Merge upstream/final-form into master

Incorporates WIP alternative measurement form (single select form with multiple select actions) and readouts controller. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Merge upstream/css-cleanup into master
2026-03-13 02:38:09 +00:00 · 2026-03-12 18:07:54 +00:00 · 2026-03-10 18:40:54 +00:00 · 2026-03-10 18:34:27 +00:00 · 2026-03-10 18:24:58 +00:00 · 2026-03-10 18:16:01 +00:00
47 changed files with 710 additions and 401 deletions
--- a/.gitea/workflows/test.yml
+++ b/.gitea/workflows/test.yml
@@ -0,0 +1,74 @@
+name: Tests
+
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+    branches: [ master ]
+
+jobs:
+  test-sqlite:
+    name: Tests (SQLite)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.3'
+          bundler-cache: true
+        env:
+          BUNDLE_WITH: "sqlite:development:test"
+
+      - name: Set up test database
+        run: bin/rails db:create db:schema:load
+        env:
+          RAILS_ENV: test
+
+      - name: Run tests
+        run: bin/rails test
+        env:
+          RAILS_ENV: test
+          CI: "true"
+
+  test-mysql:
+    name: Tests (MySQL)
+    runs-on: ubuntu-latest
+
+    services:
+      mysql:
+        image: mysql:8.0
+        env:
+          MYSQL_ROOT_PASSWORD: ""
+          MYSQL_ALLOW_EMPTY_PASSWORD: "yes"
+          MYSQL_DATABASE: fixin_test
+        ports:
+          - 3306:3306
+        options: >-
+          --health-cmd="mysqladmin ping"
+          --health-interval=10s
+          --health-timeout=5s
+          --health-retries=3
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.3'
+          bundler-cache: true
+        env:
+          BUNDLE_WITH: "mysql:development:test"
+
+      - name: Set up test database
+        run: bin/rails db:schema:load
+        env:
+          RAILS_ENV: test
+          DB_ADAPTER: mysql
+
+      - name: Run tests
+        run: bin/rails test
+        env:
+          RAILS_ENV: test
+          CI: "true"
+          DB_ADAPTER: mysql
--- a/app/assets/images/pictograms/alert-outline.svg
+++ b/app/assets/images/pictograms/alert-outline.svg
@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" id="icon" viewBox="0 0 24 24"><path fill="#ffffff" d="M12,2L1,21H23M12,6L19.53,19H4.47M11,10V14H13V10M11,16V18H13V16" /></svg>
+<svg xmlns="http://www.w3.org/2000/svg" id="icon" viewBox="0 0 24 24"><path d="M12,2L1,21H23M12,6L19.53,19H4.47M11,10V14H13V10M11,16V18H13V16" /></svg>
--- a/app/assets/images/pictograms/check-circle-outline.svg
+++ b/app/assets/images/pictograms/check-circle-outline.svg
@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" id="icon" viewBox="0 0 24 24"><path fill="#ffffff" d="M12 2C6.5 2 2 6.5 2 12S6.5 22 12 22 22 17.5 22 12 17.5 2 12 2M12 20C7.59 20 4 16.41 4 12S7.59 4 12 4 20 7.59 20 12 16.41 20 12 20M16.59 7.58L10 14.17L7.41 11.59L6 13L10 17L18 9L16.59 7.58Z" /></svg>
+<svg xmlns="http://www.w3.org/2000/svg" id="icon" viewBox="0 0 24 24"><path d="M12 2C6.5 2 2 6.5 2 12S6.5 22 12 22 22 17.5 22 12 17.5 2 12 2M12 20C7.59 20 4 16.41 4 12S7.59 4 12 4 20 7.59 20 12 16.41 20 12 20M16.59 7.58L10 14.17L7.41 11.59L6 13L10 17L18 9L16.59 7.58Z" /></svg>
--- a/app/assets/stylesheets/application.css
+++ b/app/assets/stylesheets/application.css
@@ -18,10 +18,14 @@
 /* Strive for simplicity:
 * * style elements/tags only - if possible,
 * * replace element/tag name with class name - if element has to be styled
- * differently depending on context (e.g. form)
+ * differently depending on context (e.g. <form>; <a> as link/button),
+ * * styles with multiple selectors should have all selectors with same
+ * specificity, to allow proper rule specificity vs order management.
 *
- * NOTE: Style in a modular way, similar to how CSS @scope would be used,
- * to make transition easier once @scope is widely available */
+ * NOTE: style in a modular way, similar to how CSS @scope would be used,
+ * to make transition easier once @scope is widely available. */
+/* TODO: review styles with multiple selectors and try to convert them to the same
+ * specificity. */
 :root {
  --color-focus-gray: #f3f3f3;
  --color-border-gray: #dddddd;
@@ -54,11 +58,16 @@
  outline: none;
 }

+/* [hidden] submit elements cannot have `display` set as it makes them visible. */
+[hidden] {
+  display: none !important;
+}
+

 /* Color coding of input controls' background:
- *  blue - target for interaction with pointer
- *  gray - target for interaction with keyboard
- *  red - destructive, non-undoable action
+ *  blue - target for interaction with pointer,
+ *  gray - target for interaction with keyboard,
+ *  red - destructive, non-undoable action.
 */
 button,
 details,
@@ -73,50 +82,24 @@ input,
 select {
  text-align: inherit;
 }
-a,
-button,
-input[type=submit] {
-  cursor: pointer;
-  text-decoration: none;
-  white-space: nowrap;
-}
-/* [hidden] submit controls cannot have `display` set as it makes them visible */
-.button,
-button:not([hidden]),
-input[type=submit]:not([hidden]),
-.tab {
-  align-items: center;
-  color: var(--color-gray);
-  display: flex;
-  fill: var(--color-gray);
-  font-weight: bold;
-}
-.button,
-button,
-input[type=submit] {
-  font-size: 0.8rem;
-  padding: 0.6em 0.5em;
-  width: fit-content;
-}
-input:not([type=submit]):not([type=checkbox]),
-select,
-summary,
-textarea {
-  padding: 0.2em 0.4em;
-}
-.button,
-button,
 input,
 select,
 summary,
 textarea {
-  border: solid 1px var(--color-gray);
+  border: 1px solid var(--color-gray);
  border-radius: 0.25em;
+  padding: 0.2em 0.4em;
+}
+[name=cancel],
+.auxiliary {
+  border-color: var(--color-border-gray);
+  color: var(--color-nav-gray);
+  fill: var(--color-nav-gray);
 }
 input[type=checkbox],
 svg,
 textarea {
-  margin: 0
+  margin: 0;
 }
 input[type=checkbox] {
  accent-color: var(--color-blue);
@@ -124,6 +107,8 @@ input[type=checkbox] {
  -webkit-appearance: none;
  display: flex;
  height: 1.1em;
+  margin: 0;
+  padding: 0;
  width: 1.1em;
 }
 input[type=checkbox]:checked {
@@ -131,6 +116,7 @@ input[type=checkbox]:checked {
  -webkit-appearance: checkbox;
 }
 /* Hide spin buttons in input number fields */
+/* TODO: add spin buttons inside input[number]: before (-) and after (+) input */
 input[type=number] {
  appearance: textfield;
  -moz-appearance: textfield;
@@ -142,52 +128,21 @@ input::-webkit-outer-spin-button {
  -webkit-appearance: none;
  margin: 0;
 }
-.button > svg,
-.tab > svg,
-button > svg {
-  height: 1.4em;
-  width: 1.4em;
-}
-.button > svg:not(:last-child),
-.tab > svg:not(:last-child),
-button > svg:not(:last-child) {
-  margin-right: 0.2em;
-}
-/* TODO: move normal non-button links (<a>:hover/:focus) styling here (i.e.
- * page-wide, top-level) and remove from table.items - as the style should be
- * same everywhere */
-.button:focus-visible,
-button:focus-visible,
-input[type=submit]:focus-visible {
-  background-color: var(--color-focus-gray);
-}
 input:focus-visible,
 select:focus-visible,
 select:focus-within,
-/* TODO: how to achieve summary:focus-within for ::details-content? */
+/* TODO: how to achieve `summary:focus-within` for `::details-content`? */
 summary:focus-visible,
 textarea:focus-visible {
  accent-color: var(--color-dark-blue);
  background-color: var(--color-focus-gray);
 }
-.button:hover,
-button:hover,
-input[type=submit]:hover {
-  background-color: var(--color-blue);
-  border-color: var(--color-blue);
-  color: white;
-  fill: white;
-}
-.dangerous:hover {
-  background-color: var(--color-red);
-  border-color: var(--color-red);
-}
 input:hover,
 select:hover,
 summary:hover,
 textarea:hover {
  border-color: var(--color-blue);
-  outline: solid 1px var(--color-blue);
+  outline: 1px solid var(--color-blue);
 }
 select:hover,
 summary:hover {
@@ -197,8 +152,68 @@ input:invalid,
 select:invalid,
 textarea:invalid {
  border-color: var(--color-red);
-  outline: solid 1px var(--color-red);
+  outline-color: var(--color-red);
 }
+
+/* `.button`: button-styled <a>, <button>, <input type=submit>.
+ * `.link`: any other <a>.
+ * `.tab`: tab-styled <a>.
+ */
+.button,
+.link,
+.tab {
+  cursor: pointer;
+  text-decoration: none;
+  white-space: nowrap;
+}
+.button,
+.tab {
+  align-items: center;
+  color: var(--color-gray);
+  display: flex;
+  fill: var(--color-gray);
+  font-weight: bold;
+}
+.button {
+  border: 1px solid var(--color-gray);
+  border-radius: 0.25em;
+  font-size: 0.8rem;
+  padding: 0.6em 0.5em;
+  width: fit-content;
+}
+[name=cancel],
+.auxiliary {
+  border-color: var(--color-border-gray);
+  color: var(--color-nav-gray);
+  fill: var(--color-nav-gray);
+}
+.button > svg,
+.tab > svg {
+  height: 1.4em;
+  width: 1.4em;
+}
+.button > svg:not(:last-child),
+.tab > svg:not(:last-child) {
+  margin-right: 0.2em;
+}
+.button:focus-visible,
+.tab:focus-visible,
+.tab:hover {
+  background-color: var(--color-focus-gray);
+}
+.button:hover {
+  background-color: var(--color-blue);
+  border-color: var(--color-blue);
+  color: white;
+  fill: white;
+}
+.dangerous:hover {
+  background-color: var(--color-red);
+  border-color: var(--color-red);
+}
+/* TODO: move normal, non-button links (<a>:hover/:focus) styling here (i.e.
+ * page-wide, top-level) and remove from `table.items` - as the style should be
+ * same everywhere. */
 input[type=text]:read-only,
 textarea:read-only {
  border: none;
@@ -206,8 +221,8 @@ textarea:read-only {
 }


-/* NOTE: collapse gaps around empty rows (`topside`) once possible
- * with grid-collapse property and remove alternative grid-template
+/* NOTE: collapse gaps around empty rows (`topside`) once possible with
+ * `grid-collapse` property and remove alternative `grid-template-areas`.
 * https://github.com/w3c/csswg-drafts/issues/5813 */
 body {
  display: grid;
@@ -240,18 +255,14 @@ header {
  margin-inline-start: 4%;
 }
 .navigation > .tab {
-  border-bottom: solid 2px var(--color-nav-gray);
+  border-bottom: 2px solid var(--color-nav-gray);
  flex: 1;
  font-size: 1rem;
  justify-content: center;
  padding-block: 0.4em;
 }
-.navigation > .tab:hover,
-.navigation > .tab:focus-visible {
-  background-color: var(--color-focus-gray);
-}
 .navigation > .tab.active {
-  border-bottom: solid 4px var(--color-blue);
+  border-bottom: 4px solid var(--color-blue);
  color: var(--color-blue);
  fill: var(--color-blue);
 }
@@ -283,7 +294,7 @@ header {

 #flashes {
  display: grid;
-  gap: 0.2em;
+  row-gap: 0.4em;
  grid-template-columns: 1fr auto auto auto 1fr;
  left: 0;
  pointer-events: none;
@@ -299,47 +310,42 @@ header {
  display: grid;
  grid-column: 2/5;
  grid-template-columns: subgrid;
+  line-height: 2.2em;
  pointer-events: auto;
 }
-.flash.alert:before {
-  content: url('pictograms/alert-outline.svg');
+.flash:before {
+  filter: invert();
  height: 1.4em;
  margin: 0 0.5em;
  width: 1.4em;
 }
+.flash.alert:before {
+  content: url('pictograms/alert-outline.svg');
+}
 .flash.alert {
  border-color: var(--color-red);
  background-color: var(--color-red);
 }
 .flash.notice:before {
  content: url('pictograms/check-circle-outline.svg');
-  height: 1.4em;
-  margin: 0 0.5em;
-  width: 1.4em;
 }
 .flash.notice {
  border-color: var(--color-blue);
  background-color: var(--color-blue);
 }
-.flash > div {
-  grid-column: 2;
-}
-/* NOTE: currently flash button inherits some unnecessary styles from generic
- * button. */
-.flash > button {
-  border: none;
-  color: inherit;
+.flash svg {
  cursor: pointer;
-  font-size: 1.4em;
-  font-weight: bold;
-  grid-column: 3;
+  fill: white;
+  height: 2.2em;
  opacity: 0.6;
-  padding: 0.2em 0.4em;
+  padding: 0.4em 0.5em;
+  width: 2.4em;
 }
-.flash > button:hover {
+.flash svg:hover {
  opacity: 1;
 }

+
 /* TODO: Hover over invalid should work like in measurements (thin vs thick border) */
 .labeled-form {
  align-items: center;
@@ -357,7 +363,7 @@ header {
 .labeled-form label.required {
  font-weight: bold;
 }
-/* Don't style `label.error + input` if case already covered by input:invalid */
+/* Don't style `label.error + input` if case already covered by `input:invalid`. */
 .labeled-form label.error {
  color: var(--color-red);
 }
@@ -371,15 +377,23 @@ header {
 }
 .labeled-form input[type=submit] {
  font-size: 1rem;
-  margin: 1.5em auto 0 auto;
+  margin: 1em auto 0 auto;
  padding: 0.75em;
 }
+.labeled-form .auxiliary {
+  grid-column: 3;
+  /* If more buttons are needed, `grid-row` can be replaced with
+   * `reading-flow: grid-columns` to ensure proper tabindex order */
+  grid-row: 1;
+  height: 100%;
+  padding-block: 0;
+}


-/* TODO: remove .items class (?) and make 'form table' work properly */
+/* TODO: remove `.items` class (?) and make `form table` work properly. */
 table.items {
  border-spacing: 0;
-  border: solid 1px var(--color-border-gray);
+  border: 1px solid var(--color-border-gray);
  border-radius: 0.25em;
  font-size: 0.85rem;
  text-align: left;
@@ -402,7 +416,7 @@ table.items th,
 table.items td {
  padding-inline: 1em 0;
 }
-/* For <a> to fill <td> completely, we use an ::after pseudoelement. */
+/* For <a> to fill <td> completely, we use an `::after` pseudoelement. */
 table.items td.link {
  padding: 0;
  position: relative;
@@ -432,7 +446,7 @@ table.items td:last-child {
  padding-inline-end: 0.1em;
 }
 table.items td {
-  border-top: solid 1px var(--color-border-gray);
+  border-top: 1px solid var(--color-border-gray);
  height: 2.4em;
  padding-block: 0.1em;
 }
@@ -451,7 +465,7 @@ table.items tr.dropzone::after {
  content: '';
  inset: 1px 0 0 0;
  position: absolute;
-  outline: dashed 2px var(--color-blue);
+  outline: 2px dashed var(--color-blue);
  outline-offset: -1px;
  z-index: var(--z-index-table-row-outline);
 }
@@ -462,8 +476,8 @@ table.items tr.form td {
  vertical-align: top;
 }

-/* TODO: replace :hover:focus-visible combos with proper LOVE stye order */
-/* TODO: Update table styling: simplify selectors, deduplicate, remove non-font rem. */
+/* TODO: replace `:hover:focus-visible` combos with proper LOVE style order. */
+/* TODO: update table styling: simplify selectors, deduplicate, remove non-font rem. */
 table.items td.link a:hover,
 table.items td.link a:focus-visible,
 table.items td.link a:hover:focus-visible {
@@ -501,9 +515,7 @@ table.items td.svg {
 table.items td.number {
  text-align: right;
 }
-table.items .button,
-table.items button,
-table.items input[type=submit] {
+table.items .button {
  font-weight: normal;
  height: 100%;
  padding: 0.4em;
@@ -513,30 +525,27 @@ table.items select,
 table.items textarea {
  padding-block: 0.375em;
 }
-/* TODO: find a way (layers?) to style inputs differently while making sure
- * hover works properly without using :not(:hover) selectors here. */
-table.items .button:not(:hover),
-table.items button:not(:hover),
-table.items input:not(:hover),
-table.items select:not(:hover),
-table.items textarea:not(:hover) {
+
+table input,
+table select,
+table summary,
+table textarea {
  border-color: var(--color-border-gray);
 }
-table.items .button:not(:hover),
-table.items button:not(:hover),
-table.items input[type=submit]:not(:hover),
-table.items select:not(:hover) {
+table select {
  color: var(--color-table-gray);
 }
-table.items select:focus-within,
-table.items select:focus-visible {
+table select:hover,
+table select:focus-within,
+table select:focus-visible {
  color: black;
 }
-form a[name=cancel] {
+table .button {
  border-color: var(--color-border-gray);
-  color: var(--color-nav-gray);
-  fill: var(--color-nav-gray);
+  color: var(--color-table-gray);
 }
+
+
 form table.items {
  border: none;
 }
@@ -548,6 +557,9 @@ form table.items td {
 form table.items td:first-child {
  color: inherit;
 }
+form table select {
+  color: black;
+}


 .centered {
@@ -563,34 +575,17 @@ form table.items td:first-child {
  display: flex;
  gap: 0.8em;
 }
-.hflex.reverse {
-  flex-direction: row-reverse;
-}
 .hflex.centered {
  justify-content: center;
 }
-.hint {
-  color: var(--color-table-gray);
-  font-style: italic;
-  font-size: 0.9rem;
-  text-align: center;
+.vexpand {
+  width: 100%;
 }
 .vflex {
  display: flex;
  gap: 0.8em;
  flex-direction: column;
 }
-[disabled] {
-/* label:has(input[disabled]) {
- * TODO: disabled checkbox blue square focus removal; disabled label styling;
- * focused label styling (currently only checkbox has focus)
- * */
-  border-color: var(--color-border-gray) !important;
-  color: var(--color-border-gray) !important;
-  cursor: not-allowed;
-  fill: var(--color-border-gray) !important;
-  pointer-events: none;
-}


 details {
@@ -618,7 +613,7 @@ summary:has(.button) {
  padding-inline-end: 0;
 }
 summary .button {
-  border: solid 1px var(--color-border-gray);
+  border: 1px solid var(--color-border-gray);
  border-radius: inherit;
  border-top-left-radius: 0;
  border-bottom-left-radius: 0;
@@ -634,10 +629,10 @@ details[open] summary::before {
 summary::marker {
  padding-left: 0.25em;
 }
-/* NOTE: use details[open]::details-content once widely available */
+/* NOTE: use `details[open]::details-content` once widely available. */
 details[open] ul {
  background: white;
-  border: solid 1px var(--color-border-gray);
+  border: 1px solid var(--color-border-gray);
  border-radius: 0.25em;
  box-shadow: 1px 1px 3px var(--color-border-gray);
  margin: -1px 0 0 0;
@@ -659,3 +654,10 @@ li input[type=checkbox] {
 li::marker {
  content: '';
 }
+/*
+ * TODO:
+ * * disable <label> containing disabled checkbox: `label:has(input[disabled])`,
+ * * disabled label styling,
+ * * focused label styling (currently only checkbox has focus),
+ * * disabled checkbox blue square focus removal.
+ * */
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -26,6 +26,18 @@ class ApplicationController < ActionController::Base
  #   Turbo will reload 2nd time with HTML format and flashes will be lost.
  rescue_from *ActionDispatch::ExceptionWrapper.rescue_responses.keys, with: :rescue_turbo

+  # Required by #respond_with (gem `responders`) used by Devise controllers.
+  respond_to :html, :turbo_stream
+
+  def after_sign_in_path_for(resource)
+    # TODO: allow setting path per-user or save last path in session and restore
+    units_path
+  end
+
+  def after_sign_out_path_for(resource)
+    new_user_session_path
+  end
+
  protected

  def current_user_disguised?
--- a/app/controllers/measurements_controller.rb
+++ b/app/controllers/measurements_controller.rb
@@ -1,7 +1,13 @@
 class MeasurementsController < ApplicationController
+  before_action except: :index do
+    raise AccessForbidden unless current_user.at_least(:active)
+  end
+
  def index
-    @measurements = []
-    #@measurements = current_user.units.ordered.includes(:base, :subunits)
+    readouts = current_user.readouts.includes(:quantity, :unit).order(created_at: :desc)
+    @measurements = readouts.group_by(&:created_at).map do |created_at, grouped|
+      Measurement.new(created_at: created_at, readouts: grouped)
+    end
  end

  def new
@@ -9,8 +15,33 @@ class MeasurementsController < ApplicationController
  end

  def create
+    timestamp = Time.current
+    @readouts = readout_params.map do |rp|
+      r = current_user.readouts.new(rp)
+      r.created_at = timestamp
+      r
+    end
+
+    if @readouts.all?(&:valid?)
+      Readout.transaction { @readouts.each(&:save!) }
+      @measurement = Measurement.new(readouts: @readouts, created_at: timestamp)
+      flash.now[:notice] = t('.success')
+    else
+      render :new, status: :unprocessable_entity
+    end
  end

  def destroy
+    @measurement = Measurement.new(id: params[:id].to_i,
+                                   created_at: Time.at(params[:id].to_i))
+    current_user.readouts.where(created_at: @measurement.created_at).delete_all
+    @measurements_empty = current_user.readouts.empty?
+    flash.now[:notice] = t('.success')
+  end
+
+  private
+
+  def readout_params
+    params.require(:readouts).map { |r| r.permit(:quantity_id, :value, :unit_id) }
  end
 end
--- a/app/controllers/readouts_controller.rb
+++ b/app/controllers/readouts_controller.rb
@@ -1,16 +1,23 @@
 class ReadoutsController < ApplicationController
-  before_action :find_quantities, only: [:new]
-  before_action :find_quantity, only: [:discard]
+  before_action :find_quantity, only: [:new, :discard]
  before_action :find_prev_quantities, only: [:new, :discard]

  def new
-    @quantities -= @prev_quantities
-    # TODO: raise ParameterInvalid if new_quantities.empty?
-    @readouts = current_user.readouts.build(@quantities.map { |q| {quantity: q} })
+    new_quantities =
+      case params[:button]
+      when 'children'
+        @quantity.subquantities
+      when 'subtree'
+        @quantity.progenies
+      else
+        [@quantity]
+      end
+    new_quantities -= @prev_quantities
+    @readouts = current_user.readouts.build(new_quantities.map { |q| {quantity: q} })

    @user_units = current_user.units.ordered

-    quantities = @prev_quantities + @quantities
+    quantities = @prev_quantities + new_quantities
    @superquantity = current_user.quantities
      .common_ancestors(quantities.map(&:parent_id)).first
  end
@@ -24,9 +31,6 @@ class ReadoutsController < ApplicationController

  private

-  def find_quantities
-    @quantities = current_user.quantities.find(params[:quantity])
-  end

  def find_quantity
    @quantity = current_user.quantities.find_by!(id: params[:id])
--- a/app/controllers/user/profiles_controller.rb
+++ b/app/controllers/user/profiles_controller.rb
@@ -1,8 +1,10 @@
-class RegistrationsController < Devise::RegistrationsController
-  before_action :authenticate_user!, only: [:edit, :update, :destroy]
-
+class User::ProfilesController < Devise::RegistrationsController
  def destroy
-    # TODO: Disallow/disable deletion for last admin account; update :edit view
+    if current_user.sole_admin?
+      redirect_back fallback_location: edit_user_registration_path,
+        alert: t(".sole_admin")
+      return
+    end
    super
  end

--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -37,7 +37,7 @@ class UsersController < ApplicationController
  end

  # NOTE: limited actions availabe to :admin by design. Users are meant to
-  # manage their accounts by themselves through registrations. :admin
+  # manage their accounts by themselves through profiles. :admin
  # is allowed to sign-in (disguise) as user and make changes from there.

  protected
--- a/app/helpers/application_helper.rb
+++ b/app/helpers/application_helper.rb
@@ -12,6 +12,12 @@ module ApplicationHelper
      labeled_field_for(method, options) { super }
    end

+    def submit(value = nil, options = {})
+      value, options = nil, value if value.is_a?(Hash)
+      options[:class] = @template.class_names('button', options[:class])
+      super
+    end
+
    private

    def labeled_field_for(method, options)
@@ -72,13 +78,8 @@ module ApplicationHelper
  end

  def labeled_form_for(record, options = {}, &block)
-    extra_options = {builder: LabeledFormBuilder,
-                     data: {turbo: false},
-                     html: {class: 'labeled-form'}}
-    options = options.deep_merge(extra_options) do |key, left, right|
-      key == :class ? class_names(left, right) : right
-    end
-    form_for(record, **options, &block)
+    extra_options = {builder: LabeledFormBuilder, html: {class: 'labeled-form'}}
+    form_for(record, **merge_attributes(options, extra_options), &block)
  end

  class TabularFormBuilder < ActionView::Helpers::FormBuilder
@@ -113,8 +114,12 @@ module ApplicationHelper
    end

    def button(value = nil, options = {}, &block)
-      # button does not use #objectify_options
-      options.merge!(@options.slice(:form))
+      # #button does not use #objectify_options/@default_options
+      value, options = nil, value if value.is_a?(Hash)
+      options = options.merge(
+        @default_options.slice(:form),
+        class: @template.class_names('button', options[:class])
+      )
      super
    end

@@ -135,20 +140,21 @@ module ApplicationHelper
    # [autofocus].  Otherwise IDs are not unique when multiple forms are open
    # and the first input gets focus.
    record_object, options = nil, record_object if record_object.is_a?(Hash)
-    options.merge!(builder: TabularFormBuilder, skip_default_ids: true)
+    extra_options = {builder: TabularFormBuilder, skip_default_ids: true}
+    options = merge_attributes(options, extra_options)
    # TODO: set error message with setCustomValidity instead of rendering to flash?
    render_errors(record_object || record_name)
    fields_for(record_name, record_object, **options, &block)
  end

  def tabular_form_with(**options, &block)
-    options = options.deep_merge(builder: TabularFormBuilder,
-                                 html: {autocomplete: 'off'})
-    form_with(**options, &block)
+    extra_options = {builder: TabularFormBuilder, html: {autocomplete: 'off'}}
+    form_with(**merge_attributes(options, extra_options), &block)
  end

  def svg_tag(source, label = nil, options = {})
-    svg_tag = tag.svg(options) do
+    label, options = nil, label if label.is_a? Hash
+    svg_tag = tag.svg(**options) do
      tag.use(href: "#{image_path(source + ".svg")}#icon")
    end
    label.blank? ? svg_tag : svg_tag + tag.span(label)
@@ -159,6 +165,7 @@ module ApplicationHelper
      ['measurements', 'scale-bathroom', :restricted],
      ['quantities', 'axis-arrow', :restricted, 'right'],
      ['units', 'weight-gram', :restricted],
+      # TODO: display users tab only if >1 user present; sole_user?/sole_admin?
      ['users', 'account-multiple-outline', :admin],
    ]

@@ -206,6 +213,7 @@ module ApplicationHelper

  def render_errors(records)
    # Conversion of flash to Array only required because of Devise
+    # TODO: override Devise message setting to Array()?
    flash[:alert] = Array(flash[:alert])
    Array(records).each { |record| flash[:alert] += record.errors.full_messages }
  end
@@ -215,8 +223,8 @@ module ApplicationHelper
      # Conversion of flash to Array only required because of Devise
      Array(messages).map do |message|
        tag.div class: "flash #{entry}" do
-          tag.div(sanitize(message)) + tag.button(sanitize("&times;"), tabindex: -1,
-                                                  onclick: "this.parentElement.remove();")
+          tag.span(sanitize(message)) +
+            svg_tag('pictograms/close-outline', {onclick: "this.parentElement.remove()"})
        end
      end
    end.join.html_safe
@@ -252,4 +260,11 @@ module ApplicationHelper

    [name, html_options]
  end
+
+  # Like Hash#deep_merge, but aware of HTML attributes.
+  def merge_attributes(left, right)
+    left.deep_merge(right) do |key, lvalue, rvalue|
+      key == :class ? class_names(lvalue, rvalue) : rvalue
+    end
+  end
 end
--- a/app/javascript/application.js
+++ b/app/javascript/application.js
@@ -37,6 +37,18 @@ window.detailsObserver = new MutationObserver((mutations) => {
  mutations[0].target.dispatchEvent(new Event('change', {bubbles: true}))
 });

+function formValidate(event) {
+  var id = event.submitter.getAttribute("data-validate")
+  if (!id) return;
+
+  var input = document.getElementById(id)
+  if (!input.checkValidity()) {
+    input.reportValidity()
+    event.preventDefault()
+  }
+}
+window.formValidate = formValidate
+

 /* Turbo stream actions */
 Turbo.StreamElement.prototype.disableElement = function(element) {
--- a/app/models/measurement.rb
+++ b/app/models/measurement.rb
@@ -1,3 +1,17 @@
 class Measurement
  include ActiveModel::Model
+
+  attr_accessor :readouts, :created_at
+
+  def id
+    created_at.to_i
+  end
+
+  def to_param
+    id.to_s
+  end
+
+  def persisted?
+    true
+  end
 end
--- a/app/models/quantity.rb
+++ b/app/models/quantity.rb
@@ -61,18 +61,26 @@ class Quantity < ApplicationRecord

  # Return: ordered [sub]hierarchy
  scope :ordered, ->(root: nil, include_root: true) {
-    numbered = Arel::Table.new('numbered')
-
-    self.model.with(numbered: numbered(:parent_id, :name)).with_recursive(arel_table.name => [
-      numbered.project(
-        numbered[Arel.star],
-        numbered.cast(numbered[:child_number], 'BINARY').as('path')
-      ).where(numbered[root && include_root ? :id : :parent_id].eq(root)),
-      numbered.project(
-        numbered[Arel.star],
-        arel_table[:path].concat(numbered[:child_number])
-      ).join(arel_table).on(numbered[:parent_id].eq(arel_table[:id]))
-    ]).order(arel_table[:path])
+    if connection.adapter_name =~ /mysql/i
+      numbered = Arel::Table.new('numbered')
+      self.model.with(numbered: numbered(:parent_id, :name)).with_recursive(arel_table.name => [
+        numbered.project(
+          numbered[Arel.star],
+          numbered.cast(numbered[:child_number], 'BINARY').as('path')
+        ).where(numbered[root && include_root ? :id : :parent_id].eq(root)),
+        numbered.project(
+          numbered[Arel.star],
+          arel_table[:path].concat(numbered[:child_number])
+        ).join(arel_table).on(numbered[:parent_id].eq(arel_table[:id]))
+      ]).order(arel_table[:path])
+    elsif root.nil?
+      # SQLite: pathname column already stores the full hierarchical path
+      order(:pathname)
+    else
+      root_pathname = unscoped.where(id: root).pick(:pathname)
+      scope = order(:pathname).where("pathname LIKE ?", "#{root_pathname}#{PATHNAME_DELIMITER}%")
+      include_root ? scope.or(where(id: root)) : scope
+    end
  }

  # TODO: extract named functions to custom Arel extension
--- a/app/models/unit.rb
+++ b/app/models/unit.rb
@@ -26,10 +26,8 @@ class Unit < ApplicationRecord
    other_bases_units = arel_table.alias('other_bases_units')
    sub_units = arel_table.alias('sub_units')

-    # TODO: move inner 'with' CTE to outer 'with recursive' - it can have multiple
-    # CTEs, even non recursive ones.
    Unit.with_recursive(actionable_units: [
-      Unit.with(units: self.or(Unit.defaults)).left_joins(:base)
+      self.or(Unit.defaults).left_joins(:base)
        .where.not(
          # Exclude Units that are/have default counterpart
          Arel::SelectManager.new.project(1).from(other_units)
@@ -65,8 +63,14 @@ class Unit < ApplicationRecord
        ),
      # Fill base Units to display proper hierarchy. Duplicates will be removed
      # by final group() - can't be deduplicated with UNION due to 'portable' field.
-      arel_table.join(actionable_units).on(actionable_units[:base_id].eq(arel_table[:id]))
-        .project(arel_table[Arel.star], Arel::Nodes.build_quoted(nil).as('portable'))
+      # Use ActiveRecord::Relation (not a raw SelectManager) so the SQLite Arel
+      # visitor does not wrap it in parentheses inside the UNION ALL CTE body.
+      Unit.joins(
+        arel_table.create_join(
+          actionable_units,
+          arel_table.create_on(actionable_units[:base_id].eq(arel_table[:id]))
+        )
+      ).select(arel_table[Arel.star], Arel::Nodes.build_quoted(nil).as('portable'))
    ]).select(units: [:base_id, :symbol])
      .select(
        units[:id].minimum.as('id'), # can be ANY_VALUE()
@@ -74,7 +78,7 @@ class Unit < ApplicationRecord
        Arel::Nodes.build_quoted(1).as('multiplier'), # disregard multiplier when sorting
        units[:portable].minimum.as('portable')
      )
-      .from(units).group(:base_id, :symbol)
+      .from(units).group(units[:base_id], units[:symbol])
  }
  scope :ordered, ->{
    left_outer_joins(:base).order(ordering)
@@ -83,8 +87,8 @@ class Unit < ApplicationRecord
  def self.ordering
    [arel_table.coalesce(Arel::Table.new(:bases_units)[:symbol], arel_table[:symbol]),
     arel_table[:base_id].not_eq(nil),
-     :multiplier,
-     :symbol]
+     arel_table[:multiplier],
+     arel_table[:symbol]]
  end

  before_destroy do
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -29,4 +29,11 @@ class User < ApplicationRecord
  def at_least(status)
    User.statuses[self.status] >= User.statuses[status]
  end
+
+  # Returns true when this user is the only admin account in the system.
+  # Used to block actions that would leave the application without an admin
+  # (account deletion, status demotion).
+  def sole_admin?
+    admin? && !User.admin.where.not(id: id).exists?
+  end
 end
--- a/app/views/measurements/_form.html.erb
+++ b/app/views/measurements/_form.html.erb
@@ -1,28 +1,23 @@
-<%= tabular_form_with model: Measurement.new, id: :measurement_form,
-  class: 'topside-area vflex', html: {onkeydown: 'formProcessKey(event)'} do |form| %>
-  <table class="items centered">
-    <tbody id="readouts"></tbody>
-  </table>
-
-  <div class="hflex">
-    <%# TODO: right-click selection %>
-    <details id="quantity_select" class="hexpand" open
-             onkeydown="detailsProcessKey(event)">
-      <summary autofocus>
-        <!-- TODO: Set content with CSS when span empty to avoid duplication -->
-        <span data-prompt="<%= t('.select_quantity') %>">
-          <%= t('.select_quantity') %>
-        </span>
-        <%= image_button_tag t(:apply), "update", name: nil, disabled: true,
-          formaction: new_readout_path, formmethod: :get, formnovalidate: true,
-          data: {turbo_stream: true} %>
-      </summary>
-      <ul><%= quantities_check_boxes %></ul>
-    </details>
-    <%= form.button id: :create_measurement_button, disabled: true -%>
-  </div>
-
-  <div class="hflex reverse">
+<%= tabular_form_with model: Measurement.new do |form| %>
+  <fieldset>
+    <table class="items centered">
+      <tbody id="readouts">
+        <tr id="readouts_form">
+          <td colspan="4">
+            <%= collection_select :quantity, :id, @quantities, :id, :to_s_with_depth,
+              {prompt: t('.select_quantity'), disabled: '', selected: ''},
+              {name: :id, class: 'quantity vexpand',
+               onchange: "this.form.requestSubmit(new_readout_submit);"} %>
+            <%= form.submit id: :new_readout_submit, name: nil, value: nil,
+              formaction: new_readout_path, formmethod: :get, formnovalidate: true,
+              hidden: true, data: {turbo_stream: true} %>
+          </td>
+        </tr>
+      </tbody>
+    </table>
+  </fieldset>
+  <div class="hflex centered">
+    <%= form.button -%>
    <%= image_link_to t(:cancel), "close-outline", measurements_path, name: :cancel,
      class: 'dangerous', onclick: render_turbo_stream('form_close') %>
  </div>
--- a/app/views/measurements/_form_close.html.erb
+++ b/app/views/measurements/_form_close.html.erb
@@ -1,3 +1,4 @@
+<%= turbo_stream.update :measurement_form %>
 <%= turbo_stream.update :flashes %>
 <%= turbo_stream.remove :measurement_form %>
 <%= turbo_stream.show :no_items -%>
--- a/app/views/measurements/_measurement.html.erb
+++ b/app/views/measurements/_measurement.html.erb
@@ -0,0 +1,14 @@
+<%= tag.tr id: dom_id(measurement) do %>
+  <td><%= l measurement.created_at, format: :short %></td>
+  <td>
+    <% measurement.readouts.each do |readout| %>
+      <span><%= readout.quantity.name %>: <%= readout.value %> <%= readout.unit %></span>
+    <% end %>
+  </td>
+  <% if current_user.at_least(:active) %>
+    <td class="actions">
+      <%= image_button_to t('.destroy'), 'delete-outline', measurement_path(measurement),
+        method: :delete %>
+    </td>
+  <% end %>
+<% end %>
--- a/app/views/measurements/create.turbo_stream.erb
+++ b/app/views/measurements/create.turbo_stream.erb
@@ -0,0 +1,5 @@
+<%= turbo_stream.update :flashes %>
+<%= turbo_stream.remove :measurement_form %>
+<%= turbo_stream.remove :no_items %>
+<%= turbo_stream.enable :new_measurement_link %>
+<%= turbo_stream.prepend :measurements, @measurement %>
--- a/app/views/measurements/destroy.turbo_stream.erb
+++ b/app/views/measurements/destroy.turbo_stream.erb
@@ -0,0 +1,3 @@
+<%= turbo_stream.update :flashes %>
+<%= turbo_stream.remove @measurement %>
+<%= turbo_stream.append(:measurements, render_no_items) if @measurements_empty %>
--- a/app/views/measurements/index.html.erb
+++ b/app/views/measurements/index.html.erb
@@ -1,5 +1,5 @@
 <%# TODO: show hint when no quantities/units defined %>
-<div class="rightside-area buttongrid">
+<div class="rightside buttongrid">
  <% if current_user.at_least(:active) %>
    <%= image_link_to t('.new_measurement'), 'plus-outline', new_measurement_path,
      id: :new_measurement_link, onclick: 'this.blur();',
@@ -7,7 +7,9 @@
  <% end %>
 </div>

-<table class="main-area">
+<%= tag.div class: 'topside', id: :measurement_form %>
+
+<table class="main">
  <tbody id="measurements">
    <%= render(@measurements) || render_no_items %>
  </tbody>
--- a/app/views/measurements/new.turbo_stream.erb
+++ b/app/views/measurements/new.turbo_stream.erb
@@ -1,5 +1,4 @@
 <%= turbo_stream.disable :new_measurement_link -%>
-<%= turbo_stream.hide :no_items -%>
-<%= turbo_stream.append_all 'body' do %>
+<%= turbo_stream.update :measurement_form do %>
  <%= render partial: 'form' %>
 <% end %>
--- a/app/views/readouts/_form.html.erb
+++ b/app/views/readouts/_form.html.erb
@@ -1,25 +1,22 @@
 <%# TODO: add readout reordering by dragging %>
 <%= tabular_fields_for 'readouts[]', readout do |form| %>
-  <%- tag.tr id: dom_id(readout.quantity, :new, :readout) do %>
-    <td class="actions">
-      <%# TODO: change to _link_ after giving up displaying relative paths %>
-      <%= image_button_tag '', 'delete-outline', class: 'dangerous', name: nil,
-        formaction: discard_readouts_path(readout.quantity),
-        formmethod: :get, formnovalidate: true, data: {turbo_stream: true} %>
-    </td>
+  <%- tag.tr id: dom_id(readout.quantity, :new, :readout),
+             onkeydown: 'processKey(event)' do %>
    <td>
      <%= readout.quantity.relative_pathname(@superquantity) %>
    </td>
    <td>
-      <%= form.number_field :value, required: true,
-        size: readout.type_for_attribute(:value).precision / 2,
-        autofocus: readout_counter == 0 %>
+      <%= form.number_field :value, required: true, autofocus: true, size: 10 %>
    </td>
    <td>
      <%= form.hidden_field :quantity_id %>
      <%= form.collection_select :unit_id, @user_units, :id,
-        ->(u){ sanitize('&emsp;' * (u.base_id ? 1 : 0) + u.symbol) },
-        {prompt: t('.select_unit'), disabled: '', selected: ''}, required: true %>
+        ->(u){ sanitize('&emsp;' * (u.base_id ? 1 : 0) + u.symbol) } %>
+    </td>
+    <td class="actions">
+      <%= image_button_tag '', 'delete-outline', class: 'dangerous', name: :discard,
+        formaction: discard_readouts_path(readout.quantity),
+        formmethod: :get, formnovalidate: true, data: {turbo_stream: true} %>
    </td>
  <% end %>
 <% end %>
--- a/app/views/readouts/discard.turbo_stream.erb
+++ b/app/views/readouts/discard.turbo_stream.erb
@@ -1,4 +1,4 @@
-<%= turbo_stream.disable :create_measurement_button if @prev_quantities.one? %>
 <%= turbo_stream.remove dom_id(@quantity, :new, :readout) %>
+<%= turbo_stream.disable_all 'button[name="discard"]' if @prev_quantities.one? %>
+<%= turbo_stream.enable_all "select.quantity option[value='#{@quantity.id}']" %>
 <%= render partial: 'form_repath' %>
-<%= turbo_stream.unselect dom_id(@quantity) %>
--- a/app/views/readouts/new.turbo_stream.erb
+++ b/app/views/readouts/new.turbo_stream.erb
@@ -1,8 +1,9 @@
-<% @readouts.each do |r| %>
-  <%= turbo_stream.disable dom_id(r.quantity) %>
-<% end %>
 <%= render partial: 'form_repath' %>
-<%= turbo_stream.append :readouts do %>
+<%# is .one? proper condition? can @readouts be empty? %>
+<%= turbo_stream.enable_all 'button[name="discard"]' if @prev_quantities.one? %>
+<% @readouts.each do |r| %>
+  <%= turbo_stream.disable_all "select.quantity option[value='#{r.quantity_id}']" %>
+<% end %>
+<%= turbo_stream.before :readouts_form do %>
  <%= render partial: 'form', collection: @readouts, as: :readout %>
 <% end %>
-<%= turbo_stream.enable :create_measurement_button if @prev_quantities.empty? %>
--- a/app/views/users/confirmations/create.turbo_stream.erb
+++ b/app/views/users/confirmations/create.turbo_stream.erb
@@ -0,0 +1 @@
+<% flash.discard %>
--- a/app/views/users/confirmations/new.html.erb
+++ b/app/views/users/confirmations/new.html.erb
@@ -1,9 +0,0 @@
-<%= labeled_form_for resource, url: user_confirmation_path,
-  html: {class: 'main-area'} do |f| %>
-
-  <%= f.email_field :email, required: true, size: 30, autofocus: true,
-    autocomplete: 'email', value:
-    resource.pending_reconfirmation? ? resource.unconfirmed_email : resource.email %>
-
-  <%= f.submit t(:resend_confirmation) %>
-<% end %>
--- a/app/views/users/passwords/create.turbo_stream.erb
+++ b/app/views/users/passwords/create.turbo_stream.erb
@@ -0,0 +1,2 @@
+<%# For some reason flash messages are duplicated in bot flash and flash.now %>
+<% flash.discard %>
--- a/app/views/users/passwords/edit.html.erb
+++ b/app/views/users/passwords/edit.html.erb
@@ -1,5 +1,5 @@
 <%= labeled_form_for resource, url: user_password_path,
-  html: {method: :put, class: 'main-area'} do |f| %>
+  html: {method: :put, class: 'main-area', data: {turbo: false}} do |f| %>

  <%= f.hidden_field :reset_password_token %>

--- a/app/views/users/passwords/new.html.erb
+++ b/app/views/users/passwords/new.html.erb
@@ -1,8 +0,0 @@
-<%= labeled_form_for resource, url: user_password_path,
-  html: {class: 'main-area'} do |f| %>
-
-  <%= f.email_field :email, required: true, size: 30, autofocus: true,
-    autocomplete: 'email' %>
-
-  <%= f.submit t(:recover_password) %>
-<% end %>
--- a/app/views/users/registrations/edit.html.erb
+++ b/app/views/users/registrations/edit.html.erb
@@ -4,9 +4,8 @@
 <% end %>

 <div class="rightside-area buttongrid">
-  <%#= TODO: Disallow/disable deletion for last admin account, image_button_to_if %>
-  <%= image_button_to t('.delete'), 'account-remove-outline', user_registration_path,
-    form_class: 'tools-area', method: :delete, data: {turbo: false},
+  <%= image_button_to_if !current_user.sole_admin?, t('.delete'), 'account-remove-outline',
+    user_registration_path, form_class: 'tools-area', method: :delete, data: {turbo: false},
    onclick: {confirm: t('.confirm_delete')} %>
 </div>

--- a/app/views/users/profiles/new.html.erb
+++ b/app/views/users/profiles/new.html.erb
@@ -0,0 +1,17 @@
+<%= labeled_form_for resource, url: user_registration_path,
+  html: {class: 'main-area', onsubmit: 'formValidate(event)'} do |f| %>
+
+  <%= f.email_field :email, required: true, size: 30, autofocus: true,
+    autocomplete: 'email' %>
+  <%= f.password_field :password, required: true, size: 30,
+    minlength: @minimum_password_length, autocomplete: 'new-password' %>
+  <%= f.password_field :password_confirmation, required: true, size: 30,
+    minlength: @minimum_password_length, autocomplete: 'off' %>
+
+  <%= f.submit t(:register), data: {turbo: false} %>
+
+  <%# TODO: fix button text color after change link -> button %>
+  <%= image_button_tag t(:resend_confirmation), 'email-sync-outline',
+    class: 'auxiliary', formaction: user_confirmation_path, formnovalidate: true,
+    data: {validate: f.field_id(:email)} %>
+<% end %>
--- a/app/views/users/registrations/new.html.erb
+++ b/app/views/users/registrations/new.html.erb
@@ -1,16 +0,0 @@
-<div class="main-area">
-  <%= labeled_form_for resource, url: user_registration_path do |f| %>
-    <%= f.email_field :email, required: true, size: 30, autofocus: true,
-      autocomplete: 'email' %>
-    <%= f.password_field :password, required: true, size: 30,
-      minlength: @minimum_password_length, autocomplete: 'new-password' %>
-    <%= f.password_field :password_confirmation, required: true, size: 30,
-      minlength: @minimum_password_length, autocomplete: 'off' %>
-
-    <%= f.submit t(:register) %>
-  <% end %>
-
-  <%= content_tag :p, t(:or), style: 'text-align: center;' %>
-  <%= image_link_to t(:resend_confirmation), 'email-sync-outline',
-    new_user_confirmation_path, class: 'centered' %>
-</div>
--- a/app/views/users/sessions/new.html.erb
+++ b/app/views/users/sessions/new.html.erb
@@ -1,18 +1,19 @@
-<div class="main-area">
-  <%= labeled_form_for resource, url: user_session_path do |f| %>
-    <%= f.email_field :email, required: true, size: 30, autofocus: true,
-      autocomplete: 'email' %>
-    <%= f.password_field :password, required: true, size: 30,
-      minlength: @minimum_password_length, autocomplete: 'current-password' %>
+<%= labeled_form_for resource, url: user_session_path,
+  html: {class: 'main-area', onsubmit: 'formValidate(event)'} do |f| %>

-    <% if devise_mapping.rememberable? %>
-      <%= f.check_box :remember_me %>
-    <% end %>
+  <%= f.email_field :email, required: true, size: 30, autofocus: true,
+    autocomplete: 'email' %>
+  <%= f.password_field :password, required: true, size: 30,
+    autocomplete: 'current-password' %>

-    <%= f.submit t(:sign_in) %>
+  <% if devise_mapping.rememberable? %>
+    <%= f.check_box :remember_me %>
  <% end %>

-  <%= content_tag :p, t(:or), style: 'text-align: center;' %>
-  <%= image_link_to t(:recover_password), 'lock-reset', new_user_password_path,
-    class: 'centered' %>
-</div>
+  <%# /sign_in as HTML; /password as TURBO_STREAM %>
+  <%= f.submit t(:sign_in), data: {turbo: false} %>
+
+  <%= image_button_tag t(:recover_password), 'lock-reset', class: 'auxiliary',
+    formaction: user_password_path, formnovalidate: true,
+    data: {validate: f.field_id(:email)} %>
+<% end %>
--- a/config/credentials.yml.enc
+++ b/config/credentials.yml.enc
@@ -1 +1 @@
-3nm9KZNtyLhPgZBVzOOkN2FXHD0uEMuzgb5Sl1MrAMmi6+iEFSzyTHfZFW2mz18VyNz5DDYvTODZqBDQKK+FQh70uEQkmGqaY5XsTOzUFzk56quaPNtZvFEGux1nX2avSbYQBs3HeyYyWyTAFhez5j8tVb6sZD2xZ8twa9KAB42j86NIHT9w/ZMFqZbGbdBoR1Mrqoy9/IWv2QgxMTpGR6JBpTUwauXm6wS/bTt8SCXF57JSVgvdw/BxFzoA3Xj6N5E89LbMfh54W2ruMhybka5E7zXN9z0v4oXt8GiYZFIODEYZwqzEVaUK1WXS5qb5OrDJFAzs29Uf/gDrIDx71Lot+jejCS+xFfI9454EnHcVH66wKuwF6ylKupJDffM0hQHplcEfVSq5UiDfbPXm46Vr0g1A--2RrmuzCBuHvYpPNA--ugbuRe7ivfDqeUCt6ahciA==
+OOGMGhfQuV67kqlMecZLcNfgrGS81KPAGmY27GnohtcGSPtiaqL8OZYsVf5IIOaI1K14ZEflln+E2deaIJ5apaq98f+1gJawGbAJeEfLCskJV/03nT8ICpRk+bxT/lzqeCIaUJOLk4708ufC9EpdpJD/jgVSAuI/iNMzzwMbNFvqNmx0Kmgp0mRpHSDGLZZkaP3GW7wdsJEVsNpSPIrkkGL1BvD+nHbmHjuGkn4MMsmm1Yz0M31jkJiDksT0SVeOcxWvOApclxm6VZOAws2l6YKEs/XoE7ye3ssjxdjdwjMzRXV7dwYclNBQGRoERVTozdYiFR4eAGMdlG0RsnUAp+edILH5nvHCIPb3la/dUTOzAQMNY0TqMMVUHGqGuVS/EMCX/w7zrmYN5C+2W8SfugrvTpAL--dUdvsDfbUdVrbmmo--fUwsWUp+DQGPtEF+Zq4ZTw==
--- a/config/environments/test.rb
+++ b/config/environments/test.rb
@@ -58,4 +58,7 @@ Rails.application.configure do
  # config.action_view.annotate_rendered_view_with_filenames = true

  config.log_level = :info
+
+  # Allow the default integration test host.
+  config.hosts << "www.example.com"
 end
--- a/config/initializers/devise.rb
+++ b/config/initializers/devise.rb
@@ -91,7 +91,7 @@ Devise.setup do |config|
  # It will change confirmation, password recovery and other workflows
  # to behave the same regardless if the e-mail provided was right or wrong.
  # Does not affect registerable.
-  # config.paranoid = true
+  config.paranoid = true

  # By default Devise will store the user in session. You can skip storage for
  # particular strategies by setting this option.
--- a/config/locales/devise.en.yml
+++ b/config/locales/devise.en.yml
@@ -4,15 +4,15 @@ en:
  devise:
    confirmations:
      confirmed: "Your email address has been successfully confirmed."
-      send_instructions: "You will receive an email with instructions for how to confirm your email address in a few minutes."
-      send_paranoid_instructions: "If your email address exists in our database, you will receive an email with instructions for how to confirm your email address in a few minutes."
+      send_paranoid_instructions: >
+        If your email address is in our database, a message with instructions on how
+        to confirm your email address has been sent to you.
    failure:
      already_authenticated: "You are already signed in."
      inactive: "Your account is not activated yet."
-      invalid: "Invalid %{authentication_keys} or password."
+      invalid: "Invalid <b>%{authentication_keys}</b> or <b>password</b>."
      locked: "Your account is locked."
      last_attempt: "You have one more attempt before your account is locked."
-      not_found_in_database: "Invalid %{authentication_keys} or password."
      timeout: "Your session expired. Please sign in again to continue."
      unauthenticated: "You need to sign in or sign up before continuing."
      unconfirmed: "You have to confirm your email address before continuing."
@@ -32,8 +32,9 @@ en:
      success: "Successfully authenticated from %{kind} account."
    passwords:
      no_token: "You can't access this page without coming from a password reset email. If you do come from a password reset email, please make sure you used the full URL provided."
-      send_instructions: "You will receive an email with instructions on how to reset your password in a few minutes."
-      send_paranoid_instructions: "If your email address exists in our database, you will receive a password recovery link at your email address in a few minutes."
+      send_paranoid_instructions: >
+        If your email address is in our database, the password recovery link has been
+        sent to you.
      updated: "Your password has been changed successfully. You are now signed in."
      updated_not_active: "Your password has been changed successfully."
    registrations:
@@ -50,7 +51,6 @@ en:
      signed_out: "Signed out successfully."
      already_signed_out: "Signed out successfully."
    unlocks:
-      send_instructions: "You will receive an email with instructions for how to unlock your account in a few minutes."
      send_paranoid_instructions: "If your account exists, you will receive an email with instructions for how to unlock it in a few minutes."
      unlocked: "Your account has been unlocked successfully. Please sign in to continue."
  errors:
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -85,12 +85,19 @@ en:
    navigation: Measurements
    no_items: There are no measurements taken. You can Add some now.
    form:
-      select_quantity: select the measured quantities...
+      select_quantity: select the measured quantity...
    index:
      new_measurement: Add measurement
+    create:
+      success: Measurement saved.
+    destroy:
+      success: Measurement deleted.
+    measurement:
+      destroy: Delete
  readouts:
    form:
      select_unit: ...
+      new_children: Children
  quantities:
    navigation: Quantities
    no_items: There are no configured quantities. You can Add some or Import from defaults.
@@ -150,7 +157,7 @@ en:
      edit:
        password_html: 'New password:%{password_length_hint_html}'
        update_password: Update password
-    registrations:
+    profiles:
      new:
        password_html: 'Password:%{password_length_hint_html}'
        password_confirmation: 'Retype password:'
@@ -162,6 +169,9 @@ en:
          New password:
          <br><em>leave blank to keep unchanged</em>
          %{password_length_hint_html}
+  registrations:
+    destroy:
+      sole_admin: You cannot delete the only admin account.
  actions: Actions
  setup:
    new:
@@ -186,7 +196,6 @@ en:
  cancel: Cancel
  delete: Delete
  :no: 'no'
-  or: or
  register: Register
  sign_in: Sign in
  recover_password: Recover password
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -4,6 +4,7 @@ Rails.application.routes.draw do

  resources :measurements

+
  resources :readouts, only: [:new] do
    collection {get 'new/:id/discard', action: :discard, as: :discard}
  end
@@ -27,8 +28,9 @@ Rails.application.routes.draw do
  # https://github.com/heartcombo/devise/issues/5786
  connection = ActiveRecord::Base.connection
  if connection.schema_version && connection.table_exists?(:users)
+    # NOTE: change helper prefix from *_registration to *_profile once possible
    devise_for :users, path: '', path_names: {registration: 'profile'},
-      controllers: {registrations: :registrations}
+      controllers: {registrations: 'user/profiles'}
  end

  resources :users, only: [:index, :show, :update] do
@@ -37,9 +39,7 @@ Rails.application.routes.draw do
  end

  unauthenticated do
-    as :user do
-      root to: redirect('/sign_in')
-    end
+    root to: redirect('/sign_in')
  end
  root to: redirect('/units'), as: :user_root

--- a/lib/tasks/test_multi_db.rake
+++ b/lib/tasks/test_multi_db.rake
@@ -0,0 +1,50 @@
+namespace :test do
+  desc "Run Rails tests against all supported database adapters (SQLite, MySQL)"
+  task :all_adapters do
+    # DATABASE_URL overrides the adapter from database.yml at runtime.
+    # MySQL requires the mysql2 gem: bundle install --with mysql
+    adapters = {
+      "SQLite" => {
+        "DATABASE_URL" => "sqlite3:db/test.sqlite3"
+      },
+      "MySQL" => {
+        "DATABASE_URL" => format(
+          "mysql2://%s:%s@%s/%s",
+          ENV.fetch("DATABASE_USERNAME", "root"),
+          ENV.fetch("DATABASE_PASSWORD", ""),
+          ENV.fetch("DATABASE_HOST", "127.0.0.1"),
+          ENV.fetch("DATABASE_NAME", "fixin_test")
+        )
+      }
+    }
+
+    failed = []
+
+    adapters.each do |name, extra_env|
+      puts "\n#{"=" * 60}"
+      puts "  Running tests with #{name}"
+      puts "=" * 60
+
+      env = ENV.to_h.merge("RAILS_ENV" => "test").merge(extra_env)
+
+      # Reset test database; db:drop may fail on first run — that's fine
+      system(env, "bin/rails db:drop")
+      unless system(env, "bin/rails db:create db:schema:load")
+        failed << "#{name} (database setup)"
+        next
+      end
+
+      failed << name unless system(env, "bin/rails test")
+    end
+
+    puts "\n#{"=" * 60}"
+    if failed.any?
+      puts "  FAILED: #{failed.join(", ")}"
+      puts "=" * 60
+      exit 1
+    else
+      puts "  All adapters passed!"
+      puts "=" * 60
+    end
+  end
+end
--- a/test/application_system_test_case.rb
+++ b/test/application_system_test_case.rb
@@ -1,6 +1,7 @@
 require "test_helper"

 class ApplicationSystemTestCase < ActionDispatch::SystemTestCase
+  include ActionView::Helpers::SanitizeHelper
  include ActionView::Helpers::UrlHelper

  # NOTE: geckodriver installed with Firefox, ignore incompatibility warning
@@ -32,7 +33,8 @@ class ApplicationSystemTestCase < ActionDispatch::SystemTestCase
  # Allow skipping interpolations when translating for testing purposes
  INTERPOLATION_PATTERNS = Regexp.union(I18n.config.interpolation_patterns)
  def translate(key, **options)
-    options.empty? ? super.split(INTERPOLATION_PATTERNS, 2).first : super
+    translation = options.empty? ? super.split(INTERPOLATION_PATTERNS, 2).first : super
+    sanitize(translation, tags: [])
  end
  alias :t :translate

--- a/test/controllers/default/units_controller_test.rb
+++ b/test/controllers/default/units_controller_test.rb
@@ -1,8 +1,12 @@
 require "test_helper"

 class Default::UnitsControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    sign_in users(:alice)
+  end
+
  test "should get index" do
-    get units_defaults_index_url
+    get default_units_url
    assert_response :success
  end
 end
--- a/test/controllers/registrations_controller_test.rb
+++ b/test/controllers/registrations_controller_test.rb
@@ -0,0 +1,18 @@
+require "test_helper"
+
+class RegistrationsControllerTest < ActionDispatch::IntegrationTest
+  test "sole admin cannot delete account" do
+    sign_in users(:admin)
+    delete user_registration_path
+    assert_redirected_to edit_user_registration_path
+    assert_equal t("registrations.destroy.sole_admin"), flash[:alert]
+    assert User.exists?(users(:admin).id)
+  end
+
+  test "non-admin can delete account" do
+    sign_in users(:alice)
+    assert_difference ->{ User.count }, -1 do
+      delete user_registration_path
+    end
+  end
+end
--- a/test/controllers/users_controller_test.rb
+++ b/test/controllers/users_controller_test.rb
@@ -2,7 +2,9 @@ require "test_helper"

 class UsersControllerTest < ActionDispatch::IntegrationTest
  setup do
-    @user = users(:one)
+    @admin = users(:admin)
+    @user = users(:alice)
+    sign_in @admin
  end

  test "should get index" do
@@ -10,39 +12,25 @@ class UsersControllerTest < ActionDispatch::IntegrationTest
    assert_response :success
  end

-  test "should get new" do
-    get new_user_url
-    assert_response :success
-  end
-
-  test "should create user" do
-    assert_difference("User.count") do
-      post users_url, params: { user: { email: @user.email, status: @user.status } }
-    end
-
-    assert_redirected_to user_url(User.last)
-  end
-
  test "should show user" do
    get user_url(@user)
    assert_response :success
  end

-  test "should get edit" do
-    get edit_user_url(@user)
-    assert_response :success
-  end
-
  test "should update user" do
-    patch user_url(@user), params: { user: { email: @user.email, status: @user.status } }
-    assert_redirected_to user_url(@user)
+    patch user_url(@user), params: { user: { status: :restricted } }, as: :turbo_stream
+    assert_equal "restricted", @user.reload.status
  end

-  test "should destroy user" do
-    assert_difference("User.count", -1) do
-      delete user_url(@user)
-    end
+  test "should not update self" do
+    patch user_url(@admin), params: { user: { status: :active } }, as: :turbo_stream,
+      headers: { "HTTP_REFERER" => users_url }
+    assert_response :redirect
+  end

-    assert_redirected_to users_url
+  test "should forbid non-admin" do
+    sign_in @user
+    get users_url
+    assert_response :forbidden
  end
 end
--- a/test/system/users_test.rb
+++ b/test/system/users_test.rb
@@ -5,8 +5,8 @@ class UsersTest < ApplicationSystemTestCase
    @admin = users(:admin)
  end

-  test "sign in" do
-    visit new_user_session_path
+  test 'sign in' do
+    visit root_url
    assert find_link(href: new_user_session_path)[:disabled]

    sign_in
@@ -14,16 +14,23 @@ class UsersTest < ApplicationSystemTestCase
    assert_text t('devise.sessions.signed_in')
  end

-  test 'sign in fails with invalid password' do
-    sign_in password: random_password
+  test 'sign in fails with invalid credentials' do
+    label = User.human_attribute_name(:email)
+    # Both: valid and invalid emails should give the same (paranoid) error message.
+    email = [users.sample.email, random_email].sample
+
+    visit root_url
+    fill_in label, with: email
+    fill_in User.human_attribute_name(:password), with: random_password
+    click_on t(:sign_in)
+
    assert_current_path new_user_session_path
-    assert_text t('devise.failure.not_found_in_database',
-                  authentication_keys: User.human_attribute_name(:email))
+    assert_text t('devise.failure.invalid', authentication_keys: label.downcase_first)
    assert find_link(href: new_user_session_path)[:disabled]
-    assert_not_empty find_field(User.human_attribute_name(:email)).value
+    assert has_field?(label, with: email)
  end

-  test "sign out" do
+  test 'sign out' do
    sign_in
    visit root_url
    click_on t("layouts.application.sign_out")
@@ -31,79 +38,106 @@ class UsersTest < ApplicationSystemTestCase
    assert_text t("devise.sessions.signed_out")
  end

-  test "recover password" do
-    visit new_user_session_url
-    click_on t(:recover_password)
+  test 'recover password' do
+    label = User.human_attribute_name(:email)
+    email = users.select(&:confirmed?).sample.email
+
+    visit root_url
+    fill_in label, with: email
+    # Form validations should allow empty password.
+    assert has_field?(User.human_attribute_name(:password), with: nil)

-    fill_in User.human_attribute_name(:email),
-      with: users.select(&:confirmed?).sample.email
    assert_emails 1 do
      click_on t(:recover_password)
-      # Wait until redirected to make sure async request has been processed
      assert_current_path new_user_session_path
+      # Wait for flash message to make sure async request has been processed.
+      assert_text t("devise.passwords.send_paranoid_instructions")
    end
-    assert_text t("devise.passwords.send_instructions")
+    assert has_field?(label, with: email)

    with_last_email do |mail|
      visit Capybara.string(mail.body.to_s).find_link("Change my password")[:href]
+      assert_current_path edit_user_password_path, ignore_query: true
+      # Make sure flash message is not displayed twice.
+      assert_no_text t("devise.passwords.send_paranoid_instructions")
    end
    new_password = random_password
    fill_in t("users.passwords.edit.password_html"), with: new_password
    fill_in t("helpers.label.user.password_confirmation"), with: new_password
    assert_emails 1 do
      click_on t("users.passwords.edit.update_password")
-      # Wait until redirected to make sure async request has been processed
      assert_current_path units_path
+      assert_text t("devise.passwords.updated")
    end
-    assert_text t("devise.passwords.updated")
  end

-  test "register" do
-    visit new_user_session_url
+  test 'recover password for nonexistent user' do
+    label = User.human_attribute_name(:email)
+    email = random_email
+
+    visit root_url
+    fill_in label, with: email
+
+    assert_no_emails do
+      click_on t(:recover_password)
+      assert_current_path new_user_session_path
+      assert_text t("devise.passwords.send_paranoid_instructions")
+    end
+  end
+
+  test 'register' do
+    visit root_url
    click_on t(:register)
+    assert find_link(href: new_user_registration_path)[:disabled]

    fill_in User.human_attribute_name(:email), with: random_email
    password = random_password
    fill_in User.human_attribute_name(:password), with: password
-    fill_in t("users.registrations.new.password_confirmation"), with: password
-    assert_difference ->{User.count}, 1 do
+    fill_in t("users.profiles.new.password_confirmation"), with: password
+    assert_difference ->{ User.count }, 1 do
      assert_emails 1 do
        click_on t(:register)
-        # Wait until redirected to make sure async request has been processed
        assert_current_path new_user_session_path
+        assert_text t("devise.registrations.signed_up_but_unconfirmed")
      end
    end
-    assert_text t("devise.registrations.signed_up_but_unconfirmed")

-    with_last_email do |mail|
-      visit Capybara.string(mail.body.to_s).find_link("Confirm my account")[:href]
+    assert_changes ->{ User.last.confirmed? }, from: false, to: true do
+      with_last_email do |mail|
+        visit Capybara.string(mail.body.to_s).find_link("Confirm my account")[:href]
+        assert_current_path new_user_session_path
+        assert_text t("devise.confirmations.confirmed")
+      end
    end
-    assert_current_path new_user_session_path
-    assert_text t("devise.confirmations.confirmed")
-    assert User.last.confirmed?
  end

-  test "resend confirmation" do
-    visit new_user_session_url
-    click_on t(:register)
-    click_on t(:resend_confirmation)
+  test 'resend confirmation' do
+    label = User.human_attribute_name(:email)
+    user = users.reject(&:confirmed?).sample
+
+    visit root_url
+    click_on t(:register)
+    fill_in label, with: user.email
+    assert has_field?(User.human_attribute_name(:password), with: nil)

-    fill_in User.human_attribute_name(:email),
-      with: users.reject(&:confirmed?).sample.email
    assert_emails 1 do
      click_on t(:resend_confirmation)
-      # Wait until redirected to make sure async request has been processed
-      assert_current_path new_user_session_path
+      assert_current_path new_user_registration_path
+      assert_text t("devise.confirmations.send_paranoid_instructions")
    end
-    assert_current_path new_user_session_path
-    assert_text t("devise.confirmations.send_instructions")
+    assert has_field?(label, with: user.email)

-    with_last_email do |mail|
-      visit Capybara.string(mail.body.to_s).find_link("Confirm my account")[:href]
+    assert_changes ->{ user.reload.confirmed? }, from: false, to: true do
+      with_last_email do |mail|
+        visit Capybara.string(mail.body.to_s).find_link("Confirm my account")[:href]
+        assert_current_path new_user_session_path
+        assert_no_text t("devise.confirmations.send_paranoid_instructions")
+        assert_text t("devise.confirmations.confirmed")
+      end
    end
  end

-  test "show profile" do
+  test 'show profile' do
    sign_in user: users.select(&:admin?).select(&:confirmed?).sample
    click_on t("users.navigation")
    within all('tr').drop(1).sample do |tr|
@@ -113,7 +147,7 @@ class UsersTest < ApplicationSystemTestCase
    end
  end

-  test "disguise" do
+  test 'disguise' do
    user = users.select(&:admin?).select(&:confirmed?).sample
    sign_in user: user

@@ -129,7 +163,7 @@ class UsersTest < ApplicationSystemTestCase
    assert_link user.email
  end

-  test "disguise fails for admin when disallowed" do
+  test 'disguise fails for admin when disallowed' do
    user = users.select(&:admin?).select(&:confirmed?).sample
    sign_in user: user

@@ -142,37 +176,45 @@ class UsersTest < ApplicationSystemTestCase
    assert_title 'The change you wanted was rejected (422)'
  end

-  test "disguise forbidden for non admin" do
+  test 'disguise forbidden for non admin' do
    sign_in user: users.reject(&:admin?).select(&:confirmed?).sample
    visit disguise_user_path(User.all.sample)
    assert_title 'Access is forbidden to this page (403)'
  end

-  test "delete profile" do
-    user = sign_in
+  test 'delete profile' do
+    user = sign_in user: users.reject(&:admin?).select(&:confirmed?).sample
    # TODO: remove condition after root_url changed to different path than
    # profile in routes.rb
    unless has_current_path?(edit_user_registration_path)
      first(:link_or_button, user.email).click
    end
    assert_difference ->{ User.count }, -1 do
-      accept_confirm { click_on t("users.registrations.edit.delete") }
+      accept_confirm { click_on t("users.profiles.edit.delete") }
      assert_current_path new_user_session_path
    end
    assert_text t("devise.registrations.destroyed")
  end

-  test "index forbidden for non admin" do
+  test 'sole admin cannot delete profile' do
+    sign_in user: users(:admin)
+    unless has_current_path?(edit_user_registration_path)
+      first(:link_or_button, users(:admin).email).click
+    end
+    assert find(:button, t("users.registrations.edit.delete"))[:disabled]
+  end
+
+  test 'index forbidden for non admin' do
    sign_in user: users.reject(&:admin?).select(&:confirmed?).sample
    visit users_path
    assert_title "Access is forbidden to this page (403)"
  end

-  test "update profile" do
+  test 'update profile' do
    # TODO
  end

-  test "update status" do
+  test 'update status' do
    sign_in user: users.select(&:admin?).select(&:confirmed?).sample
    visit users_path

@@ -187,7 +229,7 @@ class UsersTest < ApplicationSystemTestCase
    assert_current_path users_path
  end

-  test "update status fails for admin when disallowed" do
+  test 'update status fails for admin when disallowed' do
    sign_in user: users.select(&:admin?).select(&:confirmed?).sample
    visit users_path

@@ -200,7 +242,7 @@ class UsersTest < ApplicationSystemTestCase
    assert_title 'The change you wanted was rejected (422)'
  end

-  test "update status forbidden for non admin" do
+  test 'update status forbidden for non admin' do
    sign_in user: users.reject(&:admin?).select(&:confirmed?).sample
    visit units_path
    inject_button_to find('body'), "update status", user_path(User.all.sample), method: :patch,
--- a/test/test_helper.rb
+++ b/test/test_helper.rb
@@ -2,6 +2,10 @@ ENV["RAILS_ENV"] ||= "test"
 require_relative "../config/environment"
 require "rails/test_help"

+class ActionDispatch::IntegrationTest
+  include Devise::Test::IntegrationHelpers
+end
+
 class ActiveSupport::TestCase
  # Run tests in parallel with specified workers
  parallelize(workers: :number_of_processors)
Author	SHA1	Message	Date
barbie-bot	492507aea7	Merge upstream/final-form into master Incorporates WIP alternative measurement form (single select form with multiple select actions) and readouts controller. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-13 02:38:09 +00:00
barbie-bot	f52f4c83dd	Merge upstream/css-cleanup into master Resolves conflicts between upstream/master and upstream/css-cleanup: - CSS: take css-cleanup versions (button/link style unification, comment cleanup, table .button styles, [name=cancel]/.auxiliary styles) - application_helper.rb: use SVG icon for flash message close button (css-cleanup) - users_test.rb: use single-quote style (css-cleanup), keep sole-admin test (master) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-12 18:07:54 +00:00
barbie-bot	d54467f259	Fix quantity ordered scope for SQLite: use pathname column instead of recursive CTE SQLite's Arel visitor wraps CTE branches in extra parentheses, making the UNION ALL inside recursive CTEs invalid. Also SQLite lacks LPAD() and CAST(... AS BINARY). Fix by using the existing pathname column for ordering on SQLite, which already encodes the hierarchical path. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-10 18:40:54 +00:00
barbie-bot	2c9320010b	Fix quantity ordered scope for SQLite compatibility Replace MySQL-specific LPAD() with SQLite's format() for zero-padded row numbering, and skip CAST(... AS BINARY) on SQLite where string comparisons are already binary by default. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-10 18:34:27 +00:00
barbie-bot	179fe58421	Implement measurements create/destroy and index listing Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-10 18:24:58 +00:00
cryptogopher	68695bced9	Merge styles of <a>.button/<button>/<input type="submit"> into .button Remove flash button Fix some multi-selector specificity differences	2026-03-10 18:16:01 +00:00
cryptogopher	6717b1d4c1	Update and format comments	2026-03-10 18:15:24 +00:00
cryptogopher	d7fd8f1c45	Make [disabled] and [hidden] styles !important	2026-03-10 18:15:06 +00:00
barbie-bot	c367009347	Regenerate credentials.yml.enc with working master.key Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-10 17:58:43 +00:00
barbie-bot	1efb1ad86e	Prevent sole admin from deleting their account Without this guard, the last admin in the system could delete their own account, making the application unmanageable. This adds a model method `User#sole_admin?`, a controller guard in `RegistrationsController#destroy`, and disables the delete button in the profile edit view when the current user is the only remaining admin. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-10 17:50:47 +00:00
barbie-bot	238e8eb846	Fix controller tests and SQLite compatibility for defaults_diff Test infrastructure: - Allow www.example.com host in test env (ActionDispatch::HostAuthorization was blocking all integration test requests) - Include Devise::Test::IntegrationHelpers in ActionDispatch::IntegrationTest so tests can sign in with sign_in(user) Controller tests: - Rewrite UsersControllerTest to match actual routes/actions (no new/create/ edit/destroy); sign in as admin; test update-self rejection via turbo_stream - Fix Default::UnitsControllerTest to sign in before requesting the index SQLite compatibility in Unit#defaults_diff: - Hoist the inner "units" CTE to the outer WITH RECURSIVE level (fixes nested WITH syntax error) — this was the existing TODO in the code - Use Unit.joins(...) for the recursive part instead of a raw Arel::SelectManager so the SQLite visitor does not wrap it in parentheses inside UNION ALL - Drop the named "units" CTE (conflicts with the table name under WITH RECURSIVE in SQLite); apply the user/defaults scope directly on the base case - Qualify GROUP BY columns to avoid ambiguity when bases_units is joined - Qualify ORDER BY :multiplier/:symbol to avoid ambiguity (Unit.ordering) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-10 17:50:19 +00:00
barbie-bot	37199f85df	Use committed database.yml instead of generating it in CI The repo's config/database.yml already handles both SQLite (default) and MySQL (DB_ADAPTER=mysql) via ERB. Remove the redundant steps that overwrote it with a hardcoded version, and pass DB_ADAPTER=mysql for the MySQL job. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-10 17:50:19 +00:00
barbie-bot	7e1eacbc33	Add multi-adapter test support: SQLite + MySQL via Gitea Actions and rake task - .gitea/workflows/test.yml: two parallel CI jobs (SQLite and MySQL), each generates its own database.yml inline and runs the test suite - lib/tasks/test_multi_db.rake: `rails test:all_adapters` runs both adapters sequentially using DATABASE_URL to switch at runtime Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-10 17:50:19 +00:00
cryptogopher	83b064ef3c	Merge recover password/resend confirmation forms into sign in/register Closes #65, #66	2026-03-01 20:04:42 +01:00
cryptogopher	1acb179851	Single select form without action buttons	2026-01-15 19:00:25 +01:00
cryptogopher	207699584b	Back to single-select form w/ multiple select actions	2025-12-27 01:38:11 +01:00
cryptogopher	46dd480b4e	Alternative new Measurement form, WIP	2025-08-15 23:26:57 +02:00