plutonium 0.60.5 → 0.62.0

data/lib/plutonium/resource/controllers/wizard_actions.rb

@@ -0,0 +1,165 @@
+# frozen_string_literal: true
+
+module Plutonium
+  module Resource
+    module Controllers
+      # Resource-mounted wizard launch surface (§5.1 / Fix A). Anchored (and
+      # non-anchored) wizards registered via the `wizard` definition macro are
+      # auto-mounted as member/collection routes on the resource's OWN controller —
+      # the same way interactive record/resource actions are (see
+      # {InteractiveActions}). This is what makes the anchor IDOR-safe:
+      #
+      # - **member** actions (`wizard_record_action` / `commit_wizard_record_action`)
+      #   resolve the anchor through the resource controller's scoped, policy-gated
+      #   `resource_record!` — never an unscoped `find_by(id:)`. A record outside the
+      #   portal's authorized scope 404s, exactly like a record action.
+      # - **collection** actions (`wizard_resource_action` /
+      #   `commit_wizard_resource_action`) have no anchor (create flows).
+      #
+      # The runner-driving flow itself lives in {Plutonium::Wizard::Driving} (shared
+      # with the standalone {Plutonium::Wizard::Controller}); this concern only
+      # supplies the surface hooks (wizard class from the definition's registry, the
+      # anchor from `resource_record!`, the per-step URL) and the action authorization
+      # (the resource action policy predicate, mirroring interactive actions).
+      module WizardActions
+        extend ActiveSupport::Concern
+        include Plutonium::Wizard::Driving
+
+        included do
+          before_action :validate_wizard_action!, only: %i[
+            launch_wizard_record_action launch_wizard_resource_action
+            wizard_record_action commit_wizard_record_action
+            wizard_resource_action commit_wizard_resource_action
+          ]
+
+          before_action :authorize_wizard_record_action!, only: %i[
+            launch_wizard_record_action
+            wizard_record_action commit_wizard_record_action
+          ]
+
+          before_action :authorize_wizard_resource_action!, only: %i[
+            launch_wizard_resource_action
+            wizard_resource_action commit_wizard_resource_action
+          ]
+        end
+
+        # GET /resources/:id/wizards/:wizard_name — resolve the run, redirect to step.
+        def launch_wizard_record_action
+          wizard_launch
+        end
+
+        # GET /resources/wizards/:wizard_name — resolve the run, redirect to step.
+        def launch_wizard_resource_action
+          skip_verify_current_authorized_scope!
+          wizard_launch
+        end
+
+        # GET /resources/:id/wizards/:wizard_name/(:token)/:step
+        def wizard_record_action
+          wizard_show
+        end
+
+        # POST /resources/:id/wizards/:wizard_name/(:token)/:step
+        def commit_wizard_record_action
+          wizard_update
+        end
+
+        # GET /resources/wizards/:wizard_name/(:token)/:step
+        def wizard_resource_action
+          skip_verify_current_authorized_scope!
+          wizard_show
+        end
+
+        # POST /resources/wizards/:wizard_name/(:token)/:step
+        def commit_wizard_resource_action
+          skip_verify_current_authorized_scope!
+          wizard_update
+        end
+
+        private
+
+        # --- surface hooks (override Driving) ---
+
+        # The wizard class for this request, resolved from the resource definition's
+        # registry by the `:wizard_name` route segment.
+        def current_wizard_class
+          @current_wizard_class ||= current_wizard_registration.fetch(:wizard_class)
+        end
+
+        # The anchor for member (record) actions is the scoped, policy-gated record
+        # — the IDOR-safe path. Member routes carry `:id`; collection (create) routes
+        # don't, and have no anchor.
+        def resolved_wizard_anchor
+          return nil if params[:id].blank?
+
+          resource_record!
+        end
+
+        # Build the GET URL for a given step, preserving the `:id` (member),
+        # `:wizard_name`, and `:token` segments. Built through `resource_url_for`
+        # with the `wizard:` kwarg (mirroring how interactions build their URLs via
+        # `resource_url_for(..., interaction:)`) — never string-surgery on
+        # `request.path`, so the URL is always a same-host, route-validated path.
+        def wizard_step_url(step_key)
+          resource_url_for(
+            wizard_url_subject,
+            wizard: current_wizard_name,
+            step: step_key,
+            **wizard_token_param
+          )
+        end
+
+        # The URL anchor: the scoped record for member (record) actions, the
+        # resource class for collection (resource) actions.
+        def wizard_url_subject
+          params[:id].present? ? resource_record! : resource_class
+        end
+
+        def current_wizard_name
+          params[:wizard_name]
+        end
+
+        # Carry the `:token` segment for an authenticated repeatable (tokened) run,
+        # so a fresh GET resumes rather than forks (§4.5). Guest/keyed runs add no
+        # URL token (see Driving#wizard_url_token).
+        def wizard_token_param
+          token = wizard_url_token
+          token.present? ? {token: token} : {}
+        end
+
+        # --- registry / authorization ---
+
+        def registered_wizards
+          @registered_wizards ||= current_definition.class.registered_wizards
+        end
+
+        def current_wizard_registration
+          registered_wizards.fetch(params[:wizard_name]&.to_sym)
+        end
+
+        def wizard_page_description
+          current_definition.defined_actions[params[:wizard_name]&.to_sym]&.description
+        end
+
+        def validate_wizard_action!
+          key = params[:wizard_name]&.to_sym
+          unless registered_wizards.key?(key)
+            raise ::AbstractController::ActionNotFound, "Unknown wizard '#{key}'"
+          end
+        end
+
+        # Mirror interactive record-action authorization: gate via the resource
+        # action policy predicate named after the wizard key (e.g. `configure?`).
+        def authorize_wizard_record_action!
+          authorize_current! resource_record!, to: :"#{params[:wizard_name]}?"
+        end
+
+        # Mirror interactive resource-action authorization: gate via the resource
+        # class action policy predicate (e.g. `onboard?`).
+        def authorize_wizard_resource_action!
+          authorize_current! resource_class, to: :"#{params[:wizard_name]}?"
+        end
+      end
+    end
+  end
+end

data/lib/plutonium/resource/policy.rb

@@ -10,6 +10,12 @@ module Plutonium
       authorize :entity_scope, allow_nil: true
       authorize :parent, optional: true
       authorize :parent_association, optional: true
+      # Supplied only during a kanban drag-move (kanban_move? authorization): the
+      # source and destination Plutonium::Kanban::Column. Optional — nil for every
+      # other authorization. Lets a policy gate a specific transition, e.g.
+      #   def kanban_move? = kanban_to&.key == :closed_won ? user.admin? : super
+      authorize :kanban_from, optional: true
+      authorize :kanban_to, optional: true
 
       relation_scope do |relation|
         default_relation_scope(relation)
@@ -172,6 +178,14 @@ module Plutonium
         update?
       end
 
+      # Authorizes a kanban board move. Delegates to update? by default — override
+      # to allow board drags without granting full edit-form access.
+      #
+      # @return [Boolean] Delegates to update?.
+      def kanban_move?
+        update?
+      end
+
       # Checks if record search is permitted.
       #
       # @return [Boolean] Delegates to index?.

data/lib/plutonium/routing/mapper_extensions.rb

@@ -43,6 +43,8 @@ module Plutonium
           define_collection_interactive_actions
           define_collection_typeahead_actions
           define_collection_export_actions
+          define_member_wizard_actions
+          define_collection_wizard_actions
         end
       end
 
@@ -149,6 +151,8 @@ module Plutonium
             as: :interactive_record_action
           post "record_actions/:interactive_action", action: :commit_interactive_record_action,
             as: :commit_interactive_record_action
+          get "kanban_move_form", action: :kanban_move_form, as: :kanban_move_form
+          post "kanban_move", action: :kanban_move, as: :kanban_move
         end
       end
 
@@ -183,6 +187,47 @@ module Plutonium
         end
       end
 
+      # Defines member-level wizard launch actions (§5.1 / Fix A). Auto-mounted on
+      # every Plutonium resource alongside record_actions — the action 404s unless
+      # `:wizard_name` is a wizard registered (anchored → record) on the resource's
+      # definition, mirroring how `:interactive_action` gates record_actions. The
+      # anchor is the scoped, policy-gated `resource_record!` (IDOR-safe).
+      #
+      # @return [void]
+      def define_member_wizard_actions
+        return unless Plutonium.configuration.wizards.enabled
+
+        member do
+          # Bare launch (no :step): resolve/mint the run and redirect to its step.
+          get "wizards/:wizard_name", action: :launch_wizard_record_action,
+            as: :launch_wizard_record_action
+          get "wizards/:wizard_name(/:token)/:step", action: :wizard_record_action,
+            as: :wizard_record_action
+          post "wizards/:wizard_name(/:token)/:step", action: :commit_wizard_record_action,
+            as: :commit_wizard_record_action
+        end
+      end
+
+      # Defines collection-level wizard launch actions (§5.1 / Fix A) for
+      # non-anchored (create) wizards. Auto-mounted alongside resource_actions;
+      # the action 404s unless `:wizard_name` is a collection wizard registered on
+      # the resource's definition.
+      #
+      # @return [void]
+      def define_collection_wizard_actions
+        return unless Plutonium.configuration.wizards.enabled
+
+        collection do
+          # Bare launch (no :step): resolve/mint the run and redirect to its step.
+          get "wizards/:wizard_name", action: :launch_wizard_resource_action,
+            as: :launch_wizard_resource_action
+          get "wizards/:wizard_name(/:token)/:step", action: :wizard_resource_action,
+            as: :wizard_resource_action
+          post "wizards/:wizard_name(/:token)/:step", action: :commit_wizard_resource_action,
+            as: :commit_wizard_resource_action
+        end
+      end
+
       # Defines the collection-level CSV export action. Auto-mounted on
       # every Plutonium resource alongside typeahead and bulk actions.
       # The action itself is gated by the `export_csv?` policy (default

data/lib/plutonium/routing/wizard_registration.rb

@@ -0,0 +1,289 @@
+# frozen_string_literal: true
+
+module Plutonium
+  module Routing
+    # Adds `register_wizard` to the routing mapper, mirroring `register_resource`
+    # (see {MapperExtensions}). A wizard is **portal-hosted** (§5.2): the routes are
+    # drawn inside the portal engine's `routes.draw` block, so they inherit the
+    # portal's scope/auth/layout, and they dispatch to a portal-namespaced wizard
+    # controller that includes {Plutonium::Wizard::Controller} + the portal's own
+    # controller concern.
+    #
+    # @example inside a portal engine's routes
+    #   AdminPortal::Engine.routes.draw do
+    #     register_wizard OnboardingWizard, at: "onboarding"
+    #     register_resource ::User
+    #   end
+    #
+    # Draws (portal-relative):
+    #   GET  /onboarding(/:token)/:step  → <Portal>::WizardsController#show
+    #   POST /onboarding(/:token)/:step  → <Portal>::WizardsController#update
+    #
+    # with `onboarding_wizard_path` / `_url` helpers.
+    module WizardRegistration
+      WIZARD_CONTROLLER_NAME = "wizards"
+
+      # Tracks public wizard mounts already appended to the main app route set, so
+      # re-draws (boot, reload, multiple portals) don't stack duplicate named
+      # routes. Keyed by the wizard CLASS NAME (not the helper name) so two distinct
+      # anonymous wizards never collapse into one entry — a helper-name collision
+      # between different wizards is a hard error (see {#register_public_wizard}),
+      # not a silent drop. Maps `wizard_class.name => helper_name`.
+      class << self
+        attr_accessor :appended_public_wizards
+      end
+
+      # @param wizard_class [Class] a Plutonium::Wizard::Base subclass
+      # @param at [String] the portal-relative base path for the wizard's steps
+      # @param as [String, Symbol, nil] override the route helper name prefix
+      # @param public [Boolean, nil] mount on a PUBLIC (unauthenticated) route
+      #   outside the portal's auth constraint, for an `anonymous` (guest) wizard.
+      #   Defaults to the wizard's own `anonymous?` flag. A non-`anonymous` wizard
+      #   may not be mounted public; an `anonymous` wizard may not be mounted
+      #   authenticated (its whole point is pre-login access). See §4.5.
+      # @param layout [Symbol, String, nil] the Rails layout this mount renders in —
+      #   a layout NAME, exactly like the controller `layout` macro: `:basic` (the
+      #   bare `BasicLayout`, e.g. an onboarding screen), `:resource` (the standard
+      #   shell), or any app layout. Only meaningful for `register_wizard` mounts;
+      #   resource-defined (`wizard` macro) wizards are always embedded. Defaults by
+      #   context (portal → the resource shell, main-app → `:basic`); turbo-frame
+      #   requests are always layout-less regardless.
+      def register_wizard(wizard_class, at:, as: nil, public: nil, layout: nil)
+        # The wizard subsystem is opt-in (`config.wizards.enabled`). When disabled,
+        # draw no routes — its tables/migrations are skipped too, so a mounted route
+        # couldn't work anyway. Warn rather than fail silently, so a
+        # registered-but-disabled wizard is discoverable instead of a mystery 404.
+        unless Plutonium.configuration.wizards.enabled
+          Rails.logger.warn { "[Plutonium::Wizard] not registering routes for #{wizard_class} — config.wizards.enabled is false" }
+          return
+        end
+
+        # A CONTEXT anchor (`anchored via: :method`) is portal-level: the anchor is
+        # resolved by calling a controller method, needs no URL `:id`, and is
+        # IDOR-safe (trusted context) — so it CAN mount here. Only a TYPE anchor
+        # (`with:`-only, resolved from the URL `:id`) is rejected, because it needs
+        # the resource controller's scoped, policy-gated `resource_record!`.
+        if wizard_class.anchored? && !wizard_class.anchored_via?
+          raise ArgumentError,
+            "register_wizard #{wizard_class.name} — `with:`-anchored wizards are not " \
+            "mounted portal-level. Register them on the anchored resource's definition " \
+            "with the `wizard` macro, which auto-mounts a record action whose anchor is " \
+            "resolved through the resource controller's scoped, policy-gated " \
+            "`resource_record!`. (A `via:`-anchored wizard mounts here fine.)"
+        end
+
+        # Default the mount kind to the wizard's `anonymous?` flag, and reject
+        # contradictions (§4.5): an `anonymous` wizard NEEDS a public route
+        # (pre-login); a non-`anonymous` wizard MUST stay behind portal auth.
+        is_public = public.nil? ? wizard_class.anonymous? : !!public
+        if is_public && !wizard_class.anonymous?
+          raise ArgumentError,
+            "register_wizard #{wizard_class.name}, public: true — only an `anonymous` " \
+            "wizard may be mounted public. Add the `anonymous` macro to the wizard, or " \
+            "drop `public:`."
+        end
+        if !is_public && wizard_class.anonymous?
+          raise ArgumentError,
+            "register_wizard #{wizard_class.name} — an `anonymous` wizard must be mounted " \
+            "public (it runs pre-login). Pass `public: true` (it is the default for " \
+            "`anonymous` wizards)."
+        end
+
+        return register_public_wizard(wizard_class, at:, as:, layout:) if is_public
+
+        ensure_wizard_controller!(wizard_class)
+
+        # The helper name defaults to the mount path (`at:`), so
+        # `register_wizard W, at: "onboarding"` yields `onboarding_wizard_path`.
+        # `as:` overrides it; the wizard's own route name is the final fallback.
+        helper_name = (as || at.presence || wizard_route_name(wizard_class)).to_s.tr("/", "_")
+        defaults = wizard_route_defaults(wizard_class, layout)
+
+        scope path: at do
+          # Canonical launch: GET the bare mount → resolve/mint the run and PRG to
+          # its first (or resumed) step, with the token already in the URL. This is
+          # the shareable entry point; `wizard_step_url` builds the stepped URLs.
+          get "/", to: "#{WIZARD_CONTROLLER_NAME}#launch",
+            as: :"#{helper_name}_wizard_launch", defaults: defaults
+          get "(/:token)/:step", to: "#{WIZARD_CONTROLLER_NAME}#show",
+            as: :"#{helper_name}_wizard", defaults: defaults
+          post "(/:token)/:step", to: "#{WIZARD_CONTROLLER_NAME}#update",
+            defaults: defaults
+        end
+      end
+
+      private
+
+      # Route defaults carried on every wizard route: the wizard class (resolves the
+      # wizard at request time) and, when explicitly set, the `layout`
+      # (a layout name). An unset layout is omitted — the driving layer then
+      # defaults it by context (portal → the resource shell, main-app → `:basic`). The
+      # layout rides the route (not a controller-class setting) because one
+      # synthesized controller serves many mounts, so the per-mount value can't live
+      # on the controller.
+      def wizard_route_defaults(wizard_class, layout)
+        defaults = {wizard_class: wizard_class.name}
+        defaults[:wizard_layout] = layout.to_s if layout
+        defaults
+      end
+
+      # Mount an `anonymous` wizard on a PUBLIC (unauthenticated) route (§4.5).
+      #
+      # Portal engines are mounted INSIDE the host's auth constraint
+      # (`constraints Rodauth::Rails.authenticate(:user) { mount ... }`), so a
+      # route drawn in the engine is unreachable pre-login. A guest wizard must
+      # therefore be drawn on the MAIN application's route set, OUTSIDE that
+      # constraint. We append to `Rails.application.routes` so the public route is
+      # added after (and independent of) the engine mount.
+      #
+      # The route dispatches to a synthesized top-level `WizardsController` that
+      # includes the full Plutonium controller stack + `Plutonium::Auth::Public`
+      # (so `current_user` is the guest sentinel) + {Plutonium::Wizard::Controller}.
+      def register_public_wizard(wizard_class, at:, as:, layout: nil)
+        ensure_public_wizard_controller!
+
+        helper_name = (as || at.presence || wizard_route_name(wizard_class)).to_s.tr("/", "_")
+        defaults = wizard_route_defaults(wizard_class, layout)
+        mount_path = at.to_s.sub(%r{\A/}, "")
+
+        # `Rails.application.routes.append` blocks are RETAINED and re-run on every
+        # route reload — so append a given wizard's block at most once. Key by the
+        # wizard CLASS (not the helper name) so re-drawing the SAME wizard is a no-op
+        # while two DIFFERENT wizards are never silently collapsed.
+        registered = (Plutonium::Routing::WizardRegistration.appended_public_wizards ||= {})
+
+        # Two distinct public wizards sharing a helper name (same `at:`/`as:`) would
+        # draw the same route name → Rails "route name already in use", or worse, a
+        # silent drop. Fail loudly with a fix instead.
+        clash = registered.find { |klass_name, helper| helper == helper_name && klass_name != wizard_class.name }
+        if clash
+          raise ArgumentError,
+            "register_wizard #{wizard_class.name}, at: #{at.inspect} — the route helper " \
+            "`#{helper_name}_wizard` is already used by #{clash.first}. Give one of them a " \
+            "distinct `at:` or `as:`."
+        end
+
+        return unless registered[wizard_class.name].nil?
+        registered[wizard_class.name] = helper_name
+
+        Rails.application.routes.append do
+          scope path: mount_path do
+            get "/", to: "public_wizards#launch",
+              as: :"#{helper_name}_wizard_launch", defaults: defaults
+            get "(/:token)/:step", to: "public_wizards#show",
+              as: :"#{helper_name}_wizard", defaults: defaults
+            post "(/:token)/:step", to: "public_wizards#update",
+              defaults: defaults
+          end
+        end
+      end
+
+      # Synthesize the top-level public `PublicWizardsController` once. Unlike the
+      # portal controller (built on the portal's authenticated `PlutoniumController`),
+      # the public one is built directly on the Plutonium controller stack with
+      # `Plutonium::Auth::Public`, so it has the rendering/scoping infra a wizard
+      # needs WITHOUT requiring a login.
+      #
+      # It is a DISTINCT const from the authenticated main-app `::WizardsController`
+      # (see {#ensure_wizard_controller!}): the two must not share a controller, or a
+      # public (guest) and an authenticated main-app wizard in the same app would
+      # collapse onto whichever was synthesized first — an authenticated main-app
+      # wizard would then run through `Auth::Public` and reject every logged-in user.
+      def ensure_public_wizard_controller!
+        return if Object.const_defined?(:PublicWizardsController, false)
+
+        # Build on a BARE base, decoupled from the app's `::PlutoniumController`
+        # (which portals inherit and may carry auth). `Plutonium::Wizard::Controller`
+        # brings the full rendering stack — including `Core::Controller`'s gem
+        # view-path, which resolves the shared partials (`plutonium/_flash`, etc.) —
+        # so no PlutoniumController inheritance is needed for that.
+        base = "ApplicationController".safe_constantize || ActionController::Base
+        klass = Class.new(base) do
+          # `Auth::Public` provides the guest `current_user`; an `anonymous` wizard
+          # ignores it for identity (session-token keyed) but the host still needs a
+          # `current_user` defined.
+          include Plutonium::Auth::Public
+          include Plutonium::Wizard::Controller
+        end
+        Object.const_set(:PublicWizardsController, klass)
+      end
+
+      def wizard_route_name(wizard_class)
+        wizard_class.name.demodulize.underscore.sub(/_wizard\z/, "")
+      end
+
+      # Resolve (creating if needed) the portal-namespaced wizard controller the
+      # routes dispatch to. The portal engine isolates its namespace, so a route
+      # `controller: "wizards"` resolves to `<PortalModule>::WizardsController`.
+      # There is no hand-written file for it (unlike resource controllers, which
+      # are scaffolded), so we synthesize it here — the same idea as
+      # {Plutonium::Portal::DynamicControllers}, but triggered explicitly at route
+      # draw time rather than via `const_missing`.
+      def ensure_wizard_controller!(wizard_class)
+        engine = wizard_route_engine
+        return if engine.nil?
+
+        portal_module = wizard_portal_module(engine)
+        if portal_module.nil?
+          # Main-app / non-namespaced mount. Synthesize a BARE top-level
+          # WizardsController (ApplicationController + the wizard module) — it is NOT
+          # rooted in the app's `::PlutoniumController` (portals inherit that, so auth
+          # there would leak). A bare synthesized controller has NO auth, so a
+          # public/`anonymous` wizard works as-is; an AUTHENTICATED main-app wizard
+          # requires the app to define its own `::WizardsController` (with its auth
+          # concern), which the const-check below picks up instead of synthesizing.
+          #
+          # This rhymes with `register_resource` ("the app owns the controller") but
+          # isn't identical: `register_resource` never synthesizes a fallback, so a
+          # missing controller is a loud routing/constant error; here the fallback is
+          # auth-less, so a missing override for an authenticated wizard fails QUIETER
+          # — every user is bounced to login rather than erroring. Covered by the
+          # skill docs + main_app_wizard_test so it's an explicit, tested edge.
+          define_wizard_controller(Object, "WizardsController", "ApplicationController", nil)
+          return
+        end
+
+        define_wizard_controller(
+          portal_module,
+          "WizardsController",
+          "#{portal_module.name}::PlutoniumController",
+          "#{portal_module.name}::Concerns::Controller"
+        )
+      end
+
+      # Synthesize a wizard controller unless one is already defined (the app's
+      # override wins — define `<Portal>::WizardsController` / `::WizardsController`
+      # to take over). `Plutonium::Wizard::Controller` brings the full rendering
+      # stack, so the parent only needs to supply auth/scope (a portal's
+      # PlutoniumController) or nothing (a bare main-app base).
+      def define_wizard_controller(namespace, const_name, parent_name, concern_name)
+        return if namespace.const_defined?(const_name, false)
+
+        parent = parent_name.safe_constantize || ActionController::Base
+        klass = Class.new(parent) do
+          include Plutonium::Wizard::Controller
+        end
+        namespace.const_set(const_name, klass)
+
+        if concern_name && (concern = concern_name.safe_constantize)
+          klass.include concern
+        end
+        klass
+      end
+
+      # The Plutonium engine owning this route set (mirrors RouteSetExtensions#engine).
+      def wizard_route_engine
+        rs = respond_to?(:route_set) ? route_set : @set
+        rs.respond_to?(:engine) ? rs.engine : nil
+      end
+
+      # The portal module (e.g. AdminPortal) for a `SomePortal::Engine`, or nil for
+      # the main application.
+      def wizard_portal_module(engine)
+        return nil if engine == Rails.application.class
+
+        engine.module_parent
+      end
+    end
+  end
+end

data/lib/plutonium/ui/display/components/currency.rb

@@ -6,16 +6,52 @@ module Plutonium
   module UI
     module Display
       module Components
-        # Renders a numeric value as currency (delimited, 2 decimals). No symbol
-        # by default; pass a literal `unit:` ("£") or a Symbol read off the
-        # record (`unit: :currency_symbol`) for per-row currencies.
+        # Renders a numeric value as currency (delimited, 2 decimals). The symbol
+        # is resolved by {resolve_unit}: an explicit `unit:` (a literal "£", a
+        # Symbol read off the record for per-row currencies, or `false` for no
+        # symbol) → the record's `has_cents` unit → `default_currency_unit` /
+        # the i18n `number.currency.format.unit` ($ in en).
         #
-        #   display :price, as: :currency
+        #   display :price, as: :currency               # → configured/i18n default unit
         #   display :price, as: :currency, unit: "£"
         #   display :price, as: :currency, unit: :currency_symbol
+        #   display :price, as: :currency, unit: false  # no symbol
         class Currency < Phlexi::Display::Components::Base
           include Phlexi::Display::Components::Concerns::DisplaysValue
 
+          # Resolves the currency unit string for a value, shared by this
+          # component and the grid/kanban {Grid::Card} so both format currency
+          # identically. Precedence, where `nil` means "not set, keep looking"
+          # and `false` means "explicitly no symbol, stop":
+          #   explicit unit → record's has_cents unit → configured/i18n default.
+          #
+          # @param explicit [String, Symbol, false, nil] a per-display `unit:`.
+          # @param record [Object] the record being rendered.
+          # @param key [Symbol] the attribute name.
+          # @return [String] the unit to pass to number_to_currency ("" for none).
+          def self.resolve_unit(explicit, record, key)
+            unit = explicit
+            unit = record.has_cents_unit_for(key) if unit.nil? && record.respond_to?(:has_cents_unit_for)
+            unit = default_unit if unit.nil?
+
+            case unit
+            when nil, false then ""
+            when Symbol then record.public_send(unit).to_s
+            else unit.to_s
+            end
+          end
+
+          # The unit used when nothing more specific is configured. Returns the
+          # `default_currency_unit` config verbatim when set (including `false`
+          # to disable the symbol); otherwise the i18n `number.currency.format.unit`
+          # *if the locale defines it*, else no symbol. We don't hardcode a "$".
+          def self.default_unit
+            config = Plutonium.configuration.default_currency_unit
+            return config unless config.nil?
+
+            I18n.t("number.currency.format.unit", default: "")
+          end
+
           def render_value(value)
             p(**attributes) { format_currency(value) }
           end
@@ -35,11 +71,7 @@ module Plutonium
           end
 
           def resolved_unit
-            case @unit
-            when nil then ""
-            when Symbol then field.object.public_send(@unit)
-            else @unit
-            end
+            self.class.resolve_unit(@unit, field.object, field.key)
           end
 
           def normalize_value(value) = value

data/lib/plutonium/ui/display/options/inferred_types.rb

@@ -5,6 +5,8 @@ module Plutonium
     module Display
       module Options
         module InferredTypes
+          include Plutonium::UI::Options::HasCentsField
+
           private
 
           def infer_field_component
@@ -23,11 +25,6 @@ module Plutonium
               super
             end
           end
-
-          def has_cents_field?
-            klass = object.class
-            klass.respond_to?(:has_cents_decimal_attribute?) && klass.has_cents_decimal_attribute?(key)
-          end
         end
       end
     end

data/lib/plutonium/ui/display/resource.rb

@@ -74,18 +74,23 @@ module Plutonium
         def render_tablist_with_details
           tablist = BuildTabList()
 
-          # Build an inner display component for the Details tab.
-          # It must be a standalone Phlex component so that TabList can call
-          # `render(details_display)` from within its own context. Phlex propagates
-          # @_state through render calls, so the inner component writes to the same
-          # buffer as the outer Resource display even though self changes.
-          details_display = build_details_display
-
-          tablist.with_tab(
-            identifier: "details",
-            title: -> { plain "Details" }
-          ) do
-            render details_display
+          # Only render the Details tab when the user is permitted to see at
+          # least one field. With no permitted fields the tab would be empty,
+          # so we drop it and let the first association tab lead instead.
+          if resource_fields.present?
+            # Build an inner display component for the Details tab.
+            # It must be a standalone Phlex component so that TabList can call
+            # `render(details_display)` from within its own context. Phlex propagates
+            # @_state through render calls, so the inner component writes to the same
+            # buffer as the outer Resource display even though self changes.
+            details_display = build_details_display
+
+            tablist.with_tab(
+              identifier: "details",
+              title: -> { plain "Details" }
+            ) do
+              render details_display
+            end
           end
 
           resource_associations.each do |name|