@barefootjs/erb 0.18.4 → 0.18.7

package/lib/barefoot_js.rb

@@ -25,6 +25,18 @@ require 'barefoot_js/search_params'
 # runtime carries -- a Ruby `true`/`false` IS a boolean, distinguishable
 # from `0`/`1` for free.
 module BarefootJS
+  # Marker wrapper for a string that is ALREADY finished HTML and must not
+  # be re-escaped by `Context#h` -- e.g. a named-slot / children capture
+  # (`renderComponent`'s output-buffer slice) forwarded from a parent
+  # template into a child's vars Hash. Stdlib ERB's `<%=` has no built-in
+  # "safe string" concept the way Twig's `Markup` or Kolon's `mark_raw`
+  # do, so the escape decision that elsewhere falls out of the template
+  # engine has to be carried on the VALUE itself here; see
+  # `Backend::Erb#mark_raw`, which is what actually wraps a string in this
+  # class.
+  class SafeString < String
+  end
+
   # Context is the `bf` object every compiled `.erb` template receives as a
   # local. One instance per render (root or child); `render_child` /
   # `register_components_from_manifest` construct a fresh child instance
@@ -391,8 +403,13 @@ module BarefootJS
     # HTML-escaping helper for text interpolation (`<%= bf.h(expr) %>` --
     # stdlib ERB does not auto-escape). JS-style stringification via
     # `string` (numbers per JS Number#toString, nil -> "", booleans ->
-    # "true"/"false"), then HTML-escaped.
+    # "true"/"false"), then HTML-escaped. A `SafeString` (already-finished
+    # HTML forwarded from a parent's capture -- see that class's docstring)
+    # passes through unescaped, matching Twig/Blade/Kolon's safe-string
+    # bypass on their own auto-escaping `{{ }}`/`<: :>` output tags.
     def h(value)
+      return value if value.is_a?(SafeString)
+
       html_escape(string(value))
     end
 
@@ -430,6 +447,34 @@ module BarefootJS
       finite_number?(n) ? (n + 0.5).floor : n
     end
 
+    # `Math.min(a, b)` / `Math.max(a, b)` -- two-arg forms only (#2168
+    # math-methods). JS returns NaN if either operand is NaN. `number()`
+    # may return a plain Integer (no `#nan?`), so guard like
+    # `finite_number?` above rather than calling `#nan?` unconditionally.
+    def min(a, b)
+      x = number(a)
+      y = number(b)
+      return x if nan_number?(x)
+      return y if nan_number?(y)
+
+      x < y ? x : y
+    end
+
+    def max(a, b)
+      x = number(a)
+      y = number(b)
+      return x if nan_number?(x)
+      return y if nan_number?(y)
+
+      x > y ? x : y
+    end
+
+    # `Math.abs()` (#2168 math-methods).
+    def abs(value)
+      n = number(value)
+      nan_number?(n) ? n : n.abs
+    end
+
     # -----------------------------------------------------------------
     # Array / String method helpers
     # -----------------------------------------------------------------
@@ -563,13 +608,22 @@ module BarefootJS
       out
     end
 
-    # `Array.prototype.slice(start, end?)`. Mirrors the Go/Perl `bf_slice` /
-    # `slice` arithmetic so adapter output stays symmetric.
+    # `Array.prototype.slice(start, end?)` AND `String.prototype.slice`
+    # (the `string-slice` divergence) -- the adapter emits the same
+    # `bf_slice` call for both receiver shapes (it can't disambiguate
+    # string vs. array at compile time), so this dispatches on Ruby
+    # class, mirroring `includes` above. Mirrors the Go/Perl `bf_slice`
+    # / `slice` arithmetic so adapter output stays symmetric.
+    # `String#length` / `#[]` already index by character (not byte) for
+    # a UTF-8-encoded string, matching JS except for astral-plane input
+    # (the same divergence boundary every other adapter's pad/trim
+    # helpers already accept).
     def slice(recv, start, end_ = nil)
-      return [] unless recv.is_a?(Array)
+      return [] unless recv.is_a?(Array) || recv.is_a?(String)
 
+      empty = recv.is_a?(String) ? '' : []
       len = recv.length
-      return [] if len.zero?
+      return empty if len.zero?
 
       s = start.nil? ? 0 : start.to_i
       s = len + s if s.negative?
@@ -581,7 +635,7 @@ module BarefootJS
       e = 0 if e.negative?
       e = len if e > len
 
-      return [] if s >= e
+      return empty if s >= e
 
       recv[s...e]
     end
@@ -663,6 +717,21 @@ module BarefootJS
       string(recv).gsub(/\A\p{Space}+|\p{Space}+\z/, '')
     end
 
+    # `String.prototype.trimStart()` / `.trimEnd()` -- the one-sided
+    # siblings of `trim` above (#2183 follow-up), same `\p{Space}` regex
+    # restricted to one side.
+    def trim_start(recv)
+      return '' if recv.nil? || recv.is_a?(Array) || recv.is_a?(Hash)
+
+      string(recv).sub(/\A\p{Space}+/, '')
+    end
+
+    def trim_end(recv)
+      return '' if recv.nil? || recv.is_a?(Array) || recv.is_a?(Hash)
+
+      string(recv).sub(/\p{Space}+\z/, '')
+    end
+
     # `Number.prototype.toFixed(digits)` -- fixed-decimal string with
     # zero-padding, rounding half toward +Infinity (matching `round`).
     def to_fixed(value, digits = 0)
@@ -741,6 +810,38 @@ module BarefootJS
       s[0...idx] + n + s[(idx + o.length)..]
     end
 
+    # `String.prototype.replaceAll(pattern, replacement)` -- string-pattern
+    # form only (#2182), replacing EVERY occurrence (the all-occurrences
+    # sibling of `replace` above). Deliberately NOT `String#gsub`: Ruby's
+    # `gsub` interprets `\1` / `\&` backreference syntax in the replacement
+    # even for a literal string pattern (`"abc".gsub("b", "\\1")` -> "ac",
+    # not the literal "\1"), which would diverge from `.replace`'s literal
+    # splice above and from the other backends' literal treatment. The
+    # index/splice loop keeps the replacement literal, matching `replace`.
+    # An empty pattern inserts at every boundary, including before the
+    # first and after the last character (`"abc".replaceAll("", "X")` ->
+    # "XaXbXcX"), matching JS.
+    def replace_all(recv, pattern, replacement)
+      s = recv.nil? ? '' : string(recv)
+      o = pattern.nil? ? '' : string(pattern)
+      n = replacement.nil? ? '' : string(replacement)
+      return ([''] + s.chars + ['']).join(n) if o.empty?
+
+      # `+''` (not the frozen `''` literal under frozen_string_literal)
+      # so `<<` can append in place instead of `+=` reallocating a new
+      # string each iteration (quadratic for long inputs / many matches).
+      out = +''
+      pos = 0
+      loop do
+        idx = s.index(o, pos)
+        break if idx.nil?
+
+        out << s[pos...idx] << n
+        pos = idx + o.length
+      end
+      out << s[pos..]
+    end
+
     # `queryHref(base, { ... })` (#2042) -- build "base?k=v&..." from a flat
     # list of (guard, key, value) triples. A pair is included iff its guard
     # is truthy AND its value is a non-empty string. A value may instead be
@@ -978,6 +1079,10 @@ module BarefootJS
       !(n.respond_to?(:nan?) && n.nan?) && !(n.respond_to?(:infinite?) && n.infinite?)
     end
 
+    def nan_number?(n)
+      n.respond_to?(:nan?) && n.nan?
+    end
+
     def html_escape(s)
       s.gsub('&', '&amp;').gsub('<', '&lt;').gsub('>', '&gt;').gsub('"', '&#34;').gsub("'", '&#39;')
     end

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@barefootjs/erb",
-  "version": "0.18.4",
+  "version": "0.18.7",
   "description": "ERB (Embedded Ruby) adapter for BarefootJS — compiles IR to .erb templates and ships the Ruby rendering backend; runs under any Rack app (Sinatra, Rails)",
   "type": "module",
   "main": "./dist/index.js",
@@ -54,14 +54,14 @@
     "directory": "packages/adapter-erb"
   },
   "dependencies": {
-    "@barefootjs/shared": "0.18.4"
+    "@barefootjs/shared": "0.18.7"
   },
   "peerDependencies": {
     "@barefootjs/jsx": ">=0.2.0"
   },
   "devDependencies": {
     "@barefootjs/adapter-tests": "0.1.0",
-    "@barefootjs/jsx": "0.18.4",
+    "@barefootjs/jsx": "0.18.7",
     "typescript": "^5.0.0"
   }
 }

package/src/__tests__/erb-adapter.test.ts

@@ -304,3 +304,145 @@ export { Slot }
     expect(template).toMatch(/\*\*v\[:rest\]/)
   })
 })
+
+describe('ErbAdapter - filter().map() predicate matches the FILTER param, not the loop param (#2245)', () => {
+  // `todos.filter(t => t.done).map(todo => ...)`: the predicate's own `t`
+  // used to be matched against the LOOP's (map's) param `todo` inside
+  // `ErbFilterEmitter.identifier()`, so every reference to `t` inside the
+  // predicate fell to the `v[:t]` vars-Hash fallback instead of resolving
+  // to the loop-bound `todo` local — `v[:t]` is never seeded, and real
+  // Ruby raises `NoMethodError: undefined method '[]' for nil` on
+  // `v[:t][:done]` at render time (masked in the shipped `todo-app-ssr`
+  // corpus by its `'all'`-default filter short-circuiting the buggy
+  // branch away — see `filter-wrapper-props-reachable`'s docstring).
+  const DIFFERENTLY_NAMED_SOURCE = `
+'use client'
+import { createSignal } from '@barefootjs/client'
+
+type Todo = { id: number; text: string; done: boolean }
+
+export function TodoList(props: { initialTodos?: Todo[] }) {
+  const [todos] = createSignal<Todo[]>(props.initialTodos ?? [])
+  return (
+    <ul>
+      {todos().filter(t => !t.done).map(todo => (
+        <li key={todo.id}>{todo.text}</li>
+      ))}
+    </ul>
+  )
+}
+`
+
+  function compileToIR(source: string): ComponentIR {
+    const result = compileJSX(source.trimStart(), 'test.tsx', {
+      adapter: new ErbAdapter(),
+      outputIR: true,
+    })
+    const irFile = result.files.find(f => f.type === 'ir')
+    if (!irFile) throw new Error('No IR output')
+    return JSON.parse(irFile.content) as ComponentIR
+  }
+
+  test('predicate reference lowers through the loop-bound local, never the filter-param vars-Hash fallback', () => {
+    const ir = compileToIR(DIFFERENTLY_NAMED_SOURCE)
+    const { template } = new ErbAdapter().generate(ir)
+    // The loop-gating `<if>` must reference the loop's actual bound Ruby
+    // local (`todo[:done]`, from the MAP callback's param)...
+    expect(template).toContain('todo[:done]')
+    // ...never the filter callback's own param name resolved as an
+    // (unseeded) vars-Hash key — the literal pre-fix bug.
+    expect(template).not.toContain('v[:t]')
+  })
+
+  test('same-named filter/map params render byte-identically to the pre-#2245 form (regression pin)', () => {
+    const sameNamedSource = DIFFERENTLY_NAMED_SOURCE.replace(
+      'filter(t => !t.done)',
+      'filter(todo => !todo.done)',
+    )
+    const ir = compileToIR(sameNamedSource)
+    const { template } = new ErbAdapter().generate(ir)
+    expect(template).toContain('<%- if bf.truthy?(!bf.truthy?(todo[:done])) -%>')
+  })
+
+  test('real Ruby render: reachable predicate on differently-named params renders correctly (pre-fix NoMethodError pin)', async () => {
+    // `filter` defaults to `'active'` (never `'all'`) so the predicate
+    // branch referencing `t.done` is actually REACHABLE at render time —
+    // an `'all'`-style short-circuiting default is exactly what hid this
+    // bug in the shipped `todo-app-ssr` fixture. Block-body predicate
+    // (folded to one expression by #2040's `foldBlockToExpr` +
+    // `predicateTernaryToLogical`) matches the real `TodoAppSSR.tsx` shape.
+    const source = `
+'use client'
+import { createSignal } from '@barefootjs/client'
+
+type Todo = { id: number; text: string; done: boolean }
+type Filter = 'all' | 'active'
+
+export function TodoList(props: { initialTodos?: Todo[] }) {
+  const [todos] = createSignal<Todo[]>(props.initialTodos ?? [])
+  const [filter] = createSignal<Filter>('active')
+  return (
+    <ul>
+      {todos().filter(t => {
+        const f = filter()
+        if (f === 'active') return !t.done
+        return true
+      }).map(todo => (
+        <li key={todo.id}>{todo.text}</li>
+      ))}
+    </ul>
+  )
+}
+`
+    let html: string
+    try {
+      html = await renderErbComponent({
+        source: source.trimStart(),
+        adapter: new ErbAdapter(),
+        props: {
+          initialTodos: [
+            { id: 1, text: 'Eat breakfast', done: true },
+            { id: 2, text: 'Write tests', done: false },
+          ],
+        },
+      })
+    } catch (err) {
+      if (err instanceof ErbNotAvailableError) {
+        console.log('Skipping #2245 filter-param e2e: ruby/erb not available')
+        return
+      }
+      throw err
+    }
+    // Pre-fix: real Ruby raises `NoMethodError: undefined method '[]' for
+    // nil` evaluating `v[:t][:done]` — `renderErbComponent` surfaces that
+    // as a thrown "ruby render failed" error, so a `NoMethodError` string
+    // anywhere in a caught error would fail this test outright rather than
+    // reaching these assertions. Post-fix: only the not-done todo (id 2)
+    // survives the 'active' filter.
+    expect(html).not.toContain('Eat breakfast')
+    expect(html).toContain('Write tests')
+    expect(html).toContain('data-key="2"')
+    expect(html).not.toContain('data-key="1"')
+  })
+})
+
+describe('ErbAdapter - named-slot capture identifier safety (#2168 jsx-element-prop)', () => {
+  // A JSX-valued prop under a hyphenated name (`data-slot`, a valid JSX
+  // attribute name) must not leak into the buffer-slice capture's local
+  // variables — Ruby local variable names can't contain `-`. The capture
+  // suffix is purely counter-based (never derived from the prop name); the
+  // hash KEY passed to `render_child` still carries the real name, quoted
+  // via `rubySymbolKey`.
+  test('a hyphenated prop name does not appear in the capture variables', () => {
+    const { template } = compileAndGenerate(`
+function Card(props) { return null }
+export function Parent() {
+  return <Card data-slot={<strong>Title</strong>}>text</Card>
+}
+`)
+    expect(template).toContain('__bf_len_0 = _erbout.length')
+    expect(template).toContain('__bf_prop_0 = bf.backend.mark_raw(__bf_praw_0)')
+    expect(template).toContain('"data-slot": __bf_prop_0')
+    expect(template).not.toContain('bf_prop_data')
+  })
+})