2.7.0

Author: offerrall

CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [2.7.0] - 2026-09-13
+
+- `hidden` supports nested object paths (`config.token`) and list wildcards
+  (`items.*.token`) through pytypehintweb 1.2.0. `OpenForm` validates paths
+  against the target plan. The page delegates visibility to the widget compiler,
+  sharing its traversal with prefill. Hidden fields now remain in the DOM with
+  the native `hidden` attribute and keep their values and validation.
+
 ## [2.6.2] - 2026-09-13
 
 ### Added

README.md

@@ -1,4 +1,4 @@
-# FuncToWeb 2.6.2
+# FuncToWeb 2.7.0
 
 [![PyPI version](https://img.shields.io/pypi/v/func-to-web.svg)](https://pypi.org/project/func-to-web/)
 [![Python](https://img.shields.io/pypi/pyversions/func-to-web.svg)](https://pypi.org/project/func-to-web/)
@@ -521,7 +521,7 @@ practice.
 
 ## Status
 
-**FuncToWeb 2.6.2 is stable, used daily and actively maintained.**
+**FuncToWeb 2.7.0 is stable, used daily and actively maintained.**
 
 The public API is the one described in
 [`docs/`](docs/index.md), and the known limitations are listed in

docs/open-form.md

@@ -75,6 +75,9 @@ OpenForm(edit_product, hidden=("product_id",))
 OpenForm(edit)
 ```
 
+`hidden` accepts root names and nested paths such as `"config.token"` or
+`"items.*.token"`; see [prefill.md](prefill.md#nested-fields).
+
 `hidden` is a tuple of `str` with the usual semantics: it hides the field on the
 target form, without fixing or protecting it. A list, a bare string, or an
 element that is not a `str` raises a `TypeError` when the metadata is built.

docs/prefill.md

@@ -139,7 +139,7 @@ like any other value and the resolver recognizes it. See [files.md](files.md).
 
 ## Hidden parameters
 
-`hidden` takes the widget out of the page. What happens to the parameter is
+`hidden` hides the widget and its label using the native `hidden` attribute. What happens to the parameter is
 exactly this:
 
 * it stays compiled into the form, with its value (the prefill's, or its own
@@ -155,6 +155,29 @@ element exactly a `str`. Duplicates, ordering and unknown names are not its
 business, because hiding is a visual matter and a misspelled name does not
 break any contract.
 
+### Nested fields
+
+Use dotted paths for object fields and `*` for every item of a list:
+
+```javascript
+{
+  prefill: {config: {token: "abc", name: "Demo"}},
+  hidden: ["config.token"]
+}
+```
+
+`hidden: ["items.*.token"]` hides `token` in all items, including newly added
+ones. Nested lists use another `*`: `"items.*.*.token"`. Hiding `"config"`
+still hides the entire parameter. Optional and union wrappers add no segment;
+a path applies to every union branch containing the field. Numeric indices
+and branch-specific selectors are not supported.
+
+Preloaded values and visibility descend through the same widget compiler.
+Hidden children retain their values, validation and uploads. They stay in the
+DOM with `hidden`, so select visible fields explicitly when inspecting a page.
+URL/SDK paths that resolve to no field have no effect. `OpenForm` checks paths
+against the target plan and rejects unresolved paths during registration.
+
 ### It hides, it does not lock
 
 ```text

docs/run.md

@@ -48,7 +48,7 @@ Which two directories were in force is not left to be guessed: `run()`
 announces them, with the version, on the line before the server starts.
 
 ```text
-FuncToWeb 2.6.2
+FuncToWeb 2.7.0
 UPLOADS DIR: /srv/functoweb/uploads
 RETURNS DIR: /tmp/FuncToWeb/returns
 ```

pyproject.toml

@@ -25,7 +25,7 @@ classifiers = [
 ]
 
 dependencies = [
-    "pytypehintweb==1.1.0",
+    "pytypehintweb==1.2.0",
     "starlette==0.49.3",
     "uvicorn==0.38.0",
 ]

src/func_to_web/config.py

@@ -3,7 +3,7 @@
 from sys import platform
 from tempfile import gettempdir
 
-__version__ = "2.6.2"
+__version__ = "2.7.0"
 
 NAME: str = "".join(part.title() for part in __name__.split(".")[0].split("_"))
 

src/func_to_web/models/functions.py

@@ -148,16 +148,41 @@ def _target_of(
 
 
 def _check_hidden(mark: OpenForm, target: WebFunction) -> None:
-    names = {param.name for param in target.schema.params}
-
     for name in mark.hidden:
-        if name not in names:
+        if not _has_hidden_path(target.plan, name):
             raise ReturnContractError(
                 f"unknown hidden field {name!r} for OpenForm target "
                 f"{target.slug!r}"
             )
 
 
+def _has_hidden_path(node: dict[str, Any], path: str) -> bool:
+    """Resolve visibility against the same plan the browser compiles.
+
+    Optional and choice wrappers do not add path components. A list consumes
+    '*', so its rule also applies to items created later in the browser.
+    """
+    kind = node["kind"]
+    if kind in ("form", "object"):
+        return any(
+            path == field["name"] or (
+                path.startswith(field["name"] + ".")
+                and _has_hidden_path(field["node"], path[len(field["name"]) + 1:])
+            )
+            for field in node["fields"]
+        )
+    if kind == "list":
+        return path == "*" or (
+            path.startswith("*.") and _has_hidden_path(node["item"], path[2:])
+        )
+    if kind == "optional":
+        return _has_hidden_path(node["node"], path)
+    if kind == "choice":
+        return any(_has_hidden_path(branch["node"], path)
+                   for branch in node["branches"])
+    return False
+
+
 FunctionEntry: TypeAlias = Callable[..., Any] | WebFunction
 FunctionInput: TypeAlias = (
     WebFunctions | FunctionEntry | Iterable[FunctionEntry]

src/func_to_web/static/page.js

@@ -8,19 +8,18 @@ import { runUploads } from "./upload.js";
 
 const plan = JSON.parse(
     document.getElementById("functoweb-plan").textContent);
-const form = compileForm(plan);
+const hidden = JSON.parse(
+    document.getElementById("functoweb-hidden").textContent);
+const form = compileForm(plan, { hidden });
 
 const labels = new Map(plan.fields.map((field) => [field.name, field.label]));
 
-const hidden = new Set(JSON.parse(
-    document.getElementById("functoweb-hidden").textContent));
-
 const autorun = JSON.parse(
     document.getElementById("functoweb-autorun").textContent);
 
 const fields = document.getElementById("fields");
 for (const field of form.fields) {
-    if (!hidden.has(field.name)) fields.append(field.widget.el);
+    fields.append(field.widget.el);
 }
 
 const result = document.getElementById("result");

tests/e2e/conftest.py

@@ -7,7 +7,7 @@
 
 warm_uvicorn()
 
-READY = "#fields .pth-field"
+READY = "#fields .pth-field:visible"
 
 TIMEOUT = 15000