Set field on readonly based on a block - Unable to save due to unpermitted_params

[lpe]

This is my code in the resource :
field :accountnr, as: :text, name: "Code comptable", readonly: -> { !current_user.compta? }

This is the error when I try to edit / save :
method=PUT path=/resources/accounts/22772 format=turbo_stream controller=Avo::AccountsController action=update status=302 duration=27.26 view=0.00 db=4.79 location=http://localhost:3000/resources/accounts/22772 unpermitted_params=["_method", "authenticity_token", "account", "resellers-dummy", "categories-dummy", "fake_lastcontact", "button", "accountnr"] ...

It seems this is due to the block as this is working :
field :accountnr, as: :text, name: "Code comptable", readonly: false

This is working on another field :
field :actif, as: :boolean, index_text_align: :center, hide_on: [:show], readonly: -> { !current_user.compta? }

I don't understand why ...

Updated to 2.19, same issue.

Any idea ? Thx by advance.

[adrianthedev]

So what is the error you are getting @lpe? Is the validation failing because the field is not being sent in?

[adrianthedev]

The read-only field works like this:

• the field is shown as disabled on the page
• this is because a bad actor might go into the inspect element panel and re-enable the disabled field and send in bad data
• when the form is submitted, the value sent by the form is not assigned to the model

Do you think this is why the form submission is failing?

[lpe]

Not really a validation error. The field value is not transmitted in the params :
Account Update (0.5ms) UPDATE "accounts" SET "updated_at" = $1, "pays" = $2 WHERE "accounts"."id" = $3 [["updated_at", "2022-11-28 14:47:43.330276"], ["pays", "BELGIUMX"], ["id", 22772]]
Seems it's due to the block readonly: -> { !current_user.compta? } as readonly: false is working
Strange that it works on another field : field :actif, as: :boolean, index_text_align: :center, hide_on: [:show], readonly: -> { !current_user.compta? } The only difference is hide_on: [:show]
Perhaps is therre a better approach ?
Thx by advance for your help.

[adrianthedev]

So you're saying that if !current_user.compta? evaluates to false, Avo does something different than when you set it manually to false?

Ex: readonly: -> { !current_user.compta? # false } , is different than readonly: false.

[lpe]

Something else weird : visible: -> (resource:) {resource.current_user.compta? } is working, not readonly: -> (resource:) {resource.current_user.compta? } Error : missing keyword: :resource

[lpe]

Yes. Please note that I dit not set a context in the avo.rb intializer as config.current_user_method = :current_user is already set.

[adrianthedev]

I'm off the call link, but try to use this version 2.21.pre.1.issue1458 (gem "avo", "2.21.pre.1.issue1458") and instead of readonly: -> { !current_user.compta? }usedisabled: -> { !current_user.compta? }`.

[lpe]

Sorry, I was not in dev at this time. But good news : this is working, event without the hidden property.

[lpe]

Unfortunately I am not able anymore to edit the related contracts (account has_many contracts /contract belongs_to contract

undefined method 'disabled?' for #<Avo::Fields::BelongsToField

[lpe]

It's really buggy. I removed the readonly and disabled attributes because I can't modify the linked resources anymore. This is not fatal at this stage of the project. I will follow the updates and come back to the stable version.

[adrianthedev]

yeah. that's not polished yet. I just wanted to see if that fixes your exact issue.

the disavbled option will be better in the next release (next Tuesday)