plutonium 0.60.5 → 0.62.0

data/lib/plutonium/ui/form/base.rb

@@ -47,6 +47,13 @@ module Plutonium
           end
           alias_method :switch_tag, :toggle_tag
 
+          # Password / secret input that never renders the stored value.
+          # Routed to here for both explicit `as: :password` and every field
+          # inferred as a password (see Options::InferredTypes#infer_field_component).
+          def password_tag(**, &)
+            create_component(Components::Password, :password, **, &)
+          end
+
           def slim_select_tag(**attributes, &)
             attributes[:data_controller] = tokens(attributes[:data_controller], "slim-select")
             select_tag(**attributes, required: false, class!: "", &)
@@ -56,16 +63,27 @@ module Plutonium
             create_component(Components::Flatpickr, :flatpickr, **, &)
           end
 
+          # Money input: a number field with an optional currency-unit prefix.
+          # See {Components::Currency} for how the unit resolves.
+          def currency_tag(**, &)
+            create_component(Components::Currency, :currency, **, &)
+          end
+
           def int_tel_input_tag(**, &)
             create_component(Components::IntlTelInput, :int_tel_input, **, &)
           end
           alias_method :phone_tag, :int_tel_input_tag
 
+          # The `as:` values that render through the Uppy file-upload component —
+          # the single source of truth, also consulted by
+          # {Plutonium::Wizard::Attachments.field?} so a wizard can detect an
+          # attachment field model-free without re-listing the aliases.
+          FILE_INPUT_TYPES = %i[uppy file attachment].freeze
+
           def uppy_tag(**, &)
             create_component(Components::Uppy, :uppy, **, &)
           end
-          alias_method :file_tag, :uppy_tag
-          alias_method :attachment_tag, :uppy_tag
+          (FILE_INPUT_TYPES - [:uppy]).each { |name| alias_method :"#{name}_tag", :uppy_tag }
 
           def key_value_store_tag(**, &)
             create_component(Components::KeyValueStore, :key_value_store, **, &)
@@ -165,9 +183,11 @@ module Plutonium
           attributes["data-controller"] = form_data_controller
         end
 
-        # `dirty-form-guard` is attached unconditionally — it self-disables
-        # outside a <dialog>. Branching on `in_modal?` here would fail:
-        # Phlex forbids view-context access before rendering begins.
+        # `dirty-form-guard` is attached unconditionally — it is inert until it has
+        # something to guard: a modal (Esc/close/cancel) or a control marked
+        # `data-dirty-form-guard-leave` posting without this form's fields. With
+        # neither it never prompts. Branching on `in_modal?` here would fail: Phlex
+        # forbids view-context access before rendering begins.
         def form_data_controller
           "form dirty-form-guard"
         end

data/lib/plutonium/ui/form/components/currency.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+module Plutonium
+  module UI
+    module Form
+      module Components
+        # A numeric (money) input with an OPTIONAL currency-unit prefix. The unit
+        # is resolved by the SAME rules as the currency *display*
+        # ({Display::Components::Currency.resolve_unit}), so the input and the
+        # show/index/summary render the same symbol: an explicit `unit:` (a
+        # literal "£", a Symbol read off the record, or `false` for none) → the
+        # record's `has_cents` unit → `default_currency_unit` / the i18n default.
+        # When nothing resolves (or `unit: false`) the prefix is omitted and it's
+        # a plain number input.
+        #
+        #   input :price, as: :currency               # → configured/i18n default unit
+        #   input :price, as: :currency, unit: "£"
+        #   input :price, as: :currency, unit: false  # no prefix
+        class Currency < Phlexi::Form::Components::Input
+          def view_template
+            return super if @unit_prefix.blank?
+
+            # Overlay the unit at the input's left edge; the currency-input
+            # Stimulus controller measures this prefix and sets the input's
+            # left padding to match, so digits always clear it whatever the
+            # symbol's width ("$" vs "GH₵").
+            div(class: "relative", data: {controller: "currency-input"}) do
+              span(
+                class: "pointer-events-none absolute inset-y-0 left-0 flex items-center pl-3 text-sm text-[var(--pu-text-muted)]",
+                aria_hidden: "true",
+                data: {currency_input_target: "prefix"}
+              ) { plain @unit_prefix }
+              super
+            end
+          end
+
+          protected
+
+          def build_input_attributes
+            @unit_prefix = resolve_unit_prefix
+            attributes[:type] = :number
+            attributes[:inputmode] = "decimal"
+            attributes[:step] ||= "0.01"
+            # Mark the input so the currency-input controller can measure the
+            # prefix and set the exact left padding at connect (see the JS).
+            if @unit_prefix.present?
+              attributes[:data] = (attributes[:data] || {}).merge(currency_input_target: "field")
+            end
+            super
+          end
+
+          private
+
+          # Resolve the prefix and strip `unit:` from the attributes so it never
+          # leaks onto the <input>. Returns "" when there's no unit to show.
+          def resolve_unit_prefix
+            explicit = attributes.delete(:unit)
+            Plutonium::UI::Display::Components::Currency.resolve_unit(explicit, field.object, field.key)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/plutonium/ui/form/components/intl_tel_input.rb

@@ -6,7 +6,10 @@ module Plutonium
       module Components
         class IntlTelInput < Phlexi::Form::Components::Input
           def view_template
-            div(data_controller: "intl-tel-input") {
+            div(data: {
+              controller: "intl-tel-input",
+              intl_tel_input_options_value: @intl_options.to_json
+            }) {
               super
             }
           end
@@ -16,6 +19,29 @@ module Plutonium
           def build_input_attributes
             super
             attributes[:data_intl_tel_input_target] = tokens(attributes[:data_intl_tel_input_target], :input)
+            @intl_options = build_intl_options
+          end
+
+          # Options forwarded to the intl-tel-input library via the Stimulus
+          # controller's `options` value. Supports a convenient `initial_country:`
+          # shortcut plus an `intl_options:` hash for any other library option
+          # (keys are the library's own camelCase names, e.g. `separateDialCode`).
+          # Both are deleted from `attributes` so they don't leak onto the <input>.
+          #
+          #   input :phone, as: :phone, initial_country: "gh"
+          #   input :phone, as: :phone, intl_options: {separateDialCode: true, strictMode: false}
+          #
+          # When no country is given, falls back to
+          # `Plutonium.configuration.default_phone_country`.
+          def build_intl_options
+            options = {}
+            if (country = attributes.delete(:initial_country) || Plutonium.configuration.default_phone_country)
+              options[:initialCountry] = country
+            end
+            if (extra = attributes.delete(:intl_options))
+              options.merge!(extra)
+            end
+            options
           end
         end
       end

data/lib/plutonium/ui/form/components/password.rb

@@ -0,0 +1,126 @@
+# frozen_string_literal: true
+
+module Plutonium
+  module UI
+    module Form
+      module Components
+        # Password / secret input that never emits the stored value into the DOM.
+        #
+        # The generic Phlexi input renders `value=field.dom.value`, leaking the
+        # server-side secret (and its length) into the page source. This component
+        # instead renders a fixed SENTINEL whenever an *untouched* secret is
+        # stored, masking both the secret and its length, and renders an empty
+        # field otherwise.
+        #
+        # On submit the sentinel maps back to `nil`, which Plutonium's param
+        # extraction (`submitted_resource_params`) compacts away — leaving the
+        # stored value untouched. An empty field passes through as "":
+        #
+        #   untouched field → sentinel submitted → nil   → keep existing
+        #   emptied field   → "" submitted       → ""    → explicit clear (clear-by-blank)
+        #   typed value     → value submitted    → value → set new value
+        #
+        # On a failed re-render of an *edited* secret the field comes back blank
+        # (we never echo a submitted secret). When the edit set a new value it is
+        # also marked `required`, so the browser forces a re-type rather than a
+        # silent blank resubmit clearing the stored secret. When the edit *cleared*
+        # the value we leave it blank and not required — the clear may be intended
+        # (clear-by-blank). Either guard is client-side UX only.
+        #
+        # The rendered sentinel is guarded client-side by the `password-sentinel`
+        # Stimulus controller: the first edit (keystroke, paste, backspace) wipes
+        # the whole field, so a partial edit can't corrupt the sentinel into a
+        # literal new password.
+        #
+        # New records and interaction forms (set-password, reset-password) render
+        # an honest empty field that invites input and lets password managers
+        # offer to generate a strong password.
+        class Password < Phlexi::Form::Components::Input
+          # Rendered in place of an existing secret. Masked in the UI; only ever
+          # visible (as this constant) in page source — never the real value.
+          SENTINEL = "__plutonium_password_unchanged__"
+
+          protected
+
+          def build_input_attributes
+            super
+            attributes[:type] = :password
+            value = masked_value
+            attributes[:value] = value
+            attributes[:autocomplete] ||= "new-password"
+            # A stored secret edited (to a new value) on a failed submit comes
+            # back blank. Force re-entry so an untouched resubmit can't silently
+            # clear it via the clear-by-blank path. Client-side UX guard only.
+            attributes[:required] = true if reentry_required?
+
+            # When the field renders the sentinel, guard it so the first edit
+            # wipes the whole value — a partial edit would corrupt the sentinel
+            # into a literal new password.
+            if value == SENTINEL
+              attributes[:data_controller] = tokens(attributes[:data_controller], :"password-sentinel")
+              attributes[:data_action] = tokens(attributes[:data_action], "beforeinput->password-sentinel#beforeinput")
+              attributes[:data_password_sentinel_sentinel_value] = SENTINEL
+            end
+
+            apply_default_hint(value)
+          end
+
+          # The masked field is otherwise opaque — the user can't tell what the
+          # dots mean or what a blank submit does. Supply a default hint
+          # explaining it, unless the author already set one (theirs wins). The
+          # wrapper renders the hint after this input, so setting it here is in
+          # time. No hint for a plain empty field (new record) — it speaks for
+          # itself.
+          def apply_default_hint(value)
+            return if field.has_hint?
+            if value == SENTINEL
+              field.hint("Leave blank to keep the current value.")
+            elsif reentry_required?
+              field.hint("Re-enter the new value to save it.")
+            end
+          end
+
+          def masked_value
+            key = field.key.to_s
+            # New records and interaction forms (set-password, reset-password)
+            # have nothing stored — render an empty field that invites input.
+            return nil unless field.object.persisted?
+            # Write-only attributes (e.g. has_secure_password's `password`) are
+            # not real columns, so there is nothing stored to keep.
+            return nil unless field.object.has_attribute?(key)
+            # Nothing stored yet — render blank.
+            return nil unless field.object.attribute_in_database(key).present?
+            # A secret is stored. On a failed re-render of an edit it is dirty:
+            # render blank so the user re-enters it (we never echo a submitted
+            # secret). Otherwise mask it (and its length) behind the sentinel,
+            # which submits back as "leave unchanged".
+            field.object.attribute_changed?(key) ? nil : SENTINEL
+          end
+
+          # True only when a stored secret was edited *to a new value* and
+          # therefore renders blank — the state where an untouched resubmit would
+          # silently clear a secret the user meant to change. We deliberately do
+          # NOT force re-entry when the edit blanked the value: that user may
+          # have intended to clear it (clear-by-blank), so let the blank stand.
+          def reentry_required?
+            key = field.key.to_s
+            field.object.persisted? &&
+              field.object.has_attribute?(key) &&
+              field.object.attribute_in_database(key).present? &&
+              field.object.attribute_changed?(key) &&
+              field.object.read_attribute(key).present?
+          end
+
+          def normalize_input(input_value)
+            # The sentinel means "leave unchanged" → nil, which
+            # `submitted_resource_params` compacts away so the stored secret is
+            # kept. An empty field passes through as "" → an explicit clear
+            # (clear-by-blank); a typed value is set as-is.
+            return nil if input_value == SENTINEL
+            super
+          end
+        end
+      end
+    end
+  end
+end

data/lib/plutonium/ui/form/components/uppy.rb

@@ -13,13 +13,16 @@ module Plutonium
                 # Hidden field for ensuring removal of esp. has_one_attached attachments
                 input(type: :hidden, name: attributes[:name], multiple: attributes[:multiple], value: nil, autocomplete: "off", hidden: true)
 
-                next if field.value.nil?
-
+                # Always render the preview container — even when empty — so the
+                # `attachment-input` controller's `attachment-preview-container`
+                # OUTLET exists on a fresh (valueless) field. Without it the FIRST
+                # upload can't inject its preview: Stimulus raises on the missing
+                # outlet and the uploaded token never reaches the form.
                 div(
                   class: "attachment-preview-container grid grid-cols-[repeat(auto-fill,minmax(0,180px))] gap-4",
                   data_controller: "attachment-preview-container"
                 ) do
-                  render_existing_attachments
+                  render_existing_attachments unless field.value.nil?
                 end
               end
 
@@ -77,8 +80,13 @@ module Plutonium
               },
               title: attachment.filename.to_s
             ) do
-              # Hidden field to preserve the uploaded file
-              input(type: :hidden, name: input_name, multiple: attributes[:multiple], value: attachment.signed_id, autocomplete: "off", hidden: true)
+              # Hidden field to preserve the uploaded file across a re-render.
+              # Only when we actually have a signed_id — on a non-JS submit or a
+              # validation-failure re-render the blob may be unsaved, and asking
+              # for its signed_id would raise. Nothing to preserve → omit it.
+              if (signed_id = preservable_signed_id(attachment))
+                input(type: :hidden, name: input_name, multiple: attributes[:multiple], value: signed_id, autocomplete: "off", hidden: true)
+              end
 
               render_preview_content(attachment)
               render_filename(attachment)
@@ -86,6 +94,19 @@ module Plutonium
             end
           end
 
+          # ActiveStorage delegates signed_id to the blob, and a *new* blob raises
+          # "Cannot get a signed_id for a new record" — so skip it there. Other
+          # backends (active_shrine, the wizard's Resolved) sign the file data
+          # itself and work fine on an unsaved record, so we must NOT gate them on
+          # the parent being persisted (that would drop a still-valid token on a
+          # validation re-render). Guarding only the new-blob case covers all three.
+          def preservable_signed_id(attachment)
+            blob = attachment.try(:blob)
+            return if blob&.new_record?
+
+            attachment.signed_id
+          end
+
           def render_preview_content(attachment)
             a(
               href: attachment.url,

data/lib/plutonium/ui/form/kanban_move.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+module Plutonium
+  module UI
+    module Form
+      # The drop-interaction form used by the kanban card-drop modal.
+      #
+      # Behaves exactly like a standard interaction form (same fields, same
+      # namespacing under `interaction[...]`, same submit button) with two
+      # deliberate differences:
+      #
+      #   1. It POSTs to the record's `kanban_move` member route rather than the
+      #      interaction's own commit URL, so Task 4's atomic handler runs the
+      #      interaction AND repositions the card in one request.
+      #   2. It carries the move context (from_column/to_column/to_index) as
+      #      top-level hidden fields so the move handler knows where the card
+      #      came from and where it landed.
+      class KanbanMove < Interaction
+        private
+
+        # POST to <member>/kanban_move for the dropped record.
+        def form_action
+          resource_url_for(resource_record!, action: :kanban_move)
+        end
+
+        def form_template
+          render_kanban_move_context
+          super
+        end
+
+        # Emit the move context as top-level params (NOT namespaced under
+        # interaction[...]) — the move handler reads params[:from_column] etc.
+        # Values come from the GET request's query string.
+        def render_kanban_move_context
+          {
+            from_column: params[:from_column],
+            to_column: params[:to_column],
+            to_index: params[:to_index]
+          }.each do |name, value|
+            input(type: :hidden, name: name.to_s, value: value)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/plutonium/ui/form/options/inferred_types.rb

@@ -5,9 +5,23 @@ module Plutonium
     module Form
       module Options
         module InferredTypes
+          include Plutonium::UI::Options::HasCentsField
+
           private
 
           def infer_field_component
+            # Password detection lives in the string-type inference, not the
+            # component-type inference (a `password` column infers as :string).
+            # Route every inferred password/secret field to the masking Password
+            # component so the stored value never reaches the DOM. We also widen
+            # the heuristic to secret-bearing names Phlexi misses (`*_secret`,
+            # `*_key`, `salt`, ...) — see #secret_field_name?.
+            return :password if inferred_string_field_type == :password || secret_field_name?
+
+            # has_cents decimal accessors render as a currency input (number field
+            # + unit prefix), mirroring the display — no explicit `as: :currency`.
+            return :currency if has_cents_field?
+
             case inferred_field_type
             when :rich_text
               return :markdown
@@ -25,6 +39,18 @@ module Plutonium
               inferred_field_component
             end
           end
+
+          # Secret-bearing names Phlexi's `is_password_field?` does not catch
+          # (it only handles `password`, `encrypted_*`, `*_password`, `*_digest`,
+          # `*_hash`, `*_token`). Mask these too so their value never reaches the
+          # DOM. Still a name heuristic, not a guarantee — opt in/out per field
+          # with `as: :password` / `as: :string`.
+          def secret_field_name?
+            name = key.to_s.downcase
+            name == "token" || name == "salt" ||
+              name.include?("secret") ||
+              name.end_with?("_key", "_salt")
+          end
         end
       end
     end

data/lib/plutonium/ui/form/resource.rb

@@ -66,7 +66,7 @@ module Plutonium
               "w-full max-w-md p-0 " \
               "open:flex flex-col " \
               "opacity-0 scale-95 data-[open]:opacity-100 data-[open]:scale-100 " \
-              "transition-[opacity,transform] duration-200 ease-out",
+              "transition-[opacity,scale] duration-200 ease-out",
             data: {"dirty-form-guard-target": "confirmDialog"},
             # Modern Chrome refuses user-agent close requests (Esc, backdrop);
             # older browsers fall back to the JS controller's interception.
@@ -202,6 +202,18 @@ module Plutonium
             hidden: true,
             data: {controller: "capture-url"}
 
+          # Kanban quick-add: carry the column key through to the create POST so
+          # the controller can apply that column's on_enter + positioning to the
+          # new record post-create (the "+ Add" link opens this form with
+          # ?kanban_column=<key>). Only emitted when present, so it never appears
+          # on ordinary new/edit forms.
+          if request.params[:kanban_column].present?
+            input name: "kanban_column",
+              value: request.params[:kanban_column],
+              type: :hidden,
+              hidden: true
+          end
+
           if in_modal?
             div(class: "shrink-0 px-6 py-3 " \
                        "bg-[var(--pu-surface)] border-t border-[var(--pu-border)] " \

data/lib/plutonium/ui/form/theme.rb

@@ -80,6 +80,13 @@ module Plutonium
             invalid_flatpickr: :invalid_input,
             neutral_flatpickr: :neutral_input,
 
+            # Currency (money input; the number field styles as a normal input,
+            # the unit prefix is overlaid by the component)
+            currency: :input,
+            valid_currency: :valid_input,
+            invalid_currency: :invalid_input,
+            neutral_currency: :neutral_input,
+
             # Int tel input
             int_tel_input: :input,
             valid_int_tel_input: :valid_input,

data/lib/plutonium/ui/form/wizard.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+module Plutonium
+  module UI
+    module Form
+      # Renders the CURRENT wizard step through the existing resource-form pipeline
+      # (§7). It rides `Form::Resource` unchanged — the only wizard-specific wiring
+      # is the per-step adapter (`resource_definition`), the value source (the
+      # wizard's typed `data`, so inputs render seeded from staged data for
+      # resume/back, including repeater rows), the `wizard[...]` param namespace,
+      # the step POST URL, and a hidden `_direction` (default `next`).
+      class Wizard < Resource
+        # @param step    [Plutonium::Wizard::Step]
+        # @param data    [Object] the wizard's typed `data` snapshot (the form
+        #   `object`; responds to every step attribute / structured input name).
+        # @param action  [String] the current step's POST URL.
+        # @param fields  [Array<Symbol>] the step's renderable field names
+        #   (scalar attributes + structured inputs).
+        def initialize(step:, data:, action:, fields:, **options, &)
+          @step = step
+          options[:key] = :wizard
+          options[:as] = :wizard
+          options[:action] = action
+          options[:resource_fields] = fields
+          options[:resource_definition] = Plutonium::Wizard::StepAdapter.new(step)
+          options[:singular_resource] = true
+          super(data, **options, &)
+        end
+
+        private
+
+        attr_reader :step
+
+        def form_template
+          # The direction defaults to "next"; the nav buttons in the page override
+          # it per-button. The wizard Stimulus controller targets it.
+          input(type: :hidden, name: "_direction", value: "next", data: {wizard_target: "direction"})
+          render_fields
+        end
+
+        # The wizard form has no submit footer of its own — the page renders the
+        # Back/Next/Finish/Cancel strip. (We still override the resource actions
+        # away so no stray "Create"/"Update" button appears.)
+        def render_actions
+        end
+
+        # The step form sits INSIDE the wizard card body (which already supplies the
+        # surface + padding), so drop the default `pu-card my-4 p-8` form chrome —
+        # otherwise it reads as a card-in-card. Keep just the vertical field rhythm.
+        def form_class
+          "space-y-6"
+        end
+
+        attr_reader :form_action
+
+        def initialize_attributes
+          super
+          attributes[:id] = "wizard-form"
+        end
+      end
+    end
+  end
+end