Replace nested_form with RailsAdmin's own nested form implementation

[mshibuya]

Replaces the nested_form dependency with RailsAdmin's own implementation. Closes #3723.

nested_form has been archived since 2021. This reimplements what RailsAdmin used it for without reading its source: the contract was reconstructed from RailsAdmin's own call sites and from the HTML a rendered form actually contains, so there is no derivative work here. The vendored copy of its jQuery plugin is removed unopened.

What this means for applications

An application that has not customized the nested form markup has nothing to do. nested_form false, the nested section and inline_add all behave as before, and so does the whole server-side parameter path.

The class names are unchanged too — .fields, .add_nested_fields, .remove_nested_fields, .tab-pane, .object-infos, data-nestedmany, data-nestedone — so existing styling keeps working, with one exception: both controls are now <button type="button"> rather than <a href="javascript:void(0)">, so a selector written as a.add_nested_fields needs the a dropped. In exchange, RailsAdmin's forms no longer need a javascript: URL allowed in your Content Security Policy.

A custom _form_nested_many or _form_nested_one partial needs one line changed:

- <%= form.fields_for field.name do |nested_form| %>
+ <%= form.nested_fields_for field do |nested_form| %>

link_to_add and link_to_remove keep their names and their arguments. Renaming them was considered and dropped: it would have cost every application that customized these partials a change, in return for nothing but tidier vocabulary. Both controls now decide for themselves whether to appear, so the conditions around them can go — #nested_fields_for is the only method this adds to the public surface.

Code that hooked the JavaScript needs updating: window.nestedFormEvents and the jQuery nested:fieldAdded / nested:fieldRemoved events are replaced by rails_admin.nested_field_added and rails_admin.nested_field_removed, CustomEvents dispatched on the row and carrying {field, association} and {field, group, destroyed}.

All of this is in docs/upgrading-to-4.md.

How it works now

A nested association used to be cloned from an HTML string, HTML-escaped into a data-blueprint attribute on a page-global <div> emitted after the form. It now renders an inert <template> as the last child of its own .tab-content, and the add button finds it by name within its control group.

Position carries what the global id was encoding, which is where most of the value is: nothing page-global is left to collide, a child's template rides along inside its parent's, and the markup is escaped once by ERB rather than escaped into an attribute and unescaped again by the browser.

Fixed along the way

• Adding a row to a nested form shown in a modal built it from the form behind the modal. The row's inputs were named for the wrong model, so whatever was typed into it was dropped on save.
• A row you had just added could not be removed once the form came back from a failed save, on an association configured with allow_destroy: false.
• A nested form for an association that can reach itself — Mongoid's recursively_embeds_many, or a self-referential has_many — hung the request, climbing past 560 MB resident in seven minutes. One association may now repeat at most MAX_NESTED_FORM_RECURSION levels down a chain; a chain of distinct models stays unlimited. recursively_embeds_* had no integration coverage at all before.

Verification

ActiveRecord, Rails 8.1	1284 examples, 0 failures
Mongoid, Rails 8.1	1076 examples, 0 failures
composite_primary_keys, Rails 7.0	1284 examples, 0 failures

The three ActionView methods this hooks into are byte-identical between 7.0.8.4 and 8.1.3.1, so there is no version spread across >= 7.0, < 9.

🤖 Generated with Claude Code

[coveralls]

coverage: 96.331% (+0.05%) from 96.285% — nested-form/replacement into master