reactive_component 0.6.2 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b0c408bc69906500eee92927b43eb4f307039d4faab5e6fda80b5461ba922db0
-  data.tar.gz: 6ccf997e199cdd409138b48b187199b55c625dcdb165aabb808c2ed0657a23f6
+  metadata.gz: 4a63e206cf0f143eb6c390357606b7de7bd67d8c516867883d3c125b865ff664
+  data.tar.gz: ab1e03efda80cff6207b6e7828bc42cdd23cf207953f803a620ccea143719a6c
 SHA512:
-  metadata.gz: 689c1ffeab1b2b2c93b7df69765a9a0660c9cd5c215704b63cd5ac9128d152ac34bd39b0f8934b2798e37a649b3d6b2486aad3cf97d977f0cf3c374885f42a92
-  data.tar.gz: 6596df41e9f41b447e9e8365c5f7c1fd8603fca4212eb2f15e429278a78e65c09c929edf753d353f1f65311533c9018bdcb4236aadf0d47a97a4964cdbb6af71
+  metadata.gz: 2476e8ed1dcef187d6abfe7b011cbb8e076ac41ac0cd266b48f4174ec1c4f503ba618d8eb104c19d288f18d694a74d57e2fa2c0e591ded079113d99dc166ee7f
+  data.tar.gz: 5f6aae9647f439578c0585d3ba66586c60442a75003531c9a98e8ce0f267c77fd3089830ce9d5c17f3c91638ffd5b3c13f4ba7533d638f4c7d90da92d80f43b5

data/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## [0.7.0] - 2026-09-06
+
+### Fixed
+- `live_action` params are filtered with `permit` against the declared
+  list, so a nested hash or array sent for a scalar param no longer reaches
+  the action method.
+
+### Added
+- `live_action` `params:` accepts the full `permit` spec, so an action can
+  declare arrays and nested hashes: `params: [:title, { tags: [] }]`.
+
 ## [0.6.2] - 2026-09-06
 
 ### Changed

data/app/controllers/reactive_component/actions_controller.rb

@@ -10,7 +10,7 @@ module ReactiveComponent
       component_class.execute_action(
         params[:action_name],
         record,
-        params.fetch(:params, {}).permit!.to_h
+        params.fetch(:params, {})
       )
 
       head :ok

data/lib/reactive_component/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ReactiveComponent
-  VERSION = '0.6.2'
+  VERSION = '0.7.0'
 end

data/lib/reactive_component.rb

@@ -192,9 +192,12 @@ module ReactiveComponent
       end
     end
 
+    # `params:` takes the same spec as `ActionController::Parameters#permit`:
+    #   live_action :move, params: [:label_id]
+    #   live_action :save, params: [:title, { tags: [], address: [:city] }]
     def live_action(action_name, params: [])
       self._live_actions = _live_actions.merge(
-        action_name.to_sym => { params: Array(params).map(&:to_sym) }
+        action_name.to_sym => { params: Array(params) }
       )
     end
 
@@ -213,13 +216,11 @@ module ReactiveComponent
       instance = allocate
       instance.instance_variable_set(:"@#{live_model_attr}", record)
 
-      allowed = action_config[:params]
-      if allowed.any?
-        filtered = action_params.symbolize_keys.slice(*allowed)
-        instance.send(action_name, **filtered)
-      else
-        instance.send(action_name)
-      end
+      # `permit` (not `permit!` + slice): only declared keys, and only scalar
+      # values, so a nested hash or array never reaches the action method.
+      action_params = ActionController::Parameters.new(action_params) unless action_params.is_a?(ActionController::Parameters)
+      filtered = action_params.permit(*action_config[:params]).to_h.symbolize_keys
+      instance.send(action_name, **filtered)
     end
 
     def compiled_data

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: reactive_component
 version: !ruby/object:Gem::Version
-  version: 0.6.2
+  version: 0.7.0
 platform: ruby
 authors:
 - Przemyslaw Lusar