recourse 3.0.3 → 4.0.0

data/app/controllers/concerns/recourse/reference_resolution.rb

@@ -0,0 +1,70 @@
+module Recourse
+  # Resolves a submitted foreign key back to an id, for a belongs_to whose label
+  # is typed rather than picked from a menu — and refuses the write where a label
+  # named more than one row.
+  module ReferenceResolution
+  private
+
+    # A new record, unless a typed label named more than one row, which is answered on
+    # the form rather than by writing a guess.
+    def create_resource(record)
+      return false if ambiguous_references? record
+
+      record.save
+    end
+
+    # The same for one that already exists. The parameters are read before the refusal
+    # is asked about, since reading them is what notices an ambiguous label.
+    def update_resource(record)
+      attributes = resource_params
+      return false if ambiguous_references? record
+
+      record.update attributes
+    end
+
+    # A foreign key whose label is typed arrives as that label, so it is looked up
+    # here. Nothing found leaves the key nil, and `belongs_to` reports it missing.
+    def resolve_references(attributes)
+      resource_class.recourse_references.each do |association|
+        key = association.foreign_key.to_s
+        next unless attributes.key?(key) && association.klass.recourse_typed_reference?
+
+        attributes[key] = reference_id association, attributes[key]
+      end
+
+      attributes
+    end
+
+    # The row a label names, where it names one. Two rows are not an answer: a label is
+    # offered to be typed because it is short enough to say, not because it identifies
+    # anything, and a table whose label is not unique has rows that answer to the same
+    # words. Picking the first of them would point the key somewhere nobody asked for
+    # and report that it worked, so the write is refused instead and the field says why.
+    def reference_id(association, label)
+      found = association.klass.where(association.klass.recourse_label => label).limit 2
+      return found.first&.id unless found.length > 1
+
+      ambiguous_references[association.name] = label
+      nil
+    end
+
+    # What a label matched more than one of, kept until the record is built: the error
+    # belongs on the record, and there is none yet when the parameters are read.
+    def ambiguous_references
+      @ambiguous_references ||= {}
+    end
+
+    # Whether any label named more than one row — and, where one did, says so on the
+    # field that asked. Added after validating rather than before, since validating
+    # clears what was there, so such a record is never saved at all.
+    def ambiguous_references?(record)
+      return false if ambiguous_references.empty?
+
+      ambiguous_references.each do |name, label|
+        record.errors.add name, :ambiguous, message: t('recourse.ambiguous', label: label)
+      end
+
+      true
+    end
+  end
+end

data/app/controllers/concerns/recourse/resource_resolution.rb

@@ -0,0 +1,68 @@
+module Recourse
+  # Resolves what a route names: the model behind it, the record an id points at,
+  # and the attributes a form may submit for one.
+  module ResourceResolution
+  private
+
+    # The record the id names, under the name Rails would use. `find`, so an id naming
+    # nothing answers 404.
+    def find_resource = assign resource_class.find(params.expect(:id))
+
+    def assign(record)
+      @recourse = record
+      instance_variable_set "@#{controller_name.singularize}", record
+    end
+
+    # Whether there is a model behind this page at all. A bare action has none: it is a
+    # verb the host answers itself — `recourses :sweeps, only: :create` — labelled from the
+    # path alone, and still a `RecoursesController`, that being where a host keeps the
+    # filters guarding its admin. So what runs on every request asks this first, and the
+    # actions the gem serves reach for the model again and raise where it is missing.
+    # Asked of `resource_class`, which a bookmark answers from the listing.
+    def resource_model?
+      resource_class.present?
+    rescue Error
+      false
+    end
+
+    # The model the route is named after.
+    def resource_class = recourse_model
+
+    # The model this screen is about, and the second thing a host overrides to put a
+    # page of its own behind a screen the gem otherwise draws whole:
+    # `def recourse_model = Location`. The route's own name answers by default, which
+    # asks the app for a class of that name — so a page listing what a measurement
+    # answers rather than what a table holds is named for the answer and has no class
+    # to match it. Private, the way `recourse_relation` beside it is: naming a model
+    # adds no action.
+    def recourse_model
+      Recourse.model controller_name
+    end
+
+    def human_name
+      resource_class.model_name.human
+    end
+
+    # What a form may submit: every column a user may set, less the ones the model
+    # keeps off its screens. The other thing a host overrides, and for the same
+    # reason as `recourse_relation` — a form of its own asks for what it asks for,
+    # which may be a hidden column or an attribute that is no column at all:
+    # `def resource_params = params.expect(provider: %i[name cid])`.
+    def resource_params
+      # The parent is merged after resolving, so the one the route names is never
+      # mistaken for a label.
+      submitted_attributes.merge parent_columns
+    end
+
+    # What the form sent, with a typed reference read back as the id it names. A bare
+    # `Create` submits no attributes at all, so the key may be absent: the parent a
+    # nested route names is everything such a record starts from.
+    def submitted_attributes
+      permitted = Recourse.editable_columns resource_class
+      key = controller_name.singularize.to_sym
+      return {} unless params.key? key
+
+      resolve_lists resolve_references(params.expect(key => permitted))
+    end
+  end
+end

data/app/controllers/concerns/recourse/zoning.rb

@@ -0,0 +1,29 @@
+module Recourse
+  # Whose clock a page is drawn against. The browser says which zone it is in and the
+  # server renders in it, so a time, a date and the field that edits one all agree —
+  # which is what rendering in the browser instead could never have given.
+  module Zoning
+    extend ActiveSupport::Concern
+
+    included do
+      around_action :use_recourse_zone
+    end
+
+  private
+
+    # For the length of one of the gem's own requests and no longer: `use_zone` swaps
+    # `Time.zone`, yields, and puts the old one back in an `ensure`, and `Time.zone` is
+    # per-thread state rather than config. So the host's setting is never written, and
+    # a host's own screens are drawn against it as before, in the same second.
+    def use_recourse_zone(&) = Time.use_zone(recourse_zone, &)
+
+    # Nil where the browser has not said, or said something no zone answers to — and
+    # `Time.zone = nil` falls back to the host's own setting, so an absent cookie and a
+    # forged one both leave the page exactly as it is drawn today.
+    def recourse_zone
+      name = cookies[Recourse::ZONE_STORAGE]
+
+      ActiveSupport::TimeZone[name] if name.present?
+    end
+  end
+end

data/app/controllers/recourse/base_controller.rb

@@ -0,0 +1,85 @@
+module Recourse
+  # Everything a recoursed screen does, in a class of its own so a host can put
+  # its own behavior above it — `class RecoursesController < Recourse::BaseController`
+  # with a `before_action :authenticate!` guards every screen the gem serves.
+  class BaseController < ApplicationController
+    include Pagy::Method,
+            Landing, Paging, ListResolution, ParentNaming,
+            ParentResolution, ReferenceResolution, ResourceResolution,
+            Zoning
+
+    helper Helpers
+
+    # `find` raises RecordNotFound, so an id that names nothing answers 404.
+    before_action :find_resource, only: %i[show edit update destroy]
+
+    # The model behind the page, assigned once, and only where the route names one.
+    before_action { @recourse_model = resource_class if resource_model? }
+
+    # The model broadcasts refreshes for its index, before `create` commits its own.
+    before_action :broadcast_resource_changes
+
+    # Lists one page of the model the route is named after. `@q` is Ransack's own name.
+    def index
+      search = Search.new recourse_relation, params[:q]
+      @q = search.query
+      @pagy, @resources = pagy search.scope, limit: recourse_limit
+    end
+
+    # Builds a blank record under the name Rails would use: @contact for contacts, with
+    # the parent a nested route names already set on it.
+    def new
+      assign resource_class.new(parent_columns)
+    end
+
+    # Saves a submitted record, then shows the index again or says what turned it down.
+    def create
+      record = assign resource_class.new
+      record.assign_attributes resource_params
+      model = human_name
+
+      if create_resource record
+        wrote t('recourse.created', model: model), record
+      else
+        rejected record, :new, t('recourse.created_error', model: model)
+      end
+    end
+
+    # Reads out the record the id names, which is already known to exist.
+    def show; end
+
+    # Shows the form for the record the id names, which is already known to exist.
+    def edit; end
+
+    # Saves changes to a record, then shows the index again or says what turned it down.
+    def update
+      if update_resource @recourse
+        wrote t('recourse.updated', model: human_name), @recourse
+      else
+        rejected @recourse, :edit, t('recourse.updated_error', model: human_name)
+      end
+    end
+
+    # Deletes the record and shows the index without it. `destroy!`, so a callback that
+    # stops one says so rather than leaving the page claiming it worked.
+    def destroy
+      @recourse.destroy!
+      wrote t('recourse.deleted', model: human_name)
+    end
+
+  private
+
+    def broadcast_resource_changes
+      @recourse_model.recourse_broadcast if @recourse_model.respond_to? :recourse_broadcast
+    end
+
+    # The rows the index lists, before the search, the sort and the page reach them:
+    # every row of the model, narrowed by the parent a nested route names. The one thing
+    # a host overrides to put a scope of its own behind a screen the gem draws whole —
+    # `def recourse_relation = County.with_boosts_for(@recourse_parent)`. Private, so
+    # overriding it adds a query and never an action.
+    def recourse_relation
+      resource_class.where parent_columns
+    end
+  end
+end

data/app/controllers/recourse/bookmarks_controller.rb

@@ -0,0 +1,76 @@
+module Recourse
+  # The row behind a bookmark square: one record kept by whoever is looking, written
+  # and dropped a row at a time and never read back here. The path names the record
+  # and the host's own declaration names the viewer, so there is nothing to submit.
+  class BookmarksController < ::RecoursesController
+    # `destroy` is a member action everywhere else, so the inherited callback would
+    # look for an `:id` a singular resource never carries.
+    skip_before_action :find_resource
+
+    # Keeps the record the path names. `find_or_create_by!` rather than `create!`:
+    # the square answers before the request does, so a second click can arrive while
+    # the first is still in flight, and twice kept is once kept.
+    def create
+      viewer_bookmarks.find_or_create_by! bookmark_key
+      answer 'bookmark_added'
+    end
+
+    # And drops it. `destroy_all` rather than `destroy!`: a unique index is what keeps
+    # this to one row, and a page should not fail for having none.
+    def destroy
+      viewer_bookmarks.where(bookmark_key).destroy_all
+      answer 'bookmark_removed'
+    end
+
+  private
+
+    # The model this bookmarks, read off the listing the route was nested under
+    # rather than off this controller's own name, which is always `bookmarks`.
+    def resource_class
+      Recourse.model listing_path
+    end
+
+    # A resource whose model keeps no bookmarks draws no square, so the only way here
+    # is by hand — which earns a 404 rather than a 500 from somewhere below.
+    def bookmark_reflection!
+      bookmark_reflection || raise(ActiveRecord::RecordNotFound)
+    end
+
+    def bookmark_reflection
+      Recourse.bookmarks_for resource_class
+    end
+
+    def viewer_bookmarks
+      Recourse.bookmarks_of bookmark_reflection!
+    end
+
+    def bookmark_key
+      { bookmark_reflection!.foreign_key => params.expect(:"#{listing_name}_id") }
+    end
+
+    # Where the two paths part. A background request is answered with nothing at all:
+    # a flash it never renders would not be spent, and would surface as a toast on
+    # the next page announcing a bookmark from several pages ago.
+    def answer(message)
+      return head :no_content unless request.format.html?
+
+      flash.notice = t "recourse.#{message}"
+      redirect_back fallback_location: listing_url, status: :see_other
+    end
+
+    # One segment up, which is where the routes drew it — the gem draws this path
+    # itself, so unlike a host's nesting there is nothing to look up.
+    def listing_path
+      controller_path.rpartition('/').first
+    end
+
+    def listing_name
+      listing_path.split('/').last.singularize
+    end
+
+    # Where the square was, for a request that arrived without a referer.
+    def listing_url
+      url_for controller: "/#{listing_path}", action: :index
+    end
+  end
+end

data/app/controllers/recourses_controller.rb

@@ -1,26 +1,7 @@
-# Base class for recoursive controllers.
-class RecoursesController < ApplicationController
-  helper NavigableHelper, RecoursiveHelper, SearchableHelper
-  include Pagy::Method
-
-  def index
-    model = controller_name.classify.constantize
-    @where = request.path_parameters.except(:controller, :action)
-    @order = model.recourse_order
-    @includes = model.recourse_includes
-
-    @pagy, @resources = paginate model, where: @where, order: model.recourse_order, includes: model.recourse_includes
-  end
-
-private
-
-  def paginate(model, where: nil, includes: [], order: nil)
-    if model.recourse_searchable? || model.recourse_sortable?
-      @q = model.where(where).ransack params[:q]
-      @q.sorts = (order || 'created_at desc') if @q.sorts.empty?
-      pagy includes.present? ? @q.result.includes(includes) : @q.result.distinct(true)
-    else
-      pagy model.where(where).includes(includes).order(order)
-    end
-  end
+# The superclass every recoursed controller gets, and what puts its templates
+# under `recourses/`. A host defines this class itself — its `app/controllers`
+# comes first — to put a `before_action` of its own above every screen.
+class RecoursesController < Recourse::BaseController
+  # Empty on purpose: the behavior is the base class, so a host redefining this
+  # one loses none of it.
 end

data/app/javascript/recourse/bookmark_controller.js

@@ -0,0 +1,100 @@
+import { Controller } from '/recourse/stimulus.js'
+import { flash } from '/recourse/flash.js'
+import { marked } from '/recourse/written.js'
+
+// The square that keeps a row, answered before the server does. The icon flips under
+// the cursor and the request goes in the background, so the table is never redrawn and
+// the row stays where the eye left it — until the next load, where kept-first belongs.
+//
+// The form is still a real one. Without this controller it submits, redirects and
+// reloads, which is the same floor every other button here degrades to.
+export default class extends Controller {
+  static values = { kept: Boolean, error: String }
+
+  connect() {
+    this.form = this.element.closest('form')
+    this.row = this.element.closest('tr')
+    this.icon = this.element.querySelector('i')
+    this.form.addEventListener('submit', this.submit)
+  }
+
+  disconnect() {
+    this.form.removeEventListener('submit', this.submit)
+  }
+
+  // An arrow so `this` survives being handed to the listener, and so the same
+  // function object is the one removed again.
+  submit = (event) => {
+    event.preventDefault()
+    const kept = !this.keptValue
+    // Read the form before flipping it. The verb it is still wearing is the one this
+    // click means — `post` to keep the row, `delete` to drop it — while `render`
+    // dresses it for the click after this one, which is the opposite.
+    const body = new FormData(this.form)
+    this.render(kept)
+    this.send(body, kept)
+  }
+
+  // What the eye reads, what a screen reader reads, and what the next click will do:
+  // the path never changes, only the verb Rails wrote into the form.
+  render(kept) {
+    this.keptValue = kept
+    this.icon.className = kept ? 'bi bi-bookmark-fill' : 'bi bi-bookmark'
+    this.element.setAttribute('aria-pressed', kept)
+    this.method.value = kept ? 'delete' : 'post'
+  }
+
+  // The token in the head, not the one in the form. Rails scopes a form's own token
+  // to the method it was drawn with and this square flips that method; the form's is
+  // inside a cached fragment besides, so it belongs to whichever session drew the
+  // table. The head's is global to the session and fresh per request, and Rails takes
+  // whichever of the two is valid.
+  get token() {
+    return document.querySelector('meta[name="csrf-token"]')?.content
+  }
+
+  // Rails' own override field, which `button_to` writes only for a delete — so a
+  // square that started hollow has none until the first click makes one.
+  get method() {
+    let field = this.form.querySelector('input[name="_method"]')
+    if (!field) {
+      field = document.createElement('input')
+      field.type = 'hidden'
+      field.name = '_method'
+      this.form.prepend(field)
+    }
+    return field
+  }
+
+  // The response is never rendered, but it is read: a 500, a dropped connection or
+  // an expired session would otherwise leave a filled square that was never saved.
+  // `Accept` is what tells the server this one wants no flash and no redirect.
+  async send(body, kept) {
+    try {
+      const response = await fetch(this.form.action, {
+        method: 'post',
+        body,
+        headers: { Accept: 'application/json', 'X-CSRF-Token': this.token },
+      })
+      if (!response.ok) return this.revert(kept)
+
+      // Two halves of one report, and the reason there is no toast. The tint lasts and
+      // says which rows are kept; the mark passes and says this one was written just
+      // now — the same outline a create or an update leaves while its message stands.
+      // The icon flipped on the click and would have flipped under a request that
+      // never landed, so both are the half only the server can give.
+      this.row?.classList.toggle('recourse-kept', kept)
+      marked(this.row)
+    } catch {
+      this.revert(kept)
+    }
+  }
+
+  // Put the square back, and say why — the one time this column speaks, since a click
+  // that worked is reported by the row taking color. Nothing to put back but the
+  // square: the tint is never laid on until the row is written.
+  revert(kept) {
+    this.render(!kept)
+    flash(this.errorValue)
+  }
+}

data/app/javascript/recourse/clear_controller.js

@@ -0,0 +1,22 @@
+import { Controller } from '/recourse/stimulus.js'
+
+export default class extends Controller {
+  static targets = ['input', 'button']
+
+  connect() {
+    this.toggle()
+  }
+
+  toggle() {
+    this.buttonTarget.classList.toggle('d-none', !this.inputTarget.value)
+  }
+
+  clear() {
+    this.inputTarget.value = ''
+    // The combobox filters its menu on `input`, so it has to hear one to put every
+    // row back. Bootstrap listens on the field itself, and the event bubbles anyway.
+    this.inputTarget.dispatchEvent(new Event('input', { bubbles: true }))
+    this.inputTarget.focus()
+    this.toggle()
+  }
+}

data/app/javascript/recourse/combobox_controller.js

@@ -0,0 +1,68 @@
+import { Controller } from '/recourse/stimulus.js'
+import { Combobox } from '/recourse/bootstrap.bundle.min.js'
+
+// The plugin keeps a menu's value in a hidden input it creates itself, which
+// Turbo's DOM surgery knows nothing about: a morphing refresh deletes the input
+// while the instance keeps writing to the detached node, and a snapshot restore
+// resurrects an old input beside the one a new instance makes — either way the
+// next click submits a filter that is stale, doubled or missing. Owning the
+// lifecycle here keeps the input and the instance one thing.
+//
+// And what a menu with several picks reads as. The plugin writes `2 selected`, which
+// says how many and not which; the first pick named and the rest counted says both,
+// in the words the locale gives `more`. Written after the plugin writes its own — on
+// every change, and once the instance is made — so the plugin's text never shows.
+export default class extends Controller {
+  static values = { more: String }
+
+  connect() {
+    // A restored snapshot arrives with the last visit's input baked in. The
+    // instance it belonged to is gone, so it is only a second submission.
+    if (!Combobox.getInstance(this.element)) { this.#clearStaleInputs() }
+
+    this.combobox = Combobox.getOrCreateInstance(this.element)
+    this.#name()
+    this.named = () => this.#name()
+    this.element.addEventListener('change.bs.combobox', this.named)
+    this.morphed = () => this.#remake()
+    document.addEventListener('turbo:morph', this.morphed)
+  }
+
+  disconnect() {
+    document.removeEventListener('turbo:morph', this.morphed)
+    this.element.removeEventListener('change.bs.combobox', this.named)
+    this.combobox.dispose()
+  }
+
+  // Remade whole rather than repaired: the constructor reads the `.selected`
+  // items the morph just made truthful, so disposing and starting over syncs the
+  // input, the toggle's text and the listeners in one move.
+  #remake() {
+    if (!this.element.isConnected) { return }
+
+    this.combobox.dispose()
+    this.combobox = Combobox.getOrCreateInstance(this.element)
+    this.#name()
+  }
+
+  // `California + 1 more` over the plugin's `2 selected`. Only a multiple menu with
+  // more than one pick: with one, the plugin already names it, and with none it
+  // shows the placeholder.
+  #name() {
+    const picked = this.element.nextElementSibling.querySelectorAll('.menu-item.selected')
+    if (!this.element.dataset.bsMultiple || picked.length < 2) { return }
+
+    const first = picked[0].querySelector('.menu-item-content > span:first-child')
+    this.element.querySelector('.combobox-value').textContent = this.moreValue
+      .replace('%{first}', first.textContent)
+      .replace('%{count}', picked.length - 1)
+  }
+
+  #clearStaleInputs() {
+    const name = this.element.dataset.bsName
+
+    for (const input of this.element.parentNode.querySelectorAll('input[type="hidden"]')) {
+      if (input.name === name) { input.remove() }
+    }
+  }
+}

data/app/javascript/recourse/confirm.js

@@ -0,0 +1,46 @@
+import { Dialog } from '/recourse/bootstrap.bundle.min.js'
+
+// Turbo hands over the whole warning as one string. The first line is the question
+// and each remaining line a paragraph — real paragraphs here, where a confirm() box
+// had newlines. Always textContent, never innerHTML: the title carries a record's
+// own name, and a name is data.
+export default function confirm(message) {
+  const dialog = document.querySelector('#recourse-confirm')
+  const [title, ...lines] = message.split('\n')
+  dialog.querySelector('.dialog-title').textContent = title
+  dialog.querySelector('.dialog-body').replaceChildren(...paragraphs(lines))
+
+  return new Promise(resolve => {
+    // `onclick` rather than addEventListener: reassigning replaces the previous
+    // answer's handler, so asking twice on one page never wires the button twice.
+    dialog.querySelector('.recourse-confirm-delete').onclick = () => {
+      resolve(true)
+      Dialog.getOrCreateInstance(dialog).hide()
+    }
+    // Cancel, Esc and a click on the backdrop all close through here. After a
+    // Delete the promise is settled, and settling it again is a no-op.
+    dialog.addEventListener('hidden.bs.dialog', () => resolve(false), { once: true })
+    Dialog.getOrCreateInstance(dialog).show()
+  })
+}
+
+function paragraphs(lines) {
+  return lines.filter(line => line).map(line => {
+    const paragraph = document.createElement('p')
+    paragraph.textContent = line
+    return paragraph
+  })
+}
+
+// Three things outlive a Turbo visit that starts mid-close: the snapshot, which would
+// restore an open dialog; `dialog-open` on <html>, which is the scroll lock; and
+// `hiding` on the dialog, the class its closing animation runs under. dispose() closes
+// instantly and lifts the lock, but cuts the animation short of the end that would
+// have taken `hiding` off — and a dialog still wearing it opens invisible the next
+// time it is asked, which on a table of Remove buttons is the very next click. In the
+// module, so it registers once.
+document.addEventListener('turbo:before-cache', () => {
+  const dialog = document.querySelector('#recourse-confirm')
+  if (dialog?.open) Dialog.getOrCreateInstance(dialog).dispose()
+  dialog?.classList.remove('hiding')
+})

data/app/javascript/recourse/deselect_controller.js

@@ -0,0 +1,37 @@
+import { Controller } from '/recourse/stimulus.js'
+
+export default class extends Controller {
+  static values = { multiple: Boolean }
+
+  // `All` asks for the options the menu is holding back — they are in it already, and
+  // this is what puts them on it.
+  all(event) {
+    // A menu that sets a value is configured to close on any click inside it, this
+    // button included — which would shut it over the options it was clicked to see. The
+    // listener doing that is on the document, so stopping the click here is what keeps
+    // them in view. A menu that narrows a table closes on outside clicks only, and is
+    // unaffected either way.
+    event.stopPropagation()
+
+    const menu = this.element.closest('.menu')
+
+    for (const waiting of menu.querySelectorAll('.menu-item.d-none')) {
+      waiting.classList.remove('d-none')
+    }
+
+    // And, on a menu that narrows a table, it means every row as well as every option,
+    // which is what nothing being ticked says. Clicking each chosen item is what the
+    // plugin is already listening for, so the hidden input, the toggle's text and the
+    // events stay its business rather than ours — it has no method for this, and
+    // reaching into its state would be guessing.
+    //
+    // Only there. A menu that sets a value cannot mean none of them, and a click on the
+    // one already chosen is the plugin being told to choose it again — which closes the
+    // menu over the options this button was clicked to see.
+    if (!this.multipleValue) return
+
+    for (const item of menu.querySelectorAll('.menu-item.selected')) {
+      item.click()
+    }
+  }
+}

data/app/javascript/recourse/flash.js

@@ -0,0 +1,35 @@
+// The toast the server ships, built in the browser for the one message that has no
+// response to arrive with. `data-controller` is what hands it to the toast
+// controller for its timer and its X, so the two kinds fade alike.
+export function flash(message, theme = 'theme-danger') {
+  const toast = document.createElement('div')
+  toast.className = `toast fade show ${theme}`
+  toast.setAttribute('role', 'alert')
+  toast.setAttribute('aria-live', 'assertive')
+  toast.dataset.controller = 'toast'
+  toast.dataset.action = ['mouseenter->toast#stopTimer', 'mouseleave->toast#startTimer',
+                          'focusin->toast#stopTimer', 'focusout->toast#startTimer'].join(' ')
+  const header = document.createElement('div')
+  header.className = 'toast-header border-0'
+  const text = document.createElement('span')
+  text.className = 'me-auto'
+  // Never innerHTML: this is a message, and a message is data.
+  text.textContent = message
+  header.append(text)
+  toast.append(header)
+  container().append(toast)
+}
+
+// A page with nothing to say ships no container at all, so the first message is what
+// makes one.
+function container() {
+  let container = document.querySelector('.toast-container')
+  if (container) return container
+
+  container = document.createElement('div')
+  container.className = 'toast-container position-fixed bottom-0 end-0 p-3'
+  container.dataset.turboTemporary = ''
+  document.body.append(container)
+
+  return container
+}