turbo_form 0.6.0 → 0.7.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1ea880fbc0453b32344bf09706c5bc68c095de36fdbea018f00fdf4adc7acc03
-  data.tar.gz: 49bf3d131c1a1179d8ce8b64772e23681f1c54332797bca9cd46589c4d0c90d3
+  metadata.gz: 4cb1af8f341d1112a85f86bc4fe28470e83f867994be6029a32fbd996da03677
+  data.tar.gz: 97afa78d913454ea096c0f988ecb85d99f7ebe7027f02f2e19cc40af534b624e
 SHA512:
-  metadata.gz: 300aabd3ad77727c57ddf99980ce56036e4f5fdbf6c001a31908dcef1f0f53408b4100cf21fa1b88abfd663f2adab10dd14003d90e1915136231e62576b1e2d6
-  data.tar.gz: 24ec9eabed896e9de6f14c71b70e3f6aa8bc299244fcf3858146b55bf5d78c76549e4e08acdaaa6c0f77b13b6713183fabc2c469347c3a59df7e7dd477ed6ff9
+  metadata.gz: 221fbbcd5e31c6191a208cefb92089f70094ef5709547cdb63984a4bb419342d7109dfe4001135853ee7380537b63d82a8cb2fef64af550d40a1a713dfa93f20
+  data.tar.gz: 2e7cd4ecec1194cc7605035e9a51c9dcd1542f3c45410c6497a74221e8ae6a037991650a6d928bdf230097af4cfbc0e7aaf73751326a912f291649b9e22221b4

data/README.md

@@ -133,9 +133,9 @@ For a `WidgetsController`:
 - `new` and `edit` set `@widget`,
 - `widget_params` permits the form's fields — the same method `create` and
   `update` already use, so a trigger assigns nothing a save wouldn't,
-- `new` and `edit` leave rendering to Rails. The values are assigned just before
-  Rails' implicit render, so an action that calls `render` itself renders its
-  object as it built it, and one that redirects still redirects.
+- `new` and `edit` render their own template, implicitly or with `render`
+  themselves — `render layout: 'panel'` is fine. The values are assigned just
+  before it renders; an action that redirects still redirects.
 
 ### Switching an STI subclass
 

data/app/assets/javascripts/turbo_form.js

@@ -26,7 +26,7 @@ class FormRefresh {
   async start() {
     this.requestStarted()
     try {
-      const response = await Turbo.fetch(this.location, { method: "PATCH", body: new FormData(this.formElement), headers: this.target.headers })
+      const response = await Turbo.fetch(this.location, { method: "PATCH", body: new FormData(this.formElement), headers: { ...this.target.headers, "X-CSRF-Token": csrfToken() } })
 
       this.target.render(response.status, await response.text())
     } finally {
@@ -88,6 +88,13 @@ function targetFor(form) {
   return frame ? new FrameTarget(frame) : new PageTarget()
 }
 
+// The form's own authenticity token is scoped to its action and method when
+// per-form tokens are on, as they are by default, so it can't vouch for this
+// PATCH. The page's token can, as it does for Turbo's own submissions.
+function csrfToken() {
+  return document.querySelector('meta[name="csrf-token"]')?.content
+}
+
 const triggerSelector = "[data-turbo-form-trigger]"
 
 // Shaped like Turbo's observers. One listener per event the page's triggers

data/lib/turbo_form/controller.rb

@@ -1,22 +1,24 @@
 module TurboForm
   # Included into the host's ApplicationController. A request that
   # TurboForm::Routes marks runs `new` or `edit` as usual, callbacks and all,
-  # then assigns the form to what the action built just before the implicit
-  # render.
+  # then assigns the form to what the action built just before it renders --
+  # implicitly, or with its own `render layout: 'panel'`.
   #
-  # Leans on the scaffold's conventions: the action builds `@<resource>`,
-  # `<resource>_params` permits the form, and the action leaves rendering to Rails.
+  # Leans on the scaffold's conventions: the action builds `@<resource>` and
+  # `<resource>_params` permits the form.
   module Controller
+    # Public, as Rails' own is. ActionController::Base's public methods are never
+    # actions, so this one isn't either.
+    def render(...)
+      dynamic_form_assignment if dynamic_form?
+      super
+    end
+
     private
     def process_action(...)
       dynamic_form? ? discarding_writes { super } : super
     end
 
-    def default_render
-      dynamic_form_assignment if dynamic_form?
-      super
-    end
-
     def dynamic_form_assignment
       resource = turbo_form_resource.extend(TurboForm::Resource).dynamic_assign(turbo_form_resource_params)
       instance_variable_set(:"@#{turbo_form_resource_name}", resource)

data/lib/turbo_form/version.rb

@@ -1,3 +1,3 @@
 module TurboForm
-  VERSION = '0.6.0'
+  VERSION = '0.7.1'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: turbo_form
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.7.1
 platform: ruby
 authors:
 - Andy Cohen