Add form_with to unify form_tag/form_for.

[kaspth]

Ref #25197

form_tag and form_for serve very similar use cases. This
PR unifies that usage such that form_with can output just
the opening form tag akin to form_tag and can just work with
a url, for instance.

form_with by default doesn't attach a class or id to the form.

Ported over old tests where applicable to ensure maximum coverage,
but left some commented out because they don't yet apply (e.g.
fields_for later being replaced by fields).

Pending in this PR:

• Add new fields DSL
• Default to remote: true
• Remove commented out tests in the form_with_test.rb.
• Basic documentation
• Changelog entry 😁

Later work up for grabs once this is in:

• Add overridable field values, e.g. form.text_field :name, 'override'
• Allow fields not on the model, e.g. form.text_field :not_implemented_on_model
• Revisit form field defaults e.g. stop outputting ids and classes on fields by default
• Revisit form options DSL methods
• Implement form_tag and form_for through form_with (extract the implementations to a common object and set configs)

[kaspth]

@dhh added the fields method to do:

form_with(model: @post) do |form|
  form.fields(:comment, model: @comment) do |fields|
    fields.text_field # ...
  end
end

But it reads a bit weird if the passed model is a collection: fields(:comments, model: @post.comments).

Not sure if you intended this to be much more than a fields_for alias with the don't output ids and classes by default config.

[kaspth]

Documented form_with and had one hell of a time doing it! Really got to know the existing API and where the new one differs, plus in what way it does.

Will add docs for fields tomorrow.

[kaspth]

Figured since form_with already doesn't output id and class by default, we may as well rejigger the remaining default at the form level: remote. It's now on by default!

[kaspth]

This should be everything that's needed to prevent the default ids:

diff --git a/actionview/lib/action_view/helpers/form_helper.rb b/actionview/lib/action_view/helpers/form_helper.rb
index ef114b3..8550ad8 100644
--- a/actionview/lib/action_view/helpers/form_helper.rb
+++ b/actionview/lib/action_view/helpers/form_helper.rb
@@ -703,7 +703,7 @@ def form_with(model: nil, scope: nil, url: nil, format: nil, html: {}, remote: t
         html_options[:remote] = remote unless html_options.key?(:remote)

         if block_given?
-          builder = instantiate_builder(scope, model, options)
+          builder = instantiate_builder(scope, model, options.merge(skip_default_ids: true))
           output  = capture(builder, &Proc.new)
           html_options[:multipart] ||= builder.multipart?

@@ -963,12 +963,7 @@ def fields_for(record_name, record_object = nil, options = {}, &block)

       # TODO: Documentation
       def fields(scope = nil, model: nil, **options, &block)
-        # TODO: Remove when ids and classes are no longer output by default.
-        if model
-          scope ||= model_name_from_record_or_class(model).param_key
-        end
-
-        builder = instantiate_builder(scope, model, options)
+        builder = instantiate_builder(scope, model, options.merge(skip_default_ids: true))
         capture(builder, &block)
       end

@@ -1537,7 +1532,7 @@ def to_model
       def initialize(object_name, object, template, options)
         @nested_child_index = {}
         @object_name, @object, @template, @options = object_name, object, template, options
-        @default_options = @options ? @options.slice(:index, :namespace) : {}
+        @default_options = @options ? @options.slice(:index, :namespace, :skip_default_ids) : {}
         if @object_name.to_s.match(/\[\]$/)
           if (object ||= @template.instance_variable_get("@#{Regexp.last_match.pre_match}")) && object.respond_to?(:to_param)
             @auto_index = object.to_param
@@ -1840,6 +1835,7 @@ def fields_for(record_name, record_object = nil, fields_options = {}, &block)

       # TODO: Documentation
       def fields(scope = nil, model: nil, **options, &block)
+        options[:skip_default_ids] = true
         fields_for(scope || model, model, **options, &block)
       end

diff --git a/actionview/lib/action_view/helpers/tags/base.rb b/actionview/lib/action_view/helpers/tags/base.rb
index cf8a6d6..b8c446c 100644
--- a/actionview/lib/action_view/helpers/tags/base.rb
+++ b/actionview/lib/action_view/helpers/tags/base.rb
@@ -13,6 +13,7 @@ def initialize(object_name, method_name, template_object, options = {})

           @object_name.sub!(/\[\]$/, "") || @object_name.sub!(/\[\]\]$/, "]")
           @object = retrieve_object(options.delete(:object))
+          @skip_default_ids = options.delete(:skip_default_ids)
           @options = options
           @auto_index = Regexp.last_match ? retrieve_autoindex(Regexp.last_match.pre_match) : nil
         end
@@ -81,9 +82,12 @@ def add_default_name_and_id_for_value(tag_value, options)
           def add_default_name_and_id(options)
             index = name_and_id_index(options)
             options["name"] = options.fetch("name") { tag_name(options["multiple"], index) }
-            options["id"] = options.fetch("id") { tag_id(index) }
-            if namespace = options.delete("namespace")
-              options["id"] = options["id"] ? "#{namespace}_#{options['id']}" : namespace
+
+            unless skip_default_ids?
+              options["id"] = options.fetch("id") { tag_id(index) }
+              if namespace = options.delete("namespace")
+                options["id"] = options["id"] ? "#{namespace}_#{options['id']}" : namespace
+              end
             end
           end

@@ -154,6 +158,10 @@ def add_options(option_tags, options, value = nil)
           def name_and_id_index(options)
             options.key?("index") ? options.delete("index") || "" : @auto_index
           end
+
+          def skip_default_ids?
+            @skip_default_ids
+          end
       end
     end
   end

I think there's likely more code we can skip in the tags.

[kaspth]

Allright, I think this is ready for review 😁 — I'll merge this tomorrow/tuesday/later depending on the feedback.

[vipulnsward]

controllers

[vipulnsward]

Don't think this needs title case. It is referenced as small case in its own documentation.

[vipulnsward]

I would use "similar" instead of "Akin", since its easier to understand.

[kaspth]

Akin seems fine to me.

[vipulnsward]

post, put, patch, etc

[vipulnsward]

either comma after "by", or "and" instead of "by".

[vipulnsward]

<tt>:authenticity_token</tt>

[vipulnsward]

Looks like wrong output?

[vipulnsward]

it, in

[kaspth]

Think it's valid without the comma.

[vipulnsward]

value, a

[vipulnsward]

object, returns

[kaspth]

No those words are meant to stay together. We're talking about the return value of the reader method.

[vipulnsward]

I believe this needs the same fixes from above.

[dhh]

Since we're actually dropping jquery-ujs, maybe we need to tell a different story here.

[kaspth]

I thought we we're just dropping the jquery in jquery-ujs. Isn't the plan to keep the ujs behavior around?

[dhh]

Yeah, UJS is still there. Just that referencing jquery-ujs seems dated when that won't be the default.

[kaspth]

Got it 👍

[dhh]

Since our new default is remote: true, I think we need to think this through a little more. Like having authenticity_token be reliant on that value. If you do remote: false, THEN we'll by default include authenticity_token, but otherwise not. And in both cases you can always supply one via the option to overwrite the default.

[kaspth]

Yup, figured it was just flipping the default. But of course there's repercussions.

[matthewd]

I suspect we should keep the token by default, because otherwise our default forms are broken on JS-less browsers (and anywhere without UJS present). I could maybe see the UJS gem toggling it off by default, but making UJS a hard dep for form submissions to work [out of the box] seems a bit rough.

[kaspth]

True, I guess that was the reason for config.action_view.embed_authenticity_token_in_remote_forms as well.

[dhh]

True. Guess it can just ignore those embedded tokens. I was thinking that remote: true would force the form remote, but of course, if JS is off, that won't be read.

[dhh]

The default is true, so needs to flip what this is for.

[kaspth]

Ah yes!

[dhh]

When we have options that are default true, then it's generally better to flip the key name to a negative, imo. So we'd go with skip_enforcing_utf8: true.

[kaspth]

This was lifted from form_for. I figured the parity was better when it was a relatively oft unused option. Do you prefer that we rename still?

[dhh]

This is a new API, so I saw we make the best choices we know how. Keeping parity is not important.

[kaspth]

Sure, then we should give that treatment to these options too:

skip_id: true # Was `include_id: false` for nested `fields`
skip_authenticity_token: true # Was just `authenticity_token: false`
local: true # Was `remote: true`. Not sure about this one though.

[kaspth]

Backing out of the skip_authenticy_token: true change. Since specifying a custom token via authenticy_token: 'abcdef' is valid. And would rather not have two options for the same thing.

[dhh]

Fix when we default token to off with remote: true.

[dhh]

All this prep work is only used in the block_given? path, so it should be done there. Also, I think there's more we can do to make this a Composed Method. A lot of mechanics exposed at a high level.

[kaspth]

It's used in the else too as the last parameter here too: html_options = html_options_for_form(url || {}, html_options)

But yeah, let me see what I can do with the composition 👍

[dhh]

Mixed use of ERB insertion tags. Should use them for form_with too.

[dhh]

I'd actually like to kill accepts_nested_attributes_for in due time. Don't think we should promote it for this new API. Rather, let's just show how to do it by hand in the controller.

[kaspth]

Oh yeah! 🔥 Reading through this I thought accepts_nested_attributes_for stuck out, refrained from doing anything because I didn't have a better idea yet. But yes, let's start down the path toward something better!

[dhh]

For starters, I'd just drop the entire topic for now.

[dhh]

Seems all this doc stuff is repeated from above?

[kaspth]

Yup, copied to mirror how fields_for documents itself (i.e. both as the helper and in the builder). I'll update this to just refer to the fields helper docs above.

[kaspth]

@vipulnsward @dhh thanks for the feedback, I'll look more into this tomorrow 👍

[kaspth]

@dhh inverted the option names, removed the nested attributes example and tried to make form_with a bit more composed.

However, that carried over a lot of baggage from copying over html_options_for_form —

rails/actionview/lib/action_view/helpers/form_tag_helper.rb

Lines 833 to 854 in 6d6249b

	def html_options_for_form(url_for_options, options)
	options.stringify_keys.tap do |html_options|
	html_options["enctype"] = "multipart/form-data" if html_options.delete("multipart")
	# The following URL is unescaped, this is just a hash of options, and it is the
	# responsibility of the caller to escape all the values.
	html_options["action"] = url_for(url_for_options)
	html_options["accept-charset"] = "UTF-8"
	html_options["data-remote"] = true if html_options.delete("remote")
	if html_options["data-remote"] &&
	!embed_authenticity_token_in_remote_forms &&
	html_options["authenticity_token"].blank?
	# The authenticity token is taken from the meta tag in this case
	html_options["authenticity_token"] = false
	elsif html_options["authenticity_token"] == true
	# Include the default authenticity_token, which is only generated when its set to nil,
	# but we needed the true value to override the default of no authenticity_token on data-remote.
	html_options["authenticity_token"] = nil
	end
	end
	end

— which was the most sensible way to do it that I could see.

I think it would be easier to improve the code structure further here in more focused commits after this PR.

[dhh]

Looks pretty good to me 👍

[claudiob]

@kaspth Thanks for this PR.

You added a fields method to Action View which lets you group multiple fields together, so that:

<%= fields :comment do |fields| %>
  <%= fields.text_field :subject %>
  <%= fields.text_field :body %>
<% end %>

becomes:

<input type="text" name="comment[subject] id="comment_subject">
<input type="text" name="comment[body] id="comment_body">

As you see, the HTML has lost the nuance that those two fields are grouped together.

In my mind, since you are grouping them together in your code, a better output would be:

<fieldset>
  <input type="text" name="comment[subject] id="comment_subject">
  <input type="text" name="comment[body] id="comment_body">
</fieldset>

since the fieldset HTML tag is used to group related elements in a form:

Grouping related form controls makes forms more understandable for all users, as related controls are easier to identify. It also makes it easier for people to focus on smaller and more manageable groups rather than try to grasp the entire form at once.

Grouping needs to be carried out visually and in the code, for example, by using the <fieldset> and <legend> elements to associate related form controls.

@kaspth (and @dhh -- original requester for this PR)… what is your opinion on this?

Could the fields method introduced here have at least an option to wrap the fields in a <fieldset>?

[kaspth]

I'd rather just defer any extra markup onto people themselves, so they have the complete freedom on how to design their forms.

[aditya-vector]

This means when passing :url option, I would have to explicitly attach the format to the url as well? Wouldnt it be nicer to allow url without an explicit format and allow :format option too?

[aledalgrande]

This doesn't seem to be in the Rails guides, is it?