plutonium 0.60.5 → 0.62.0

data/gemfiles/postgres.gemfile.lock

@@ -0,0 +1,321 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    action_text-trix (2.1.19)
+      railties
+    actioncable (8.1.3)
+      actionpack (= 8.1.3)
+      activesupport (= 8.1.3)
+      nio4r (~> 2.0)
+      websocket-driver (>= 0.6.1)
+      zeitwerk (~> 2.6)
+    actionmailbox (8.1.3)
+      actionpack (= 8.1.3)
+      activejob (= 8.1.3)
+      activerecord (= 8.1.3)
+      activestorage (= 8.1.3)
+      activesupport (= 8.1.3)
+      mail (>= 2.8.0)
+    actionmailer (8.1.3)
+      actionpack (= 8.1.3)
+      actionview (= 8.1.3)
+      activejob (= 8.1.3)
+      activesupport (= 8.1.3)
+      mail (>= 2.8.0)
+      rails-dom-testing (~> 2.2)
+    actionpack (8.1.3)
+      actionview (= 8.1.3)
+      activesupport (= 8.1.3)
+      nokogiri (>= 1.8.5)
+      rack (>= 2.2.4)
+      rack-session (>= 1.0.1)
+      rack-test (>= 0.6.3)
+      rails-dom-testing (~> 2.2)
+      rails-html-sanitizer (~> 1.6)
+      useragent (~> 0.16)
+    actiontext (8.1.3)
+      action_text-trix (~> 2.1.15)
+      actionpack (= 8.1.3)
+      activerecord (= 8.1.3)
+      activestorage (= 8.1.3)
+      activesupport (= 8.1.3)
+      globalid (>= 0.6.0)
+      nokogiri (>= 1.8.5)
+    actionview (8.1.3)
+      activesupport (= 8.1.3)
+      builder (~> 3.1)
+      erubi (~> 1.11)
+      rails-dom-testing (~> 2.2)
+      rails-html-sanitizer (~> 1.6)
+    activejob (8.1.3)
+      activesupport (= 8.1.3)
+      globalid (>= 0.3.6)
+    activemodel (8.1.3)
+      activesupport (= 8.1.3)
+    activerecord (8.1.3)
+      activemodel (= 8.1.3)
+      activesupport (= 8.1.3)
+      timeout (>= 0.4.0)
+    activestorage (8.1.3)
+      actionpack (= 8.1.3)
+      activejob (= 8.1.3)
+      activerecord (= 8.1.3)
+      activesupport (= 8.1.3)
+      marcel (~> 1.0)
+    activesupport (8.1.3)
+      base64
+      bigdecimal
+      concurrent-ruby (~> 1.0, >= 1.3.1)
+      connection_pool (>= 2.2.5)
+      drb
+      i18n (>= 1.6, < 2)
+      json
+      logger (>= 1.4.2)
+      minitest (>= 5.1)
+      securerandom (>= 0.3)
+      tzinfo (~> 2.0, >= 2.0.5)
+      uri (>= 0.13.1)
+    base64 (0.3.0)
+    bigdecimal (4.1.2)
+    builder (3.3.0)
+    concurrent-ruby (1.3.7)
+    connection_pool (3.0.2)
+    crass (1.0.7)
+    date (3.5.1)
+    drb (2.2.3)
+    erb (6.0.4)
+    erubi (1.13.1)
+    globalid (1.4.0)
+      activesupport (>= 6.1)
+    i18n (1.15.2)
+      concurrent-ruby (~> 1.0)
+    io-console (0.8.2)
+    irb (1.18.0)
+      pp (>= 0.6.0)
+      prism (>= 1.3.0)
+      rdoc (>= 4.0.0)
+      reline (>= 0.4.2)
+    json (2.20.0)
+    logger (1.7.0)
+    loofah (2.25.1)
+      crass (~> 1.0.2)
+      nokogiri (>= 1.12.0)
+    mail (2.9.0)
+      logger
+      mini_mime (>= 0.1.1)
+      net-imap
+      net-pop
+      net-smtp
+    marcel (1.2.1)
+    mini_mime (1.1.5)
+    mini_portile2 (2.8.9)
+    minitest (6.0.6)
+      drb (~> 2.0)
+      prism (~> 1.5)
+    net-imap (0.6.4.1)
+      date
+      net-protocol
+    net-pop (0.1.2)
+      net-protocol
+    net-protocol (0.2.2)
+      timeout
+    net-smtp (0.5.1)
+      net-protocol
+    nio4r (2.7.5)
+    nokogiri (1.19.4)
+      mini_portile2 (~> 2.8.2)
+      racc (~> 1.4)
+    nokogiri (1.19.4-aarch64-linux-gnu)
+      racc (~> 1.4)
+    nokogiri (1.19.4-aarch64-linux-musl)
+      racc (~> 1.4)
+    nokogiri (1.19.4-arm-linux-gnu)
+      racc (~> 1.4)
+    nokogiri (1.19.4-arm-linux-musl)
+      racc (~> 1.4)
+    nokogiri (1.19.4-arm64-darwin)
+      racc (~> 1.4)
+    nokogiri (1.19.4-x86_64-darwin)
+      racc (~> 1.4)
+    nokogiri (1.19.4-x86_64-linux-gnu)
+      racc (~> 1.4)
+    nokogiri (1.19.4-x86_64-linux-musl)
+      racc (~> 1.4)
+    pg (1.6.3)
+    pg (1.6.3-aarch64-linux)
+    pg (1.6.3-aarch64-linux-musl)
+    pg (1.6.3-arm64-darwin)
+    pg (1.6.3-x86_64-darwin)
+    pg (1.6.3-x86_64-linux)
+    pg (1.6.3-x86_64-linux-musl)
+    pp (0.6.4)
+      prettyprint
+    prettyprint (0.2.0)
+    prism (1.9.0)
+    racc (1.8.1)
+    rack (3.2.6)
+    rack-session (2.1.2)
+      base64 (>= 0.1.0)
+      rack (>= 3.0.0)
+    rack-test (2.2.0)
+      rack (>= 1.3)
+    rackup (2.3.1)
+      rack (>= 3)
+    rails (8.1.3)
+      actioncable (= 8.1.3)
+      actionmailbox (= 8.1.3)
+      actionmailer (= 8.1.3)
+      actionpack (= 8.1.3)
+      actiontext (= 8.1.3)
+      actionview (= 8.1.3)
+      activejob (= 8.1.3)
+      activemodel (= 8.1.3)
+      activerecord (= 8.1.3)
+      activestorage (= 8.1.3)
+      activesupport (= 8.1.3)
+      bundler (>= 1.15.0)
+      railties (= 8.1.3)
+    rails-dom-testing (2.3.0)
+      activesupport (>= 5.0.0)
+      minitest
+      nokogiri (>= 1.6)
+    rails-html-sanitizer (1.7.0)
+      loofah (~> 2.25)
+      nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
+    railties (8.1.3)
+      actionpack (= 8.1.3)
+      activesupport (= 8.1.3)
+      irb (~> 1.13)
+      rackup (>= 1.0.0)
+      rake (>= 12.2)
+      thor (~> 1.0, >= 1.2.2)
+      tsort (>= 0.2)
+      zeitwerk (~> 2.6)
+    rake (13.4.2)
+    rbs (4.0.3)
+      logger
+      prism (>= 1.6.0)
+      tsort
+    rdoc (8.0.0)
+      erb
+      prism (>= 1.6.0)
+      rbs (>= 4.0.0)
+      tsort
+    reline (0.6.3)
+      io-console (~> 0.5)
+    securerandom (0.4.1)
+    thor (1.5.0)
+    timeout (0.6.1)
+    tsort (0.2.0)
+    tzinfo (2.0.6)
+      concurrent-ruby (~> 1.0)
+    uri (1.1.1)
+    useragent (0.16.11)
+    websocket-driver (0.8.2)
+      base64
+      websocket-extensions (>= 0.1.0)
+    websocket-extensions (0.1.5)
+    zeitwerk (2.8.2)
+
+PLATFORMS
+  aarch64-linux
+  aarch64-linux-gnu
+  aarch64-linux-musl
+  arm-linux-gnu
+  arm-linux-musl
+  arm64-darwin
+  ruby
+  x86_64-darwin
+  x86_64-linux
+  x86_64-linux-gnu
+  x86_64-linux-musl
+
+DEPENDENCIES
+  pg (~> 1.5)
+  rails (~> 8.1.0)
+
+CHECKSUMS
+  action_text-trix (2.1.19) sha256=7012f59421009cf284aa651294896414d653a61a2417c9b8714c8476d2f74009
+  actioncable (8.1.3) sha256=e5bc7f75e44e6a22de29c4f43176927c3a9ce4824464b74ed18d8226e75a80f0
+  actionmailbox (8.1.3) sha256=df7da474eaa0e70df4ed5a6fef66eb3b3b0f2dbf7f14518deee8d77f1b4aae59
+  actionmailer (8.1.3) sha256=831f724891bb70d0aaa4d76581a6321124b6a752cb655c9346aae5479318448d
+  actionpack (8.1.3) sha256=af998cae4d47c5d581a2cc363b5c77eb718b7c4b45748d81b1887b25621c29a3
+  actiontext (8.1.3) sha256=d291019c00e1ea9e6463011fa214f6081a56d7b9a1d224e7d3f6384c1dafc7d2
+  actionview (8.1.3) sha256=1347c88c7f3edb38100c5ce0e9fb5e62d7755f3edc1b61cce2eb0b2c6ea2fd5d
+  activejob (8.1.3) sha256=a149b1766aa8204c3c3da7309e4becd40fcd5529c348cffbf6c9b16b565fe8d3
+  activemodel (8.1.3) sha256=90c05cbe4cef3649b8f79f13016191ea94c4525ce4a5c0fb7ef909c4b91c8219
+  activerecord (8.1.3) sha256=8003be7b2466ba0a2a670e603eeb0a61dd66058fccecfc49901e775260ac70ab
+  activestorage (8.1.3) sha256=0564ce9309143951a67615e1bb4e090ee54b8befed417133cae614479b46384d
+  activesupport (8.1.3) sha256=21a5e0dfbd4c3ddd9e1317ec6a4d782fa226e7867dc70b0743acda81a1dca20e
+  base64 (0.3.0) sha256=27337aeabad6ffae05c265c450490628ef3ebd4b67be58257393227588f5a97b
+  bigdecimal (4.1.2) sha256=53d217666027eab4280346fba98e7d5b66baaae1b9c3c1c0ffe89d48188a3fbd
+  builder (3.3.0) sha256=497918d2f9dca528fdca4b88d84e4ef4387256d984b8154e9d5d3fe5a9c8835f
+  concurrent-ruby (1.3.7) sha256=4412caec3a5ea2e5fdc52076724c071a81f2c0593d83b2ac8cbb8ca63b3151b0
+  connection_pool (3.0.2) sha256=33fff5ba71a12d2aa26cb72b1db8bba2a1a01823559fb01d29eb74c286e62e0a
+  crass (1.0.7) sha256=94868719948664c89ddcaf0a37c65048413dfcb1c869470a5f7a7ceb5390b295
+  date (3.5.1) sha256=750d06384d7b9c15d562c76291407d89e368dda4d4fff957eb94962d325a0dc0
+  drb (2.2.3) sha256=0b00d6fdb50995fe4a45dea13663493c841112e4068656854646f418fda13373
+  erb (6.0.4) sha256=38e3803694be357fe2bfe312487c74beaf9fb4e5beb3e22498952fe1645b95d9
+  erubi (1.13.1) sha256=a082103b0885dbc5ecf1172fede897f9ebdb745a4b97a5e8dc63953db1ee4ad9
+  globalid (1.4.0) sha256=037f12fbf1d9d7a014d501c2d5c77356fd4ddd96d7a7991d6700bba96706f427
+  i18n (1.15.2) sha256=00f9eb62412fe593b2a65a97daa75300d37abb8f7202ec748e94b6d46a9dd1b5
+  io-console (0.8.2) sha256=d6e3ae7a7cc7574f4b8893b4fca2162e57a825b223a177b7afa236c5ef9814cc
+  irb (1.18.0) sha256=de9454a0703a54704b9811a5ef31a60c86949fbf4013fcf244fabc7c775248e3
+  json (2.20.0) sha256=9362bc6e55a952b056abf9167cf053358181c904cb70cd6eee0808ea830fc32b
+  logger (1.7.0) sha256=196edec7cc44b66cfb40f9755ce11b392f21f7967696af15d274dde7edff0203
+  loofah (2.25.1) sha256=d436c73dbd0c1147b16c4a41db097942d217303e1f7728704b37e4df9f6d2e04
+  mail (2.9.0) sha256=6fa6673ecd71c60c2d996260f9ee3dd387d4673b8169b502134659ece6d34941
+  marcel (1.2.1) sha256=1678e9360e32f9eafa917c80029e2f6d10b2715c66a4b87b6d0da9b9cd1f859f
+  mini_mime (1.1.5) sha256=8681b7e2e4215f2a159f9400b5816d85e9d8c6c6b491e96a12797e798f8bccef
+  mini_portile2 (2.8.9) sha256=0cd7c7f824e010c072e33f68bc02d85a00aeb6fce05bb4819c03dfd3c140c289
+  minitest (6.0.6) sha256=153ea36d1d987a62942382b61075745042a2b3123b1cd48f4c3675af9cc7d6f1
+  net-imap (0.6.4.1) sha256=29f0360d75a7efd3539f16ac1957dea5c0a51ddeceb348db4553c3120914ea0d
+  net-pop (0.1.2) sha256=848b4e982013c15b2f0382792268763b748cce91c9e91e36b0f27ed26420dff3
+  net-protocol (0.2.2) sha256=aa73e0cba6a125369de9837b8d8ef82a61849360eba0521900e2c3713aa162a8
+  net-smtp (0.5.1) sha256=ed96a0af63c524fceb4b29b0d352195c30d82dd916a42f03c62a3a70e5b70736
+  nio4r (2.7.5) sha256=6c90168e48fb5f8e768419c93abb94ba2b892a1d0602cb06eef16d8b7df1dca1
+  nokogiri (1.19.4) sha256=50c951611c92bca05c51411aef45f1cbc50f2821c4802758c5c6d34696533ab5
+  nokogiri (1.19.4-aarch64-linux-gnu) sha256=1269fb644a6de405057a53dd5c762b1209b43ca7424f839454d3dbc677c31a8f
+  nokogiri (1.19.4-aarch64-linux-musl) sha256=35c65b9ce72b3bb03207bdbe7067915019dc18c1b9b59139684bd6690fdd01af
+  nokogiri (1.19.4-arm-linux-gnu) sha256=a301313e38bb065d68239e79734bcd6f56fb6efaacebde29e9abf2a4735340ca
+  nokogiri (1.19.4-arm-linux-musl) sha256=588923c101bcfa78869734d247d25b598674323e7f22474fc468f6e5647311eb
+  nokogiri (1.19.4-arm64-darwin) sha256=a46db9853286e6597b36ebc6953817d15acf3a299583eb3f89fdc6f91dd63527
+  nokogiri (1.19.4-x86_64-darwin) sha256=7fd17057d3e1f00e9954a74b3cd76595d3d4a5ef233b7ed9599047c204f70551
+  nokogiri (1.19.4-x86_64-linux-gnu) sha256=379fae440b28915e3f19d752ce2dcf8465ed2b2fbefd2a7ca0dd497bc981a06a
+  nokogiri (1.19.4-x86_64-linux-musl) sha256=17dfb7c1fa194ae02fbf7c51a7afc8d278045ab3fdacfd86f91d02d7b274470b
+  pg (1.6.3) sha256=1388d0563e13d2758c1089e35e973a3249e955c659592d10e5b77c468f628a99
+  pg (1.6.3-aarch64-linux) sha256=0698ad563e02383c27510b76bf7d4cd2de19cd1d16a5013f375dd473e4be72ea
+  pg (1.6.3-aarch64-linux-musl) sha256=06a75f4ea04b05140146f2a10550b8e0d9f006a79cdaf8b5b130cde40e3ecc2c
+  pg (1.6.3-arm64-darwin) sha256=7240330b572e6355d7c75a7de535edb5dfcbd6295d9c7777df4d9dddfb8c0e5f
+  pg (1.6.3-x86_64-darwin) sha256=ee2e04a17c0627225054ffeb43e31a95be9d7e93abda2737ea3ce4a62f2729d6
+  pg (1.6.3-x86_64-linux) sha256=5d9e188c8f7a0295d162b7b88a768d8452a899977d44f3274d1946d67920ae8d
+  pg (1.6.3-x86_64-linux-musl) sha256=9c9c90d98c72f78eb04c0f55e9618fe55d1512128e411035fe229ff427864009
+  pp (0.6.4) sha256=dfcb0fce700c41456265922884f9fe195d7fbb0674a3578e6c0f69588e82b570
+  prettyprint (0.2.0) sha256=2bc9e15581a94742064a3cc8b0fb9d45aae3d03a1baa6ef80922627a0766f193
+  prism (1.9.0) sha256=7b530c6a9f92c24300014919c9dcbc055bf4cdf51ec30aed099b06cd6674ef85
+  racc (1.8.1) sha256=4a7f6929691dbec8b5209a0b373bc2614882b55fc5d2e447a21aaa691303d62f
+  rack (3.2.6) sha256=5ed78e1f73b2e25679bec7d45ee2d4483cc4146eb1be0264fc4d94cb5ef212c2
+  rack-session (2.1.2) sha256=595434f8c0c3473ae7d7ac56ecda6cc6dfd9d37c0b2b5255330aa1576967ffe8
+  rack-test (2.2.0) sha256=005a36692c306ac0b4a9350355ee080fd09ddef1148a5f8b2ac636c720f5c463
+  rackup (2.3.1) sha256=6c79c26753778e90983761d677a48937ee3192b3ffef6bc963c0950f94688868
+  rails (8.1.3) sha256=6d017ba5348c98fc909753a8169b21d44de14d2a0b92d140d1a966834c3c9cd3
+  rails-dom-testing (2.3.0) sha256=8acc7953a7b911ca44588bf08737bc16719f431a1cc3091a292bca7317925c1d
+  rails-html-sanitizer (1.7.0) sha256=28b145cceaf9cc214a9874feaa183c3acba036c9592b19886e0e45efc62b1e89
+  railties (8.1.3) sha256=913eb0e0cb520aac687ffd74916bd726d48fa21f47833c6292576ef6a286de22
+  rake (13.4.2) sha256=cb825b2bd5f1f8e91ca37bddb4b9aaf345551b4731da62949be002fa89283701
+  rbs (4.0.3) sha256=5a7bf70e2628549d9a1f44eae447b2cfe55968a9c60cfff52693a4bdcc020e14
+  rdoc (8.0.0) sha256=03bf8c08a9639658855a0cfd77c0abca8325c227693f7f33f82957811348c469
+  reline (0.6.3) sha256=1198b04973565b36ec0f11542ab3f5cfeeec34823f4e54cebde90968092b1835
+  securerandom (0.4.1) sha256=cc5193d414a4341b6e225f0cb4446aceca8e50d5e1888743fac16987638ea0b1
+  thor (1.5.0) sha256=e3a9e55fe857e44859ce104a84675ab6e8cd59c650a49106a05f55f136425e73
+  timeout (0.6.1) sha256=78f57368a7e7bbadec56971f78a3f5ecbcfb59b7fcbb0a3ed6ddc08a5094accb
+  tsort (0.2.0) sha256=9650a793f6859a43b6641671278f79cfead60ac714148aabe4e3f0060480089f
+  tzinfo (2.0.6) sha256=8daf828cc77bcf7d63b0e3bdb6caa47e2272dcfaf4fbfe46f8c3a9df087a829b
+  uri (1.1.1) sha256=379fa58d27ffb1387eaada68c749d1426738bd0f654d812fcc07e7568f5c57c6
+  useragent (0.16.11) sha256=700e6413ad4bb954bb63547fa098dddf7b0ebe75b40cc6f93b8d54255b173844
+  websocket-driver (0.8.2) sha256=97c556b019bf3410b4961002ac501621e9322d3f8a7bc02161a09301cc4c4146
+  websocket-extensions (0.1.5) sha256=1c6ba63092cda343eb53fc657110c71c754c56484aad42578495227d717a8241
+  zeitwerk (2.8.2) sha256=7212a61311083c604184b1ea2574b9aa05cd14f855a0841c06985cabe9181d12
+
+BUNDLED WITH
+  4.0.6

data/gemfiles/rails_7.gemfile

@@ -15,6 +15,7 @@ gem "sequel-activerecord_connection"
 gem "tilt"
 gem "bcrypt"
 gem "rqrcode"
+gem "active_shrine"
 gem "tzinfo-data", platforms: [:windows, :jruby]
 
 gemspec path: "../"

data/gemfiles/rails_7.gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: ..
   specs:
-    plutonium (0.59.0)
+    plutonium (0.60.4)
       action_policy (~> 0.7.0)
       csv
       listen (~> 3.8)

data/gemfiles/rails_8.0.gemfile

@@ -15,6 +15,7 @@ gem "sequel-activerecord_connection"
 gem "tilt"
 gem "bcrypt"
 gem "rqrcode"
+gem "active_shrine"
 gem "tzinfo-data", platforms: [:windows, :jruby]
 
 gemspec path: "../"

data/gemfiles/rails_8.0.gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: ..
   specs:
-    plutonium (0.59.0)
+    plutonium (0.60.4)
       action_policy (~> 0.7.0)
       csv
       listen (~> 3.8)

data/gemfiles/rails_8.1.gemfile

@@ -15,6 +15,7 @@ gem "sequel-activerecord_connection"
 gem "tilt"
 gem "bcrypt"
 gem "rqrcode"
+gem "active_shrine"
 gem "tzinfo-data", platforms: [:windows, :jruby]
 
 gemspec path: "../"

data/gemfiles/rails_8.1.gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: ..
   specs:
-    plutonium (0.59.0)
+    plutonium (0.61.0)
       action_policy (~> 0.7.0)
       csv
       listen (~> 3.8)
@@ -74,6 +74,11 @@ GEM
       erubi (~> 1.11)
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
+    active_shrine (0.7.1)
+      activestorage
+      activesupport
+      railties
+      shrine
     activejob (8.1.2)
       activesupport (= 8.1.2)
       globalid (>= 0.3.6)
@@ -137,9 +142,13 @@ GEM
       thor (>= 0.14.6)
     concurrent-ruby (1.3.6)
     connection_pool (3.0.2)
+    content_disposition (1.0.0)
     crass (1.0.6)
     csv (3.3.5)
     date (3.5.1)
+    down (5.6.0)
+      addressable (~> 2.8)
+      base64 (~> 0.3)
     drb (2.2.3)
     erb (6.0.2)
     erubi (1.13.1)
@@ -369,6 +378,9 @@ GEM
     sequel-activerecord_connection (2.0.1)
       activerecord (>= 5.1)
       sequel (~> 5.38)
+    shrine (3.7.1)
+      content_disposition (~> 1.0)
+      down (~> 5.1)
     sin_lru_redux (2.5.2)
     sqlite3 (2.9.1-arm64-darwin)
     standard (1.54.0)
@@ -427,6 +439,7 @@ PLATFORMS
   arm64-darwin
 
 DEPENDENCIES
+  active_shrine
   appraisal
   bcrypt
   brakeman

data/lib/generators/pu/gem/active_shrine/active_shrine_generator.rb

@@ -18,6 +18,11 @@ module Pu
 
       def start
         bundle "active_shrine"
+        # The generated shrine.rb determine_mime_type analyzer refines
+        # marcel's `text/plain` (e.g. CSV/TXT uploads) via Shrine's :mime_types
+        # analyzer, which does `require "mime/types"` — bundle it so the first
+        # text/plain upload doesn't 500 with `cannot load such file -- mime/types`.
+        bundle "mime-types"
         bundle "aws-sdk-s3" if options[:s3]
         bundle "fastimage" if options[:store_dimensions]
 

data/lib/generators/pu/invites/templates/packages/invites/app/controllers/invites/user_invitations_controller.rb.tt

@@ -54,9 +54,14 @@ module Invites
 
 <% if rodauth? -%>
     def create_user_for_signup(email, password)
+      # Normalize the login up front. Lookups (account_from_login) downcase the
+      # login, so on a case-sensitive database a verbatim mixed-case email would
+      # be created but never found again. Downcasing here keeps create and
+      # lookup in agreement across both branches.
+      email = email.downcase
       password_hash = rodauth.password_hash(password)
 
-      if email.downcase == @invite.email.downcase
+      if email == @invite.email.downcase
         # Email matches invitation - create verified account directly
         <%= user_model %>.create!(
           email: email,

data/lib/plutonium/action/base.rb

@@ -23,6 +23,7 @@ module Plutonium
         @collection_record_action = options[:collection_record_action] || false
         @record_action = options[:record_action] || false
         @resource_action = options[:resource_action] || false
+        @kanban_drop = options[:kanban_drop] || false
         @category = ActiveSupport::StringInquirer.new((options[:category] || :secondary).to_s)
         @position = options[:position] || 50
         @modal_mode = options[:modal]
@@ -49,8 +50,17 @@ module Plutonium
       # Downgrades the remote-modal frame to nil when the definition has
       # `modal false`, so the link navigates as a full page instead of
       # targeting a frame that won't exist. Other frames pass through.
+      #
+      # The canonical :show action carries no explicit frame; instead it reads
+      # the definition's `show_in` so a resource can open its show page in a
+      # modal (`show_in :modal`) or full-page (`:page`, default) without the
+      # caller threading a frame. This is deliberately independent of
+      # `modal_mode` (which styles :new/:edit) — show is always centered.
       def turbo_frame(definition = nil)
         return nil if definition && targets_remote_modal? && definition.modal_mode == false
+        if definition && name == :show && @turbo_frame.nil?
+          return (definition.show_in == :modal) ? Plutonium::REMOTE_MODAL_FRAME : nil
+        end
         @turbo_frame
       end
 
@@ -59,6 +69,12 @@ module Plutonium
       def record_action? = @record_action
       def resource_action? = @resource_action
 
+      # True when this action was auto-registered for a kanban column's
+      # `enter_interaction`. Such actions exist only so their policy method,
+      # form, and params machinery are wired up — they are reachable by
+      # dropping a card, never rendered as a normal toolbar/row button.
+      def kanban_drop? = @kanban_drop
+
       def permitted_by?(policy)
         policy.allowed_to?(:"#{name}?")
       end
@@ -103,6 +119,7 @@ module Plutonium
           collection_record_action: @collection_record_action,
           record_action: @record_action,
           resource_action: @resource_action,
+          kanban_drop: @kanban_drop,
           category: @category.to_sym,
           position: @position,
           modal: @modal_mode,

data/lib/plutonium/auth/rodauth.rb

@@ -7,7 +7,7 @@ module Plutonium
           extend ActiveSupport::Concern
 
           included do
-            helper_method :current_user, :current_#{name}
+            helper_method :current_user
             helper_method :logout_url
             helper_method :profile_url
           end
@@ -23,7 +23,6 @@ module Plutonium
           def current_user
             rodauth.rails_account
           end
-          alias_method :current_#{name}, :current_user
 
           def logout_url
             rodauth.logout_path

data/lib/plutonium/configuration.rb

@@ -24,6 +24,9 @@ module Plutonium
     # @return [AssetConfiguration] asset configuration
     attr_reader :assets
 
+    # @return [Plutonium::Wizard::Configuration] wizard subsystem configuration
+    attr_reader :wizards
+
     # @return [Float] the current defaults version
     attr_reader :defaults_version
 
@@ -37,6 +40,18 @@ module Plutonium
     #   or proxy the service.
     attr_accessor :navii_host_url
 
+    # @return [String, false, nil] the currency unit (symbol) used when rendering
+    #   a currency value that has no unit configured on `has_cents` or the display.
+    #   `nil` (default) falls back to the i18n `number.currency.format.unit` when
+    #   the locale defines it, otherwise no symbol. Set a literal like `"£"` to
+    #   change the default, or `false` (or `""`) for no symbol application-wide.
+    attr_accessor :default_currency_unit
+
+    # @return [String, nil] the default country (ISO2 code, e.g. "gh") for phone
+    #   (`as: :phone`) inputs that don't set their own `initial_country:`. `nil`
+    #   (default) leaves it to the intl-tel-input library (no country preselected).
+    attr_accessor :default_phone_country
+
     # Map of version numbers to their default configurations
     VERSION_DEFAULTS = {
       1.0 => proc do |config|
@@ -54,6 +69,7 @@ module Plutonium
     def initialize
       @defaults_version = nil
       @assets = AssetConfiguration.new
+      @wizards = Plutonium::Wizard::Configuration.new
 
       @development = parse_boolean_env("PLUTONIUM_DEV")
       @cache_discovery = !Rails.env.development?

data/lib/plutonium/core/controller.rb

@@ -127,7 +127,7 @@ module Plutonium
       #
       # @return [Hash] args to pass to `url_for`
       #
-      def resource_url_args_for(*args, action: nil, parent: nil, association: nil, package: nil, interaction: nil, **kwargs)
+      def resource_url_args_for(*args, action: nil, parent: nil, association: nil, package: nil, interaction: nil, wizard: nil, **kwargs)
         element = args.first
 
         raise ArgumentError, "parent is required when using symbol association name" if element.is_a?(Symbol) && parent.nil?
@@ -138,6 +138,12 @@ module Plutonium
           kwargs[:interactive_action] = interaction
         end
 
+        if wizard
+          raise ArgumentError, "cannot pass both `wizard:` and `action:`" if action
+          action = wizard_action_type_for(element, step: kwargs[:step])
+          kwargs[:wizard_name] = wizard
+        end
+
         # For nested resources, use named route helpers to avoid Rails param recall ambiguity
         if parent.present?
           assoc_name = if element.is_a?(Symbol)
@@ -194,6 +200,19 @@ module Plutonium
         end
       end
 
+      # Determine the wizard action type for the given element. Records → member,
+      # classes/symbols/nil → collection (wizards have no bulk variant). With no
+      # `step:`, target the bare LAUNCH action (which resolves the run and redirects
+      # to its current step); with a `step:`, target the stepped show action.
+      def wizard_action_type_for(element, step: nil)
+        member = !(element.is_a?(Class) || element.is_a?(Symbol) || element.nil?)
+        if step.nil?
+          member ? :launch_wizard_record_action : :launch_wizard_resource_action
+        else
+          member ? :wizard_record_action : :wizard_resource_action
+        end
+      end
+
       def build_nested_resource_url_args(element, parent:, association_name:, route_config:, action: nil, **kwargs)
         prefix = Plutonium::Routing::NESTED_ROUTE_PREFIX
         is_singular = route_config[:route_type] == :resource

data/lib/plutonium/definition/base.rb

@@ -29,6 +29,7 @@ module Plutonium
       include ConfigAttr
       include InheritableConfigAttr
       include Actions
+      include Wizards
       include Sorting
       include Scoping
       include Search
@@ -120,6 +121,30 @@ module Plutonium
         modal_size size
       end
 
+      # show_in — how the :show page opens from a record link (table row,
+      # grid card). Unlike :new/:edit (which follow `modal_mode`), the show
+      # page is ALWAYS centered when shown in a modal, so this is just a
+      # modal/page switch — not a style.
+      #
+      #   :page  (default) — full-page navigation to the show route
+      #   :modal           — open the show page in a centered dialog
+      #
+      # The kanban board has its own `show_in` that overrides this per-board.
+      VALID_SHOW_IN = [:modal, :page].freeze
+
+      inheritable_config_attr :show_in
+      show_in :page
+
+      # Validated setter — raises on an unknown mode rather than silently
+      # falling back, matching the kanban board's `show_in`.
+      def self.show_in(value = :__not_set__)
+        return show_in_config if value == :__not_set__
+        unless VALID_SHOW_IN.include?(value)
+          raise ArgumentError, "show_in must be one of #{VALID_SHOW_IN.inspect}, got #{value.inspect}"
+        end
+        self.show_in_config = value
+      end
+
       def initialize
         super
       end