trek 2.2.0 → 2.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 76621e65ede62feb9ed4fd8aa029352bfbdda31c814a7e9679330597a631b2f6
-  data.tar.gz: a28bce934474a0d57069466281121658c75115eb9b9b1a3056eab9c6ee03ca5f
+  metadata.gz: d6ee08de9f89d342f41a9c9139580e2b9bdc3196278a25093c32f4fdb252f2a8
+  data.tar.gz: c9117839af6d9cbcec4951468913246ac20af148628d67a7930d0f8b8d74a3be
 SHA512:
-  metadata.gz: 5653df741bf84cedce799a58c4f9d8c13d8a13226793f05d1f158b4971b0b08b1806463c82fa818526c8a0454d5b489f65cae207373c581bae074e1e3ae037bd
-  data.tar.gz: aad5fb5a6e0e9010c5b611ef2ba67e7ddf112d2b983c85684ce698d32083d1da82ac24469404f3377a131d3ef1be56ec369baa81bd9cd7e71b4560a916800e62
+  metadata.gz: 79a68fecd5c544d8e3184a9388196e9cc80403b4b788614dc4db7f98ca9734a5a14543a56eeb7cd2b777f96ad3dd57fe29883687ef3771362f6c12f2b7e34123
+  data.tar.gz: 66358069ffd43f58794febe08082171cb2d47855e5f701436d5c38a87eb7c929490c7a4ae4837cdc7422765f6c1f57f1ee1214254b779300dcdb499eb01b5c3b

data/.slim-lint.yml

@@ -8,9 +8,6 @@
 skip_frontmatter: false
 
 linters:
-  AllCops:
-    NewCops: disable
-
   CommentControlStatement:
     enabled: true
 

data/AGENTS.md

@@ -21,6 +21,7 @@ bin/setup                 # bundle install + yarn install (dev setup)
 bin/console               # IRB with trek loaded
 rake                      # default: spec + rubocop
 rake spec                 # run tests (or: bundle exec rspec)
+COVERAGE=1 bundle exec rspec  # tests + SimpleCov report in coverage/ (fails under the minimum set in spec/spec_helper.rb)
 make lint                 # all linters below
 make fix                  # rubocop/eslint/stylelint/prettier autocorrect
 make release              # bump version (version.rb + package.json), stamp CHANGELOG, tag, push gem + npm
@@ -45,7 +46,13 @@ Security: `bundle exec brakeman` · `bundle exec bundle-audit check --update`
 - `lib/generators/trek/` — the heart of the gem: `install/` (~30 generators), `scaffold_generator.rb`, `admin/`, `templates/`
 - `lib/trek/` — `engine.rb`, `version.rb`, `i18n_keys_resolver.rb`, `typography_formatter.rb`
 - `config/locales/` — `trek.en.yml`, `trek.fr.yml`
-- `spec/` — RSpec suite · `docs/` — VitePress site
+- `spec/` — RSpec suite, two kinds of spec:
+  - **isolated** (`require_relative` the file under test, stub its host): concerns, helpers, simple components
+  - **Rails** (`require "rails_helper"`): boots `spec/dummy`, a minimal host app on PostgreSQL (`trek_test`, or `DATABASE_URL`). Its models, migrations, Shrine initializer and the whole admin (controllers, views, routes, policies, mailers) are not committed: `spec/dummy/lib/generated_files.rb` runs Trek's own generator steps into `tmp/dummy` on every boot, and the database is rebuilt from them. A new model or migration template must be added to its `STEPS`, or `spec/dummy/generated_files_spec.rb` fails.
+  - **Host-app specs**: model and admin request specs and their [Oaken](https://github.com/kaspth/oaken) seeds are templates (`lib/generators/trek/templates/{spec/models,spec/requests,db/seeds}/`), installed in host apps by `trek:install:model_specs` and run by Trek's suite from `tmp/dummy` (`spec/dummy/generated_specs_spec.rb`); test data comes from `users.create`, `pages.create` and `seed "cases/…"`, not factories. Write specs for Trek's models there, in host-app style (no `frozen_string_literal`, Ruby 3.1-compatible — no bare `it` block parameter), so host apps get them too.
+  - **Generators** (`spec/trek/generators_spec.rb`): every generator runs on a copy of a real `rails new` app (`spec/support/generators.rb`, built once per run into `tmp/generator_skeleton`), then again to check it changes nothing. Shell-outs are recorded in `shell_commands`, not run. A new generator is picked up automatically; if it needs arguments, an earlier Trek step or a starting file, add it to the spec's `arguments`, `prerequisites` or `setups`.
+  - Both kinds run in one process, so an isolated spec must restore any global it changes (`I18n`, `Shrine` storages…). `spec_helper` loads Rails and Action View before Trek, as a host app does: several dependencies (ActionPolicy, Slim, ViewComponent) configure themselves from what is already loaded.
+- `docs/` — VitePress site
 
 ## Conventions
 
@@ -53,6 +60,6 @@ Security: `bundle exec brakeman` · `bundle exec bundle-audit check --update`
 - **Slim** linted via slim_lint; **JS/CSS** via ESLint + Stylelint + Prettier 2.8.8
 - **i18n**: keep English + French locales in sync (`config/locales/trek.*.yml`); DeepL auto-translation via `DEEPL_AUTH_KEY`
 - **Versioning**: version lives in both `lib/trek/version.rb` and `package.json` — keep in sync via `make release`
-- **CHANGELOG.md**: Keep-a-Changelog format. **Every MR must add an `[Unreleased]` entry.** When the change requires action in the host app on upgrade, end the entry with a bold `**Upgrade note:**` label followed by what to do. Use the same label when the change lets host apps remove or simplify existing patches or custom implementations (e.g. "**Upgrade note:** you can now drop your custom …") — never as an unlabelled trailing sentence.
+- **CHANGELOG.md**: Keep-a-Changelog format. **Every MR must add an `[Unreleased]` entry.** Keep entries short: one or two sentences on what changed for host apps, not how it was found or fixed — the MR description holds the details. When the change requires action in the host app on upgrade, end the entry with a bold `**Upgrade note:**` label followed by what to do. Use the same label when the change lets host apps remove or simplify existing patches or custom implementations (e.g. "**Upgrade note:** you can now drop your custom …") — never as an unlabelled trailing sentence.
 - **Public code**: Trek ships publicly (gem, npm, docs), so nothing committed may mention a client or project name, nor a client's domain models or business logic — not in code, comments, specs, templates, docs, CHANGELOG or commit messages. Use neutral examples (`Page`, `Shop::Product`, an engine's `Blog::Post`). Client context belongs in GitLab issues and MR descriptions only.
 - **CI**: GitLab CI (`.gitlab-ci.yml`), stages build → lint → security → test → deploy; docs deploy to Netlify; deps via Renovate

data/CHANGELOG.md

@@ -1,5 +1,78 @@
 ## [Unreleased]
 
+## [2.3.1] - 2026-10-02
+
+### Changed
+
+- `Trek::Filters` only filters on the columns a controller lists in its new `available_filters` (empty by default), read through strong params (`filter_params`): other keys of `params[:filters]`, and values that aren't a single value, are ignored. Until now any key became a `where` condition, so a request could filter an index on columns it was never meant to expose. **Upgrade note:** in each controller including `Trek::Filters`, define `available_filters` returning the filtered columns (e.g. `def available_filters = %i[country_code]`), or its filters stop applying.
+- `Trek::Users::Validations` stores emails stripped and in lower case (sign-in and password resets now ignore case), checks them with `email_validator`'s strict mode, and refuses a spaces-only password; the password reset form refuses an empty password instead of pretending to change it. **Upgrade note:** resolve users whose emails differ only by case (`User.group("lower(email)").having("count(*) > 1").count`), then downcase the rest (`User.find_each { |user| user.update_column(:email, user.email.strip.downcase) }`); in `Admin::UserPasswordResetsController#update`, redirect back with an error when `params[:password]` is blank (see Trek's template); re-run `rails g trek:install:model_specs` for the new specs.
+
+### Fixed
+
+- The header's theme switcher now hovers like the links next to it, and the whole pill is clickable, not just the icon. `Trek::DropdownComponent`'s trigger inherits its context's color, and a new `trigger_classnames:` option styles the trigger button. **Upgrade note:** if you reuse `Trek::DropdownComponent`, move trigger styling (padding, hover) from `classnames:` to `trigger_classnames:`.
+
+## [2.3.0] - 2026-10-01
+
+### Added
+
+- More admin request specs from `rails g trek:install:model_specs`, run by Trek's own suite as well: `fragments_spec.rb` (index, new, create, duplicate key, edit, update, destroy), `users_spec.rb` (an admin lists privileged users only, creates a user and sends the invitation, changes a role, deletes a user; an editor is sent back from the users list and other profiles, gets a 403 in JSON, edits their own profile but not their role, switches the admin theme) and `user_password_resets_spec.rb` (the reset request answers known and unknown emails alike and only mails privileged users, reset and invitation links open the form, an invalid link goes back to the request form, a new password signs the user out everywhere, a password under 8 characters is refused). A `db/seeds/setup/fragments.rb` makes `fragments` available to seeds and specs. **Upgrade note:** re-run `rails g trek:install:model_specs` to add them.
+- `Trek::Dashboard::TileComponent` accepts `method:` and `data:`. With `method: :post` (or `:delete`…) the tile issues that request through Turbo, as a `data-turbo-method` link like `Trek::ButtonComponent`'s `to:` links, so a dashboard shortcut can create a record in one click (e.g. a pre-filled draft) rather than only open a form; `data:` adds attributes to the link, such as `turbo_confirm:`. Tiles without them still render a plain GET link. **Upgrade note:** you can now turn a tile pointing to a form into a direct action, and drop buttons kept elsewhere only because a tile couldn't POST.
+- Policy specs for host apps, run by Trek's own suite as well: `rails g trek:install:model_specs` installs `spec/policies/admin/` specs for the page, fragment, user, preview and external link policies (what each role may do, which attributes it may change, which records it sees), and `rails g trek:taxonomies` installs the tag and tag category ones (a tag or category in use can't be deleted). **Upgrade note:** re-run `rails g trek:install:model_specs` (and `rails g trek:taxonomies` if you use tags) to add them.
+- Sound uploads from the admin: `Trek::Form::SoundFieldComponent` (`f.sound_field`) posted to `/admin/upload/audio`, which no generated app routed or handled. `trek:install:uploaders` now installs an `AudioUploader` (MP3, AAC/M4A, Ogg, WAV, WebM, FLAC, up to the field's 200 MB), the generated `Admin::UploadsController` gains an `audio` action, and `trek:install:admin:routes` adds `post "upload/audio", to: "uploads#audio"` to the admin namespace. Attach it with `include AudioUploader::Attachment(:audio)` on a record with an `audio_data` jsonb column. **Upgrade note:** copy `app/uploaders/audio_uploader.rb` from Trek (or re-run `rails g trek:install:uploaders`), add the `audio` action to `app/controllers/admin/uploads_controller.rb` (`set_rack_response AudioUploader.upload_response(:cache, request.env)`), and add `post "upload/audio", to: "uploads#audio"` inside `namespace :admin` in `config/routes.rb`; you can then drop a hand-written audio uploader, action and route that did the same.
+- `rails g trek:install:model_specs` also installs request specs for the admin, run by Trek's own suite as well: `spec/requests/admin/user_sessions_spec.rb` (sign-in form, signing in and out, refusing a wrong password or a user who isn't privileged), `pages_spec.rb` (index, new, create, invalid create, edit, update, destroy as an editor), `uploads_spec.rb` (the image upload endpoint) and the existing `n_plus_one_spec.rb`, with an image fixture in `spec/fixtures/files`. The Oaken users setup gains a `users.password` helper to sign in with. **Upgrade note:** re-run `rails g trek:install:model_specs` to add them, then `bin/rails spec`.
+- `rails g trek:install:model_specs`, a new installer step (also runnable alone) giving host apps specs for the models Trek installs: `spec/models/page_spec.rb` (slugs, full paths through the page tree, path history when a page moves) and `spec/models/user_spec.rb` (validations, roles, `privileged`, `to_s`). Their test data uses [Oaken](https://github.com/kaspth/oaken) seed scripts rather than factories: `db/seeds/setup/users.rb` sets defaults for `users.create`/`users.new` (a unique email, a valid password), and `db/seeds/test/cases/page_tree.rb` lays out a named page tree the Page spec loads with `seed "cases/page_tree"`. The step adds the `oaken` gem (in every group, since `db/seeds.rb` now calls `Oaken.seed`, which also makes these seeds available to `bin/rails db:seed`) and `require "oaken/rspec_setup"` in `spec/rails_helper.rb`, which seeds the database before the suite. The specs check Trek's behaviour inside the app, so a customization that breaks it fails the app's own suite; edit or remove the ones covering behaviour you deliberately changed. Trek's own suite runs the very same files against its dummy app, so they stay green with each Trek release. Oaken needs Ruby 3.2+. **Upgrade note:** run `rails g trek:install:model_specs` to add them (it skips the gem, the `db/seeds.rb` line and the `rails_helper` line when already there, and asks before overwriting an existing file), then `bundle exec rspec spec/models`. `oaken/rspec_setup` truncates every table and runs `db/seeds.rb` before the suite, so make sure your `db/seeds.rb` is fine to run in the test environment.
+- The header's theme button is now a working theme switcher. It used to toggle `light-theme`/`dark-theme` on the page without saving the choice (a `TODO` logged it to the console), so the theme reset on the next page load. It now opens a menu offering **Auto**, **Light** and **Dark**, applies the choice at once and saves it to the user's `theme` through `PATCH /admin/users/theme`. The action answers with a turbo stream that refreshes the header icon. Logged-out pages (login, password reset) now render with `auto-theme` instead of `light-theme`. **Auto** follows the system setting (`prefers-color-scheme`) without JavaScript: a small PostCSS plugin in `postcss.config.js` copies Radix's `.dark-theme` variables into a `@media (prefers-color-scheme: dark)` block scoped to `.auto-theme`. `color-scheme` is now set for each theme too, so native controls and scrollbars follow it. The menu is a new `Trek::DropdownComponent` (a trigger slot plus `with_item` entries, with keyboard navigation), which host apps can reuse. **Upgrade note:** in `app/controllers/admin/users_controller.rb`, replace `head :no_content` in the `theme` action with `respond_to { |format| format.turbo_stream; format.html { head :no_content } }`, and add `app/views/admin/users/theme.turbo_stream.slim` from Trek's generator templates (or re-run `rails g trek:install:admin:users`). Without them the theme is still saved, but the header icon only updates on the next page load. For **Auto** to follow the system setting, copy the `autoDarkTheme` plugin from Trek's `postcss.config.js` into yours and add it to `plugins` right after `postcss-import`; without it, **Auto** renders the light theme.
+- `phonable_attributes` accepts a `strictness:` option — `:possible` (the default, unchanged) or `:valid`. `:possible` only asks Phonelib whether the digits could form a number for the country; `:valid` asks whether they fall in a range the regulator has actually assigned. The gap bites on input errors: with a French default country, `"0012345678"` is possible, so it is accepted and normalized to `"+12345678"` — the stray leading zero read as an international prefix, the number silently rehomed to country code +1, and the original input gone since normalization happens on save. Apps that intend to call or text the numbers they collect want `phonable_attributes :phone, strictness: :valid`.
+- Plain file inputs are now styled: inside a `Trek::Form::GroupComponent` (`f.group`), a standard `f.file_field` gets its native `::file-selector-button` styled like a `Trek::ButtonComponent` with `size: :narrow`, using the accent variables so `data-accent-color` applies as on buttons. The browser's built-in "file chosen" feedback is kept and no JS is involved — useful for one-off uploads (e.g. an .xlsx import) next to Trek's styled fields. The Shrine-backed `image_field`/`sound_field` are unaffected (their file inputs are visually hidden). **Upgrade note:** you can now drop custom `::file-selector-button` styles that mirrored Trek's buttons for plain file inputs.
+- The confirm dialog (`Trek::DialogComponent` wired to `Turbo.config.forms.confirm`) now takes its title, confirm button label and button color per action from the confirming element's data attributes — `data-turbo-confirm-title`, `data-turbo-confirm-button` and `data-turbo-confirm-color` alongside `data-turbo-confirm` — falling back to the current delete wording ("Are you sure?" / "Delete" / tomato) when absent. A non-destructive confirm (a "Validate" flow, a scheduled job trigger) no longer shows a **Delete** button, and one page can host a delete confirm and an action confirm side by side. Works on form submit buttons and on `data-turbo-method` links (the clicked element is remembered, since Turbo only forwards `data-turbo-confirm` to the form it builds for a link). **Upgrade note:** you can now drop `content_for(:dialog)`-style overrides that swapped the whole dialog just to rename the button — pass the data attributes on the confirming button instead.
+- `Trek::MenuComponent` items accept a `target:` option forwarded to the link — e.g. `s.with_item(text: …, href: …, target: "_blank")` for external tools mounted in the admin, like a GoodJob dashboard. A `_blank` item automatically gets `rel="noopener"` and the `trek/external` new-tab icon after its text, as the toast link already did. `Trek::Dashboard::TileComponent` (which already accepted `target:`/`rel:`) now also defaults `rel` to `noopener` when `target` is `_blank`. **Upgrade note:** you can now drop initializer patches that reopened `ItemComponent` to add a `target` option.
+- `Trek::ButtonComponent` accepts a `name:` option, rendered on the plain-button branch (paired with `value:`) so a `type: :submit` button can carry a param — needed when a form has two submit actions with different outcomes (e.g. a "save" button next to a "save then preview" one submitting `then_preview`). **Upgrade note:** you can now drop initializer patches that reopened the component to add a `name` option.
+- `rails g trek:install:appsignal`, a new installer step (also runnable alone) that sets up [AppSignal](https://appsignal.com) error tracking and performance monitoring, until now wired by hand in every app: it adds the `appsignal` gem, injects `APPSIGNAL_PUSH_API_KEY` into the Rails credentials (as the Postmark generator does with its API token — `bundle exec appsignal install` would write the key in plain text and needs a terminal), and writes a `config/appsignal.rb` that reads the key from the credentials, activates the agent in production as soon as a key exists, and ignores the `/healthcheck` action. It also wraps the boot in `config.ru` so a broken initializer or a missing credential is reported, and installs an `AppsignalContext` controller concern that sets the `admin`/`web` namespace and tags transactions with the acting user — included in `ApplicationController` and, through an initializer, in `Trek::BaseController`. `APPSIGNAL_APP_ENV` is added to `.env.example`; the rescued Postmark delivery in `ApplicationMailer` now reports through `Rails.error` rather than only logging, which keeps app code independent of the monitoring vendor. Check an install with `bundle exec appsignal diagnose`. **Upgrade note:** existing apps can run `rails g trek:install:appsignal` — it skips the gem and the credentials when AppSignal is already set up, but review the generated `config/appsignal.rb` against your own (it takes the push API key from the credentials, so drop a plain-text key or an `APPSIGNAL_PUSH_API_KEY` environment variable you no longer need), and remove your hand-written `AppsignalContext` equivalent if you have one.
+- `bin/rails trek:attachments:promote_cached`, a rake task finding the records whose Shrine attachments still point to the temporary `cache` storage — for every model and attachment, whatever the uploader — and promoting those whose cached file still exists (backed by `Trek::CachedAttachments`). It prints one line per attachment with its status: `promoted`, `missing` when the cached file is gone (it has to be uploaded again), or `changed` when the record changed meanwhile; `DRY_RUN=1` only lists them, as `promotable`. Documented in the [uploaders reference](/reference/uploaders).
+
+### Changed
+
+- Trek's dummy app now generates and serves the whole admin (authentication, authorization, the admin generator's controllers and layout, routes, the pages, fragments, users, sessions and password-reset panels, mailers), so request and component specs run against the real admin. Line coverage goes from 49% to 73%; the minimum is raised to 72%.
+- Every Trek generator is now run by Trek's own suite (`spec/trek/generators_spec.rb`): on a fresh `rails new` app set up as in the Getting started guide, then a second time to check that re-running it changes nothing (host apps re-run generators when upgrading). Shell-outs (bundle, yarn, migrations, rubocop) are recorded rather than run; the few other gems' generators whose output a later step edits (`rails g model`, `action_policy:install`, `mobility:install`, `rspec:install`) run for real, in-process. `trek:admin:user` has its own spec against the dummy app's database. Line coverage goes from 35% to 49%; the minimum is raised to 49%.
+- `trek:install:ruby` now pins **Ruby 4.0.7** (was 4.0.6), and the CI images (repo + generated `.gitlab-ci.yml` template) use the matching `4.0.7` tag. **Upgrade note:** existing apps can set `4.0.7` in `.ruby-version` and bump the `ci-ruby` image tag in `.gitlab-ci.yml`.
+- Trek's own specs now run in random order (`--seed` replays an order, `--bisect` finds the spec leaking state), and no longer depend on it: `page_path_helper_spec` switched the default locale to French inside `I18n.with_locale`, which left `I18n.locale` set to `:fr` for the specs that ran after it, so `localization_spec` and `i18n_helper_spec` failed under some orders.
+- Trek's own suite can now test code that needs Rails and a database. Specs that `require "rails_helper"` boot `spec/dummy`, a minimal host app on PostgreSQL. Its models, migrations and Shrine initializer are not copied by hand: they are produced on each boot by running Trek's own generator steps (`trek:install:page`, `:user`, `:authentication`, `:fragment`…), so they cannot drift from what `rails g trek:install` gives a real app, and a spec fails when a model or migration template is added without the suite generating it. First `User` and `Page` model specs come with it. Line coverage goes from 9% to 35%, most of it from the app's code now being loaded; the minimum is raised to 34%.
+- Trek's own spec suite runs in CI again, in a `tests` job that had been commented out — so nothing flagged that `spec/helpers/trek/page_path_helper_spec.rb` required a `rails_helper` the repository does not have, which stopped the whole suite from loading. That spec is rewritten in the suite's isolated style (no Rails app, stubbed routes). `COVERAGE=1` turns on SimpleCov, which reports line and branch coverage over every Ruby file in `app/` and `lib/` (generator templates excluded), writes a Cobertura report for GitLab's merge-request diff coverage, and fails the run below a minimum line coverage, currently 9%, to be raised as coverage grows.
+- Trek is now developed and tested against **Shrine 3.10** (was 3.6). The gemspec constraint stays `~> 3.0`, so this changes nothing for host apps by itself — they already resolve 3.10 on Ruby ≥ 3.2 — but Trek's own suite and the generated app in CI no longer run against a version nobody installs. Worth picking up: 3.8 fixes a path traversal outside the storage directory in the `file_system` storage (the development and test storage), 3.7 stops `column` from failing on an empty string, 3.9 fixes `remove_invalid` leaving the attribute set after an invalid file is deassigned and stops the `activerecord` plugin from deleting the original attachment of a duplicated record. Shrine 3.7 dropped Ruby < 3.2, so an app still on Ruby 3.1 keeps resolving 3.6. **Upgrade note:** run `bundle update shrine` (nothing else to change).
+
+### Fixed
+
+- A signed-in user opening what their role doesn't allow (an editor on the users panel, or on another user's profile) got a 500 error page: `ActionPolicy::Unauthorized` was raised and handled nowhere. `Trek::Authorization` now rescues it: back to the previous page, or to the dashboard, with a translated alert (`notices.unauthorized`); Turbo Stream and JSON requests get a 403.
+- The new fragment form (and any fragment saved without content) raised `undefined method '[]' for nil`: the generated `fragments` migration created `content` as a jsonb column without the `{}` default its translated `title` has, and Mobility's jsonb backend reads a translation as `column[locale]`. The migration now defaults `content` to `{}`. **Upgrade note:** in apps generated before this version, add a migration with `change_column_default :fragments, :content, from: nil, to: {}` and `up_only { execute "UPDATE fragments SET content = '{}' WHERE content IS NULL" }`.
+- The generated `Admin::ExternalLinkPolicy` scoped external links for non-privileged users with `relation.where(user:)`, a leftover from an example: `external_links` has no `user` column, so applying the scope raised a SQL error. Non-privileged users now get none, as in Trek's other policies. **Upgrade note:** in `app/policies/admin/external_link_policy.rb`, replace `relation.where(user:)` with `relation.none`.
+- With `rails g trek:taxonomies`, asking whether a tag could be deleted (`Admin::TagPolicy#destroy?`) raised `HasManyThroughAssociationPolymorphicSourceError`: it called `Tag#taggables`, a `has_many :taggables, through: :taggings` that Rails can't build over the polymorphic `Tagging#taggable`. The policy now checks `taggings`, and `Tag#taggables` is a method returning the tagged records. **Upgrade note:** in `app/models/tag.rb`, replace `has_many :taggables, through: :taggings` with `def taggables = taggings.includes(:taggable).map(&:taggable)`, and in `app/policies/admin/tag_policy.rb`, replace `record.taggables.empty?` with `record.taggings.empty?`.
+- The docs and README still described [Sorcery](https://github.com/Sorcery/sorcery) as Trek's authentication, and the `User` reference listed its `crypted_password` column. Trek authenticates with Rails' `has_secure_password` and database-backed `UserSession` records; the Getting started guide, the introduction, the home page, the customization guide, the installer and `User` references now say so, and the `User` columns table lists `password_digest` and `last_activity_at`. The README's ClosureTree link, which pointed to Sorcery, now points to ClosureTree.
+- Deleting a page (or a page version) raised `NameError: Missing model class Section for the Page#sections association`: `Trek::Sectionable`, included in the generated `Page` and `PageVersion`, declared `has_many :sections, dependent: :destroy`, but no generator creates a `Section` model. The association is now declared only when the app defines one, so apps with their own sections keep them.
+- Editing a page raised `undefined method 'page_path' for an instance of Trek::HeaderComponent`: the admin header's "See on website" link called `page_path`, which components don't include. The header now includes `Trek::PagePathHelper`, and leaves the link out when the app has no front-office route for the page (a freshly generated app has none), instead of raising.
+- Image uploads from the admin returned 404: `trek:install:admin:routes` wrote `post "upload", to: "uploads#image", namespace: :admin` at the top of the routes (the `namespace:` ended up inside the route string), while image fields post to `/admin/upload/image`. It now writes `post "upload/image", to: "uploads#image"` inside `namespace :admin`. **Upgrade note:** in `config/routes.rb`, replace `post "upload", to: "uploads#image", namespace: :admin` with `post "upload/image", to: "uploads#image"` inside your `namespace :admin do … end` block.
+- Trek's components use `Turbo::FramesHelper`, but the gemspec didn't declare `turbo-rails`: it only worked because `rails new` adds it by default. Trek now depends on `turbo-rails` (>= 1.0) and requires it.
+- `Trek::Users::Validations` only enforced the 8-character password minimum when a user was created: the check for a later change looked at `crypted_password`, a column from Trek's former authentication library that `has_secure_password` users don't have, so an existing user could set a 1-character password (e.g. through the password reset form). It now also applies whenever `password_digest` changes, and still skips saves that leave the password alone. The generated `spec/models/user_spec.rb` covers both cases. **Upgrade note:** nothing to change; to get the new examples in an existing app, re-run `rails g trek:install:model_specs` and accept overwriting `spec/models/user_spec.rb` (or copy the two examples).
+- `rails g trek:upgrade:v2` left two blank lines in `.yarnrc.yml` where it removed the `git.etamin.studio` registry, right before the `npmPreapprovedPackages` block it adds, so running it again changed the file. It now leaves a single one.
+- `rails g trek:scaffold` wrote an invalid `config/locales/models/<model>.en.yml`: the attribute labels ran together on one line (`name: Name        description: Description`), so Rails failed to load the translations (`Psych::SyntaxError: mapping values are not allowed in this context`) and every page rendering a translation raised. Each attribute is on its own line again. Trek's CI now generates its test app the way the Getting started guide does (`rails new -j esbuild`) and runs that app's own suite (`bin/rails spec`) after `trek:install` and `trek:scaffold`, which is how this surfaced. **Upgrade note:** in models scaffolded before this version, put each attribute of `config/locales/models/*.en.yml` on its own line.
+- Freshly generated apps got a broken `db/schema.rb`: they resolve `json` 3, whose `JSON.parse` takes its options as keywords only, while ActiveSupport (up to 8.1.3.1, the latest release) passes them positionally. The schema dumper then fails on every jsonb column with a default and writes `# Could not dump table "pages" because of following ArgumentError` in place of `pages`, `page_paths`, `fragments` and `menu_nodes`, so the test database, loaded from `schema.rb`, lacks those tables and the app's specs cannot run. Trek now requires `json` < 3 until Rails supports json 3, and its suite dumps the generated schema to catch a regression. **Upgrade note:** run `bundle update trek` (it moves `json` back to 2.x if you had 3), then `bin/rails db:schema:dump` and check that `db/schema.rb` has no "Could not dump" comment left.
+- Three generated migrations tripped RuboCop in a freshly generated app: `trek_tag_categories` and `trek_taggings` (from `rails g trek:taxonomies`) indented `create_table` by one space, and `trek_menu_nodes` ended with a trailing blank line. The templates are fixed, and Trek's suite now runs RuboCop on every generated migration. **Upgrade note:** apps generated before this version can run `bundle exec rubocop --autocorrect db/migrate` to fix them.
+- `Trek::PagePathHelper#page_path` (and `page_url`) raised `NoMethodError: undefined method 'shop/product_path'` for a page attached to a namespaced pageable: the route name was built from `pageable.class.name.underscore`, which keeps the `/` of the namespace. It now uses `pageable.model_name.singular_route_key`, the key Rails' polymorphic routes use — `shop_product_path` for `Shop::Product`, and `post_path` for an isolated engine's `Blog::Post`. Non-namespaced pageables are unaffected.
+- `Trek::PagePathHelper#page_url` returned a path, not a URL, for a page with a named route (a keyed page such as `about`): that branch always called `#{key}_path` and ignored the `url` suffix the other branches honour. It now calls `about_url`, so mailers, sitemaps and canonical links built with `page_url` get an absolute URL. **Upgrade note:** you can now drop workarounds that made `page_url` absolute for keyed pages (e.g. prefixing `request.base_url`).
+- `trek:install:scalingo` pinned the buildpack with `BUILDPACK_URL=https://github.com/etaminstudio/trek-buildpack#v0.1.0`, and Scalingo resolves a `#ref` suffix as a **branch**: the tag was looked up as `archive/refs/heads/v0.1.0`, which does not exist, and every build failed with `fail to download and extract the custom buildpack: Invalid status code: 404 Not Found`. The generator and the [Deploying to Scalingo](https://trek.etamin.studio/deploy) guide now point at the release archive, `https://github.com/etaminstudio/trek-buildpack/archive/refs/tags/v0.1.0.tar.gz`, which Scalingo downloads as is and which stays pinned to the release. **Upgrade note:** on each Scalingo app, run `scalingo --app <app> env-set BUILDPACK_URL=https://github.com/etaminstudio/trek-buildpack/archive/refs/tags/v0.1.0.tar.gz` — an app still on the `#v0.1.0` form cannot deploy, and nothing surfaces it until the next deploy fails.
+- The English locale gave the content editor's prompt panel its target labels in French ("un nouvel onglet" / "le même onglet"): `admin.content_editor.prompt.targets` had been copied from `trek.fr.yml` rather than translated. An English-locale admin inserting a Turbo-frame prompt now reads "a new tab" / "the same tab", as the link panel right above already did.
+- The generated `trek_users` migration tripped RuboCop's `Rails/NotNullColumn` on `add_column :users, :password_digest, :string, null: false`, so `make lint` (and the `lint` CI job) failed in a freshly generated app — the installer's own closing `make fix` already exited non-zero on it. The column is fine as it stands: the preceding `trek_create_users` migration creates the table empty, so there is nothing to backfill and no default is wanted on a password digest. The line now carries an inline `rubocop:disable Rails/NotNullColumn` with a comment saying why. **Upgrade note:** apps generated before this version can add the same disable comment to `db/migrate/*_trek_users.rb`.
+- The generated `.slim-lint.yml` listed an `AllCops:` key (`NewCops: disable`) among its linters. slim-lint validates linter names since 0.34 ("Add check for invalid keys in config files"), so `make lint` in a freshly generated app died with `No such linter: AllCops. Available: CommentControlStatement, …` before checking a single template; Trek's own lockfile pins 0.33, where the unknown key was ignored, which is why it went unnoticed. The key is gone — it configured nothing (the embedded RuboCop is configured under the `RuboCop` linter's `ignored_cops`). **Upgrade note:** remove the two `AllCops:` / `NewCops: disable` lines from your `.slim-lint.yml` if it still has them.
+- The generated `config/appsignal.rb` now sets `config.log_path = "/tmp"` in production, so the AppSignal agent stops announcing `appsignal: Unable to log to '/app/log'. Logging to '/tmp' instead.` on every boot and every one-off container. Hosts with a read-only filesystem (Scalingo, Heroku and the like) cannot let the agent write its diagnostic log next to the app, and it falls back to `/tmp` by itself — nothing was lost, but the message reads like a misconfiguration. **Upgrade note:** add `config.log_path = "/tmp" if Rails.env.production?` to a `config/appsignal.rb` written before this version, or regenerate it with `rails g trek:install:appsignal`.
+- `Trek::Phonable#normalize_phone` normalized every declared attribute from the value of `phone`: a model declaring `phonable_attributes :phone, :fax` — the concern's own documented example — overwrote the fax with the phone number on every save, and wiped it when the phone was blank. Each attribute is now parsed from its own value. Models declaring a single attribute are unaffected.
+- `Trek::ButtonComponent`'s `disabled` option is now actually rendered — it was declared but ignored by every branch, so a "disabled" button stayed clickable with no visual cue. A disabled button renders `<button disabled>`; a disabled link (`href:` or `to:`) renders an inert anchor — no `href`, no Turbo method — with `aria-disabled="true"`, since `<a>` has no `disabled` attribute. Both get a dimmed, non-interactive style (`opacity: 0.5`, `pointer-events: none`, `cursor: not-allowed`). **Upgrade note:** you can now drop `classnames: "is-disabled"`-style workarounds and their CSS, and pass `disabled:` with a real `href` instead of blanking the href conditionally.
+- The icon of a `Trek::ButtonComponent` no longer shrinks next to a long label: as a flex item it was squeezed (and, with a `min-width`, distorted) when the text ran out of room. It keeps its size, the text wraps or ellipsises as before. **Upgrade note:** you can now drop a `.c-trek--button-icon { flex-shrink: 0 }` override.
+- The login, forgotten-password and password-reset forms labelled their fields with the humanized attribute name ("Email", "Password") whatever the locale. They post to a URL rather than to a record, so `Trek::Form::GroupComponent` had no model to resolve `activerecord.attributes.user.*` against and fell back to the attribute name; the translations shipped in Trek's locales were never looked up. The three generated views now pass `model_name: User.model_name` to `f.group`, which drives the i18n lookup alone and leaves field names (and therefore the params the controllers read) untouched. **Upgrade note:** views generated before this version keep the old labels — add `model_name: User.model_name` to the `f.group` calls in `app/views/admin/user_sessions/new.html.slim` and `app/views/admin/user_password_resets/{new,edit}.html.slim`, or regenerate them.
+- The toast link's new-tab icon rendered as an empty `<svg><use></svg>`: `Trek::Toaster::ToastComponent::LinkComponent` referenced an `external` icon that didn't ship with the gem (it only resolved when the host app provided its own `app/assets/icons/external.svg`). Trek now bundles `trek/external` ([Lucide](https://lucide.dev)'s `external-link`, ISC) and the toast link uses it; the icon is also available to host apps as `Trek::IconComponent.new("trek/external")`. **Upgrade note:** you can now drop an `app/assets/icons/external.svg` that only existed to back the toast link (keep it if your own code renders the bare `external` key).
+- `Trek::MenuComponent` items pointing at a namespaced model doubled the namespace in the path used for the active-state check (`href: [:admin, :missive, Missive::List]` compared against `admin/missive/missive/lists`), so those items never got `is-active`. The namespace segments already covered by the model's collection are now deduplicated, and the item highlights on its own controller. **Upgrade note:** you can now drop `active:` overrides that only worked around this (e.g. `active: "admin/#{model.model_name.collection}"`).
+- `make release` now chains its steps with `&&`, so a failing step halts the run. Previously the steps were separated by `;`: when `rake release` failed (e.g. RubyGems asking for an MFA code), `npm publish` still ran and its output buried the error, leaving the gem unpublished while the tag and npm package were out.
+- `make release` prompts for the RubyGems and npm one-time passwords right before each publish step (passed as `GEM_HOST_OTP_CODE` and `npm publish --otp`), so accounts with MFA no longer fail the push; leave a prompt empty when MFA is off for that registry.
+- A file attached to a record on a numerically ordered closure tree — the generated `Page` and its image — stayed in Shrine's temporary `cache` storage forever when attached on create or together with a parent change. closure_tree reloads the record in its `after_save` callback to reorder siblings, and Shrine's `activerecord` plugin resets the attacher on reload, so the `after_commit` promotion found nothing to promote: the record kept `"storage": "cache"` data, and its derivation URLs broke with "Source file not found" as soon as the cached file was deleted. Updating an existing page's image was unaffected. `Trek::SavedAttachmentsReload`, a Shrine plugin loaded by the generated `RecordImageUploader`, now keeps across a reload the attachers whose file was saved with the record (an unsaved attachment is still discarded), so the file is promoted and the replaced one deleted after commit. **Upgrade note:** add `plugin Trek::SavedAttachmentsReload` under `plugin :activerecord` in `app/uploaders/record_image_uploader.rb` (it covers every model using that uploader, not only Trek's). Records saved before that may still point to cached files — run `bin/rails trek:attachments:promote_cached` to promote those whose file still exists, and have the ones it reports as `missing` uploaded again.
+
 ## [2.2.0] - 2026-08-28
 
 ### Added

data/Gemfile

@@ -22,6 +22,10 @@ group :development, :test do
 end
 
 group :test do
+  gem "bcrypt", "~> 3.1"
   gem "capybara", "~> 3.38"
+  gem "oaken", "~> 1.0"
+  gem "pg", "~> 1.5"
   gem "simplecov", "~> 0.22.0"
+  gem "simplecov-cobertura", "~> 3.0"
 end

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    trek (2.2.0)
+    trek (2.3.1)
       action_policy (~> 0.6)
       actioncable
       acts_as_list (~> 1.1)
@@ -10,10 +10,12 @@ PATH
       closure_tree (~> 9.0)
       deepl-rb (~> 3.0)
       dry-initializer (~> 3.1)
+      email_validator (~> 2.2)
       fastimage (~> 2.2)
       http_accept_language (~> 2.1)
       i18n-tasks (~> 1.0)
       image_processing (~> 1.8)
+      json (< 3)
       kaminari
       listen
       lookbook (>= 2.3.13)
@@ -28,6 +30,7 @@ PATH
       shrine-blurhash (~> 0.2)
       slim-rails (~> 4.0)
       strip_attributes (~> 2.0)
+      turbo-rails (>= 1.0)
       view_component (< 5.0)
       view_component-form (~> 0.3)
       zeitwerk (~> 2.6)
@@ -137,6 +140,7 @@ GEM
     aws-sigv4 (1.12.1)
       aws-eventstream (~> 1, >= 1.0.2)
     base64 (0.3.0)
+    bcrypt (3.1.22)
     bigdecimal (4.1.2)
     blurhash (0.1.8)
     brakeman (7.1.2)
@@ -169,8 +173,9 @@ GEM
     deepl-rb (3.6.1)
     diff-lcs (1.6.2)
     docile (1.4.1)
-    down (5.4.2)
+    down (5.6.0)
       addressable (~> 2.8)
+      base64 (~> 0.3)
     drb (2.2.3)
     dry-configurable (1.3.0)
       dry-core (~> 1.1)
@@ -201,6 +206,8 @@ GEM
       dry-inflector (~> 1.0)
       dry-logic (~> 1.4)
       zeitwerk (~> 2.6)
+    email_validator (2.2.4)
+      activemodel
     erb (6.0.4)
     erubi (1.13.1)
     fastimage (2.4.0)
@@ -302,10 +309,13 @@ GEM
       racc (~> 1.4)
     nokogiri (1.19.4-x86_64-darwin)
       racc (~> 1.4)
+    oaken (1.0.0)
     parallel (1.27.0)
     parser (3.3.10.0)
       ast (~> 2.4.1)
       racc
+    pg (1.6.3-arm64-darwin)
+    pg (1.6.3-x86_64-darwin)
     phonelib (0.10.15)
     postmark (1.25.1)
       json
@@ -457,7 +467,7 @@ GEM
       ffi (~> 1.12)
       logger
     securerandom (0.4.1)
-    shrine (3.6.0)
+    shrine (3.10.0)
       content_disposition (~> 1.0)
       down (~> 5.1)
     shrine-blurhash (0.2.3)
@@ -467,6 +477,9 @@ GEM
       docile (~> 1.1)
       simplecov-html (~> 0.11)
       simplecov_json_formatter (~> 0.1)
+    simplecov-cobertura (3.2.0)
+      rexml
+      simplecov (~> 0.19)
     simplecov-html (0.13.2)
     simplecov_json_formatter (0.1.4)
     slim (5.2.1)
@@ -491,6 +504,9 @@ GEM
     tilt (2.6.1)
     timeout (0.6.1)
     tsort (0.2.0)
+    turbo-rails (2.0.23)
+      actionpack (>= 7.1.0)
+      railties (>= 7.1.0)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
     unicode-display_width (3.2.0)
@@ -528,9 +544,12 @@ PLATFORMS
   x86_64-darwin-24
 
 DEPENDENCIES
+  bcrypt (~> 3.1)
   brakeman (~> 7.0)
   bundler-audit (~> 0.9)
   capybara (~> 3.38)
+  oaken (~> 1.0)
+  pg (~> 1.5)
   rake (~> 13.0)
   reek (~> 6.1)
   rspec-html-matchers (~> 0.10)
@@ -541,6 +560,7 @@ DEPENDENCIES
   rubocop-rails-omakase (~> 1.1)
   rubocop-rspec (~> 3.5)
   simplecov (~> 0.22.0)
+  simplecov-cobertura (~> 3.0)
   slim_lint (~> 0.24)
   trek!
 

data/Makefile

@@ -15,15 +15,17 @@ fix:
 
 release:
 	@read -p "New version (current: $$(sed -n 's/.*VERSION = "\(.*\)"/\1/p' lib/trek/version.rb)): " version; \
-	if [ -z "$$version" ]; then echo "Version cannot be empty"; exit 1; fi; \
-	sed -i '' "s/VERSION = \".*\"/VERSION = \"$$version\"/" lib/trek/version.rb; \
-	sed -i '' "s/\"version\": \".*\"/\"version\": \"$$version\"/" package.json; \
-	awk -v v="$$version" -v d="$$(date +%F)" '!done && /^## \[Unreleased\]/ {print; print ""; print "## [" v "] - " d; done=1; next} {print}' CHANGELOG.md > CHANGELOG.md.tmp && mv CHANGELOG.md.tmp CHANGELOG.md; \
-	bundle; \
-	git add -A; \
-	git commit -m "Version $$version"; \
-	bundle exec rake release; \
-	npm publish
+	if [ -z "$$version" ]; then echo "Version cannot be empty"; exit 1; fi && \
+	sed -i '' "s/VERSION = \".*\"/VERSION = \"$$version\"/" lib/trek/version.rb && \
+	sed -i '' "s/\"version\": \".*\"/\"version\": \"$$version\"/" package.json && \
+	awk -v v="$$version" -v d="$$(date +%F)" '!done && /^## \[Unreleased\]/ {print; print ""; print "## [" v "] - " d; done=1; next} {print}' CHANGELOG.md > CHANGELOG.md.tmp && mv CHANGELOG.md.tmp CHANGELOG.md && \
+	bundle && \
+	git add -A && \
+	git commit -m "Version $$version" && \
+	read -p "RubyGems OTP code (leave empty if MFA is off): " gem_otp && \
+	env $${gem_otp:+GEM_HOST_OTP_CODE=$$gem_otp} bundle exec rake release && \
+	read -p "npm OTP code (leave empty if MFA is off): " npm_otp && \
+	npm publish $${npm_otp:+--otp=$$npm_otp}
 
 audit-fix:
 	@out=$$(bundle exec bundle-audit check --update 2>&1); \

data/README.md

@@ -16,7 +16,7 @@ Trek is a modern content management system for Ruby on Rails, that is designed t
 Trek uses these gems under the hood:
 
 - [ActionPolicy](https://github.com/palkan/action_policy) for authorization
-- [ClosureTree](https://github.com/Sorcery/sorcery) for hierarchies
+- [ClosureTree](https://github.com/ClosureTree/closure_tree) for hierarchies
 - [Postmark](https://github.com/ActiveCampaign/postmark-rails) for sending emails
 - [rails-i18n](https://github.com/svenfuchs/rails-i18n), [mobility](https://github.com/shioyama/mobility) and [i18n-tasks](https://github.com/glebm/i18n-tasks) for internationalization
 - [RSpec](https://github.com/rspec/rspec-rails) for testing

data/app/assets/icons/trek/chevron-down.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down-icon lucide-chevron-down"><path d="m6 9 6 6 6-6"/></svg>

data/app/assets/icons/trek/chevron-up.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-up-icon lucide-chevron-up"><path d="m18 15-6-6-6 6"/></svg>

data/app/assets/icons/trek/external.svg

@@ -0,0 +1 @@
+<svg viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><path d="M15 3h6v6" fill="none" stroke="#000000" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"></path><path d="M10 14 21 3" fill="none" stroke="#000000" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"></path><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6" fill="none" stroke="#000000" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"></path></svg>

data/app/assets/icons/trek/theme-auto.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-sun-moon-icon lucide-sun-moon"><path d="M12 2v2"/><path d="M14.837 16.385a6 6 0 1 1-7.223-7.222c.624-.147.97.66.715 1.248a4 4 0 0 0 5.26 5.259c.589-.255 1.396.09 1.248.715"/><path d="M16 12a4 4 0 0 0-4-4"/><path d="m19 5-1.256 1.256"/><path d="M20 12h2"/></svg>

data/app/assets/icons/trek/theme-dark.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-moon-icon lucide-moon"><path d="M20.985 12.486a9 9 0 1 1-9.473-9.472c.405-.022.617.46.402.803a6 6 0 0 0 8.268 8.268c.344-.215.825-.004.803.401"/></svg>

data/app/assets/icons/trek/theme-light.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-sun-medium-icon lucide-sun-medium"><circle cx="12" cy="12" r="4"/><path d="M12 3v1"/><path d="M12 20v1"/><path d="M3 12h1"/><path d="M20 12h1"/><path d="m18.364 5.636-.707.707"/><path d="m6.343 17.657-.707.707"/><path d="m5.636 5.636.707.707"/><path d="m17.657 17.657.707.707"/></svg>

data/app/assets/stylesheets/trek/base.css

@@ -7,6 +7,19 @@ html {
   font-size: 62.5%; /* for easy rem sizing: 1rem = 10px */
 }
 
+/* let native UI (form controls, scrollbars) follow the theme */
+.light-theme {
+  color-scheme: light;
+}
+
+.dark-theme {
+  color-scheme: dark;
+}
+
+.auto-theme {
+  color-scheme: light dark;
+}
+
 /* allow modules to change the box-sizing */
 *,
 *::before,

data/app/components/trek/button_component/button_component.css

@@ -35,7 +35,16 @@
   border-color: var(--accent-7);
 }
 
+.root:disabled,
+.root[aria-disabled="true"] {
+  cursor: not-allowed;
+  opacity: 0.5;
+  pointer-events: none;
+}
+
+/* Keeps its size next to a long label, which would otherwise squeeze it. */
 .icon {
+  flex-shrink: 0;
   margin-right: 1.2rem;
 }
 

data/app/components/trek/button_component.rb

@@ -10,6 +10,7 @@ module Trek
     option :form_class, optional: true
     option :href, optional: true
     option :method, optional: true
+    option :name, optional: true
     option :params, optional: true
     option :position, type: proc(&:to_sym), optional: true
     option :rel, optional: true
@@ -50,7 +51,16 @@ module Trek
     end
 
     def call
-      if link?
+      if disabled && (link? || to?)
+        # <a> has no disabled attribute: render an inert anchor — no href, no
+        # turbo method — flagged for assistive technologies.
+        content_tag :a,
+          rendered_content,
+          class: classes,
+          data: data_attributes,
+          title: title,
+          "aria-disabled": true
+      elsif link?
         link_to rendered_content,
           href,
           class: classes,
@@ -72,7 +82,9 @@ module Trek
           rendered_content,
           class: classes,
           data: data_attributes,
+          disabled:,
           form:,
+          name:,
           type:,
           value:
       end

data/app/components/trek/dashboard/tile_component/tile_component.html.slim

@@ -1,5 +1,5 @@
 - if href.present?
-  = link_to href, class: classes, rel: rel, target: target
+  = link_to href, class: classes, data: link_data, rel: link_rel, target: target
     - if title
       span(class=class_for("title")) = title
     - if icon

data/app/components/trek/dashboard/tile_component.rb

@@ -3,8 +3,14 @@
 module Trek
   class Dashboard::TileComponent < Trek::Component
     option :color, default: proc { :slate }
+    # Extra data attributes for the link, e.g. `turbo_confirm:`.
+    option :data, default: proc { {} }
     option :href, optional: true
     option :icon, optional: true
+    # An HTTP method other than GET (`:post`, `:delete`…), issued through
+    # Turbo like Trek::ButtonComponent's `to:` links: a tile can create a
+    # record in one click rather than open a form.
+    option :method, optional: true
     option :rel, optional: true
     option :target, optional: true
     option :text
@@ -25,6 +31,14 @@ module Trek
       )
     end
 
+    def link_data
+      data.merge(turbo_method: method).compact
+    end
+
+    def link_rel
+      rel || ("noopener" if target == "_blank")
+    end
+
     def formatted_text
       # rubocop:disable Rails/OutputSafety
       text.gsub("\n", "#{tag.br} ")&.html_safe

data/app/components/trek/dialog_component/dialog_component.html.slim

@@ -1,5 +1,8 @@
 dialog(class=root_class data-controller=identifier)
-  h2(class=class_for("title")) = title || t(".title")
+  h2(
+    class=class_for("title")
+    data=stimulus_target_hash("title")
+  ) = title || t(".title")
   p(
     class=class_for("text")
     data=stimulus_target_hash("text")
@@ -22,5 +25,6 @@ dialog(class=root_class data-controller=identifier)
           text: t("admin.actions.delete"),
           color: :tomato,
           value: "confirm",
-          data: { action: stimulus_action("close") },
+          data: { action: stimulus_action("close") }
+            .merge(stimulus_target_hash("confirm_button")),
         )

data/app/components/trek/dialog_component/dialog_component.js

@@ -3,11 +3,26 @@ import "./dialog_component.css";
 import { Controller as BaseController } from "@hotwired/stimulus";
 
 export class Controller extends BaseController {
-  static targets = ["text"];
+  static targets = ["title", "text", "confirmButton"];
 
   connect() {
+    this.saveDefaults();
+
+    // For a link with data-turbo-method, Turbo submits an ephemeral form it
+    // only copies data-turbo-confirm onto, and calls confirm() without a
+    // submitter — remember the clicked element to read the other
+    // data-turbo-confirm-* attributes from.
+    this.rememberConfirmSource = (event) => {
+      this.confirmSource = event.target.closest?.("[data-turbo-confirm]");
+    };
+    document.addEventListener("click", this.rememberConfirmSource, {
+      capture: true,
+    });
+
     // eslint-disable-next-line no-undef
-    Turbo.config.forms.confirm = (message) => {
+    Turbo.config.forms.confirm = (message, _formElement, submitter) => {
+      this.customize({ ...this.confirmSource?.dataset, ...submitter?.dataset });
+      this.confirmSource = null;
       this.setText(message);
       this.open();
 
@@ -23,6 +38,51 @@ export class Controller extends BaseController {
     };
   }
 
+  disconnect() {
+    document.removeEventListener("click", this.rememberConfirmSource, {
+      capture: true,
+    });
+  }
+
+  saveDefaults() {
+    if (this.hasTitleTarget) {
+      this.defaultTitle = this.titleTarget.textContent;
+    }
+
+    if (this.hasConfirmButtonTarget) {
+      this.defaultConfirmLabel = this.confirmLabelElement.textContent;
+      this.defaultConfirmColor = this.confirmButtonTarget.dataset.accentColor;
+    }
+  }
+
+  customize({ turboConfirmTitle, turboConfirmButton, turboConfirmColor }) {
+    if (this.hasTitleTarget) {
+      this.titleTarget.textContent = turboConfirmTitle ?? this.defaultTitle;
+    }
+
+    if (this.hasConfirmButtonTarget) {
+      this.confirmLabelElement.textContent =
+        turboConfirmButton ?? this.defaultConfirmLabel;
+      this.setConfirmColor(turboConfirmColor ?? this.defaultConfirmColor);
+    }
+  }
+
+  setConfirmColor(color) {
+    const button = this.confirmButtonTarget;
+
+    // Swap the postcss-modules-scoped color-* class along with the accent
+    // variables (see generateScopedName in postcss.config.js).
+    button.classList.replace(
+      `c-trek--button-color-${button.dataset.accentColor}`,
+      `c-trek--button-color-${color}`
+    );
+    button.dataset.accentColor = color;
+  }
+
+  get confirmLabelElement() {
+    return this.confirmButtonTarget.querySelector("span");
+  }
+
   setText(text) {
     if (this.hasTextTarget) {
       this.textTarget.textContent = text;