plutonium 0.62.2 → 0.63.0

data/lib/rodauth/features/session_isolation.rb

@@ -0,0 +1,92 @@
+require "rodauth"
+
+# Keeps each Rodauth configuration's session state independent of the others, so a
+# person can be signed into more than one portal at a time.
+#
+# Rodauth calls +clear_session+ from +update_session+ on *every* login - including
+# the +remember+ feature's +load_memory+ autologin - to defend against session
+# fixation. rodauth-rails implements that as a full +reset_session+, which drops the
+# entire Rails session rather than just the keys belonging to the configuration
+# doing the login.
+#
+# In a Plutonium app that breaks multi-portal access. Each portal authenticates
+# through its own configuration (+:user+, +:admin+, ...), so signing into one portal
+# evicts every other portal's session. Worse, with +after_login { remember_login }+
+# enabled the +load_memory+ calls in +RodauthApp#route+ then re-authenticate the
+# evicted configuration from its remember cookie on the very next request - and
+# evict the new one in turn. The last +load_memory+ in the route block wins
+# permanently, so the other portal can never hold a session at all.
+#
+# This feature carries the *other* configurations' session entries across the
+# reset. The Rails session id is still rotated and this configuration's own state is
+# still dropped, so session fixation is still defeated; application session data is
+# still cleared, exactly as before.
+#
+# Ownership is decided by +session_key_prefix+, so every configuration that wants to
+# coexist must set one. A configuration without a prefix uses Rodauth's unprefixed
+# default key names - the same names every other unprefixed configuration uses - so
+# there is no way to tell its entries apart and nothing is carried for it.
+module Rodauth
+  Feature.define(:session_isolation, :SessionIsolation) do
+    def clear_session
+      carried = sibling_session_data
+      super
+      carried.each { |key, value| session[key] = value }
+    end
+
+    private
+
+    # The session entries owned by the app's other Rodauth configurations.
+    #
+    # Keys are matched by prefix rather than by asking each configuration to
+    # enumerate them. Deriving them from method names (e.g. everything matching
+    # /_session_key\z/) would mean blind-sending methods that are not readers at
+    # all: +single_session+ exposes +reset_single_session_key+ and
+    # +update_single_session_key+ as public auth methods, both of which UPDATE the
+    # database with a fresh random key - signing the sibling out, the exact opposite
+    # of this feature's purpose.
+    def sibling_session_data
+      data = session.to_hash
+
+      sibling_rodauths.each_with_object({}) do |sibling, carried|
+        prefix = sibling.session_key_prefix.to_s
+        # Unprefixed sibling: its key names are indistinguishable from ours, and
+        # carrying them would restore our own pre-login auth state across the reset,
+        # defeating the session fixation protection.
+        next if prefix.empty?
+
+        keys = data.keys.select { |key| key.to_s.start_with?(prefix) }
+        # Courtesy for a hand-written config that sets an explicit `session_key`
+        # alongside its prefix: that value bypasses `convert_session_key` and so is
+        # unprefixed. Do NOT read this as endorsing that shape - it leaves the account
+        # id rotating separately from every other key, which is a crash waiting to
+        # happen (see the note on session_key_prefix in the auth guide). Generated
+        # configs set the prefix only, and for them this line never matches.
+        account_key = sibling.session_key.to_s
+        keys << account_key if data.key?(account_key)
+
+        keys.each do |key|
+          carried[key] = data[key] unless own_session_key?(key)
+        end
+      end
+    end
+
+    # Guards against a misconfiguration in which a sibling shares our prefix: we must
+    # never restore our own entries, or the reset would be a no-op for us.
+    def own_session_key?(key)
+      key = key.to_s
+      return true if key == session_key.to_s
+
+      prefix = session_key_prefix.to_s
+      prefix.present? && key.start_with?(prefix)
+    end
+
+    # Only base-Rodauth methods are called on siblings (+session_key_prefix+ and
+    # +session_key+), so configurations that do not enable this feature - or do not
+    # descend from the app's base plugin at all - still work.
+    def sibling_rodauths
+      names = scope.opts[:rodauths].keys - [self.class.configuration_name]
+      names.map { |name| scope.rodauth(name) }
+    end
+  end
+end

data/lib/rodauth/plugins.rb

@@ -1 +1,2 @@
 require_relative "features/case_insensitive_login"
+require_relative "features/session_isolation"

data/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@radioactive-labs/plutonium",
-  "version": "0.62.2",
+  "version": "0.63.0",
   "description": "Build production-ready Rails apps in minutes, not days. Convention-driven, fully customizable, AI-ready.",
   "type": "module",
   "main": "src/js/core.js",
@@ -40,6 +40,7 @@
     "cssnano": "^7.0.2",
     "esbuild": "^0.28.1",
     "esbuild-plugin-manifest": "^1.0.3",
+    "feed": "^6.0.0",
     "flowbite-typography": "^1.0.5",
     "medium-zoom": "^1.1.0",
     "mermaid": "^11.15.0",

data/plutonium.gemspec

@@ -12,6 +12,10 @@ Gem::Specification.new do |spec|
                      "definitions, and portals that make building complex apps faster. Built for the AI era with Claude Code skills."
   spec.homepage = "https://radioactive-labs.github.io/plutonium-core/"
   spec.license = "MIT"
+  # Ruby 3.2 is DEPRECATED and will be dropped in the next release — see the
+  # post_install_message. Held here for one more release so 3.2 users can
+  # receive the fixes in this one before support ends; raising it in the same
+  # release that ships them would strand those users on the old version.
   spec.required_ruby_version = ">= 3.2.2"
 
   spec.metadata["allowed_push_host"] = "https://rubygems.org"
@@ -19,21 +23,22 @@ Gem::Specification.new do |spec|
   # owner changes). `gem push` will prompt for an OTP at release time.
   spec.metadata["rubygems_mfa_required"] = "true"
 
+  # Prints on EVERY install: only notices still actionable for someone
+  # installing THIS version.
   spec.post_install_message = <<~MSG
-    ℹ️  Plutonium — breaking change introduced in 0.49.0
+    ⚠️  Ruby 3.2 support ends in the NEXT release
 
-    Entity-scoped URL helpers and path params were renamed in 0.49.0 from
-    `<entity>_scope_*` to `<entity>_scoped_*`.
+    This is the last Plutonium release that installs on Ruby 3.2.
 
-    Examples:
-      organization_scope_widgets_path  →  organization_scoped_widgets_path
-      params[:organization_scope]      →  params[:organization_scoped]
+    Why: pagy patches CVE-2026-54659 (a path-traversal in
+    `Pagy::I18n.locale=`) only in >= 43.5.6, and pagy dropped Ruby 3.2 in
+    43.5.0. No pagy version is both patched and installable on 3.2, so
+    continuing to support it means shipping a known-vulnerable dependency.
 
-    If you are upgrading from 0.48.0 or earlier and reference these helpers or
-    params directly (e.g. in tests, custom redirects, or hand-written links),
-    update them to the new names.
+    Ruby 3.2 reached end-of-life in March 2026.
 
-    Apps that only use `resource_url_for` are unaffected.
+    Action: upgrade to Ruby 3.3 or newer before your next Plutonium bump.
+    If you stay on 3.2, `bundle update plutonium` will hold you here.
   MSG
 
   spec.metadata["homepage_uri"] = spec.homepage
@@ -53,9 +58,14 @@ Gem::Specification.new do |spec|
   spec.require_paths = ["lib"]
 
   spec.add_dependency "zeitwerk"
-  spec.add_dependency "rails", ">= 7.2"
+  spec.add_dependency "rails", ">= 7.2.3.1"
   spec.add_dependency "csv" # CSV export; no longer a default gem on Ruby 3.4+
   spec.add_dependency "listen", "~> 3.8"
+  # NOT pinned to >= 43.5.6 (which patches CVE-2026-54659) yet: that version
+  # requires Ruby >= 3.3, so pinning it here would silently drop Ruby 3.2 a
+  # release early. `~> 43.0` already resolves to a patched 43.6.x on any fresh
+  # install under Ruby 3.3+, so the exposure is limited to apps holding an old
+  # pagy in their lockfile. Pin it in the release that drops 3.2.
   spec.add_dependency "pagy", "~> 43.0"
   spec.add_dependency "rabl", "~> 0.17.0" # TODO: what to do with RABL
   spec.add_dependency "semantic_range", "~> 3.0"
@@ -83,6 +93,14 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "combustion"
   spec.add_development_dependency "capybara"
   spec.add_development_dependency "selenium-webdriver"
+  # Exercises the Mode B positioning escape hatch (position_on with a block)
+  # against a REAL third-party positioning gem, which is the only way the
+  # worked example in docs/reference/positioning.md can be kept honest.
+  # A development dependency declared here (rather than in the Gemfile) is
+  # inherited by every appraisal gemfile via `gemspec path: "../"`, so the
+  # dummy app's acts_as_list resource loads on rails-7, 8.0 and 8.1 alike —
+  # and never becomes a runtime dependency of the gem.
+  spec.add_development_dependency "acts_as_list"
 
   # For more information and examples about making a new gem, check out our
   # guide at: https://bundler.io/guides/creating_gem.html

data/src/css/components.css

@@ -803,6 +803,18 @@ html.pu-rail-pinned .icon-rail-pin-expand {
   overscroll-behavior: contain;
 }
 
+/* Full visible viewport height.
+   100vh is the viewport as it would be with the browser's own chrome hidden,
+   so on a phone a 100vh box is taller than what the user can actually see and
+   its bottom edge sits under the URL bar or the gesture bar. dvh tracks the
+   visible area; 100vh stays as the fallback for engines without it. Same
+   reasoning as the cap on .icon-rail-flyout-inner above, which is where this
+   pattern is already in use. */
+.pu-min-h-viewport {
+  min-height: 100vh;
+  min-height: 100dvh;
+}
+
 @keyframes pu-rail-flyout-in {
   from { opacity: 0; transform: translateX(-4px); }
   to   { opacity: 1; transform: translateX(0); }
@@ -1059,7 +1071,7 @@ html.pu-rail-pinned .icon-rail-pin-expand {
 
 /* Column highlighted as the current drop target */
 .pu-kanban-drop-target {
-  outline: 2px solid var(--color-primary-500, #3b82f6);
+  outline: 2px solid theme(colors.primary.500);
   outline-offset: -2px;
   border-radius: var(--pu-radius-md, 0.5rem);
 }
@@ -1068,3 +1080,79 @@ html.pu-rail-pinned .icon-rail-pin-expand {
 .pu-kanban-no-drop {
   opacity: 0.45;
 }
+
+/* Where the drop will land. Shared by the kanban board and every positioned
+   table/grid (src/js/drag/sortable.js). Parked on <body> and positioned in
+   viewport coordinates, so it is never clipped by a scrolling column or an
+   overflow-x table wrapper. pointer-events:none keeps it out of the way of the
+   dragover hit-testing that positions it. */
+.pu-drag-marker {
+  position: fixed;
+  z-index: 60;
+  display: none;
+  pointer-events: none;
+  background: theme(colors.primary.500);
+  border-radius: var(--pu-radius-full, 9999px);
+}
+
+/* `between` is already centred in the gap the layout leaves, so it only pulls
+   back by half the line's thickness. The two ENDS touch a single item and have
+   to be pushed clear of it — off the top of the first, below the bottom of the
+   last. Tune the end clearance with --pu-drag-marker-gap. */
+.pu-drag-marker[data-axis="vertical"] {
+  height: 2px;
+}
+
+.pu-drag-marker[data-axis="vertical"][data-edge="between"] {
+  margin-top: -1px;
+}
+
+.pu-drag-marker[data-axis="vertical"][data-edge="leading"] {
+  margin-top: calc(-1 * var(--pu-drag-marker-gap, 4px));
+}
+
+.pu-drag-marker[data-axis="vertical"][data-edge="trailing"] {
+  margin-top: var(--pu-drag-marker-gap, 4px);
+}
+
+.pu-drag-marker[data-axis="horizontal"] {
+  width: 2px;
+}
+
+.pu-drag-marker[data-axis="horizontal"][data-edge="between"] {
+  margin-left: -1px;
+}
+
+.pu-drag-marker[data-axis="horizontal"][data-edge="leading"] {
+  margin-left: calc(-1 * var(--pu-drag-marker-gap, 4px));
+}
+
+.pu-drag-marker[data-axis="horizontal"][data-edge="trailing"] {
+  margin-left: var(--pu-drag-marker-gap, 4px);
+}
+
+/* Indeterminate progress for an async run with no denominator (opaque work).
+   A short segment sweeping the track: the motion is what says "alive", which a
+   static bar at any width cannot, and a full-width bar would misread as done. */
+.pu-run-progress-indeterminate {
+  width: 33%;
+  /* 1.4s must match AsyncRunProgress::SWEEP_DURATION_MS, which the server uses
+     to compute the negative animation-delay that keeps the sweep continuous
+     across polls. */
+  animation: pu-run-progress-sweep 1.4s ease-in-out infinite;
+}
+
+@keyframes pu-run-progress-sweep {
+  0% { margin-left: -33%; }
+  100% { margin-left: 100%; }
+}
+
+@media (prefers-reduced-motion: reduce) {
+  /* No sweep to convey liveness, so fall back to a full track rather than a
+     segment frozen at an arbitrary position, which would read as a percentage. */
+  .pu-run-progress-indeterminate {
+    width: 100%;
+    animation: none;
+    opacity: 0.6;
+  }
+}

data/src/css/slim_select.css

@@ -159,10 +159,30 @@
      declare its own color rule. Specific rules below still win. */
   color: var(--pu-text);
   box-shadow: var(--pu-shadow-md);
+  /* pu-input (copied onto the panel, see the guard below) would round all
+     four corners. Keep the panel square by default — the open-above/below
+     rules add back the rounding on the outer edge only. */
+  border-radius: 0;
   transform: scaleY(0);
   transform-origin: top;
 }
 
+/* SlimSelect copies the <select>'s classes onto both .ss-main and .ss-content.
+   pu-input / pu-input-(in)valid are trigger styling — on the panel their
+   translucent validation tints replace the surface background (worst in dark
+   mode, where `.dark .pu-input-invalid` outranks `.ss-content` and the panel
+   turns see-through). Re-assert the panel chrome at higher specificity. */
+.ss-content.pu-input,
+.ss-content.pu-input-invalid,
+.ss-content.pu-input-valid,
+.dark .ss-content.pu-input,
+.dark .ss-content.pu-input-invalid,
+.dark .ss-content.pu-input-valid {
+  background-color: var(--pu-surface);
+  border-color: var(--pu-border);
+  color: var(--pu-text);
+}
+
 .ss-content.ss-relative {
   @apply relative h-full;
 }

data/src/js/controllers/breadcrumbs_controller.js

@@ -0,0 +1,112 @@
+import { Controller } from "@hotwired/stimulus"
+
+// Connects to data-controller="breadcrumbs"
+//
+// Folds the middle of the trail into an overflow menu, but only as far as it
+// has to: segments are measured and dropped left-to-right until the trail fits
+// on one line. The dashboard link and the last segment always survive.
+//
+// This is deliberately width-driven rather than breakpoint-driven — a trail
+// with one short segment fits fine on a phone, and a trail with a long record
+// title can overflow a laptop. A media query can't tell those apart.
+//
+// Every segment is `shrink-0` so measurements reflect natural widths and real
+// overflow is detectable. Only once everything foldable is folded do we let the
+// final segment shrink and ellipsize, as a last resort.
+export default class extends Controller {
+  static targets = ["list", "item", "last", "overflow", "menuItem"]
+
+  connect() {
+    // The dropdown controller teleports its menu to <body> while open, which
+    // moves these rows out of our scope — hold direct references so a resize
+    // mid-open doesn't throw.
+    this.menuItems = this.menuItemTargets
+
+    this.observer = new ResizeObserver(() => this.reflow())
+    this.observer.observe(this.element)
+    this.reflow()
+
+    // Web fonts land after first paint and change every measurement.
+    document.fonts?.ready.then(() => this.reflow())
+  }
+
+  disconnect() {
+    this.observer.disconnect()
+  }
+
+  reflow() {
+    // `fonts.ready` can resolve after a Turbo navigation has already torn this
+    // element out, where every measurement reads 0 and we would "helpfully"
+    // unfold the whole trail in a detached tree.
+    if (!this.element.isConnected || !this.hasListTarget) return
+
+    // Reset to "everything inline" so we measure natural widths, not the
+    // previous pass's decisions. Nothing paints mid-reflow, so hiding the
+    // control here is invisible even when it ends up shown again below.
+    this.itemTargets.forEach((el) => this.#show(el))
+    if (this.hasOverflowTarget) this.#hide(this.overflowTarget)
+    if (this.hasLastTarget) this.lastTarget.classList.add("shrink-0")
+
+    if (this.#overflows()) {
+      // A trail with a single segment has nothing foldable and so no control.
+      if (this.hasOverflowTarget) {
+        // The control takes room too, so it has to be in place before we
+        // measure whether folding a given segment was enough.
+        this.#show(this.overflowTarget)
+
+        for (const item of this.itemTargets) {
+          if (!this.#overflows()) break
+          this.#hide(item)
+        }
+      }
+
+      // Nothing left to fold and it still doesn't fit: let the last segment
+      // ellipsize rather than push the trail off-screen.
+      if (this.#overflows() && this.hasLastTarget) {
+        this.lastTarget.classList.remove("shrink-0")
+      }
+    }
+
+    this.#syncMenu()
+  }
+
+  // Measured on the nav rather than the <ol>, because the nav is the element
+  // that actually clips (`overflow-hidden`). A non-scrolling box reports
+  // overflow inconsistently once direction is rtl; the clipping box doesn't.
+  #overflows() {
+    return this.element.scrollWidth > this.element.clientWidth
+  }
+
+  #show(el) {
+    el.classList.remove("hidden")
+    el.classList.add("flex")
+  }
+
+  #hide(el) {
+    el.classList.remove("flex")
+    el.classList.add("hidden")
+  }
+
+  // A menu row is shown exactly when its inline twin has been folded away.
+  #syncMenu() {
+    if (!this.hasOverflowTarget) return
+
+    const folded = this.itemTargets.map((el) => el.classList.contains("hidden"))
+
+    this.menuItems.forEach((row, i) => {
+      row.classList.toggle("hidden", !folded[i])
+    })
+
+    if (!folded.some(Boolean)) this.#closeOverflowMenu()
+  }
+
+  // The trail grew back far enough that the control is gone. Its menu may
+  // still be open — and teleported to <body>, so hiding the control does not
+  // hide the menu. Popper would go on positioning it against a display:none
+  // trigger, whose rect is all zeros, parking the menu in the viewport corner.
+  #closeOverflowMenu() {
+    const host = this.overflowTarget.querySelector('[data-controller~="resource-drop-down"]')
+    const dropdown = this.application.getControllerForElementAndIdentifier(host, "resource-drop-down")
+    if (dropdown?.visible) dropdown.hide()
+  }
+}

data/src/js/controllers/bulk_actions_controller.js

@@ -56,9 +56,17 @@ export default class extends Controller {
       const baseUrl = button.dataset.bulkActionUrl
       const actionName = button.dataset.bulkActionName
 
-      // Update URL with selected IDs
+      // Update URL with selected IDs.
+      //
+      // Merged into whatever query the server already put on the URL, not
+      // appended with a bare "?" — that discarded every existing param (and
+      // produced a malformed second "?" when there was one). The toolbar carries
+      // return_to there, which is what sends the user back to this index rather
+      // than stranding them on whatever the action redirects to.
       if (baseUrl) {
-        button.href = idsParam ? `${baseUrl}?${idsParam}` : baseUrl
+        const [path, query] = baseUrl.split("?")
+        const merged = [query, idsParam].filter(Boolean).join("&")
+        button.href = merged ? `${path}?${merged}` : path
       }
 
       // Show/hide button based on whether action is allowed for all selected records

data/src/js/controllers/kanban_controller.js

@@ -1,5 +1,6 @@
 import { Controller } from "@hotwired/stimulus"
 import { morphTurboFrameElements } from "@hotwired/turbo"
+import { beginDrag, computeDropIndex, endDrag, hideInsertionMarker, showInsertionMarker } from "../drag/sortable"
 
 // Connects to data-controller="kanban"
 //
@@ -435,13 +436,14 @@ export default class extends Controller {
     if (!card) return
 
     this.draggedCard = card
-    event.dataTransfer.effectAllowed = "move"
-    // Store the id so native DnD still carries data if the card is dropped
-    // outside the board (where we won't handle it, but no error).
-    event.dataTransfer.setData("text/plain", card.dataset.kanbanRecordId)
-
-    // Defer the opacity change so the drag ghost image is captured first.
-    requestAnimationFrame(() => card.classList.add("pu-kanban-dragging"))
+    // Generic mechanics (payload + deferred dragging class) live in
+    // ../drag/sortable so the table/grid reorder controller shares them.
+    // The payload is the record id, so a card dropped outside the board still
+    // carries data natively (we won't handle it, but no error).
+    beginDrag(event, card, {
+      draggingClass: "pu-kanban-dragging",
+      payload: card.dataset.kanbanRecordId
+    })
 
     // Mark columns that would reject a drop from this card's source column.
     this.#applyDropHints(card.dataset.kanbanColumnKey)
@@ -459,6 +461,19 @@ export default class extends Controller {
     event.preventDefault()
     event.dataTransfer.dropEffect = "move"
     this.#highlightColumn(column)
+
+    // The column outline says WHICH column; this says which SLOT within it.
+    // Same exclusion and same index function #onDrop uses, so the line marks
+    // the position the drop will actually take.
+    const existingCards = [...column.querySelectorAll("[data-kanban-record-id]")]
+      .filter(c => c !== this.draggedCard)
+    showInsertionMarker(existingCards, computeDropIndex(event.clientY, existingCards), {
+      axis: "vertical",
+      container: column,
+      // Cards sit further apart than table rows, so the table's clearance reads
+      // as cramped against a card's edge here.
+      gap: "10px"
+    })
   }
 
   #onDragLeave(event) {
@@ -467,12 +482,16 @@ export default class extends Controller {
     // the board wrapper when crossing the edge.
     if (!this.element.contains(event.relatedTarget)) {
       this.#clearHighlights()
+      hideInsertionMarker()
     }
   }
 
   async #onDrop(event) {
     event.preventDefault()
     this.#clearHighlights()
+    // On release, not on dragend: the marker should not outlive the gesture
+    // while the move is in flight.
+    hideInsertionMarker()
 
     if (!this.draggedCard) return
 
@@ -494,7 +513,9 @@ export default class extends Controller {
     const existingCards = [...column.querySelectorAll("[data-kanban-record-id]")]
       .filter(c => c !== this.draggedCard)
 
-    const toIndex = this.#computeDropIndex(event.clientY, existingCards)
+    // 0-based insertion index from the cursor's y-position against each card's
+    // vertical midpoint (shared geometry — see ../drag/sortable).
+    const toIndex = computeDropIndex(event.clientY, existingCards)
 
     // Columns that declare an enter_interaction, on a CROSS-column drop:
     //   • immediate (input-less) interaction  → commit directly via the normal
@@ -616,7 +637,7 @@ export default class extends Controller {
     this.#clearHighlights()
     this.#clearDropHints()
     if (this.draggedCard) {
-      this.draggedCard.classList.remove("pu-kanban-dragging")
+      endDrag(this.draggedCard, { draggingClass: "pu-kanban-dragging" })
       this.draggedCard = null
     }
   }
@@ -693,18 +714,6 @@ export default class extends Controller {
 
   // ─── helpers ─────────────────────────────────────────────────────────────────
 
-  // Returns the 0-based insertion index within the destination column by
-  // comparing the cursor y-position against each card's vertical midpoint.
-  // The card is inserted before the first card whose midpoint is below the
-  // cursor, or appended after all cards if the cursor is below every midpoint.
-  #computeDropIndex(clientY, cards) {
-    for (let i = 0; i < cards.length; i++) {
-      const rect = cards[i].getBoundingClientRect()
-      if (clientY < rect.top + rect.height / 2) return i
-    }
-    return cards.length
-  }
-
   #highlightColumn(column) {
     this.columnTargets.forEach(c => {
       c.classList.toggle("pu-kanban-drop-target", c === column)