rolemodel-rails 2.3.1 → 2.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c9809271c3cc1c97337717b8d1d79b934a215d343f9b62e4cd6be25d9a906a39
-  data.tar.gz: 7e6493f9b61aaa33adadc0957ca25e897ff36228eeb6a667b07a9f846fadccec
+  metadata.gz: 41af565ee256cafc1b08a53dcdce9bf029e1503d8a368d2e946bb4bebec284a2
+  data.tar.gz: f7247392ea0c87346ba0915d14506852f34ced3380331905e7e9209f4b2436d7
 SHA512:
-  metadata.gz: 25500fd7928c067bc0dd8405fd6140d23b932aa7742e566e008c9f3c8386a74efe44321675147c2951f6cb9dabe5b047445b126b688abf651f8ccfe7b719118e
-  data.tar.gz: 2f1bf50daa539e964159cd300f24022cd6d2614cd19886608f0acc323fbfb16e207c25d40b192a4fc783bb09b9c3272d17d84d08d9429ce07e29becd62adff51
+  metadata.gz: f5fe95adeb421eb88bf8c04e9630b6c688403237fd09b68b4185391254430d12161cd3de74cceabda0b11680a56ee2848fba273b2070a3bc36b7a5ce3701b29d
+  data.tar.gz: 89343467c51120526e7ef218d3037fdeb920b75ab846ba5c09a45464897e6484db0532d70d66bf9a3d3477d3d2c13bf34197fe432fd980ff47ad1d6ca50ef058

data/README.md

@@ -219,6 +219,98 @@ DRY_RUN=true rake users:dev[_,bob@example.com]
 #=>    -> 0.0000s
 ```
 
+### `Rolemodel::ResourceFor::ControllerExtension`
+
+Provides the private `resource_for` utility method to all controller classes throughout your app. Use it in conjunction with Routing concerns.
+
+#### The Problem It Solves
+
+Apps accumulate resources that hang off many different parents. Good examples include `comments`, `reports`, `duplications`.
+
+The naive approach involves many namespaced controllers that all do the same thing but with a different parent resource, or adding several non-restful actions to each parent controller.
+
+The following example illustrates a better pattern.
+
+##### Routing
+
+Declare the child resource inside a route concern and pass the parent's class name as a route default using `parent_resource`:
+
+```ruby
+concern :commentable do
+  resources :comments, commentable_type: parent_resource.name.classify
+end
+
+concern :reportable do
+  resources :generated_reports, only: %i[show create], reportable_type: parent_resource.name.classify
+end
+
+shallow do
+  resources :accounts do
+    resources :estimates, concerns: %i[commentable reportable] do
+      resources :widgets, concerns: %i[commentable reportable]
+    end
+  end
+end
+```
+
+##### Controller
+
+One controller serves every parent:
+
+```ruby
+class CommentsController < ApplicationController
+  before_action :set_commentable, only: %i[index new create]
+  before_action :set_comment, except: %i[index new create]
+
+  def create
+    # ...
+  end
+
+  private
+
+  def set_commentable
+    @commentable = resource_for(:commentable_type) # pass in the symbol specified in your routing concern.
+  end
+end
+```
+
+Under `shallow: true`, only the collection actions (`index`, `new`, `create`) carry the parent id — hence the `only:`/`except:` split above. Member actions find the child directly by `params[:id]` and reach the parent through its own association.
+
+`resource_for` returns the record itself, so it composes with authorization and presentation:
+
+```ruby
+def set_resource
+  @resource = authorize resource_for(:resource_type)
+end
+```
+
+#### Guarding User-Supplied Types
+
+Route defaults are merged into `params` last, so a route-supplied type cannot be overridden by a query string or request body. If a type ever arrives from user input instead, allowlist it before calling `resource_for` — `safe_constantize` will happily resolve any constant in the app:
+
+```ruby
+REPORT_CONTEXTS = %w[Accessory Estimate PartProxy Tank].freeze
+
+before_action :verify_context_type, :set_context, only: %i[create]
+
+private
+
+def verify_context_type
+  return if REPORT_CONTEXTS.include?(params[:context_type])
+
+  redirect_back_or_to root_url, alert: 'Invalid Request'
+end
+```
+
+Doing this even for route-supplied types is cheap insurance: it documents which parents the controller actually supports and fails loudly when a new route wires up a parent the controller cannot handle.
+
+#### Notes
+
+* Raises `ActiveRecord::RecordNotFound` when the id does not resolve, which Rails renders as a 404 — the same behavior as any other `find`.
+* `safe_constantize` returns `nil` for an unknown constant, producing a `NoMethodError`; allowlisting avoids that.
+* The class name is demodulized when deriving the id param, so `Reporting::Tank` looks for `params[:tank_id]`.
+* Included via `ActiveSupport.on_load(:action_controller_base)`, so `ActionController::API` controllers do not get it.
+
 ## Development
 
 Install the versions of Node and Ruby specified in `.node-version` and `.ruby-version` on your machine. https://asdf-vm.com/ is a great tool for managing language versions. Then run `corepack enable` to activate the Yarn 4+ version pinned by each project's `packageManager` field.

data/lib/generators/rolemodel/linters/eslint/eslint_generator.rb

@@ -18,8 +18,7 @@ module Rolemodel
       ].freeze
 
       def install_eslint
-        ensure_yarn
-        run "yarn add --dev #{DEV_DEPENDENCIES.join(' ')}"
+        yarn_command "add --dev #{DEV_DEPENDENCIES.join(' ')}"
       end
 
       def add_config

data/lib/generators/rolemodel/optics/base/base_generator.rb

@@ -6,8 +6,7 @@ module Rolemodel
       def add_optics_package
         say 'installing Optics package', :green
 
-        ensure_yarn
-        run 'yarn add @rolemodel/optics'
+        yarn_command 'add @rolemodel/optics'
       end
 
       def copy_templates

data/lib/generators/rolemodel/react/react_generator.rb

@@ -6,8 +6,7 @@ module Rolemodel
       @add_react = yes?('Would you like to add react?')
 
       if @add_react
-        ensure_yarn
-        run 'yarn add react react-dom'
+        yarn_command 'add react react-dom'
       end
     end
 

data/lib/generators/rolemodel/sentry/sentry_generator.rb

@@ -43,8 +43,7 @@ module Rolemodel
     def add_js_dependencies
       say 'Adding Sentry JS dependencies to package.json', :green
 
-      ensure_yarn
-      run "yarn add --dev #{JS_DEPS.join(' ')}"
+      yarn_command "add --dev #{JS_DEPS.join(' ')}"
     end
 
     def add_js_initializer

data/lib/generators/rolemodel/tailored_select/tailored_select_generator.rb

@@ -7,8 +7,7 @@ module Rolemodel
     def add_tailored_select_package
       say 'Installing Tailored Select package', :green
 
-      ensure_yarn
-      run 'yarn add @rolemodel/tailored-select'
+      yarn_command 'add @rolemodel/tailored-select'
     end
 
     def add_simple_form_input

data/lib/generators/rolemodel/testing/jasmine_playwright/jasmine_playwright_generator.rb

@@ -18,8 +18,10 @@ module Rolemodel
         raise Thor::InvocationError, 'a --github_package_token option or GITHUB_PACKAGES_TOKEN environment variable is required' if options[:github_package_token].blank?
       end
 
-      def enable_corepack_and_yarn
-        ensure_yarn
+      def add_dev_dependencies
+        say 'Adding new dev dependency to package.json', :green
+
+        yarn_command "add --dev #{DEV_DEPENDENCIES.join(' ')}"
       end
 
       def add_browser_test_script
@@ -34,12 +36,6 @@ module Rolemodel
         create_file '.node-version', NODE_VERSION, force: true
       end
 
-      def add_dev_dependencies
-        say 'Adding new dev dependency to package.json', :green
-
-        run "yarn add --dev #{DEV_DEPENDENCIES.join(' ')}"
-      end
-
       def add_spec_config_files
         say 'Adding Jasmine Playwright configuration files', :green
 

data/lib/generators/rolemodel/testing/rspec/rspec_generator.rb

@@ -27,9 +27,8 @@ module Rolemodel
       def install_playwright
         say 'Installing Playwright for system tests', :green
 
-        ensure_yarn
-        run 'yarn add --dev playwright'
-        run 'yarn run playwright install'
+        yarn_command 'add --dev playwright'
+        yarn_command 'run playwright install'
       end
 
       def add_spec_files

data/lib/generators/rolemodel/testing/vitest/vitest_generator.rb

@@ -14,17 +14,16 @@ module Rolemodel
         @vitest/ui
       ].freeze
 
-      def update_test_script
-        say 'Update yarn test command', :green
-        ensure_yarn
+      def add_dev_dependencies
+        say 'Adding new dev dependency to package.json', :green
 
-        add_package_json_script 'test', TEST_COMMAND
+        yarn_command "add --dev #{DEV_DEPENDENCIES.join(' ')}"
       end
 
-      def add_dev_dependencies
-        say 'Adding new dev dependency to package.json', :green
+      def update_test_script
+        say 'Update yarn test command', :green
 
-        run "yarn add --dev #{DEV_DEPENDENCIES.join(' ')}"
+        add_package_json_script 'test', TEST_COMMAND
       end
 
       def add_spec_config_files

data/lib/generators/rolemodel/turbo/confirm/confirm_generator.rb

@@ -6,8 +6,7 @@ module Rolemodel
       def add_turbo_confirm_package
         say 'Installing Turbo Confirm package', :green
 
-        ensure_yarn
-        run 'yarn add @rolemodel/turbo-confirm'
+        yarn_command 'add @rolemodel/turbo-confirm'
       end
 
       def add_initializer

data/lib/generators/rolemodel/turbo/form/form_generator.rb

@@ -6,8 +6,7 @@ module Rolemodel
       def add_rails_request_package
         say 'Installing @rails/request.js package', :green
 
-        ensure_yarn
-        run 'yarn add @rails/request.js'
+        yarn_command 'add @rails/request.js'
       end
 
       def add_stimulus_controller

data/lib/generators/rolemodel/ui_components/navbar/navbar_generator.rb

@@ -25,8 +25,7 @@ module Rolemodel
       def install_shoelace
         say 'Installing Shoelace package', :green
 
-        ensure_yarn
-        run 'yarn add @shoelace-style/shoelace'
+        yarn_command 'add @shoelace-style/shoelace'
       end
 
       def add_shoelace_javascript_imports

data/lib/generators/rolemodel/webpack/webpack_generator.rb

@@ -41,12 +41,6 @@ module Rolemodel
       create_file '.node-version', NODE_VERSION, force: true
     end
 
-    def enable_corepack_and_yarn
-      say 'Enabling Corepack and pinning the project to Yarn 4+', :green
-
-      ensure_yarn
-    end
-
     def force_node_to_use_es_modules
       say 'Configuring project to use ES Modules instead of CommonJS', :green
 
@@ -56,14 +50,14 @@ module Rolemodel
     def remove_obsolete_javascript_dependencies
       say 'Removing webpack & webpack-cli from package.json dependencies', :green
 
-      run 'yarn remove webpack webpack-cli'
+      yarn_command 'remove webpack webpack-cli'
     end
 
     def add_npm_packages
       say 'Adding new dev dependencies to package.json', :green
 
       dependencies = DEV_DEPS + POSTCSS_PKGS + WEBPACK_CSS_PKGS
-      run "yarn add --dev #{dependencies.join(' ')}"
+      yarn_command "add --dev #{dependencies.join(' ')}"
     end
 
     def add_webpack_config

data/lib/rolemodel/engine.rb

@@ -3,9 +3,16 @@
 module Rolemodel
   class Engine < ::Rails::Engine
     require_relative 'generator_base'
+    require_relative 'resource_for/controller_extension'
 
     generators do
       require 'generators/rolemodel/all_generator'
     end
+
+    initializer 'rolemodel.action_controller' do
+      ActiveSupport.on_load(:action_controller_base) do
+        include Rolemodel::ResourceFor::ControllerExtension
+      end
+    end
   end
 end

data/lib/rolemodel/generator_base.rb

@@ -9,19 +9,25 @@ module Rolemodel
   class GeneratorBase < ::Rails::Generators::Base
     include ::Rails::Generators::BundleHelper, ReplaceContentHelper
 
-
     private
     # based on https://github.com/rails/rails/blob/main/railties/lib/rails/generators/app_base.rb#L713
     def run_bundle
       bundle_command("install --quiet", "BUNDLE_IGNORE_MESSAGES" => "1")
     end
 
+    def yarn_command(command)
+      ensure_yarn
+
+      run "yarn #{command}"
+    end
+
     # Enable Corepack and pin the project to Yarn 4+ before running any `yarn`
     # command. Empty args/opts are required: without them, Thor forwards this
     # generator's own CLI args (e.g. the test harness's --skip-bundle
     # --skip-bootsnap) into Rolemodel::Yarn#setup, which takes none and raises
     # Thor::InvocationError.
     def ensure_yarn
+      return if Rails.root.join(destination_root, '.yarnrc.yml').exist?
       invoke 'rolemodel:yarn:setup', [], {}
     end
 

data/lib/rolemodel/resource_for/controller_extension.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module Rolemodel
+  module ResourceFor
+    module ControllerExtension
+      extend ActiveSupport::Concern
+
+      private
+
+      def resource_for(type_symbol)
+        params[type_symbol].safe_constantize.find(params[params[type_symbol].foreign_key])
+      end
+    end
+  end
+end

data/lib/rolemodel/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Rolemodel
-  VERSION = '2.3.1'
+  VERSION = '2.4.0'
 end

data/lib/rolemodel/yarn.rb

@@ -5,11 +5,10 @@ module Rolemodel
   class Yarn < ::Thor
     include ::Thor::Actions
 
-    # Enable Corepack and pin the project to Yarn 4+ (instead of the classic
-    # Yarn 1.22). Idempotent, so any generator can call it before running a
-    # `yarn` command to guarantee the modern toolchain is in place.
+    # Enable Corepack and pin the project to Yarn 4+ (instead of the classic Yarn 1.22).
     desc 'setup', 'Set the current stable version of Yarn, enable corepack, and initialize a package.json file'
     def setup
+      say 'Setting up Yarn 4+ and Corepack', :green
       # Configure the node-modules linker so webpack, Playwright, and the Rails
       # asset pipeline keep working (Yarn 4 defaults to Plug'n'Play otherwise).
       # skip if exists? to avoid overwriting any other existing config

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rolemodel-rails
 version: !ruby/object:Gem::Version
-  version: 2.3.1
+  version: 2.4.0
 platform: ruby
 authors:
 - RoleModel Software Inc
@@ -436,6 +436,7 @@ files:
 - lib/rolemodel/optics/phosphor_icon_builder.rb
 - lib/rolemodel/optics/tabler_icon_builder.rb
 - lib/rolemodel/replace_content_helper.rb
+- lib/rolemodel/resource_for/controller_extension.rb
 - lib/rolemodel/utility.rb
 - lib/rolemodel/utility/task_tools.rb
 - lib/rolemodel/version.rb