gina 0.5.3 → 0.5.4

package/framework/{v0.5.3 → v0.5.4}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -4347,8 +4347,23 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet) {
             }
 
             // test if val is strictly a float
-            if ( Number(val) === val && val % 1 !== 0 ) {
-                this.value = local.data[this.name] = Number(val);
+            // #B46 (2026-06-15) — accept STRING floats, not only real JS numbers.
+            // The old gate `Number(val) === val` is true only for a real number,
+            // so a string "1.5" (browser .value and urlencoded bodies are ALWAYS
+            // strings) was rejected server-side. Coerce to Number first, then
+            // require a finite value with a fractional part. Whole numbers ("2", 2)
+            // still fail (no fractional part), preserving isFloat's contract that
+            // an integer is not a float.
+            // was:
+            // if ( Number(val) === val && val % 1 !== 0 ) {
+            //     this.value = local.data[this.name] = Number(val);
+            //     isValid = true
+            // } else {
+            //     isValid = false
+            // }
+            var floatVal = Number(val);
+            if ( Number.isFinite(floatVal) && floatVal % 1 !== 0 ) {
+                this.value = local.data[this.name] = floatVal;
                 isValid = true
             } else {
                 isValid = false
@@ -4529,7 +4544,7 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet) {
          *
          * @param {string|boolean} [mask] - by default "yyyy-mm-dd"
          *
-         * @returns {date} date - extended by gina::lib::helpers::dateFormat; an adaptation of Steven Levithan's code
+         * @returns {object} field object (chainable). The parsed Date is preserved on the field's `.value` and rendered via the field's own `.format()` method (DateFormatHelper — an adaptation of Steven Levithan's code).
          * */
         self[el]['isDate'] = function(mask) {
             var val         = this.value
@@ -4570,22 +4585,60 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet) {
                     throw new Error('[FormValidator::isDate] Provided mask not allowed: `'+ mask +'`');
                 }
 
+                // #B47 (2026-06-15) — build the Date from explicit numeric
+                // components identified by the mask tokens (y*/m*/d*), then
+                // range-check via a round-trip. The old path rebuilt the string
+                // FROM THE MASK (keeping its separators) and handed it to
+                // `new Date(str)`, which parses a slash mask (e.g. "15/06/2023")
+                // as US MM/DD -> month 15 -> Invalid Date, so any non-ISO mask
+                // with day>12 (or non-US field order) was wrongly rejected. A
+                // naive `new Date(y, m-1, d)` is not enough either: JS rolls
+                // invalid components over (new Date(2023,12,45) is a valid date),
+                // so the round-trip check (constructed components must equal the
+                // inputs) is what still rejects e.g. 2023-13-45 and 2023-02-30.
+                // was:
+                // try {
+                //     val = val.match(/[^\/\- ]+/g);
+                //     var dic = {}, d, len;
+                //     for (d=0, len=m.length; d<len; ++d) { dic[m[d]] = val[d] }
+                //     var formatedDate = mask;
+                //     for (var v in dic) { formatedDate = formatedDate.replace(new RegExp(v, "g"), dic[v]) }
+                // } catch (err) { throw new Error('...Provided value not allowed...'); }
+                // date = this.value = local.data[this.name] = new Date(formatedDate);
+                var dic = {}, d, len, parts = null,
+                    yNum = NaN, moNum = NaN, dNum = NaN;
                 try {
-                    val = val.match(/[^\/\- ]+/g);
-                    var dic = {}, d, len;
-                    for (d=0, len=m.length; d<len; ++d) {
-                        dic[m[d]] = val[d]
-                    }
-                    var formatedDate = mask;
-                    for (var v in dic) {
-                        formatedDate = formatedDate.replace(new RegExp(v, "g"), dic[v])
+                    parts = val.match(/[^\/\- ]+/g);
+                    for (d = 0, len = m.length; d < len; ++d) {
+                        dic[m[d]] = parts[d];
                     }
                 } catch (err) {
                     throw new Error('[FormValidator::isDate] Provided value not allowed: `'+ val +'`' + err);
                 }
 
+                for (var tok in dic) {
+                    if ( /y/i.test(tok) )      { yNum  = parseInt(dic[tok], 10); }
+                    else if ( /m/i.test(tok) ) { moNum = parseInt(dic[tok], 10); }
+                    else if ( /d/i.test(tok) ) { dNum  = parseInt(dic[tok], 10); }
+                }
 
-                date = this.value = local.data[this.name] = new Date(formatedDate);
+                if (
+                    !Number.isFinite(yNum) || !Number.isFinite(moNum) || !Number.isFinite(dNum)
+                    || moNum < 1 || moNum > 12 || dNum < 1 || dNum > 31
+                ) {
+                    date = this.value = local.data[this.name] = new Date(NaN);
+                } else {
+                    date = new Date(yNum, moNum - 1, dNum);
+                    // reject rolled-over components (e.g. Feb 30 -> Mar 2)
+                    if (
+                        date.getFullYear() !== yNum
+                        || date.getMonth() !== (moNum - 1)
+                        || date.getDate() !== dNum
+                    ) {
+                        date = new Date(NaN);
+                    }
+                    this.value = local.data[this.name] = date;
+                }
 
                 if ( /Invalid Date/i.test(date) || date instanceof Date === false ) {
                     if ( !errors['isRequired'] && this.value == '' ) {
@@ -4605,7 +4658,14 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet) {
 
             this.valid = isValid;
 
-            return date
+            // #B48 (2026-06-17) — return the field object (chainable), like
+            // every other rule, instead of the raw parsed Date. The Date is
+            // preserved on this.value (set above), so
+            // `field.isDate(mask).format('isoDateTime')` still renders it via
+            // the field's own `format` method; returning the Date here broke
+            // chaining into any validator rule (a Date has no .isX()).
+            // was: return date
+            return self[this.name]
         }
 
         /**
@@ -6482,7 +6542,13 @@ function Routing() {
                     namespace           : routing[name].namespace || undefined,
                     url                 : safeDecodeURI(pathname), /// avoid %20 — #B30 malformed-%-safe
                     rule                : routing[name].originalRule || name,
-                    param               : routing[name].param,
+                    // #B52-residual finding-2: clone so the matcher's in-place param substitution
+                    // (fitsWithRequirements / checkRouteParams rewrite param.{path,namespace,file,title})
+                    // does NOT mutate the shared config singleton — getRouteByUrl's `routing` is
+                    // config.getRouting() (server-side) / gina.config.routing (client), both by reference.
+                    // Mirrors server.js:4852 and the middleware clone on the next line.
+                    //param             : routing[name].param,
+                    param               : JSON.clone(routing[name].param),
                     //middleware: routing[name].middleware,
                     middleware          : JSON.clone(routing[name].middleware),
                     bundle              : routing[name].bundle,
@@ -6496,6 +6562,11 @@ function Routing() {
                     if (isRoute.past) {
                         route = JSON.clone(routing[name]);
                         route.name = name;
+                        // #B52-residual finding-2: getRouteByUrl returns `route` (a fresh clone of the
+                        // singleton), NOT the mutated `params`. Carry the per-request substituted param
+                        // (rewritten on the private clone above) onto the returned route so the result is
+                        // correct AND the singleton keeps its `:placeholder`(s) for the next request.
+                        route.param = params.param;
 
                         matched = true;
                         isRoute = {};
@@ -10513,7 +10584,12 @@ function ValidatorPlugin(rules, data, formId) {
 
                         $divs[d].parentElement.removeChild($divs[d]);
                         $err = document.createElement('div');
-                        $err.setAttribute('class', 'form-item-error-message');
+                        // #livecheck — a field being typed in (the active element) surfaces only the
+                        // soft form-item-warning border; its committed error message stays hidden until
+                        // blur. This "refresh" re-create runs AFTER refreshWarning in the live-check
+                        // global pass, so without this focus guard it re-shows the message mid-typing.
+                        // On blur (field no longer active) the message is created shown (focusout commits).
+                        $err.setAttribute('class', ( document.activeElement && document.activeElement.name == name ) ? 'form-item-error-message hidden' : 'form-item-error-message');
 
                         // #A11Y1 (slice 2) — preserve the aria-errormessage wire we own across refresh.
                         if ( _ginaOwnsErrMsg && _ariaErrId ) {