plutonium 0.62.2 → 0.63.0

data/lib/plutonium/ui/table/theme.rb

@@ -32,7 +32,11 @@ module Plutonium
             header_cell_link: "flex items-center gap-1 cursor-pointer hover:text-[var(--pu-text)]",
 
             # Body
-            body_row: "pu-table-body-row",
+            # `group/row` is what lets the drag grip reveal itself on row hover.
+            # NAMED, not the bare `group`: header cells already use an unnamed
+            # group for their sort indicator, and a future nested group inside a
+            # cell would silently capture `group-hover:` from anything below it.
+            body_row: "pu-table-body-row group/row",
             body_cell: "pu-table-body-cell whitespace-pre max-w-[450px] overflow-hidden text-ellipsis",
 
             # Sorting
@@ -49,7 +53,60 @@ module Plutonium
             column_menu_panel: "hidden absolute right-0 top-full mt-1 z-50 min-w-[180px] bg-[var(--pu-surface)] border border-[var(--pu-border)] rounded-md shadow-lg p-1",
             column_menu_item: "flex items-center gap-2 px-2 py-1.5 text-sm text-[var(--pu-text)] rounded hover:bg-[var(--pu-surface-alt)] w-full",
             column_menu_item_disabled: "flex items-center gap-2 px-2 py-1.5 text-sm text-[var(--pu-text-subtle)] opacity-60 cursor-not-allowed",
-            column_menu_separator: "my-1 border-t border-[var(--pu-border)]"
+            column_menu_separator: "my-1 border-t border-[var(--pu-border)]",
+
+            # Drag-to-reorder grip (see Components::DragHandle)
+            #
+            # `-ml-5` cancels `w-5` exactly, so the grip sits in the cell's
+            # existing left padding and costs the content no horizontal space.
+            #
+            # Hidden until the row is hovered — but ALWAYS visible on focus. A
+            # keyboard user cannot hover, and an invisible tab stop that moves
+            # rows when you press an arrow key is worse than no affordance at all.
+            drag_handle_cell: "flex items-center",
+            drag_handle: "-ml-5 mr-1.5 w-5 h-5 shrink-0 inline-flex items-center justify-center rounded " \
+                         "text-[var(--pu-text-subtle)] hover:text-[var(--pu-text)] " \
+                         "opacity-0 group-hover/row:opacity-100 focus:opacity-100 " \
+                         "transition-opacity cursor-grab active:cursor-grabbing " \
+                         "focus:outline-none focus:ring-2 focus:ring-[var(--pu-input-focus-ring)]",
+            # Dimmer than the live grip, and a pointer rather than a grab cursor:
+            # it looks like the same control, switched off, and clicking it is
+            # what switches it back on.
+            drag_handle_disabled: "-ml-5 mr-1.5 w-5 h-5 shrink-0 inline-flex items-center justify-center rounded " \
+                                  "text-[var(--pu-text-subtle)] " \
+                                  "opacity-0 group-hover/row:opacity-40 hover:opacity-100 focus:opacity-100 " \
+                                  "transition-opacity cursor-pointer " \
+                                  "focus:outline-none focus:ring-2 focus:ring-[var(--pu-input-focus-ring)]",
+
+            # The card-grid placement of the same grip (Grid::Card).
+            #
+            # Same principle as the row grip — live in padding the card already
+            # had, cost the content nothing — but expressed as a full-height rail
+            # rather than a negative margin, because a card's content is a
+            # multi-line flex column rather than one cell. `w-4` is exactly the
+            # `p-4` left padding of both card layouts, so the rail fills the
+            # gutter and stops precisely where the text begins. A floating corner
+            # button was tried first and sat on top of the card title.
+            #
+            # It still carries a translucent surface + blur: in the :media layout
+            # the cover image runs edge to edge, so the gutter is only empty in
+            # the compact layout.
+            #
+            # `group/card`, not `group/row`: the card names its own hover group
+            # so nesting a card inside a table (or vice versa) can never have one
+            # reveal the other's grip.
+            drag_handle_card: "absolute left-0 top-0 bottom-0 z-20 w-4 inline-flex items-center justify-center " \
+                              "bg-[var(--pu-surface-alt)]/70 backdrop-blur-sm " \
+                              "text-[var(--pu-text-subtle)] hover:text-[var(--pu-text)] " \
+                              "opacity-0 group-hover/card:opacity-100 focus:opacity-100 " \
+                              "transition-opacity cursor-grab active:cursor-grabbing " \
+                              "focus:outline-none focus:ring-2 focus:ring-inset focus:ring-[var(--pu-input-focus-ring)]",
+            drag_handle_card_disabled: "absolute left-0 top-0 bottom-0 z-20 w-4 inline-flex items-center justify-center " \
+                                       "bg-[var(--pu-surface-alt)]/70 backdrop-blur-sm " \
+                                       "text-[var(--pu-text-subtle)] " \
+                                       "opacity-0 group-hover/card:opacity-40 hover:opacity-100 focus:opacity-100 " \
+                                       "transition-opacity cursor-pointer " \
+                                       "focus:outline-none focus:ring-2 focus:ring-inset focus:ring-[var(--pu-input-focus-ring)]"
           })
         end
       end

data/lib/plutonium/ui/wizard/review.rb

@@ -114,11 +114,13 @@ module Plutonium
             div(class: "px-5 py-4") do
               # Decorate so attachment fields resolve to displayable attachments —
               # the SummaryDisplay then renders them through the normal attachment
-              # display component, not the raw token string.
+              # display component, not the raw token string. (Choice fields need no
+              # decorator: the summary resolves their labels per field from the
+              # `inputs` it is already handed.)
               if fields.any?
                 render SummaryDisplay.new(
                   Plutonium::Wizard::AttachmentData.wrap(step_data(step), step),
-                  fields:, inputs: step.inputs
+                  fields:, inputs: step.inputs, wizard: @runner.wizard
                 )
               end
               render_structured(step) if structured.any?

data/lib/plutonium/ui/wizard/summary_display.rb

@@ -14,13 +14,20 @@ module Plutonium
         # @param inputs [Hash] the step's input config ({name => {options:}}), so a
         #   field's declared `as:` informs the display component (e.g. a `:text`
         #   input renders via the markdown/text display tag).
-        def initialize(object, fields:, inputs: {}, **options)
+        def initialize(object, fields:, inputs: {}, wizard: nil, **options)
           options[:key] = :wizard
           @summary_fields = fields
           @summary_inputs = inputs
+          @wizard = wizard
           super(object, **options)
         end
 
+        # The wizard driving this run. Present for the same reason the step form
+        # exposes it: an `->(form) { form.wizard… }` option asks the form for it,
+        # and on the review page this component stands in for the form.
+        # @return [Plutonium::Wizard::Base, nil]
+        attr_reader :wizard
+
         def display_template
           dl(class: "grid grid-cols-1 sm:grid-cols-2 gap-x-6 gap-y-3") do
             @summary_fields.each { |name| render_summary_field(name) }
@@ -37,7 +44,7 @@ module Plutonium
           # has_cents reflection, so inference would render it as a bare number.
           # Force the currency display and thread the declared `unit:` so the
           # recap reads "$1,234.56", matching the input's prefix.
-          if input_options[:as]&.to_sym == :currency
+          if Plutonium::Definition::InputAliases.resolve(input_options[:as]) == :currency
             return render field(name, **field_options).wrapped { |f|
               render f.send(:create_component, Plutonium::UI::Display::Components::Currency, :currency, unit: input_options[:unit])
             }
@@ -58,17 +65,41 @@ module Plutonium
         end
 
         # Map the raw value(s) to their choice label(s) using the SAME mapper the
-        # form's select uses, so summary labels always match the form. Falls back
-        # to the raw value for anything not in `choices:`; nil for an empty field
-        # (so the display renders its placeholder).
+        # form's select uses, so summary labels always match the form. Falls back to
+        # the raw value for anything not in `choices:`; nil for an empty field (so
+        # the display renders its placeholder).
+        #
+        # The mapper is built ONCE per field, not once per value: `choices:` is
+        # routinely a proc (`-> { Member.all.map { |m| [m.name, m.id] } }`), and a
+        # per-value mapper would re-run that query for every element of a
+        # multi-select.
+        #
         def resolve_choice_label(name, input_options)
+          values = Array(Phlexi::Field::Support::Value.from(object, name))
+          return if values.empty?
+
           mapper = Phlexi::Form::SimpleChoicesMapper.new(
-            input_options[:choices],
+            resolved_choices(input_options[:choices]),
             label_method: input_options[:label_method],
             value_method: input_options[:value_method]
           )
-          raw = Phlexi::Field::Support::Value.from(object, name)
-          Array(raw).map { |value| mapper[value] || value }.join(", ").presence
+          values.map { |value| mapper[value] || value }.join(", ").presence
+        end
+
+        # Resolve a proc'd `choices:` by the SAME arity rule the form applies to
+        # every input option (see Form::Resource#call_option_proc): zero-arity means
+        # what it reads like where it was written; `->(form) { … }` is asking for
+        # the form, and on the review page this component stands in for it — it
+        # answers `object` (the step's staged data) and `wizard`.
+        #
+        # Without this the summary hands the raw proc to the mapper, which bare-
+        # `call`s it — so `choices: ->(form) { form.wizard.anchor.available_tiers }`,
+        # a declaration Form::Wizard documents and the step form renders happily,
+        # would raise ArgumentError the moment the user reached review.
+        def resolved_choices(choices)
+          return choices unless choices.is_a?(Proc)
+
+          choices.arity.zero? ? choices.call : choices.call(self)
         end
 
         # Pick the display component the same way a resource display does — infer it
@@ -78,12 +109,9 @@ module Plutonium
         # data object is decorated upstream to resolve the token to an attachment).
         def summary_tag_block(name)
           ->(f) {
-            tag = Plutonium::Wizard::Attachments.field?(@summary_inputs[name]) ? :attachment : f.inferred_field_component
-            if tag.is_a?(Class)
-              f.send(:create_component, tag, tag.name.demodulize.underscore.sub(/component$/, "").to_sym)
-            else
-              f.send(:"#{tag}_tag")
-            end
+            # nil lets the builder infer the tag from the value's type.
+            tag = :attachment if Plutonium::Wizard::Attachments.field?(@summary_inputs[name])
+            f.component_for(tag)
           }
         end
       end

data/lib/plutonium/version.rb

@@ -1,5 +1,5 @@
 module Plutonium
-  VERSION = "0.62.2"
+  VERSION = "0.63.0"
   NEXT_MAJOR_VERSION = VERSION.split(".").tap { |v|
     v[1] = v[1].to_i + 1
     v[2] = 0

data/lib/plutonium/wizard/attachments.rb

@@ -2,224 +2,59 @@
 
 module Plutonium
   module Wizard
-    # Bridges a wizard's staged attachment value to the displayable attachment the
-    # `Uppy` input and `Display::Components::Attachment` render — **model-free and
-    # backend-agnostic**, for a bare `attribute :photo, :string` + `input :photo,
-    # as: :uppy, direct_upload: true` field (no `using:` model needed).
+    # A wizard's view of {Plutonium::Attachments}.
     #
-    # A wizard stages plain strings, so an attachment field holds its backend's own
-    # direct-upload token: ActiveStorage's **signed_id** (an opaque signed string)
-    # or active_shrine/Shrine's **cached-file data** (a JSON object). Those are the
-    # only two shapes, and they're distinguishable — a Shrine token parses as JSON,
-    # an AS signed_id doesn't — so we revive each through its own backend with no
-    # model and no per-field configuration.
+    # The staging and revival machinery moved out when async interactions needed
+    # the same thing: both hold an attachment as a bare string while the work is
+    # in flight, and neither has a model to hang it off until the work lands.
+    # None of that was ever wizard-specific — only the two things left here are.
     #
-    # Resolution is **display-only**: staging and `execute` (which assigns the token
-    # straight to a model attachment — both AS and active_shrine accept it) never
-    # call it. The two backends' native objects answer DIFFERENT method names
-    # (`filename`/`content_type` vs `original_filename`/`mime_type`), so a resolved
-    # token is wrapped in {Resolved}, a uniform view exposing exactly what the
-    # display + preview components call. See the wizard-attachments design spec.
+    # This stays the wizard's entry point rather than having wizard code reach
+    # for the shared module directly, so the +backend:+ default keeps being the
+    # wizard's own setting without every call site remembering to pass it.
     module Attachments
-      module_function
+      # Kept as a constant here because it is part of this module's published
+      # surface: a host rendering a staged attachment may name
+      # +Wizard::Attachments::Resolved+.
+      Resolved = Plutonium::Attachments::Resolved
 
-      # Resolve a staged attachment token (or array of them) into uniform
-      # {Resolved} view(s).
-      #
-      # @param value [String, Array, nil] the staged token(s).
-      # @return [Array<Resolved>] resolved attachments; blank, tampered, or
-      #   unrecognized tokens are dropped (never raised), so a bad token can't 500
-      #   the form or the review.
-      def resolve(value)
-        Array(value).filter_map { |token| resolve_token(token) }
-      end
+      module_function
 
       # Whether a step input renders as an attachment (its `as:` is a file alias),
       # so its staged token should be resolved for display. Keys off the form's
       # canonical file-input alias set, so the two never drift.
+      #
+      # Wizard-only: it reads a STEP INPUT's options, which is a shape nothing
+      # outside the wizard DSL has.
       def field?(input_options)
         as = input_options&.dig(:options, :as) || input_options&.dig(:as)
-        Plutonium::UI::Form::Base::Builder::FILE_INPUT_TYPES.include?(as&.to_sym)
+        Plutonium::Definition::InputAliases.file_input?(as)
       end
 
-      # SERVER-SIDE staging: turn a submitted attachment value into a token string
-      # to stage in `data`, minting one from an uploaded file when needed.
+      # The server-side staging backend for wizard attachments: the wizard's own
+      # setting, else the global default.
       #
-      # Handles every shape a step POST can carry for an attachment field:
-      # - an already-minted token String (direct upload, or the hidden preview field
-      #   on re-submit) → kept verbatim;
-      # - an uploaded file (IO-like) → uploaded to the backend's cache, returning its
-      #   token (an AS signed_id, or Shrine cached-file JSON);
-      # - blank / no selection → nil (the caller drops the key so the previously
-      #   staged token survives a Back/re-submit);
-      # - an Array (multiple) → each element mapped, blanks dropped.
+      # Layered rather than replacing: an app that sets only
+      # +config.attachment_backend+ gets it here too, and one that sets
+      # +config.wizards.attachment_backend+ still overrides it for wizards alone.
       #
-      # @param backend [Symbol, nil] per-field override; nil → the configured default.
-      # @param uploader [Class, String, nil] a Shrine uploader to cache through
-      #   (`:shrine` backend only) — its cache-stage plugins (mime/dimension
-      #   extraction, `generate_location`, validations) run instead of base Shrine's.
-      #   The minted token stays uploader-agnostic, so display + `execute` promotion
-      #   are unaffected. Ignored shape for ActiveStorage (raises if given).
-      def stage_upload(value, backend: nil, uploader: nil)
-        if value.is_a?(Array)
-          value.filter_map { |v| stage_upload(v, backend:, uploader:) }.presence
-        elsif value.is_a?(String)
-          value.presence
-        elsif value.respond_to?(:read)
-          upload_to_cache(value, backend || attachment_backend, uploader:)
-        end
-      end
-
-      # The default server-side staging backend: the configured one, else
-      # auto-detected (active_shrine loaded → Shrine, else ActiveStorage).
+      # @return [Symbol]
       def attachment_backend
         Plutonium.configuration.wizards.attachment_backend ||
-          (defined?(ActiveShrine) ? :shrine : :active_storage)
-      end
-
-      # Run the EFFECTIVE Shrine uploader's attacher validations against a staged
-      # token (or array of them), returning the validation messages — so a file that
-      # violates the uploader's `validate_*` rules is rejected at the STEP (stage
-      # phase), not deferred to `execute`'s model assignment.
-      #
-      # The effective uploader is the field's `uploader:` if given, else base
-      # `Shrine` — both of which may carry `Attacher.validate` rules. Returns `[]`
-      # when the field isn't Shrine-backed (ActiveStorage has no attacher here), when
-      # nothing is staged, or when the effective uploader declares no validations.
-      #
-      # @param value [String, Array, nil] the staged token(s).
-      # @param backend [Symbol, nil] per-field override; nil → the configured default.
-      # @param uploader [Class, String, nil] the field's `uploader:` option.
-      # @return [Array<String>] validation messages (empty ⇒ valid).
-      def validation_errors(value, backend: nil, uploader: nil)
-        return [] unless (backend || attachment_backend).to_sym == :shrine
-
-        klass = shrine_uploader(uploader)
-        # Shrine's `validation` plugin is OPTIONAL — without it (or `validation_helpers`)
-        # the Attacher has no `#errors` and nothing to enforce. Detect it up front so a
-        # plugin-less app is a clean no-op, not a per-step rescued NoMethodError.
-        return [] unless klass::Attacher.method_defined?(:errors)
-
-        Array(value).flat_map { |token| token_validation_errors(klass, token) }
-      end
-
-      # Validate one cached token through an uploader's attacher. A broad rescue
-      # (like {resolve_token}) — a tampered/expired token shouldn't 500 the step; it
-      # surfaces at `execute` instead, where it's caught as a RecordInvalid.
-      def token_validation_errors(uploader_class, token)
-        return [] if token.blank?
-
-        attacher = uploader_class::Attacher.new
-        attacher.assign(token)
-        Array(attacher.errors)
-      rescue => e
-        Rails.logger.warn { "[Plutonium::Wizard] attachment validation skipped: #{e.class}: #{e.message}" }
-        []
-      end
-      private_class_method :token_validation_errors
-
-      # Upload a file to the backend's CACHE and return its re-postable token. The
-      # file lives in cache until `execute` assigns the token to a real attachment
-      # (which promotes it); an abandoned upload is reaped by the backend's own
-      # unattached-cache cleanup.
-      def upload_to_cache(file, backend, uploader: nil)
-        case backend.to_sym
-        when :shrine
-          shrine_uploader(uploader).upload(file, :cache).to_json
-        when :active_storage
-          raise ArgumentError, "input `uploader:` is only supported for the :shrine backend" if uploader
-          ActiveStorage::Blob.create_and_upload!(
-            io: file, filename: file.original_filename, content_type: file.content_type
-          ).signed_id
-        else
-          raise ArgumentError, "unknown wizard attachment backend: #{backend.inspect}"
-        end
-      end
-      private_class_method :upload_to_cache
-
-      # Resolve an `uploader:` option to the Shrine uploader class to cache through.
-      # nil → base `Shrine`; a class is used as-is; a String/Symbol is constantized.
-      # Anything that isn't a Shrine subclass is a configuration error (fail loud).
-      def shrine_uploader(uploader)
-        return Shrine if uploader.nil?
-
-        klass = uploader.is_a?(Class) ? uploader : uploader.to_s.safe_constantize
-        unless klass.is_a?(Class) && klass <= Shrine
-          raise ArgumentError, "input `uploader:` must be a Shrine uploader class, got #{uploader.inspect}"
-        end
-        klass
-      end
-      private_class_method :shrine_uploader
-
-      # Revive one token through whichever backend owns it, wrapped in {Resolved}. A
-      # broad rescue is warranted here (unlike elsewhere): the token is arbitrary,
-      # user-supplied input reconstituted at a render boundary, and the two backends
-      # raise different error classes for a tampered/expired token — none of which
-      # should take down the page.
-      def resolve_token(token)
-        return if token.blank?
-
-        source = shrine_uploaded_file(token) || active_storage_blob(token)
-        source && Resolved.new(source, token)
-      rescue => e
-        Rails.logger.warn { "[Plutonium::Wizard] could not resolve attachment token: #{e.class}: #{e.message}" }
-        nil
+          Plutonium::Attachments.default_backend
       end
-      private_class_method :resolve_token
-
-      # A Shrine cached-file token is JSON (`{"id":…,"storage":"cache",…}`); an AS
-      # signed_id isn't. Parse-success → Shrine materializes it from the globally
-      # registered storages (no model, no per-field uploader needed for a `.url`).
-      def shrine_uploaded_file(token)
-        return unless defined?(Shrine)
 
-        data = begin
-          JSON.parse(token)
-        rescue JSON::ParserError, TypeError
-          nil
-        end
-        return unless data.is_a?(Hash)
-
-        Shrine.uploaded_file(data)
-      end
-      private_class_method :shrine_uploaded_file
+      # @see Plutonium::Attachments.resolve
+      def resolve(value) = Plutonium::Attachments.resolve(value)
 
-      def active_storage_blob(token)
-        ActiveStorage::Blob.find_signed(token) if defined?(ActiveStorage::Blob)
+      # @see Plutonium::Attachments.stage_upload
+      def stage_upload(value, backend: nil, uploader: nil)
+        Plutonium::Attachments.stage_upload(value, backend: backend || attachment_backend, uploader:)
       end
-      private_class_method :active_storage_blob
-
-      # A uniform view over a resolved attachment so the review display + the uppy
-      # preview don't care whether the source is an ActiveStorage `Blob`
-      # (`filename`/`content_type`/`representable?`) or a Shrine `UploadedFile`
-      # (`original_filename`/`mime_type`, none of the AS-only methods). Exposes
-      # exactly what those components call.
-      class Resolved
-        # @param source the backend object (AS Blob or Shrine UploadedFile).
-        # @param token  [String] the ORIGINAL staged token — what the hidden preview
-        #   field re-posts to preserve the upload across a Back/re-submit, and what
-        #   `execute` assigns to the model attachment.
-        def initialize(source, token)
-          @source = source
-          @token = token
-        end
-
-        # `url` is lazy (called at render, inside a request, where AS url options
-        # exist) — never eager at resolve time.
-        def url(*args) = @source.url(*args)
-
-        # The re-postable token, surfaced under the name the uppy input reads.
-        def signed_id = @token
-
-        def filename = (@source.try(:filename) || @source.try(:original_filename)).to_s
 
-        def content_type = @source.try(:content_type) || @source.try(:mime_type)
-
-        def representable? = @source.try(:representable?) || content_type.to_s.start_with?("image/")
-
-        def extension = @source.try(:extension).presence || File.extname(filename).delete(".").presence
-
-        def present? = true
+      # @see Plutonium::Attachments.validation_errors
+      def validation_errors(value, backend: nil, uploader: nil)
+        Plutonium::Attachments.validation_errors(value, backend: backend || attachment_backend, uploader:)
       end
     end
   end

data/lib/plutonium/wizard/base.rb

@@ -205,7 +205,12 @@ module Plutonium
       def failed(errors = nil, attribute = :base)
         case errors
         when Hash
-          errors.each { |attr, error| self.errors.add(attr, error) }
+          # A per-attribute value may be a single message or a list of them
+          # (`{name: ["is required", "is too short"]}`). `Array.wrap`, not `Array()`
+          # — the latter would splat a Hash value into [key, value] pairs.
+          errors.each do |attr, error|
+            Array.wrap(error).each { |err| self.errors.add(attr, err) }
+          end
         else
           Array(errors).each { |error| self.errors.add(attribute, error) }
         end

data/lib/plutonium/wizard/configuration.rb

@@ -29,8 +29,20 @@ module Plutonium
       #   arrive as a token and ignore this.
       attr_accessor :attachment_backend
 
+      # @return [Symbol] width for wizard step pages, one of
+      #   {Plutonium::UI::PageWidth::VALID_SIZES}.
+      #
+      #   Deliberately INDEPENDENT of `config.default_page_width`. A wizard is
+      #   its own kind of page — a focused, self-contained flow, not a resource
+      #   detail page — so an app that widens (or unconstrains) its resource
+      #   pages should not silently drag its wizards along. The default here
+      #   happens to match the resource default, but nothing ties them: change
+      #   one and the other stays put.
+      attr_accessor :width
+
       # Initialize a new wizard Configuration instance with default values.
       def initialize
+        @width = :md
         @enabled = false
         @cleanup_after = 14.days
         @database = :primary

data/lib/plutonium/wizard/controller.rb

@@ -63,6 +63,11 @@ module Plutonium
         wizard_update
       end
 
+      # DELETE .../:token
+      def cancel
+        wizard_cancel
+      end
+
       private
 
       # Identity for a standalone wizard host. Defers to the host's own auth
@@ -157,6 +162,15 @@ module Plutonium
           :"#{name}_path"
         end
       end
+
+      def wizard_launch_url
+        url_options = {}
+        if scoped_to_entity?
+          url_options[scoped_entity_param_key] = params[scoped_entity_param_key]
+        end
+        helper_name = wizard_step_url_helper.to_s.sub(/_path\z/, "_launch_path").to_sym
+        current_engine.routes.url_helpers.public_send(helper_name, **url_options)
+      end
     end
   end
 end