plutonium 0.60.5 → 0.62.0

data/src/js/controllers/password_sentinel_controller.js

@@ -0,0 +1,39 @@
+import { Controller } from "@hotwired/stimulus";
+
+// Guards a password field pre-filled with the server "unchanged" sentinel — a
+// stored secret the user hasn't touched, masked behind a fixed placeholder.
+//
+// The sentinel must be edited all-or-nothing: a partial edit (e.g. one
+// backspace) would leave a truncated sentinel that no longer matches on the
+// server and gets saved as a literal new password. So the first edit gesture
+// replaces the whole field — Backspace/Delete empties it (keep-or-clear), a
+// typed/pasted character starts a fresh value. After that first edit the field
+// behaves natively.
+export default class extends Controller {
+  static values = { sentinel: String };
+
+  connect() {
+    this.armed = this.element.value === this.sentinelValue;
+  }
+
+  beforeinput(event) {
+    if (!this.armed) return;
+
+    // Replace the whole sentinel regardless of caret position, so a click into
+    // the middle followed by a keystroke can't corrupt it.
+    event.preventDefault();
+    this.armed = false;
+
+    let next = "";
+    if (event.inputType === "insertText" && event.data != null) {
+      next = event.data;
+    } else if (event.inputType === "insertFromPaste" && event.dataTransfer) {
+      next = event.dataTransfer.getData("text");
+    }
+    // Backspace/Delete (deleteContent*) and anything else collapse to "".
+
+    this.element.value = next;
+    this.element.setSelectionRange(next.length, next.length);
+    this.element.dispatchEvent(new Event("input", { bubbles: true }));
+  }
+}

data/src/js/controllers/register_controllers.js

@@ -19,6 +19,7 @@ import AttachmentPreviewController from "./attachment_preview_controller.js"
 import AttachmentPreviewContainerController from "./attachment_preview_container_controller.js"
 import SidebarController from "./sidebar_controller.js"
 import PasswordVisibilityController from "./password_visibility_controller.js"
+import PasswordSentinelController from "./password_sentinel_controller.js"
 import RemoteModalController from "./remote_modal_controller.js"
 import KeyValueStoreController from "./key_value_store_controller.js"
 import BulkActionsController from "./bulk_actions_controller.js"
@@ -34,10 +35,14 @@ import RowClickController from "./row_click_controller.js"
 import ViewSwitcherController from "./view_switcher_controller.js"
 import AutosubmitController from "./autosubmit_controller.js"
 import DirtyFormGuardController from "./dirty_form_guard_controller.js"
+import WizardController from "./wizard_controller.js"
+import KanbanController from "./kanban_controller.js"
+import CurrencyInputController from "./currency_input_controller.js"
 
 export default function (application) {
   // Register controllers here
   application.register("password-visibility", PasswordVisibilityController)
+  application.register("password-sentinel", PasswordSentinelController)
   application.register("sidebar", SidebarController)
   application.register("resource-header", ResourceHeaderController)
   application.register("nested-resource-form-fields", NestedResourceFormFieldsController)
@@ -72,4 +77,7 @@ export default function (application) {
   application.register("view-switcher", ViewSwitcherController)
   application.register("autosubmit", AutosubmitController)
   application.register("dirty-form-guard", DirtyFormGuardController)
+  application.register("wizard", WizardController)
+  application.register("kanban", KanbanController)
+  application.register("currency-input", CurrencyInputController)
 }

data/src/js/controllers/remote_modal_controller.js

@@ -67,6 +67,16 @@ export default class extends Controller {
     if (this._closing) return;
     this._closing = true;
 
+    // Commit any in-flight enter transition to its open end-state before
+    // reversing it. Removing data-open while the enter is still running
+    // reverses that transition, and CSS shortens the reverse duration in
+    // proportion to how far the enter got — so a quick open→close snaps
+    // shut instead of animating, which reads as choppy. finish() jumps to
+    // the open state so the exit always plays its full duration. Scoped to
+    // the dialog's own transitions (not the subtree) so a descendant's
+    // infinite animation can't throw on finish().
+    this.element.getAnimations().forEach((animation) => animation.finish());
+
     this.element.removeAttribute("data-open");
 
     const animations = this.element.getAnimations({ subtree: true });

data/src/js/controllers/row_click_controller.js

@@ -16,6 +16,19 @@ export default class extends Controller {
     if (event.target.closest("a, button, input, label, select, textarea, [data-row-click-ignore]")) {
       return
     }
-    this.element.querySelector('[data-row-click-target="show"]')?.click()
+
+    const show = this.element.querySelector('[data-row-click-target="show"]')
+    if (!show) return
+
+    // Modifier-click (⌘/Ctrl) or middle-click opens the record's full page in a
+    // new tab — the standard "open in new tab" gesture — instead of following
+    // the show link's configured target (which may be a modal frame). A new
+    // browsing context sends no Turbo-Frame header, so it renders full-page.
+    if (event.metaKey || event.ctrlKey || event.button === 1) {
+      window.open(show.href, "_blank", "noopener")
+      return
+    }
+
+    show.click()
   }
 }

data/src/js/controllers/wizard_controller.js

@@ -0,0 +1,54 @@
+import { Controller } from "@hotwired/stimulus"
+
+// Connects to data-controller="wizard"
+//
+// Lightweight glue for the wizard step page. Navigation itself is plain HTML —
+// each Back/Next/Finish/Cancel button submits with its own `name="_direction"`
+// value, so the wizard works without JavaScript. This controller only:
+//
+//   - exposes the hidden `_direction` field (the `direction` target) so future
+//     client-side affordances (e.g. an autosave or a "save & exit") can set the
+//     direction before submitting;
+//   - guards against a double submit once a nav button has been pressed.
+export default class extends Controller {
+  static targets = ["direction"]
+
+  connect() {
+    this.submitting = false
+    this.element.addEventListener("submit", this.onSubmit)
+    // Re-enable when the submission's request SETTLES (success or failure), so a
+    // real later submit works while a double-click mid-flight stays blocked. A
+    // bare setTimeout(0) fired on the next tick — sub-millisecond, long before a
+    // human's second click — so it never actually guarded a double-click.
+    this.element.addEventListener("turbo:submit-end", this.onSettled)
+    // A non-Turbo full-page submit navigates away; on a Turbo back/forward
+    // (bfcache) restore the cached form returns with `submitting` still set —
+    // clear it so the restored page is usable.
+    document.addEventListener("turbo:load", this.onSettled)
+    window.addEventListener("pageshow", this.onSettled)
+  }
+
+  disconnect() {
+    this.element.removeEventListener("submit", this.onSubmit)
+    this.element.removeEventListener("turbo:submit-end", this.onSettled)
+    document.removeEventListener("turbo:load", this.onSettled)
+    window.removeEventListener("pageshow", this.onSettled)
+  }
+
+  // Set the hidden `_direction` value programmatically (optional helper).
+  setDirection(value) {
+    if (this.hasDirectionTarget) this.directionTarget.value = value
+  }
+
+  onSubmit = (event) => {
+    if (this.submitting) {
+      event.preventDefault()
+      return
+    }
+    this.submitting = true
+  }
+
+  onSettled = () => {
+    this.submitting = false
+  }
+}

data/src/js/turbo/turbo_confirm.js

@@ -35,7 +35,7 @@ function ensureDialog() {
     "scale-95",
     "data-[open]:opacity-100",
     "data-[open]:scale-100",
-    "transition-[opacity,transform]",
+    "transition-[opacity,scale]",
     "duration-200",
     "ease-out",
   ].join(" ");