the Builder can detect hidden fields via `options[:as]`.
+          field_options = field_options.except(:condition)
 
           condition = input_options[:condition] || field_options[:condition]
           conditionally_hidden = condition && !instance_exec(&condition)

data/lib/plutonium/ui/form/theme.rb

@@ -49,7 +49,7 @@ module Plutonium
             hint: "pu-hint whitespace-pre",
 
             # Error themes
-            error: "pu-error",
+            error: "text-xs text-danger-600 mt-1",
 
             # Button themes
             button: "pu-btn pu-btn-md pu-btn-primary",

data/lib/plutonium/ui/frame_navigator_panel.rb

@@ -10,12 +10,14 @@ module Plutonium
 
         def view_template
           button(
+            type: "button",
             title: @label,
+            aria: {label: @label},
             style: "display: none",
-            class: "text-[var(--pu-text-muted)] hover:text-[var(--pu-text)] transition-colors",
+            class: "inline-flex items-center justify-center w-7 h-7 rounded text-[var(--pu-text-muted)] hover:text-[var(--pu-text)] hover:bg-[var(--pu-surface-alt)] transition-colors",
             **@attributes
           ) {
-            render @icon.new(class: "w-6 h-6")
+            render @icon.new(class: "w-4 h-4")
           }
         end
       end
@@ -31,11 +33,12 @@ module Plutonium
         def view_template
           a(
             title: @label,
-            class: "text-[var(--pu-text-muted)] hover:text-[var(--pu-text)] transition-colors",
+            aria: {label: @label},
             href: @href,
+            class: "inline-flex items-center justify-center w-7 h-7 rounded text-[var(--pu-text-muted)] hover:text-[var(--pu-text)] hover:bg-[var(--pu-surface-alt)] transition-colors",
             **@attributes
           ) {
-            render @icon.new(class: "w-6 h-6")
+            render @icon.new(class: "w-4 h-4")
           }
         end
       end

data/lib/plutonium/ui/grid/card.rb

@@ -0,0 +1,235 @@
+# frozen_string_literal: true
+
+module Plutonium
+  module UI
+    module Grid
+      # Renders a single record as a card built from semantic slots
+      # (image / header / subheader / body / meta / footer) declared via
+      # `grid_fields` on the resource definition. Each slot is optional;
+      # `header` falls back to `record.to_label` when undeclared.
+      class Card < Plutonium::UI::Component::Base
+        attr_reader :record, :resource_definition, :resource_fields
+
+        def initialize(record, resource_definition:, resource_fields: nil)
+          @record = record
+          @resource_definition = resource_definition
+          @resource_fields = resource_fields
+        end
+
+        def view_template
+          article(
+            class: card_class,
+            data: {controller: "row-click", action: "click->row-click#click"}
+          ) do
+            render_show_link if can_show?
+            render_actions_dropdown
+            case resource_definition.defined_grid_layout
+            when :media then render_media_layout
+            else render_compact_layout
+            end
+          end
+        end
+
+        private
+
+        def slots = resource_definition.defined_grid_fields
+
+        # ---------------------------------------------------------------
+        # Layout shells
+        # ---------------------------------------------------------------
+
+        def render_compact_layout
+          div(class: "flex items-start gap-3 p-4") do
+            render_image_slot(size: :sm) if slots[:image]
+            div(class: "min-w-0 flex-1 flex flex-col gap-1") do
+              render_header_slot
+              render_subheader_slot if slots[:subheader]
+              render_body_slot if slots[:body]
+              render_meta_slot if slots[:meta]
+              render_footer_slot if footer_field
+            end
+          end
+        end
+
+        def render_media_layout
+          render_image_slot(size: :cover) if slots[:image]
+          div(class: "p-4 flex flex-col gap-1") do
+            render_header_slot
+            render_subheader_slot if slots[:subheader]
+            render_body_slot if slots[:body]
+            render_meta_slot if slots[:meta]
+            render_footer_slot if footer_field
+          end
+        end
+
+        # Footer falls back to `:created_at` when the slot is unset and
+        # the record has a created_at column. Gives cards a sensible
+        # second line without forcing every grid_fields call to repeat it.
+        def footer_field
+          slots[:footer] || (record.respond_to?(:created_at) ? :created_at : nil)
+        end
+
+        # ---------------------------------------------------------------
+        # Slot renderers
+        # ---------------------------------------------------------------
+
+        def render_image_slot(size:)
+          value = field_value(slots[:image])
+          return unless value
+          src = image_src_for(value)
+          return unless src
+
+          if size == :cover
+            div(class: "w-full aspect-video bg-[var(--pu-surface-alt)] overflow-hidden") do
+              img(src: src, alt: header_text.to_s, class: "w-full h-full object-cover")
+            end
+          else
+            img(
+              src: src,
+              alt: header_text.to_s,
+              class: "w-12 h-12 rounded-full object-cover bg-[var(--pu-surface-alt)] shrink-0"
+            )
+          end
+        end
+
+        def render_header_slot
+          h3(class: "text-sm font-semibold text-[var(--pu-text)] truncate") do
+            plain header_text
+          end
+        end
+
+        def render_subheader_slot
+          value = field_value(slots[:subheader])
+          return if value.blank?
+          p(class: "text-xs text-[var(--pu-text-muted)] truncate") { plain helpers.display_name_of(value) }
+        end
+
+        def render_body_slot
+          value = field_value(slots[:body])
+          return if value.blank?
+          p(class: "text-sm text-[var(--pu-text)] line-clamp-3") { plain helpers.display_name_of(value) }
+        end
+
+        def render_meta_slot
+          fields = Array(slots[:meta])
+          values = fields.map { |f| field_value(f) }.reject(&:blank?)
+          return if values.empty?
+
+          div(class: "flex flex-wrap items-center gap-1.5 mt-1") do
+            values.each do |v|
+              span(class: "inline-flex items-center px-2 py-0.5 rounded-full text-[10px] font-medium " \
+                          "bg-[var(--pu-surface-alt)] text-[var(--pu-text-muted)]") do
+                plain helpers.display_name_of(v)
+              end
+            end
+          end
+        end
+
+        def render_footer_slot
+          value = field_value(footer_field)
+          return if value.blank?
+          p(class: "text-xs text-[var(--pu-text-subtle)] mt-1") do
+            if value.respond_to?(:strftime)
+              # display_datetime_value returns HTML-safe <time> markup
+              # rendered by the timeago Stimulus controller.
+              raw safe(helpers.display_datetime_value(value))
+            else
+              plain helpers.display_name_of(value)
+            end
+          end
+        end
+
+        # ---------------------------------------------------------------
+        # Card chrome — selection, actions, show
+        # ---------------------------------------------------------------
+
+        def render_actions_dropdown
+          # Cards have limited surface area, so all collection-record
+          # actions (including primary ones like Edit) live in the
+          # dropdown rather than splitting between buttons and a menu
+          # like the table view does.
+          actions = row_actions.reject { |a| a.name == :show }
+          return if actions.empty?
+          div(class: "absolute top-2 right-2 z-10") do
+            RowActionsDropdown(actions: actions, record:)
+          end
+        end
+
+        # Hidden link the `row-click` controller delegates to when the
+        # user clicks anywhere on the card body. Mirrors how the show
+        # action button works in the Table view.
+        def render_show_link
+          show = resource_definition.defined_actions[:show]
+          url = route_options_to_url(show.route_options, record)
+          a(
+            href: url,
+            data: {row_click_target: "show", turbo_frame: show.turbo_frame},
+            class: "sr-only",
+            tabindex: "-1",
+            "aria-label": "Open #{header_text}"
+          ) { plain "Open" }
+        end
+
+        # ---------------------------------------------------------------
+        # Helpers
+        # ---------------------------------------------------------------
+
+        def header_text
+          @header_text ||= helpers.display_name_of(field_value(slots[:header]) || record)
+        end
+
+        def field_value(name)
+          return nil unless name
+          # Skip fields the user's policy doesn't permit. nil collapses
+          # the slot in render_*_slot guards above.
+          return nil if resource_fields && !resource_fields.include?(name.to_sym)
+          unless record.respond_to?(name)
+            raise ArgumentError,
+              "grid_fields slot points at `:#{name}` but " \
+              "#{record.class.name} doesn't respond to it. " \
+              "Define the method on the model or remove the slot."
+          end
+          record.public_send(name)
+        end
+
+        # Resolves a slot value to an image URL. Supports:
+        # - ActiveStorage attachments (`record.avatar` -> Attached::One/Many)
+        # - Shrine uploaders (`record.avatar` -> UploadedFile, responds to :url)
+        # - Plain URL strings ("https://..." or "/uploads/...")
+        def image_src_for(value)
+          return nil if value.nil?
+          if value.respond_to?(:attached?)
+            value.attached? ? helpers.url_for(value) : nil
+          elsif value.respond_to?(:url)
+            value.url
+          elsif value.is_a?(String) && value.start_with?("http", "/")
+            value
+          end
+        rescue ArgumentError, URI::InvalidURIError
+          nil
+        end
+
+        def row_actions
+          @row_actions ||= resource_definition.defined_actions.values.select { |a|
+            a.collection_record_action? && a.permitted_by?(record_policy)
+          }
+        end
+
+        def can_show?
+          resource_definition.defined_actions[:show]&.permitted_by?(record_policy)
+        end
+
+        def record_policy
+          @record_policy ||= policy_for(record:)
+        end
+
+        def card_class
+          tokens(
+            "pu-card relative overflow-hidden transition-shadow",
+            -> { can_show? } => "cursor-pointer hover:shadow-md focus-within:ring-2 focus-within:ring-primary-500"
+          )
+        end
+      end
+    end
+  end
+end