class Bezel::HtmlBuilder

include DslScope, Bezel::Elements

Writes HTML: an element per method (h.div, h.a, ...; see HtmlBuilder in src/html/elements.qz), each taking its content as a text (escaped) or a block, its attributes as keywords, and the global ones (id:, class_name: for class, style:, title:, lang:, dir:, hidden:, tabindex:, role:, data: for data-*, aria: for aria-*, and attrs: for any other). (class cannot name a parameter; class: waits for quarz-lang/quarz#382.) A String attribute is escaped, nil leaves it out, true writes a boolean attribute and false none; an attribute given twice is an ArgumentError. A URL attribute (href, src, action, formaction, cite, poster, a srcset's candidates, a meta refresh's url=, and those names and the other URL attributes of AttrList::URL_NAMES in attrs:) must be relative or of the schemes http, https, mailto or tel (data:image/ for images): another (javascript:) is an ArgumentError. srcdoc is refused. A style is escaped but not checked: do not build one from input.

A form or link carries a CSRF token only when the builder has one: Bezel.html(conn), with the CSRF plug (bezel#6) setting it.

src/html.qz:89

Constants

SCHEMES: Array[String]

The schemes a URL attribute may have.

src/html.qz:215

TEXT_CONTAINERS: Array[String]

The elements whose content the parser reads as text up to their end tag (raw text and RCDATA, and noscript, raw text when scripting is on).

src/html.qz:257

Class methods

def self.new(csrf_token: String? = …) -> Bezel::HtmlBuilder

A builder whose forms carry csrf_token (when given).

src/html.qz:98

Methods

def csrf_token -> String?

The CSRF token forms carry, or nil.

src/html.qz:101

def to_html -> Bezel::Html

What was written, as Html (the builder is left empty).

src/html.qz:104

def text(text: String) -> Void

Writes text, escaped.

src/html.qz:107

def put(value: Object?) -> Void

Writes value as a template's {expr} does: Html as it is, nil as nothing, anything else as its to_s, escaped.

src/html.qz:114

def append(html: Bezel::Html) -> Void

Writes html as it is: Html is safe already.

src/html.qz:123

def raw(source: String) -> Void

Writes source without escaping it: the caller vouches that it is safe. Never pass it what a request sent.

src/html.qz:130

def doctype -> Void

Writes <!DOCTYPE html>.

src/html.qz:136

def component(c: Bezel::Component) -> Void

Writes the component, with the HTML the block makes (none without one) as its content.

src/html.qz:140

def component(c: Bezel::Component, &block: () -> Void) -> Void

Writes the component, with the HTML the block makes (none without one) as its content.

src/html.qz:143

def capture(&block: () -> Void) -> Bezel::Html

The HTML the block writes, as Html, without writing it here.

src/html.qz:148

def hidden_input(name: String, value: String) -> Void

Writes <input type="hidden" name="..." value="...">.

src/html.qz:186

def csrf_input -> Void

Writes the hidden CSRF field (_csrf_token) when the builder has a token.

src/html.qz:190

def form_for[M <: Rotor::Model](cs: Rotor::Changeset[M], *, action: String, method: Symbol = …, as: String? = …, class_name: String | Array[String?] | Nil = …, &block: (Bezel::FormBuilder) -> Void) -> Void

A form over a rotor changeset: <form action=... method="post"> with _method for another method and the CSRF token, and the block given a FormBuilder whose fields read the changeset (see FormBuilder). The fields' names are <as>[<field>], as by default the model's class name in snake_case (user[email]).

src/html.qz:200