plutonium 0.66.0 → 0.68.0

data/config/brakeman.ignore

@@ -120,7 +120,7 @@
     {
       "warning_type": "Dangerous Eval",
       "warning_code": 13,
-      "fingerprint": "e5f68f8342a094ffd2124c1650428135e0549da39950158725414bfca0bb8f1e",
+      "fingerprint": "616e2daa0e04bcadd42f0af563dedff5450d69e0c9a0f4147c528ffbf98e3d8a",
       "check_name": "Evaluation",
       "message": "Dynamic string evaluated as code",
       "file": "lib/plutonium/auth/rodauth.rb",

data/config/locales/en/dashboard.yml

@@ -23,3 +23,4 @@ en:
         increase: "Up %{change}"
         decrease: "Down %{change}"
         unchanged: "No change"
+        points: "%{change} pts"

data/config/locales/en/js.yml

@@ -13,6 +13,9 @@ en:
         copied: "Copied!"
       slim_select:
         search_failed: "Search failed"
+        # Chip inputs that accept new values (`as: :list`, tags)
+        add_placeholder: "Type to add…"
+        add_search_placeholder: "Search or add new"
       dirty_form_guard:
         unsaved_changes: "You have unsaved changes that will be lost. Continue?"
         discard_changes: "Discard your changes?"
@@ -35,6 +38,7 @@ en:
           searchText: "No Results"
           searchPlaceholder: "Search"
           searchingText: "Searching..."
+          addableText: 'Press "Enter" to add {value}'
         # flatpickr: `locale: "de"` (the host must load the matching l10n bundle)
         # uppy: `strings: {...}` (Uppy locale strings, merged over the English defaults)
         # intl_tel_input: `{...}` (intl-tel-input `i18n` option)

data/config/locales/en/ui.yml

@@ -86,8 +86,27 @@ en:
           key_placeholder: "Key"
           value_placeholder: "Value"
           add_pair: "+ Add Pair"
+          remove_pair: "Remove pair"
         password:
           keep_current_hint: "Leave blank to keep the current value."
           reenter_hint: "Re-enter the new value to save it."
         attachment:
           delete: "Delete"
+        rating:
+          clear: "Clear"
+        association_choices:
+          none: "None"
+          empty: "No options available"
+        binary:
+          replace_hint: "Stored: %{size}. Choose a file to replace it."
+      display:
+        binary: "Binary data (%{size})"
+        code:
+          copy: "Copy"
+        duration:
+          days: "%{count}d"
+          hours: "%{count}h"
+          minutes: "%{count}m"
+          seconds: "%{count}s"
+        rating:
+          label: "%{value} out of %{max}"

data/docs/reference/dashboard/dsl.md

@@ -30,6 +30,49 @@ Default reload interval for every lazy card. `nil` (the default) disables it.
 
 Page width, one of `:sm`, `:md`, `:lg`, `:xl`, `:full`. Default `:full`.
 
+### filter(key, choices: nil, scopes: nil, default: nil, label: nil)
+
+A page-level control every card reads, such as a period or a region.
+
+```ruby
+filter :period, choices: {"7" => "Last 7 days", "30" => "Last 30 days", "90" => "Last 90 days"}, default: "30"
+
+metric(:orders) { orders.where(created_at: filter_value(:period).to_i.days.ago..).count }
+```
+
+- `choices:` maps each value to its label (a string or a lazy `t` proc), in display order. `default:` must be one of the values and is the first when omitted.
+- The key cannot be one the card route or `url_for` uses (`card`, `format`, `anchor`, `host`, `use_route`, ...), which raises when declared, or a path segment of the dashboard's route (the entity param on a path-scoped portal, a `(:locale)` scope), which raises on the request.
+- The value comes from the query string under the filter's key. A value that is not one of the choices reads as the default.
+- Every lazy card's frame URL carries every filter's value, so a card's own request reads what the page read.
+- The page renders each filter as a segmented row of links above the cards, so a choice is a URL that survives a reload and can be shared. Other query parameters on the page are kept.
+- A card's `href:` is not rewritten with the filter values. Use a scope filter (below) to link a card to the matching list.
+
+#### Scope filters
+
+`scopes:` takes a resource instead of `choices:`. The choices are "All" plus the scopes the resource's definition declares, labelled and gated (`condition:`) the way the index's scope pills are. The default is `default:`, else the definition's `default_scope`, else "All". A default whose `condition:` hides it from the current user reads as "All" for that user.
+
+```ruby
+filter :status, scopes: Post
+
+metric(:posts, href: -> { filtered_url(Post) }) { filtered(Post).count }
+chart(:by_author) { filtered(Post).group(:author_name).count }
+```
+
+- `filtered(Post)` is `authorized_resource_scope(Post)` with the chosen scope applied through the definition's own scope, the same code the index runs, so the card's number matches the list.
+- `filtered_url(Post)` is the Post index on that scope (`q[scope]=...`). With "All" chosen and a `default_scope` on the definition, it sends an explicit blank scope so the index shows everything.
+- Without a scope filter for the resource, `filtered` is the authorized scope as is and `filtered_url` the plain index.
+- A scope's block runs against the dashboard's controller. `current_user`, `current_scoped_entity` and the portal's helpers work there; resource-controller helpers such as `current_parent` do not.
+- One scope filter per resource; a second raises when declared. A `default:` that is not one of the definition's scopes, or a definition scope named `:all` (the "All" choice's value), raises on the request.
+
+### link(key, href:, label: nil, icon: nil, condition: nil)
+
+A button in the toolbar above the cards, such as the dashboard's settings or a full report. `href:` and `condition:` take the same forms as a card's and are evaluated on the dashboard instance. A link whose `href:` resolves to nil is left out.
+
+```ruby
+link :settings, icon: Phlex::TablerIcons::Settings, href: -> { resource_url_for(Setting) },
+  condition: -> { allowed_to?(:update?, Setting) }
+```
+
 ## Cards
 
 ```ruby
@@ -70,8 +113,8 @@ The block returns a value or a hash.
 | Hash key | Meaning |
 |---|---|
 | `value` | The number or string. `nil` renders `plutonium.dashboard.metric.empty` |
-| `previous` | Computes `change` as a percentage from this value; a zero previous yields no percentage |
-| `change` | Numeric percentage points (`2.5` → `+2.5%`) or a string shown as-is |
+| `previous` | Computes `change` from this value: a percentage of it, or the difference with `change_unit: :points`. A zero previous yields no percentage (a neutral dash when there is a caption); with `:points` the difference still shows. The change is rounded to one decimal before its trend is read |
+| `change` | A number (`2.5` → `+2.5%`, or `+2.5 pts` with `change_unit: :points`) or a string shown as-is |
 | `trend` | `:up`, `:down`, `:flat`; inferred from the sign of `change` |
 | `change_label` | Caption after the change |
 
@@ -83,6 +126,7 @@ The block returns a value or a hash.
 | `prefix:` / `suffix:` | String | Wrapped around the formatted value |
 | `positive:` | `:up` (default), `:down` | Which direction is good; drives the change colour |
 | `change_label:` | String | Same as the hash key |
+| `change_unit:` | `:percent` (default), `:points` | How the change reads. Use `:points` for a value that is itself a percentage: 50% to 55.6% reads `+5.6 pts`, not `+11.2%` |
 
 ### chart
 
@@ -106,6 +150,11 @@ No kind-specific options. The block is `instance_exec`ed in `Plutonium::UI::Dash
 |---|---|
 | `authorize?` | Override to gate the page and every card. Default `true` |
 | `visible_cards` | Cards whose `condition:` passes |
+| `filter_value(key)` | The filter's value for this request, or its default |
+| `filter_values` | `{key => value}` for every filter; what each card's frame URL carries |
+| `filtered(resource_class)` | The authorized scope with the resource's scope filter applied |
+| `filtered_url(resource_class)` | The resource's index on the scope that filter has chosen |
+| `visible_links` | Toolbar links whose `condition:` passes |
 | `visible_card!(key)` | The card, or `Plutonium::Dashboard::UnknownCardError` (404) |
 | `refresh_for(card)` | The card's interval, else the dashboard's; `nil` for a card declared `refresh: false` |
 | `view_context` / `helpers` | The Rails view context |
@@ -117,7 +166,9 @@ No kind-specific options. The block is `instance_exec`ed in `Plutonium::UI::Dash
 |---|---|
 | `cards` | All declared cards, in order |
 | `find_card(key)` / `find_card!(key)` | Lookup by key |
+| `filters` / `find_filter(key)` | Declared filters |
+| `links` | Declared toolbar links |
 | `label`, `description`, `icon` | Resolved presentation |
 | `i18n_key`, `route_name` | `admin_portal/sales`, `sales` |
 
-Subclasses inherit the parent's cards and options by copy, so a portal-specific subclass can add cards without touching the parent.
+Subclasses inherit the parent's cards, filters, links and options by copy, so a portal-specific subclass can add cards without touching the parent.

data/docs/reference/resource/definition.md

@@ -72,6 +72,7 @@ Plutonium detects, from the model:
 | `boolean` | `:boolean` |
 | `date`, `datetime`, `time` | `:date` / `:datetime` / `:time` |
 | `json`, `jsonb` | `:json` |
+| `binary` | `:binary` |
 
 Validations on the model inform the UI too: `validates :title, presence: true` → required field; `validates :role, inclusion: { in: [...] }` → select choices.
 
@@ -99,19 +100,20 @@ end
 
 | Category | Types |
 |---|---|
-| Text | `:string`, `:text`, `:email`, `:url`, `:tel`, `:password` |
-| Rich text | `:markdown` (EasyMDE editor) |
-| Numeric | `:number`, `:integer`, `:decimal`, `:range` |
+| Text | `:string`, `:text`, `:email`, `:url`, `:phone`, `:password` (alias `:secret`) |
+| Rich text | `:rich_text` (Action Text editor: Trix, or Lexxy once installed; **default** for `has_rich_text`), `:markdown` (EasyMDE) |
+| Numeric | `:number`, `:integer`, `:decimal`, `:range`, `:rating` (star picker, `max:`) |
 | Boolean | `:toggle` / `:switch` (switch: **default** for boolean columns), `:boolean` (plain checkbox) |
 | Date/Time | `:date`, `:time`, `:datetime` |
-| Selection | `:select`, `:slim_select`, `:radio_buttons`, `:check_boxes` |
-| Files | `:file`, `:uppy`, `:attachment` |
+| Selection | `:select`, `:slim_select`, `:collection_radio_buttons`, `:collection_checkboxes` |
+| Lists | `:list` (chip input for array values; `suggestions:`, `addable:`, `limit:`), `:tags` (no_fly_list `has_tags` contexts, **auto-detected**) |
+| Files | `:file`, `:uppy`, `:attachment` (Active Storage), `:binary` (bytes in a `binary` column) |
 | Associations | `:association`, `:secure_association`, `:belongs_to`, `:has_many`, `:has_one` |
-| Special | `:hidden`, `:color`, `:phone` |
+| Special | `:hidden`, `:color`, `:json`, `:key_value` |
 
 ### Display types (show / index)
 
-`:string`, `:text`, `:email`, `:url`, `:phone`, `:markdown`, `:number`, `:integer`, `:decimal`, `:boolean`, `:badge`, `:currency`, `:date`, `:time`, `:datetime`, `:association`, `:attachment`, `:color`
+`:string`, `:text`, `:email`, `:url`, `:phone`, `:markdown`, `:number`, `:integer`, `:decimal`, `:boolean`, `:badge`, `:currency`, `:date`, `:time`, `:datetime`, `:association`, `:attachment`, `:color`, `:key_value`, `:binary`, `:list`, `:tags`, `:rich_text`, `:relative_time`, `:code`, `:duration`, `:file_size`, `:progress`, `:rating`
 
 #### Auto-inferred display formatting
 
@@ -121,6 +123,9 @@ These render automatically; declare an `as:` only to override or pass options:
 |---|---|---|
 | `boolean` | Yes/No pill (`:boolean`) | green "Yes" / neutral "No"; override with `true_label:` / `false_label:` |
 | `enum` | status badge (`:badge`) | known statuses auto-colored; unknown values get a stable decorative color; override per-value with `colors:` |
+| `binary` | size (`:binary`) | `Binary data (12 KB)`, never the bytes |
+| `has_rich_text` | HTML (`:rich_text`) | rendered and sanitized by Action Text |
+| no_fly_list `has_tags` | chips (`:tags`) | declare by context name (`:labels`), not `labels_list` |
 | `has_cents` decimal | currency (`:currency`) | delimited, 2 decimals; symbol from `unit:` on `has_cents` (model-wide) or per-display, else `config.default_currency_unit` / the i18n default (see below) |
 
 ```ruby
@@ -1006,6 +1011,8 @@ end
 
 Grid slots, `:image`, `:header`, `:subheader`, `:body`, `:meta`, `:footer`, are all optional. `:meta` accepts an array; the rest are single fields. Slots pointing at policy-blocked fields collapse silently.
 
+In the `:media` layout a record whose image does not resolve keeps the cover's space, with a neutral icon, so cards in a row stay one height. An image may be an attachment, an `http` or root-relative URL, or a `data:image/` URI.
+
 Only declare `index_views` explicitly to **disable** one (e.g. `index_views :grid` to drop the table view).
 
 ## Custom page classes

data/docs/reference/resource/query.md

@@ -82,7 +82,7 @@ For large tables, write an explicit `search` block backed by a trigram or full-t
 
 ## Filters
 
-Six built-in filter types. Use the shorthand symbol or the full class name.
+Seven built-in filter types. Use the shorthand symbol or the full class name.
 
 `search`, `scope`, `sort_fields`, and `sort_directions` are reserved filter names; they're built-in controls in the `q[<name>]` namespace, so `filter :scope` raises `ArgumentError`.
 
@@ -94,6 +94,7 @@ Six built-in filter types. Use the shorthand symbol or the full class name.
 | Date range | `:date_range` | `from`, `to` | `from_label:`, `to_label:` |
 | Select | `:select` | `value` | `choices:`, `multiple:` |
 | Association | `:association` | `value` | `class_name:`, `multiple:` |
+| Tags | `:tags` | `value` | `match:` (`:any` default, or `:all`) |
 
 ### Text predicates
 
@@ -149,6 +150,15 @@ filter :author,   with: :association, class_name: User
 filter :tags,     with: :association, class_name: Tag, multiple: true
 ```
 
+### Tags
+
+For a [no_fly_list](https://github.com/radioactive-labs/no_fly_list) `has_tags` context. The options are the tags used by records the user can see (the policy scope), so a tenant never sees another tenant's tags.
+
+```ruby
+filter :labels, with: :tags               # records with any chosen tag
+filter :labels, with: :tags, match: :all  # records with every chosen tag
+```
+
 ### Custom filter (lambda)
 
 For simple one-offs:

data/docs/reference/ui/displays.md

@@ -78,6 +78,18 @@ Some types render with richer components automatically; you only declare an `as:
 | `:badge` | colored status pill | `enum` columns | `colors:` (per-value override) |
 | `:currency` | delimited, 2-decimal money | `has_cents` decimal accessors | `unit:`, `options:` |
 | `:color` | swatch + value | - | - |
+| `:key_value` | two-column list of keys and values; nested hashes/arrays as compact JSON | `hstore` columns | - |
+| `:binary` | `Binary data (12 KB)`, never the bytes | `binary` columns | - |
+| `:number` | delimited, at the column's scale (`1,999.50`) | `float` / `decimal` columns | - |
+| `:rich_text` | Action Text HTML, sanitized | `has_rich_text` fields | - |
+| `:tags` | chips | no_fly_list `has_tags` contexts | - |
+| `:list` | chips | - | - |
+| `:relative_time` | "3 minutes ago", kept live; absolute time on hover | - | - |
+| `:code` | monospace value with a Copy button | - | - |
+| `:duration` | seconds as `2h 15m` | - | - |
+| `:file_size` | bytes as `12 KB` | - | - |
+| `:progress` | bar + percentage | - | `max:` (default 100) |
+| `:rating` | stars | - | `max:` (default 5) |
 
 ```ruby
 class OrderDefinition < ResourceDefinition
@@ -85,12 +97,17 @@ class OrderDefinition < ResourceDefinition
   display :total,   as: :currency, unit: "£"
   display :total,   as: :currency, unit: :currency_symbol   # Symbol → read off each record
   display :shipped, as: :boolean,  true_label: "Sent", false_label: "Pending"
+  field   :settings, as: :key_value     # key/value editor on the form, key/value list on show
+  display :last_seen_at, as: :relative_time
+  display :api_reference, as: :code
+  display :completion, as: :progress, max: 1   # stored as 0..1
+  field   :score, as: :rating                # star picker on the form, stars on show
 end
 ```
 
 **Badge colors.** Known statuses (`active`, `pending`, `failed`, …) are auto-colored by meaning. Unknown values get a stable decorative color (same value → same color). Override per-value with `colors:`; valid variants: `:neutral`, `:primary`, `:secondary`, `:success`, `:danger`, `:warning`, `:info`, `:accent`.
 
-**Currency.** No symbol is shown unless you pass `unit:`, a literal string (`"£"`) or a Symbol read off the record for per-row currencies. `has_cents` decimal accessors infer `:currency` automatically (still symbol-less until you set `unit:`).
+**Currency.** The symbol comes from a per-display `unit:` (a literal `"£"`, or a Symbol read off the record for per-row currencies), else the model's `has_cents ... unit:`, else `Plutonium.configuration.default_currency_unit` / the i18n `number.currency.format.unit` (`$` in `en`). Pass `unit: false` for no symbol. `has_cents` decimal accessors infer `:currency` automatically.
 
 ## Theming
 
@@ -115,7 +132,7 @@ end
 
 ### Theme keys
 
-`fields_wrapper`, `fields_inner`, `sections_wrapper`, `section_grid`, `label`, `description`, `string`, `text`, `link`, `email`, `phone`, `markdown`, `json`, `boolean`, `badge`, `currency`, `color`, plus the shared section-chrome keys (`section_wrapper`, `section_header`, `section_summary`, `section_accent`, `section_heading`, `section_description`, `section_caret`, `section_body`).
+`fields_wrapper`, `fields_inner`, `sections_wrapper`, `section_grid`, `label`, `description`, `string`, `text`, `link`, `email`, `phone`, `markdown`, `json`, `key_value` (+ `key_value_key`, `key_value_value`, `key_value_nested`), `list` / `list_item`, `rich_text`, `relative_time`, `code` (+ `code_value`, `code_copy`), `duration`, `file_size`, `progress` (+ `progress_track`, `progress_bar`, `progress_label`), `rating` (+ `rating_filled`, `rating_empty`), `binary`, `boolean`, `badge`, `currency`, `color`, plus the shared section-chrome keys (`section_wrapper`, `section_header`, `section_summary`, `section_accent`, `section_heading`, `section_description`, `section_caret`, `section_body`).
 
 ::: warning `fields_wrapper` is the card, `fields_inner` is the grid
 `fields_wrapper` is merged into a `Plutonium::UI::Block`, which supplies `pu-card` itself, grid classes put there style the card, not the fields. Override **`fields_inner`** for the unsectioned grid, and **`section_grid`** for the grid inside a [`display_layout`](/reference/resource/definition#display-layout) section.

data/docs/reference/ui/forms.md

@@ -150,8 +150,8 @@ render field(:title).wrapped(class: "col-span-full") { |f| f.input_tag }
 | Tag | Input |
 |---|---|
 | `input_tag` | text (auto-detected type) |
-| `string_tag`, `text_tag`, `number_tag`, `email_tag`, `password_tag`, `url_tag`, `tel_tag`, `hidden_tag` | standard HTML inputs |
-| `checkbox_tag`, `select_tag`, `radio_button_tag` | standard |
+| `string_tag`, `text_tag`, `number_tag`, `email_tag`, `password_tag`, `url_tag`, `hidden_tag` | standard HTML inputs |
+| `checkbox_tag`, `select_tag`, `radio_button_tag`, `collection_radio_buttons_tag`, `collection_checkboxes_tag` | standard |
 | `toggle_tag` / `switch_tag` | switch-styled boolean (`as: :toggle` / `:switch`), the **default** for boolean columns; same behavior as a checkbox. Use `checkbox_tag` (`as: :boolean`) for a plain checkbox. |
 
 ### Plutonium-enhanced tags
@@ -164,12 +164,19 @@ render field(:title).wrapped(class: "col-span-full") { |f| f.input_tag }
 | `phone_tag` / `int_tel_input_tag` | intl-tel-input phone field |
 | `currency_tag` | Money input (number field + optional unit prefix) |
 | `uppy_tag` / `file_tag` | Uppy file upload |
+| `binary_tag` | Plain file input whose bytes go into a `binary` column |
+| `rich_text_tag` | Action Text editor (Trix, or Lexxy once installed) |
+| `list_tag` | Chip input for array values |
+| `tags_tag` | Chip input for a no_fly_list `has_tags` context |
+| `rating_tag` | Star picker (radio buttons, no JS); an optional rating gets a Clear option |
 | `secure_association_tag` | Association with policy-checked options (inline `+` add, typeahead) |
 | `belongs_to_tag` / `has_many_tag` / `has_one_tag` | Association selects |
+| `association_checkboxes_tag` / `association_toggles_tag` | has_many / habtm as a list of checkboxes or switches (see [Association inputs](#association-inputs)) |
+| `association_radio_buttons_tag` | belongs_to / has_one as a radio group |
 | `key_value_store_tag` | Key/value pairs editor |
 
 ```ruby
-render field(:published_at).wrapped { |f| f.flatpickr_tag(min_date: Date.today, enable_time: true) }
+render field(:published_at).wrapped { |f| f.flatpickr_tag }
 
 render field(:avatar).wrapped do |f|
   f.uppy_tag(allowed_file_types: %w[.jpg .png], max_file_size: 5.megabytes)
@@ -237,21 +244,66 @@ The sentinel is guarded client-side by the `password-sentinel` Stimulus controll
 - ends with `_password`, `_digest`, `_hash`, `_token`, `_key`, or `_salt`;
 - contains `secret`.
 
+The same names are masked everywhere the value would otherwise print: the show page, table cells, the wizard summary, and grid and kanban card slots all render `••••••••` instead of the value. A `field`/`display` `as:` overrides the heuristic on those surfaces too.
+
 This is a naming convenience, **not** a security guarantee, tune it per field:
 
 ```ruby
 # Opt OUT: render the value as a normal, readable text input
-field :api_token,   as: :string      # a token the admin needs to copy
+field :api_token,   as: :string      # a token the admin needs to copy (shown on the show page and cards too)
 field :content_hash, as: :string     # a checksum, not a secret
 field :public_key,  as: :string      # *_key matches, but a public key is not secret
 
 # Opt IN: mask a secret the heuristic still misses (e.g. no telltale name)
 field :recovery_phrase, as: :password
+field :pin, as: :secret                # alias of :password
 ```
 
 > [!WARNING]
 > The heuristic is name-based and best-effort. A secret column with an unconventional name (e.g. `recovery_phrase`, `pin`) still renders its value into the page unless you set `as: :password`. Audit secret-bearing columns explicitly.
 
+### Rich text (Action Text and Lexxy) {#rich-text-fields}
+
+A `has_rich_text` field renders Action Text's own editor tag, so it gets whichever editor the app has set up: Trix by default, or [Lexxy](https://lexxy.dev) once the `lexxy` gem is in the bundle (it takes over Action Text's helpers on Rails 8.0/8.1 and registers itself as the editor on 8.2). Lexxy needs Rails 8.0.2 or later. The editor's JavaScript and CSS come from the app's bundle, as Action Text's or Lexxy's install instructions describe. The show page renders the HTML through Action Text, which sanitizes it.
+
+### Lists and tags {#list-fields}
+
+`as: :list` edits an array value (a JSON or array column) as chips. Options go on `input`:
+
+```ruby
+field :nicknames, as: :list
+input :nicknames, suggestions: %w[Basin Tub], limit: 5   # addable: false allows only suggestions
+```
+
+Removing every chip saves an empty array.
+
+[no_fly_list](https://github.com/radioactive-labs/no_fly_list) `has_tags` contexts are detected automatically. Permit them by context name (`labels`, not `labels_list`) and they render as chips on the form, the show page and the table:
+
+```ruby
+class Article < ResourceRecord
+  include NoFlyList::TaggableRecord
+  has_tags :labels, scope: :organization            # per-tenant vocabulary
+  has_tags :topics, restrict_to_existing: true, limit: 3
+end
+
+# policy
+def permitted_attributes_for_create = %i[title labels topics]
+```
+
+- The input suggests tags that already exist in the record's tag scope.
+- `restrict_to_existing` only allows picking existing tags. Plutonium doesn't decide where that vocabulary is managed: create the tags however suits the app (register the tag model as a resource, seed them, or add them in an interaction).
+- `limit` caps how many tags can be chosen.
+- Add `filter :labels, with: :tags` for a table filter.
+- The table reads tags through the context's association, so preload it (`includes(:labels)`) to avoid a query per row.
+
+### Binary columns {#binary-fields}
+
+A `binary` column renders `binary_tag`: a plain file input. The uploaded file's bytes are written to the column, and the show page and table print its size (`Binary data (12 KB)`), never the bytes.
+
+- Saving without choosing a file keeps the stored bytes. There is no control to clear the column.
+- Browsers can't refill a file input, so after a failed validation the user has to choose the file again.
+- The whole file is read into memory and stored in the row. Use Active Storage (`has_one_attached` + `:uppy`) for anything that isn't small.
+
 ### Wrapped vs unwrapped
 
 - `wrapped`: includes label, hint, and error rendering. Use for normal form fields.
@@ -283,6 +335,27 @@ input :author, label_method: :email
 For large target tables, write an explicit `search` block on the target resource definition; the fallback's leading-wildcard `LIKE` can't use a b-tree index.
 :::
 
+### List variants: checkboxes, toggles, radio buttons
+
+For a short list of options, render one control per record instead of a dropdown:
+
+```ruby
+input :tags, as: :association_checkboxes      # has_many / habtm
+input :tags, as: :association_toggles         # same, styled as switches
+input :category, as: :association_radio_buttons # belongs_to / has_one
+```
+
+The variants share the select's security: options come from the target's policy scope (or `choices:`), values are signed global ids, and submitted ids are checked against the authorized relation. Like the select, they always render the records the field holds now, even past `choice_limit:` or outside the viewer's scope, and accept them back on submit, so saving a form never drops a value the viewer did not touch. The inline `+` add button renders next to the list, and `add_action:`, `skip_authorization:`, `choices:` and `label_method:` work the same way.
+
+How they differ from the select:
+
+- **The list is capped like the select.** `choice_limit:` defaults to the select's cap. There is no typeahead, so a record past the cap can't be picked: use them for short lists, or raise `choice_limit:`.
+- **Unchecking everything clears the association.** The checkbox list submits a blank value, so an empty selection saves as no records.
+- **Optional radio groups get a "None" choice.** A radio group can't be cleared otherwise. Picking it clears the association. On a has_one, Active Record detaches the old record (or destroys it, with `dependent: :destroy`) as soon as the value is assigned, before the form validates, the same as picking a different record. It is left out when the field is required (a checked "None" would satisfy the browser's `required`), and `include_blank: false` drops it on an optional one. Its label is the field's `placeholder:` if set.
+- **The macro has to fit.** Checkboxes and toggles take a has_many or habtm; radio buttons take a belongs_to or has_one. A mismatch raises `ArgumentError` when the input is built, on render and on submit, as do a polymorphic association and `group_method:`.
+
+The list and its controls are themed by `association_checkboxes`, `association_toggles`, `association_radio_buttons` (the list), `association_checkbox`, `association_toggle`, `association_radio_button` (each control) and `association_choice_label`.
+
 ## Submit buttons
 
 Default `render_actions` produces the primary submit, plus an optional "Save and add another" / "Update and continue editing" secondary button.

data/gemfiles/rails_7.gemfile

@@ -3,6 +3,7 @@
 source "https://rubygems.org"
 
 gem "rotp"
+gem "no_fly_list", github: "radioactive-labs/no_fly_list", branch: "feat/scoped-tags"
 gem "rails", "~> 7.2"
 gem "sqlite3"
 gem "puma", ">= 5.0"

data/gemfiles/rails_7.gemfile.lock

@@ -1,7 +1,15 @@
+GIT
+  remote: https://github.com/radioactive-labs/no_fly_list.git
+  revision: e1e88d9c7d898ef269e3cabfa12da2fb327459cc
+  branch: feat/scoped-tags
+  specs:
+    no_fly_list (0.7.4)
+      activerecord (>= 7.2)
+
 PATH
   remote: ..
   specs:
-    plutonium (0.64.0)
+    plutonium (0.66.0)
       action_policy (~> 0.7.0)
       csv
       listen (~> 3.8)
@@ -490,6 +498,7 @@ DEPENDENCIES
   importmap-rails
   minitest
   minitest-reporters
+  no_fly_list!
   plutonium!
   propshaft
   puma (>= 5.0)
@@ -521,7 +530,7 @@ CHECKSUMS
   activerecord (7.2.3.2) sha256=e62d24ba7e5f820d24ed122eb9225491b0aaa8398778783b400067c3467285c7
   activestorage (7.2.3.2) sha256=863cb4b21b83505555be2addb939fefb856ab05f6c6d24bab00d6f1a7e4edbfc
   activesupport (7.2.3.2) sha256=ddc90d11dd88086d78ace03407fe3c2a3f5c8853c3c3046313db5ed823ef3312
-  acts_as_list (1.2.6)
+  acts_as_list (1.2.6) sha256=8345380900b7bee620c07ad00991ccee59af3d8c9e8574f426e321da2865fdc8
   addressable (2.9.0) sha256=7fdf6ac3660f7f4e867a0838be3f6cf722ace541dd97767fa42bc6cfa980c7af
   ansi (1.6.0) sha256=ac9ea0c0ea8d32fb4e271348e609963ac78882f34b73836c2a02b3622e666658
   appraisal (2.5.0) sha256=36989221be127913b0dba8d114da2001e6b2dceea7bd4951200eaba764eed3ce
@@ -580,6 +589,7 @@ CHECKSUMS
   net-protocol (0.2.2) sha256=aa73e0cba6a125369de9837b8d8ef82a61849360eba0521900e2c3713aa162a8
   net-smtp (0.5.1) sha256=ed96a0af63c524fceb4b29b0d352195c30d82dd916a42f03c62a3a70e5b70736
   nio4r (2.7.5) sha256=6c90168e48fb5f8e768419c93abb94ba2b892a1d0602cb06eef16d8b7df1dca1
+  no_fly_list (0.7.4)
   nokogiri (1.19.4-aarch64-linux-gnu) sha256=1269fb644a6de405057a53dd5c762b1209b43ca7424f839454d3dbc677c31a8f
   nokogiri (1.19.4-aarch64-linux-musl) sha256=35c65b9ce72b3bb03207bdbe7067915019dc18c1b9b59139684bd6690fdd01af
   nokogiri (1.19.4-arm-linux-gnu) sha256=a301313e38bb065d68239e79734bcd6f56fb6efaacebde29e9abf2a4735340ca
@@ -601,7 +611,7 @@ CHECKSUMS
   phlexi-form (0.14.3) sha256=47d69c4a49ba22279ba541b9b110e81d62acc4602513f21bb5c3d29fa9c8d5ca
   phlexi-menu (0.4.1) sha256=f6eeb1eb9597caadeee33a53f1520b3613a6ac616cf1e395e9d734a412895fb2
   phlexi-table (0.2.0) sha256=73bee135adbe73fcdb6fdd2672444373556dd9e6bba61e7b5b20ca8b7a1f822c
-  plutonium (0.64.0)
+  plutonium (0.66.0)
   pp (0.6.4) sha256=dfcb0fce700c41456265922884f9fe195d7fbb0674a3578e6c0f69588e82b570
   prettyprint (0.2.0) sha256=2bc9e15581a94742064a3cc8b0fb9d45aae3d03a1baa6ef80922627a0766f193
   prism (1.9.0) sha256=7b530c6a9f92c24300014919c9dcbc055bf4cdf51ec30aed099b06cd6674ef85

data/gemfiles/rails_8.0.gemfile

@@ -3,6 +3,7 @@
 source "https://rubygems.org"
 
 gem "rotp"
+gem "no_fly_list", github: "radioactive-labs/no_fly_list", branch: "feat/scoped-tags"
 gem "rails", "~> 8.0.0"
 gem "sqlite3"
 gem "puma", ">= 5.0"

data/gemfiles/rails_8.0.gemfile.lock

@@ -1,7 +1,15 @@
+GIT
+  remote: https://github.com/radioactive-labs/no_fly_list.git
+  revision: e1e88d9c7d898ef269e3cabfa12da2fb327459cc
+  branch: feat/scoped-tags
+  specs:
+    no_fly_list (0.7.4)
+      activerecord (>= 7.2)
+
 PATH
   remote: ..
   specs:
-    plutonium (0.62.2)
+    plutonium (0.66.0)
       action_policy (~> 0.7.0)
       csv
       listen (~> 3.8)
@@ -457,6 +465,7 @@ DEPENDENCIES
   importmap-rails
   minitest
   minitest-reporters
+  no_fly_list!
   plutonium!
   propshaft
   puma (>= 5.0)

data/gemfiles/rails_8.1.gemfile

@@ -3,6 +3,7 @@
 source "https://rubygems.org"
 
 gem "rotp"
+gem "no_fly_list", github: "radioactive-labs/no_fly_list", branch: "feat/scoped-tags"
 gem "rails", "~> 8.1.0"
 gem "sqlite3"
 gem "puma", ">= 5.0"

data/gemfiles/rails_8.1.gemfile.lock

@@ -1,7 +1,15 @@
+GIT
+  remote: https://github.com/radioactive-labs/no_fly_list.git
+  revision: e1e88d9c7d898ef269e3cabfa12da2fb327459cc
+  branch: feat/scoped-tags
+  specs:
+    no_fly_list (0.7.4)
+      activerecord (>= 7.2)
+
 PATH
   remote: ..
   specs:
-    plutonium (0.65.0)
+    plutonium (0.66.0)
       action_policy (~> 0.7.0)
       csv
       listen (~> 3.8)
@@ -459,6 +467,7 @@ DEPENDENCIES
   importmap-rails
   minitest
   minitest-reporters
+  no_fly_list!
   plutonium!
   propshaft
   puma (>= 5.0)

data/lib/plutonium/auth/rodauth.rb

@@ -24,6 +24,13 @@ module Plutonium
             rodauth.rails_account
           end
 
+          # A request Rodauth authenticated with a valid JWT reads its session
+          # from the token, not the cookie, so there is nothing for a forged
+          # request to ride on. Everything else gets the CSRF token check.
+          def verified_request?
+            super || (rodauth.features.include?(:jwt) && rodauth.valid_jwt?)
+          end
+
           def logout_url
             rodauth.logout_path
           end

data/lib/plutonium/core/controller.rb

@@ -10,8 +10,6 @@ module Plutonium
       included do
         add_flash_types :success, :warning, :error
 
-        protect_from_forgery with: :null_session, if: -> { request.headers["Authorization"].present? }
-
         rescue_from ::ActionPolicy::Unauthorized do |exception|
           respond_to do |format|
             format.any(:html, :turbo_stream) do