active_admin_filter_extensions 1.0.0

data/spec/integration/filter_defaults_spec.rb

@@ -0,0 +1,229 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+require "rack/utils"
+
+# The sample app registers Post once per filter input type - see spec/support/rails_template.rb.
+# Every default below selects `keep me` and rejects `drop me`, so one pair of records exercises
+# all of them. Capybara follows the one canonicalizing redirect, so every example asserts the
+# final page.
+RSpec.describe "Filter default values", type: :feature do
+  before do
+    AdminUser.create!(email: "admin@example.com", default_status: "published")
+
+    Post.create!(title: "keep me", body: "keep body", status: "published",
+                 position: 20, published_date: Date.new(2026, 6, 1), starred: true)
+    Post.create!(title: "drop me", body: "drop body", status: "draft",
+                 position: 1, published_date: Date.new(2020, 1, 1), starred: false)
+  end
+
+  describe "every filter input type" do
+    {
+      "string, predicate in the Hash key" => "/admin/string_posts",
+      "string, predicate already in the filter name" => "/admin/scalar_posts",
+      "numeric" => "/admin/numeric_posts",
+      "date range" => "/admin/date_posts",
+      "select" => "/admin/select_posts",
+      "check boxes" => "/admin/check_boxes_posts",
+      "boolean" => "/admin/boolean_posts"
+    }.each do |input_type, path|
+      it "applies the declared default to a #{input_type} filter" do
+        visit path
+
+        expect(page).to have_content("keep me")
+        expect(page).to have_no_content("drop me")
+      end
+    end
+  end
+
+  # `Proc#[]` is `call`, so a Proc left in `:input_html` answers Formtastic's `[:multiple]`
+  # check with a truthy Hash and a select derives `_in` instead of `_eq` - filtering nothing,
+  # silently. The Proc is resolved first, the way the filters form resolves it.
+  it "resolves a Proc :input_html before asking the input" do
+    visit "/admin/proc_input_html_posts"
+
+    expect(page).to have_content("keep me")
+    expect(page).to have_no_content("drop me")
+    expect(page).to have_select("q[status_eq]", selected: "published")
+  end
+
+  describe "a value that cannot be placed" do
+    it "says so instead of guessing" do
+      expect { visit "/admin/ambiguous_posts" }
+        .to raise_error(ArgumentError, /filter :published_date declares a `default:`.*single value cannot say which to fill/m)
+    end
+
+    it "says so for an exclusive Range instead of widening it" do
+      # The inputs submit gteq and lteq, so an excluded end has no spelling: stored as lteq it
+      # searched the day the Range left out, and the redirect froze that bound into every
+      # copied URL. Every other Range ambiguity here raises; this one changed data quietly.
+      expect { visit "/admin/banana_exclusive_range_posts" }
+        .to raise_error(ArgumentError, /exclusive Range.*use an inclusive range/m)
+    end
+  end
+
+  # Filtering the collection is only half of it: the admin has to be able to see what the page
+  # decided on their behalf, and change it. Every input type is checked, because each renders
+  # its value differently and a default that filters invisibly is the thing to avoid.
+  describe "the value the admin sees in the form" do
+    it "shows it on a string filter" do
+      visit "/admin/string_posts"
+
+      expect(page).to have_field("q[title_cont]", with: "keep")
+    end
+
+    it "shows it on a string filter whose name carries the predicate" do
+      visit "/admin/scalar_posts"
+
+      expect(page).to have_field("q[title_cont]", with: "keep")
+    end
+
+    it "shows it on a select filter" do
+      visit "/admin/select_posts"
+
+      expect(page).to have_select("q[status_eq]", selected: "published")
+    end
+
+    it "shows it on a check boxes filter" do
+      visit "/admin/check_boxes_posts"
+
+      expect(page).to have_checked_field("q[status_in][]", with: "published")
+      expect(page).to have_unchecked_field("q[status_in][]", with: "draft")
+    end
+
+    it "shows it on a boolean filter" do
+      visit "/admin/boolean_posts"
+
+      expect(page).to have_select("q[starred_eq]", selected: "Yes")
+    end
+
+    it "shows it on both ends of a date range filter" do
+      visit "/admin/date_posts"
+
+      expect(page).to have_field("q[published_date_gteq]", with: "2026-01-01")
+      expect(page).to have_field("q[published_date_lteq]", with: "")
+    end
+
+    it "shows it on a numeric filter, with the predicate its Hash named selected" do
+      visit "/admin/numeric_posts"
+
+      expect(page).to have_field("q[position_gt]", with: "10")
+    end
+
+    it "shows the one read off the signed in admin" do
+      visit "/admin/admin_preference_posts"
+
+      expect(page).to have_select("q[status_eq]", selected: "published")
+    end
+
+    it "shows everything once the field is blanked and the form submitted" do
+      visit "/admin/string_posts"
+      fill_in "q[title_cont]", with: ""
+      click_button "Filter"
+
+      expect(page).to have_content("keep me")
+      expect(page).to have_content("drop me")
+    end
+
+    it "leaves a resource that declares no default alone" do
+      visit "/admin/plain_posts"
+
+      expect(page).to have_content("keep me")
+      expect(page).to have_content("drop me")
+    end
+  end
+
+  describe ":if and :unless" do
+    it "neither renders a denied filter nor lets it impose its default" do
+      visit "/admin/conditional_posts"
+
+      # `title` is denied by `:if`, `body` by `:unless`: their inputs are gone, and their
+      # defaults are not in force either - `drop me` is excluded by the `status` filter alone.
+      expect(page).to have_no_field("q[title_cont]")
+      expect(page).to have_no_field("q[body_cont]")
+      expect(page).to have_field("q[status_eq]")
+    end
+
+    it "renders the index when every filter of the resource is denied" do
+      visit "/admin/all_hidden_posts"
+
+      expect(page).to have_content("keep me")
+      expect(page).to have_content("drop me")
+    end
+
+    it "applies the default of the filter its condition allows" do
+      visit "/admin/conditional_posts"
+
+      expect(page).to have_content("keep me")
+      expect(page).to have_no_content("drop me")
+    end
+  end
+
+  describe "a default read off the signed in admin" do
+    it "filters on what the admin saved" do
+      visit "/admin/admin_preference_posts"
+
+      expect(page).to have_content("keep me")
+      expect(page).to have_no_content("drop me")
+    end
+
+    it "applies no filter when the admin saved nothing" do
+      AdminUser.update_all(default_status: nil)
+
+      visit "/admin/admin_preference_posts"
+
+      expect(page).to have_content("keep me")
+      expect(page).to have_content("drop me")
+    end
+  end
+
+  describe "default_filters_notice" do
+    it "tells the admin why the list is cut down" do
+      visit "/admin/colliding_notice_posts"
+
+      expect(page).to have_content("Showing published posts by default")
+    end
+
+    it "stays quiet once the admin has filtered for themselves" do
+      visit "/admin/colliding_notice_posts"
+      select "draft", from: "q[status_eq]"
+      click_button "Filter"
+
+      expect(page).to have_no_content("Showing published posts by default")
+    end
+  end
+
+  describe "requests that carry no q of their own" do
+    it "keeps the default while paging" do
+      visit "/admin/string_posts?page=1"
+
+      expect(page).to have_no_content("drop me")
+    end
+
+    # The download link is built from params, which carry no `q` while the index is showing its
+    # declared defaults, so the CSV request has to derive them again to match the screen.
+    it "exports the filtered collection to CSV, not the whole table" do
+      visit "/admin/string_posts"
+      click_link "CSV"
+
+      expect(page.body).to include("keep me")
+      expect(page.body).to_not include("drop me")
+    end
+  end
+
+  # Clear Filters strips `q[`, `page`, `utf8` and `commit` from the query string, which is the
+  # state a first visit is in, so it returns the page to its declared defaults rather than to an
+  # empty filter set.
+  it "returns to the defaults after Clear Filters", :js do
+    visit "/admin/string_posts"
+    fill_in "q[title_cont]", with: ""
+    click_button "Filter"
+    expect(page).to have_content("drop me")
+
+    click_link "Clear Filters"
+
+    expect(page).to have_content("keep me")
+    expect(page).to have_no_content("drop me")
+  end
+
+end

data/spec/integration/numeric_builtins_spec.rb

@@ -0,0 +1,104 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+require "rack/utils"
+
+# The built-in numeric pair: `sanitize: :digits` strips a value to its digits, `validate:
+# :integer` refuses what does not fit a PG int4 - the guard every inventoried app hand-rolled
+# around its id/position filters.
+RSpec.describe "built-in numeric policies", type: :feature do
+  before do
+    Post.create!(title: "keep me", body: "keep body", status: "published",
+                 position: 20, published_date: Date.new(2026, 6, 1), starred: true)
+    Post.create!(title: "drop me", body: "drop body", status: "draft",
+                 position: 1, published_date: Date.new(2020, 1, 1), starred: false)
+  end
+
+  def query_of(url)
+    Rack::Utils.parse_nested_query(URI.parse(url).query.to_s)
+  end
+
+  describe "validate: :integer" do
+    it "refuses a value that does not fit a PG int4" do
+      visit "/admin/integer_posts?q%5Bposition_eq%5D=2147483648"
+
+      expect(page).to have_content("Position eq filter has an invalid value.")
+      expect(URI.parse(page.current_url).query).to be_nil
+    end
+
+    it "lets the int4 maximum itself through" do
+      visit "/admin/integer_posts?q%5Bposition_eq%5D=2147483647"
+
+      expect(query_of(page.current_url)["q"]).to eq("position_eq" => "2147483647")
+      expect(page).to have_no_content("invalid value")
+    end
+  end
+
+  describe "a default through its own sanitizer" do
+    it "stores and says the sanitized value on every format" do
+      # Not only the HTML path (which would self-heal with an extra hop): the CSV runs
+      # filtering_params directly and must search what the sanitizer produced.
+      visit "/admin/digit_default_posts.csv"
+
+      expect(page.body).to include("keep me")
+      expect(page.body).not_to include("drop me")
+    end
+
+    it "sanitizes a non-String default the same way every format will see it" do
+      visit "/admin/signed_default_posts.csv"
+
+      expect(page.body).to include("keep me")
+    end
+
+    it "lands the sanitized default in the URL in one hop" do
+      visit "/admin/digit_default_posts"
+
+      expect(query_of(page.current_url)["q"]).to eq("position_eq" => "20")
+      expect(page).to have_content("keep me")
+    end
+  end
+
+  describe "sibling predicates" do
+    # The filter's own predicate dropdown submits _gt/_lt/_not_eq and friends; a policy
+    # guarding only the head key leaves the same column one dropdown click from unpoliced.
+    it "polices a sibling predicate the dropdown submits" do
+      visit "/admin/integer_posts?q%5Bposition_gt%5D=2147483648"
+
+      expect(page).to have_content("has an invalid value")
+      expect(URI.parse(page.current_url).query).to be_nil
+    end
+
+    it "refills the owning filter's default after a sibling reset" do
+      # The reset deletes the sibling key; the refill promise belongs to the FILTER - its
+      # declared default comes back even though the submitted key never carried one.
+      visit "/admin/guarded_posts?q%5Btitle_eq%5D=keep123&commit=Filter"
+
+      expect(query_of(page.current_url)["q"]).to eq("title_cont" => "keep")
+      expect(page).to have_content("keep me")
+      expect(page).to have_no_content("drop me")
+    end
+
+    it "sanitizes a sibling predicate too" do
+      visit "/admin/integer_posts?q%5Bposition_lt%5D=2%200a"
+
+      expect(query_of(page.current_url)["q"]).to eq("position_lt" => "20")
+      expect(page).to have_content("drop me")
+      expect(page).to have_no_content("keep me")
+    end
+  end
+
+  describe "sanitize: :digits" do
+    it "strips the value to its digits and searches that" do
+      visit "/admin/integer_posts?q%5Bposition_eq%5D=%202-0a"
+
+      expect(query_of(page.current_url)["q"]).to eq("position_eq" => "20")
+      expect(page).to have_content("keep me")
+      expect(page).to have_no_content("drop me")
+    end
+
+    it "raises for an unknown built-in sanitizer" do
+      expect { visit "/admin/banana_sanitize_builtin_posts?q%5Btitle_cont%5D=x" }
+        .to raise_error(ArgumentError, /unknown built-in sanitizer/)
+    end
+  end
+end

data/spec/integration/on_invalid_spec.rb

@@ -0,0 +1,174 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+require "rack/utils"
+
+# `on_invalid:` names what a violated policy does. :reset (the default) is covered elsewhere;
+# here the other two: :reject bounces back, :empty shows nothing but says why.
+RSpec.describe "on_invalid policies", type: :feature do
+  before do
+    Post.create!(title: "keep me", body: "keep body", status: "published",
+                 position: 20, published_date: Date.new(2026, 6, 1), starred: true)
+    Post.create!(title: "drop me", body: "drop body", status: "draft",
+                 position: 1, published_date: Date.new(2020, 1, 1), starred: false)
+  end
+
+  def query_of(url)
+    Rack::Utils.parse_nested_query(URI.parse(url).query.to_s)
+  end
+
+  describe ":reject" do
+    it "flashes and bounces to the bare index" do
+      visit "/admin/reject_posts?q%5Bposition_eq%5D=abc"
+
+      expect(page).to have_content("Position filter has an invalid value.")
+      expect(URI.parse(page.current_url).query).to be_nil
+      expect(page).to have_content("keep me")
+      expect(page).to have_content("drop me")
+    end
+
+    it "bounces once even when several filters are violated" do
+      # redirect_back does not break Ruby loops; without a performed? guard the second
+      # violation double-renders into a 500 instead of the promised bounce.
+      visit "/admin/reject_posts?q%5Bposition_eq%5D=abc&q%5Btitle_cont%5D=keep123"
+
+      expect(URI.parse(page.current_url).query).to be_nil
+      expect(page).to have_content("filter has an invalid value.").or have_content("must not contain digits")
+    end
+
+    it "bounces to the bare index when back is the offending URL itself" do
+      # Browsers keep the original Referer across a 302: redirect_back would re-reject the
+      # same request forever, dying at the browser's redirect cap instead of showing the
+      # error.
+      offending = "/admin/reject_posts?q%5Bposition_eq%5D=abc"
+      page.driver.header("Referer", "http://www.example.com#{offending}")
+      visit offending
+
+      expect(URI.parse(page.current_url).query).to be_nil
+      expect(page).to have_content("Position filter has an invalid value.")
+    ensure
+      page.driver.header("Referer", nil)
+    end
+
+    it "degrades to :reset off the HTML path" do
+      # A CSV index is answered in one request everywhere else in the gem, a flash it cannot
+      # render would be lost, and url_for drops the format - so the export is bounded the
+      # :reset way instead of being bounced into an HTML page.
+      visit "/admin/reject_posts.csv?q%5Bposition_eq%5D=abc"
+
+      expect(page.response_headers["Content-Type"]).to include("text/csv")
+      expect(page.body).to include("keep me")
+    end
+
+    it "bounces once when value and window policies are violated together" do
+      visit "/admin/reject_window_posts?q%5Bpublished_date_gteq%5D=2020-01-01X&q%5Bpublished_date_lteq%5D=2026-01-01X"
+
+      expect(URI.parse(page.current_url).query).to be_nil
+      expect(page).to have_content("No X dates.")
+    end
+  end
+
+  describe ":empty" do
+    it "shows nothing, says why, and keeps the admin's input on screen" do
+      visit "/admin/empty_posts?q%5Btitle_cont%5D=keep123"
+
+      expect(page).to have_content("Title filter must not contain digits.")
+      expect(page).to have_no_content("keep me")
+      expect(page).to have_no_content("drop me")
+      expect(page).to have_field("q[title_cont]", with: "keep123")
+      expect(URI.parse(page.current_url).query).to eq("q%5Btitle_cont%5D=keep123")
+    end
+
+    it "survives the canonicalizing redirect when the sanitizer empties the value" do
+      # digits("abc") is "" - the blank would otherwise redirect away, and the next request,
+      # flagless, renders the whole table.
+      visit "/admin/empty_digits_posts?q%5Bposition_eq%5D=abc"
+
+      expect(URI.parse(page.current_url).query).to eq("q%5Bposition_eq%5D=abc")
+      expect(page).to have_content("filter has an invalid value")
+      # The admin's own input is preserved (not the sanitizer's ""): the URL carries it and
+      # the form re-renders it - as Ransack casts it for this integer attribute, so "0".
+      # The literal-text case is EmptyPost's string-attribute example above.
+      expect(page).to have_field("q[position_eq]", with: "0")
+      expect(page).to have_no_content("keep me")
+      expect(page).to have_no_content("drop me")
+    end
+
+    it "validates array elements emptied by the sanitizer and keeps a checkbox input" do
+      visit "/admin/empty_digits_array_posts"
+      check "Not a number"
+      click_button "Filter"
+
+      expect(page).to have_content("filter has an invalid value")
+      expect(query_of(page.current_url)["q"]).to eq("status_in" => ["abc"])
+      expect(page).to have_checked_field("q[status_in][]", with: "abc")
+      expect(page).to have_no_content("keep me")
+      expect(page).to have_no_content("drop me")
+    end
+
+    it "leaves a valid search alone" do
+      visit "/admin/empty_posts?q%5Btitle_cont%5D=drop"
+
+      expect(page).to have_content("drop me")
+      expect(page).to have_no_content("keep me")
+    end
+  end
+
+  describe "a default against its own value policy" do
+    it "raises instead of flashing itself forever" do
+      # Accepted, the default refills on every bare visit, fails its own validator, resets,
+      # and refills - a permanent self-inflicted error banner.
+      expect { visit "/admin/banana_validated_default_posts" }
+        .to raise_error(ArgumentError, /default that violates its own validate/)
+    end
+  end
+
+  describe "a default against its own value policy" do
+    it "raises for a non-String default its validator refuses as submitted" do
+      # The URL will say the default as a String - that is the value to judge.
+      expect { visit "/admin/banana_integer_default_posts" }
+        .to raise_error(ArgumentError, /default that violates its own validate/)
+    end
+  end
+
+  describe "values the URL cannot carry" do
+    it "raises for a sanitizer with no fixpoint instead of redirect-looping" do
+      expect { visit "/admin/banana_sanitize_posts?q%5Btitle_cont%5D=acme" }
+        .to raise_error(ArgumentError, /sanitize.*idempotent/m)
+    end
+
+    it "raises for a default its sanitizer keeps rewriting" do
+      # The default faces the same fixpoint check submitted values do - otherwise the CSV
+      # searches the once-sanitized value while the HTML converges on another.
+      expect { visit "/admin/banana_shrinking_default_posts" }
+        .to raise_error(ArgumentError, /sanitize.*idempotent/m)
+    end
+
+    it "raises for a sanitizer that mutates the value in place" do
+      # `value << "%"` returns the SAME object - compared against itself, the no-fixpoint
+      # guard would wave the loop through.
+      expect { visit "/admin/banana_mutating_sanitize_posts?q%5Btitle_cont%5D=acme" }
+        .to raise_error(ArgumentError, /sanitize.*idempotent/m)
+    end
+
+    it "does not chase a default that serializes to nothing" do
+      # {}.to_query drops the pair entirely - same loop shape as the empty Array.
+      visit "/admin/empty_hash_default_posts"
+
+      expect(URI.parse(page.current_url).query).to be_nil
+      expect(page).to have_content("keep me")
+    end
+  end
+
+  describe "sanitize: rewrites the URL to what actually ran" do
+    it "redirects once to the sanitized value, without greeting it as a default" do
+      visit "/admin/guarded_posts?q%5Btitle_cont%5D=ke-ep"
+
+      expect(query_of(page.current_url)["q"]).to eq("title_cont" => "keep")
+      expect(page).to have_content("keep me")
+      # The search ran the admin's own (sanitized) value - no default engaged, so the
+      # travelling notice must stay home.
+      expect(page).to have_no_content("Showing kept posts by default")
+    end
+  end
+end