Fix textarea and hidden field HTML export

TextareaField was exported as `<input type="textarea">`. That input type
does not exist, so browsers degrade it to `type="text"`: the field
rendered as a single line, could not hold line breaks, and Enter
triggered the browser's implicit form submission.

- Render TextareaField as a real `<textarea>`, with the value as element
  content (HTML-escaped, so a value containing `</textarea>` can no
  longer break the markup) instead of a `value` attribute.
- Emit the `rows`, `cols`, `minlength` and `maxlength` attributes, which
  were declared on the model but never reached the HTML.
- Honour `readonly` on textarea and regular inputs.
- Render hidden fields as a bare `<input type="hidden">`, without the
  `form-group` wrapper and `form-control` class that reserved visible
  vertical space for every hidden field in a form.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: Juan Pablo Manson

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codeforms"
-version = "0.2.2"
+version = "0.2.3"
 description = "Python library for creating, validating, and rendering web forms using Pydantic"
 readme = "README.md"
 requires-python = ">=3.9"

src/codeforms/export.py

@@ -1,4 +1,5 @@
 from enum import Enum
+from html import escape as html_escape
 from typing import Any, Dict
 
 from codeforms.fields import (
@@ -322,6 +323,24 @@ def field_to_html(field: FormFieldBase, **kwargs) -> str:
         form_group_class = "form-field"
         help_text_class = "help-text"
 
+    # Un campo oculto no lleva label, clases de presentacion ni wrapper: el
+    # <div class="form-group"> reservaba espacio vertical visible por cada
+    # hidden del formulario.
+    if field.field_type_value == "hidden":
+        hidden_attrs = {
+            "id": str(field.id),
+            "name": field.name,
+            "type": "hidden",
+        }
+        hidden_value = field.default_value
+        if hidden_value is None:
+            hidden_value = getattr(field, "value", None)
+        if hidden_value is not None:
+            hidden_attrs["value"] = str(hidden_value)
+        hidden_attrs.update(field.attributes)
+        attrs_str = " ".join(f'{k}="{v}"' for k, v in hidden_attrs.items() if v)
+        return f"<input {attrs_str}>"
+
     skip_label = ["hidden"]
 
     label_html = ""
@@ -422,6 +441,43 @@ def field_to_html(field: FormFieldBase, **kwargs) -> str:
             '<div class="checkbox-group">' + "".join(checkbox_html_parts) + "</div>"
         )
 
+    # Manejar campos TEXTAREA de manera especial
+    # Un textarea no es un <input>: necesita etiqueta propia y el valor va como
+    # contenido, no como atributo. Renderizarlo como <input type="textarea">
+    # produce un campo de una sola linea (el navegador lo degrada a type="text"),
+    # perdiendo el salto de linea y disparando el submit implicito con Enter.
+    elif field.field_type_value == "textarea":
+        textarea_attrs = {
+            "id": str(field.id),
+            "name": field.name,
+            "class": f"{base_input_class} {field.css_classes or ''}".strip(),
+            "placeholder": field.placeholder or "",
+        }
+
+        for attr_name in ("rows", "cols", "minlength", "maxlength"):
+            attr_value = getattr(field, attr_name, None)
+            if attr_value is not None:
+                textarea_attrs[attr_name] = str(attr_value)
+
+        if field.required:
+            textarea_attrs["required"] = "required"
+
+        if field.readonly:
+            textarea_attrs["readonly"] = "readonly"
+
+        # Agregar atributos personalizados
+        textarea_attrs.update(field.attributes)
+
+        attrs_str = " ".join(f'{k}="{v}"' for k, v in textarea_attrs.items() if v)
+
+        # El contenido se escapa: un valor con "</textarea>" romperia el markup
+        content = field.default_value
+        if content is None:
+            content = getattr(field, "value", None)
+        content_html = html_escape(str(content), quote=False) if content else ""
+
+        input_html = f"<textarea {attrs_str}>{content_html}</textarea>"
+
     # Manejar campos normales (input)
     else:
         attributes = {
@@ -438,6 +494,9 @@ def field_to_html(field: FormFieldBase, **kwargs) -> str:
         if field.required:
             attributes["required"] = "required"
 
+        if field.readonly:
+            attributes["readonly"] = "readonly"
+
         if field.default_value is not None:
             attributes["value"] = str(field.default_value)
 

tests/test_textarea_export.py

@@ -0,0 +1,152 @@
+from __future__ import annotations
+
+import pytest
+
+from codeforms import Form
+from codeforms.fields import TextareaField
+
+
+def _export(field: TextareaField, output_format: str = "html_bootstrap4") -> str:
+    form = Form(name="comment_form", title="Comentario", content=[field])
+    return form.export(output_format=output_format, id="form1")["output"]
+
+
+@pytest.mark.parametrize("output_format", ["html", "html_bootstrap4", "html_bootstrap5"])
+def test_textarea_renders_as_textarea_tag(output_format):
+    """Un textarea debe emitirse como <textarea>, nunca como <input>."""
+    html = _export(TextareaField(name="comentario", label="Comentario"), output_format)
+
+    assert "<textarea " in html
+    assert "</textarea>" in html
+    # El bug original: <input type="textarea"> el navegador lo degrada a
+    # type="text", quedando un campo de una sola linea.
+    assert 'type="textarea"' not in html
+
+
+def test_textarea_keeps_name_and_id():
+    field = TextareaField(name="comentario", label="Comentario")
+    html = _export(field)
+
+    assert 'name="comentario"' in html
+    assert f'id="{field.id}"' in html
+
+
+def test_textarea_emits_size_and_length_attributes():
+    html = _export(
+        TextareaField(
+            name="comentario",
+            label="Comentario",
+            rows=8,
+            cols=40,
+            minlength=10,
+            maxlength=500,
+        )
+    )
+
+    assert 'rows="8"' in html
+    assert 'cols="40"' in html
+    assert 'minlength="10"' in html
+    assert 'maxlength="500"' in html
+
+
+def test_textarea_default_rows_is_emitted():
+    """rows tiene default 3 en el modelo y debe llegar al HTML."""
+    html = _export(TextareaField(name="comentario", label="Comentario"))
+
+    assert 'rows="3"' in html
+
+
+def test_textarea_required_and_readonly():
+    html = _export(
+        TextareaField(
+            name="comentario", label="Comentario", required=True, readonly=True
+        )
+    )
+
+    assert 'required="required"' in html
+    assert 'readonly="readonly"' in html
+
+
+def test_textarea_value_goes_in_content_not_attribute():
+    html = _export(
+        TextareaField(
+            name="comentario", label="Comentario", default_value="Primera linea"
+        )
+    )
+
+    assert ">Primera linea</textarea>" in html
+    assert 'value="Primera linea"' not in html
+
+
+def test_textarea_content_is_escaped():
+    """Un valor con markup no debe poder cerrar el textarea."""
+    html = _export(
+        TextareaField(
+            name="comentario",
+            label="Comentario",
+            default_value="</textarea><script>alert(1)</script>",
+        )
+    )
+
+    assert "<script>" not in html
+    assert html.count("</textarea>") == 1
+
+
+def test_textarea_placeholder_and_custom_attributes():
+    html = _export(
+        TextareaField(
+            name="comentario",
+            label="Comentario",
+            placeholder="Escribi un comentario",
+            attributes={"data-test": "comentario"},
+        )
+    )
+
+    assert 'placeholder="Escribi un comentario"' in html
+    assert 'data-test="comentario"' in html
+
+
+def test_textarea_gets_bootstrap_class():
+    html = _export(TextareaField(name="comentario", label="Comentario"))
+
+    assert 'class="form-control"' in html
+
+
+def test_textarea_has_label_bound_to_field():
+    field = TextareaField(name="comentario", label="Comentario")
+    html = _export(field)
+
+    assert f'for="{field.id}"' in html
+    assert ">Comentario</label>" in html
+
+
+def test_readonly_input_emits_readonly():
+    from codeforms.fields import TextField
+
+    form = Form(
+        name="f",
+        title="t",
+        content=[TextField(name="codigo", label="Codigo", readonly=True)],
+    )
+    html = form.export(output_format="html_bootstrap4", id="form1")["output"]
+
+    assert 'readonly="readonly"' in html
+
+
+def test_hidden_field_has_no_wrapper_or_presentation_classes():
+    """Los hidden no deben ocupar espacio ni arrastrar clases de presentacion."""
+    from codeforms.fields import HiddenField
+
+    form = Form(
+        name="f",
+        title="t",
+        content=[HiddenField(name="_action", value="approve", label=None)],
+    )
+    html = form.export(output_format="html_bootstrap4", id="form1")["output"]
+
+    assert 'name="_action"' in html
+    assert 'value="approve"' in html
+    assert 'type="hidden"' in html
+    assert "form-group" not in html
+    assert "form-control" not in html
+    assert "<label" not in html