feat(transaction): add support for file attachments using Active Storage (#713)

* feat(transaction): add support for file attachments using Active Storage

* feat(attachments): implement transaction attachments with upload, show, and delete functionality

* feat(attachments): enhance attachment upload functionality to support multiple files and improved error handling

* feat(attachments): add attachment upload form and display functionality in transaction views

* feat(attachments): implement attachment validation for count, size, and content type; enhance upload form with validation hints

* fix(attachments): use correct UI components

* feat(attachments): Implement Turbo Stream responses for creating and deleting transaction attachments.

* fix(attachments): include auth in activestorage controller

* test(attachments): add test coverage for turbostream and auth

* feat(attachments): extract strings to i18n

* fix(attachments): ensure only newly added attachments are purged when transaction validation fails.

* fix(attachments): validate attachment params

* refactor(attachments): use stimulus declarative actions

* fix(attachments): add auth for other representations

* refactor(attachments): use Browse component for attachment uploads

* fix(attachments): reject empty values on attachment upload

* fix(attachments): hide the upload form if reached max uploads

* fix(attachments): correctly purge only newly added attachments on upload failure

* fix(attachments): ensure attachment count limit is respected within a transaction lock

* fix(attachments): update attachment parameter handling to avoid `ParameterMissing` errors.

* fix(components): adjust icon_only logic for buttonish

---------

Signed-off-by: Juan José Mata <juanjo.mata@gmail.com>
Co-authored-by: Juan José Mata <juanjo.mata@gmail.com>

app/controllers/transaction_attachments_controller.rb

@@ -0,0 +1,98 @@
+class TransactionAttachmentsController < ApplicationController
+  before_action :set_transaction
+  before_action :set_attachment, only: [ :show, :destroy ]
+
+  def show
+    disposition = params[:disposition] == "attachment" ? "attachment" : "inline"
+    redirect_to rails_blob_url(@attachment, disposition: disposition)
+  end
+
+  def create
+    attachments = attachment_params
+
+    if attachments.present?
+      @transaction.with_lock do
+        # Check attachment count limit before attaching
+        current_count = @transaction.attachments.count
+        new_count = attachments.is_a?(Array) ? attachments.length : 1
+
+        if current_count + new_count > Transaction::MAX_ATTACHMENTS_PER_TRANSACTION
+          respond_to do |format|
+            format.html { redirect_back_or_to transaction_path(@transaction), alert: t("transactions.attachments.cannot_exceed", count: Transaction::MAX_ATTACHMENTS_PER_TRANSACTION) }
+            format.turbo_stream { flash.now[:alert] = t("transactions.attachments.cannot_exceed", count: Transaction::MAX_ATTACHMENTS_PER_TRANSACTION) }
+          end
+          return
+        end
+
+        existing_ids = @transaction.attachments.pluck(:id)
+        attachment_proxy = @transaction.attachments.attach(attachments)
+
+        if @transaction.valid?
+          count = new_count
+          message = count == 1 ? t("transactions.attachments.uploaded_one") : t("transactions.attachments.uploaded_many", count: count)
+          respond_to do |format|
+            format.html { redirect_back_or_to transaction_path(@transaction), notice: message }
+            format.turbo_stream { flash.now[:notice] = message }
+          end
+        else
+          # Remove invalid attachments
+          newly_added = Array(attachment_proxy).reject { |a| existing_ids.include?(a.id) }
+          newly_added.each(&:purge)
+          error_messages = @transaction.errors.full_messages_for(:attachments).join(", ")
+          respond_to do |format|
+            format.html { redirect_back_or_to transaction_path(@transaction), alert: t("transactions.attachments.failed_upload", error: error_messages) }
+            format.turbo_stream { flash.now[:alert] = t("transactions.attachments.failed_upload", error: error_messages) }
+          end
+        end
+      end
+    else
+      respond_to do |format|
+        format.html { redirect_back_or_to transaction_path(@transaction), alert: t("transactions.attachments.no_files_selected") }
+        format.turbo_stream { flash.now[:alert] = t("transactions.attachments.no_files_selected") }
+      end
+    end
+  rescue => e
+    logger.error "#{e.class}: #{e.message}\n#{e.backtrace.join("\n")}"
+    respond_to do |format|
+      format.html { redirect_back_or_to transaction_path(@transaction), alert: t("transactions.attachments.upload_failed") }
+      format.turbo_stream { flash.now[:alert] = t("transactions.attachments.upload_failed") }
+    end
+  end
+
+  def destroy
+    @attachment.purge
+    message = t("transactions.attachments.attachment_deleted")
+    respond_to do |format|
+      format.html { redirect_back_or_to transaction_path(@transaction), notice: message }
+      format.turbo_stream { flash.now[:notice] = message }
+    end
+  rescue => e
+    logger.error "#{e.class}: #{e.message}\n#{e.backtrace.join("\n")}"
+    respond_to do |format|
+      format.html { redirect_back_or_to transaction_path(@transaction), alert: t("transactions.attachments.delete_failed") }
+      format.turbo_stream { flash.now[:alert] = t("transactions.attachments.delete_failed") }
+    end
+  end
+
+  private
+
+    def set_transaction
+      @transaction = Current.family.transactions.find(params[:transaction_id])
+    end
+
+    def set_attachment
+      @attachment = @transaction.attachments.find(params[:id])
+    end
+
+    def attachment_params
+      if params.has_key?(:attachments)
+        Array(params.fetch(:attachments, [])).reject(&:blank?).map do |param|
+          param.respond_to?(:permit) ? param.permit(:file, :filename, :content_type, :description, :metadata) : param
+        end
+      elsif params.has_key?(:attachment)
+        param = params[:attachment]
+        return nil if param.blank?
+        param.respond_to?(:permit) ? param.permit(:file, :filename, :content_type, :description, :metadata) : param
+      end
+    end
+end