reactive_component 0.6.2 → 0.7.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b0c408bc69906500eee92927b43eb4f307039d4faab5e6fda80b5461ba922db0
-  data.tar.gz: 6ccf997e199cdd409138b48b187199b55c625dcdb165aabb808c2ed0657a23f6
+  metadata.gz: 6897d1bd7689445185a2a06d80b868778d1dca89fa15bf1cbbc81ac31ce2ccb2
+  data.tar.gz: a285c182b5fea6ab970d8d0f609237f81a98d7724d95c88a8f595dce121b361f
 SHA512:
-  metadata.gz: 689c1ffeab1b2b2c93b7df69765a9a0660c9cd5c215704b63cd5ac9128d152ac34bd39b0f8934b2798e37a649b3d6b2486aad3cf97d977f0cf3c374885f42a92
-  data.tar.gz: 6596df41e9f41b447e9e8365c5f7c1fd8603fca4212eb2f15e429278a78e65c09c929edf753d353f1f65311533c9018bdcb4236aadf0d47a97a4964cdbb6af71
+  metadata.gz: d8c1a5eaddc568b0c8aa20e88a18e7631633d46d344892d447ed0bbe6b12513b7637c0b00794d19679ef2f3da13d1ba012a1559540f754f911c5b2f2179230f1
+  data.tar.gz: 1b6ec87280c44844c8b93350d21f255280bce22ed79cf192234c6319f1f30971f5e0947e34433c2ee19a72fde6535f31b3a7ccfe5dac3800a10fdc28e50f72fe

data/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## [0.7.1] - 2026-09-06
+
+### Added
+- The JavaScript is an npm package too: `package.json` exports
+  `reactive_component/controllers/*` and `reactive_component/lib/*`, so an app
+  can `npm install` the gem's GitHub tag tarball instead of aliasing the
+  bundler path (which a Node-only Docker stage cannot resolve).
+
+### Changed
+- The renderer controller imports its utils by relative path, so it resolves
+  without an alias or importmap pin for the lib file.
+
+## [0.7.0] - 2026-09-06
+
+### Fixed
+- `live_action` params are filtered with `permit` against the declared
+  list, so a nested hash or array sent for a scalar param no longer reaches
+  the action method.
+
+### Added
+- `live_action` `params:` accepts the full `permit` spec, so an action can
+  declare arrays and nested hashes: `params: [:title, { tags: [] }]`.
+
 ## [0.6.2] - 2026-09-06
 
 ### Changed

data/app/controllers/reactive_component/actions_controller.rb

@@ -10,7 +10,7 @@ module ReactiveComponent
       component_class.execute_action(
         params[:action_name],
         record,
-        params.fetch(:params, {}).permit!.to_h
+        params.fetch(:params, {})
       )
 
       head :ok

data/app/javascript/reactive_component/controllers/reactive_renderer_controller.js

@@ -1,6 +1,6 @@
 import { Controller } from "@hotwired/stimulus"
 import { createConsumer } from "@rails/actioncable"
-import { compileTemplate, decompress, morphElement, buildActionBody, routeMessage, duplicateIds, strictData } from "reactive_component/lib/reactive_renderer_utils"
+import { compileTemplate, decompress, morphElement, buildActionBody, routeMessage, duplicateIds, strictData } from "../lib/reactive_renderer_utils.js"
 
 const consumer = createConsumer()
 const log = (...args) => {

data/lib/reactive_component/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ReactiveComponent
-  VERSION = '0.6.2'
+  VERSION = '0.7.1'
 end

data/lib/reactive_component.rb

@@ -192,9 +192,12 @@ module ReactiveComponent
       end
     end
 
+    # `params:` takes the same spec as `ActionController::Parameters#permit`:
+    #   live_action :move, params: [:label_id]
+    #   live_action :save, params: [:title, { tags: [], address: [:city] }]
     def live_action(action_name, params: [])
       self._live_actions = _live_actions.merge(
-        action_name.to_sym => { params: Array(params).map(&:to_sym) }
+        action_name.to_sym => { params: Array(params) }
       )
     end
 
@@ -213,13 +216,11 @@ module ReactiveComponent
       instance = allocate
       instance.instance_variable_set(:"@#{live_model_attr}", record)
 
-      allowed = action_config[:params]
-      if allowed.any?
-        filtered = action_params.symbolize_keys.slice(*allowed)
-        instance.send(action_name, **filtered)
-      else
-        instance.send(action_name)
-      end
+      # `permit` (not `permit!` + slice): only declared keys, and only scalar
+      # values, so a nested hash or array never reaches the action method.
+      action_params = ActionController::Parameters.new(action_params) unless action_params.is_a?(ActionController::Parameters)
+      filtered = action_params.permit(*action_config[:params]).to_h.symbolize_keys
+      instance.send(action_name, **filtered)
     end
 
     def compiled_data

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: reactive_component
 version: !ruby/object:Gem::Version
-  version: 0.6.2
+  version: 0.7.1
 platform: ruby
 authors:
 - Przemyslaw Lusar