active_admin_filter_extensions 1.0.0

data/spec/integration/policies_spec.rb

@@ -0,0 +1,204 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+require "rack/utils"
+
+# `sanitize:` and `validate:` on a filter: value policies that used to live in hand-written
+# before_actions. On violation the default policy is :reset - drop the offending key, flash
+# the message, and let the declared default refill, with the redirect telling the truth about
+# what actually ran.
+RSpec.describe "Filter value policies", type: :feature do
+  before do
+    Post.create!(title: "keep me", body: "keep body", status: "published",
+                 position: 20, published_date: Date.new(2026, 6, 1), starred: true)
+    Post.create!(title: "drop me", body: "drop body", status: "draft",
+                 position: 1, published_date: Date.new(2020, 1, 1), starred: false)
+  end
+
+  def query_of(url)
+    Rack::Utils.parse_nested_query(URI.parse(url).query.to_s)
+  end
+
+  describe "sanitize:" do
+    it "rewrites the value before the search sees it" do
+      visit "/admin/guarded_posts?q%5Btitle_cont%5D=ke-ep"
+
+      expect(page).to have_content("keep me")
+      expect(page).to have_no_content("drop me")
+    end
+
+    it "sanitizes a frozen default without mutating the config" do
+      visit "/admin/frozen_default_posts"
+
+      expect(query_of(page.current_url)["q"]).to eq("title_cont" => "keep")
+      expect(page).to have_content("keep me")
+    end
+  end
+
+  describe "validate: with the default :reset policy" do
+    it "drops the value, says why, and falls back to the declared default" do
+      visit "/admin/guarded_posts?q%5Btitle_cont%5D=keep123"
+
+      expect(page).to have_content("Title filter must not contain digits.")
+      # The default refilled - and the URL says so: validation ran before the redirect
+      # decision, so the address bar reflects what was actually searched.
+      expect(query_of(page.current_url)["q"]).to eq("title_cont" => "keep")
+      expect(page).to have_content("keep me")
+      expect(page).to have_no_content("drop me")
+    end
+
+    it "does not greet the fallback with the defaults notice" do
+      # One render, one message: the error already explains why the page shows the
+      # default slice - the notice on top of it would be noise.
+      visit "/admin/guarded_posts?q%5Btitle_cont%5D=keep123"
+
+      expect(page).to have_no_content("Showing kept posts by default")
+    end
+
+
+    it "refills the default on a real filters-form submission too" do
+      # The form always sends commit; the reset's whole promise is the refill, and a promise
+      # that holds only on hand-typed URLs is not one.
+      visit "/admin/guarded_posts?q%5Btitle_cont%5D=keep123&commit=Filter"
+
+      expect(page).to have_content("Title filter must not contain digits.")
+      expect(query_of(page.current_url)["q"]).to eq("title_cont" => "keep")
+      expect(page).to have_no_content("drop me")
+    end
+
+
+    it "refuses a value that is not a plain string" do
+      # Ransack executes ?q[title_cont][value]=x byte-identically to the scalar - skipping
+      # the policy for non-String shapes was a straight bypass.
+      visit "/admin/guarded_posts?q%5Btitle_cont%5D%5Bvalue%5D=keep123"
+
+      expect(page).to have_content("filter has an invalid value")
+      expect(query_of(page.current_url)["q"]).to eq("title_cont" => "keep")
+    end
+
+    it "leaves a valid value alone" do
+      visit "/admin/guarded_posts?q%5Btitle_cont%5D=drop"
+
+      expect(page).to have_no_content("Title filter must not contain digits.")
+      expect(query_of(page.current_url)["q"]).to eq("title_cont" => "drop")
+      expect(page).to have_content("drop me")
+      expect(page).to have_no_content("keep me")
+    end
+
+    it "still greets a bare visit with the notice" do
+      visit "/admin/guarded_posts"
+
+      expect(page).to have_content("Showing kept posts by default")
+      expect(page).to have_no_content("drop me")
+    end
+  end
+
+  describe "a multi-valued filter" do
+    it "lets its Array submission through" do
+      visit "/admin/policed_boxes_posts?q%5Bstatus_in%5D%5B%5D=draft"
+
+      expect(page).to have_no_content("No x statuses.")
+      expect(page).to have_content("drop me")
+      expect(page).to have_no_content("keep me")
+    end
+
+    it "judges each element and resets the key on a bad one" do
+      visit "/admin/policed_boxes_posts?q%5Bstatus_in%5D%5B%5D=draft&q%5Bstatus_in%5D%5B%5D=xdraft"
+
+      expect(page).to have_content("No x statuses.")
+      expect(page).to have_content("keep me")
+      expect(page).to have_no_content("drop me")
+    end
+
+    it "ignores a blank element beside a real selection" do
+      # ?q[status_in][]=&q[status_in][]=draft is the shape a multi-select submits, and
+      # normalization drops the blank before searching - judged, it flashed an error about a
+      # value nothing searches and reset a legitimate selection to the default.
+      visit "/admin/policed_boxes_posts?q%5Bstatus_in%5D%5B%5D=&q%5Bstatus_in%5D%5B%5D=draft"
+
+      expect(page).to have_no_content("Letters only.")
+      expect(page).to have_content("drop me")
+      expect(page).to have_no_content("keep me")
+    end
+
+    it "removes blank elements before sanitizing a multi-valued filter" do
+      visit "/admin/integer_sanitized_boxes_posts?q%5Bposition_in%5D%5B%5D=&q%5Bposition_in%5D%5B%5D=20"
+
+      expect(page).to have_content("keep me")
+      expect(page).to have_no_content("drop me")
+    end
+
+    it "still refuses a Hash-wrapped value on the same filter" do
+      visit "/admin/policed_boxes_posts?q%5Bstatus_in%5D%5Bvalue%5D=draft"
+
+      expect(page).to have_content("has an invalid value")
+    end
+
+    it "ignores a blank member of an Array default" do
+      # nil became "", the validator refused it, and materialization raised on every request -
+      # for exactly the admins whose per-admin member resolved to nothing.
+      visit "/admin/nil_member_policed_posts"
+
+      expect(query_of(page.current_url)["q"]).to eq("status_in" => ["published"])
+      expect(page).to have_content("keep me")
+      expect(page).to have_no_content("drop me")
+    end
+
+    it "materializes an Array default beside its validator" do
+      visit "/admin/policed_boxes_posts"
+
+      expect(page).to have_content("keep me")
+      expect(page).to have_no_content("drop me")
+    end
+  end
+
+  describe "message: overrides the violation text" do
+    it "speaks the filter's own words for a built-in validator" do
+      visit "/admin/ip_guarded_posts?q%5Btitle_cont%5D=not-an-ip"
+
+      expect(page).to have_content("Allowed IP address is incorrect!")
+      expect(page).to have_no_content("filter has an invalid value")
+    end
+
+    it "falls back to the generic message for a Symbol no locale defines" do
+      visit "/admin/banana_message_posts?q%5Btitle_cont%5D=keep123"
+
+      expect(page).to have_content("Title cont filter has an invalid value.")
+      expect(page).to have_no_content("translation missing")
+    end
+
+    it "interpolates the override" do
+      # Used verbatim, the app's own words could never name %{limit} or %{floor}.
+      visit "/admin/interpolated_message_posts?q%5Bpublished_date_gteq%5D=2020-01-01" \
+            "&q%5Bpublished_date_lteq%5D=2026-01-01"
+
+      expect(page).to have_content("Pick at most 90 days.")
+    end
+
+    it "does not refuse a blank default" do
+      # Blank is no value: the URL cannot carry it and Ransack would strip it, so judging it
+      # raised over a default that never reaches a search.
+      visit "/admin/blank_default_policed_posts"
+
+      expect(URI.parse(page.current_url).query).to be_nil
+      expect(page).to have_content("keep me")
+      expect(page).to have_content("drop me")
+    end
+
+    it "falls back to the generic text for a parameterized symbol it cannot interpolate" do
+      # The docs invite a validate: that returns a gem scope symbol; the parameterized ones
+      # have nothing to interpolate from, and raising there 500s the request the policy is
+      # meant to answer.
+      visit "/admin/parameterized_symbol_posts?q%5Btitle_cont%5D=keep123"
+
+      expect(page).to have_content("Title cont filter has an invalid value.")
+      expect(page).to have_no_content("translation missing")
+    end
+
+    it "stays quiet for a valid value" do
+      visit "/admin/ip_guarded_posts?q%5Btitle_cont%5D=10.0.0.0%2F8"
+
+      expect(page).to have_no_content("Allowed IP address is incorrect!")
+    end
+  end
+end

data/spec/integration/redirect_spec.rb

@@ -0,0 +1,204 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+require "rack/utils"
+
+# The gem's defining behavior: the bare index redirects once to itself with the effective
+# filters spelled out in the query string. What the admin copies out of the address bar is
+# then the page they were looking at - same window, same values - instead of a bare path that
+# every recipient resolves against their own clock and their own preferences.
+RSpec.describe "The redirect", type: :feature do
+  before do
+    Post.create!(title: "keep me", body: "keep body", status: "published",
+                 position: 20, published_date: Date.new(2026, 6, 1), starred: true)
+    Post.create!(title: "drop me", body: "drop body", status: "draft",
+                 position: 1, published_date: Date.new(2020, 1, 1), starred: false)
+  end
+
+  def query_of(url)
+    Rack::Utils.parse_nested_query(URI.parse(url).query.to_s)
+  end
+
+  describe "a bare visit" do
+    it "lands on a URL that carries the defaults, values frozen" do
+      visit "/admin/posts"
+
+      expect(query_of(page.current_url)["q"])
+        .to eq("status_eq" => "published", "published_date_gteq" => "2026-01-01")
+      expect(page).to have_content("keep me")
+      expect(page).to have_no_content("drop me")
+    end
+
+    it "keeps the rest of the query string" do
+      visit "/admin/posts?order=title_asc&page=1"
+
+      expect(query_of(page.current_url)).to include("order" => "title_asc", "page" => "1")
+      expect(query_of(page.current_url)["q"]).to include("status_eq" => "published")
+    end
+  end
+
+  describe "a widened filter_defaults_apply?" do
+    it "adds the defaults beside the pinned key in one hop" do
+      visit "/admin/widened_posts?q%5Btitle_cont%5D=keep"
+
+      expect(query_of(page.current_url)["q"])
+        .to eq("title_cont" => "keep", "status_eq" => "published")
+      expect(page).to have_content("keep me")
+      expect(page).to have_no_content("drop me")
+
+      # The redirected-to URL itself passes through - the guard has converged.
+      converged = page.current_url
+      visit converged
+      expect(page.current_url).to eq(converged)
+    end
+  end
+
+  it "treats `?q=` - an empty string - as a bare visit" do
+    visit "/admin/posts?q="
+
+    expect(query_of(page.current_url)["q"]).to include("status_eq" => "published")
+    expect(page).to have_no_content("drop me")
+  end
+
+  describe "a request that already says what it wants" do
+    it "is left alone when it carries its own filters" do
+      visit "/admin/posts?q%5Bstatus_eq%5D=draft"
+
+      expect(query_of(page.current_url)["q"]).to eq("status_eq" => "draft")
+      expect(page).to have_content("drop me")
+      expect(page).to have_no_content("keep me")
+    end
+
+    it "is left alone after a blank filters-form submission" do
+      # Submitting the form with every field blank sends `commit` and no `q` - the admin asked
+      # for everything, and a redirect back to the defaults would make that impossible to ask.
+      visit "/admin/posts?commit=Filter"
+
+      expect(query_of(page.current_url)).to eq("commit" => "Filter")
+      expect(page).to have_content("keep me")
+      expect(page).to have_content("drop me")
+    end
+  end
+
+  # The URL is only rewritten where an address bar is watching. The defaults still filter a
+  # CSV export - that is the gem's core, not the mode's - so skipping the redirect loses
+  # nothing but the detour.
+  it "exports CSV in one request, defaults still applied" do
+    visit "/admin/posts.csv"
+
+    expect(URI.parse(page.current_url).query).to be_nil
+    expect(page.body).to include("keep me")
+    expect(page.body).not_to include("drop me")
+  end
+
+  it "does not chase a default the URL cannot carry" do
+    # to_query drops an empty Array entirely, so redirecting on it would loop: the redirected
+    # URL parses back without the key and the next request is bare again. Such a value stays
+    # out of the URL instead.
+    visit "/admin/empty_default_posts"
+
+    expect(URI.parse(page.current_url).query).to be_nil
+    expect(page).to have_content("keep me")
+    expect(page).to have_content("drop me")
+  end
+
+  it "does not chase a blank default the URL cannot round-trip" do
+    # ?q[k]= comes back in with the blank stripped - chasing it alternates between the blank
+    # URL and the bare one forever.
+    visit "/admin/banana_blank_default_posts"
+
+    expect(URI.parse(page.current_url).query).to be_nil
+    expect(page).to have_content("keep me")
+    expect(page).to have_content("drop me")
+  end
+
+  it "does not chase an Array default whose members are all blank" do
+    # [nil] survives a plain blank-reject, serializes to ?q[k][]= and parses back as [""] -
+    # which normalization drops, so the defaults re-apply and the two sides never agree.
+    visit "/admin/nil_member_default_posts"
+
+    expect(URI.parse(page.current_url).query).to be_nil
+    expect(page).to have_content("keep me")
+    expect(page).to have_content("drop me")
+  end
+
+  it "does not redirect a resource that declares no defaults" do
+    visit "/admin/no_defaults_posts"
+
+    expect(URI.parse(page.current_url).query).to be_nil
+    expect(page).to have_content("keep me")
+    expect(page).to have_content("drop me")
+  end
+
+  # A batch action flashes and redirects back to the index; the bare index then answers 302
+  # again. Flash survives exactly one request, so without keeping it the extra hop eats every
+  # such message.
+  it "keeps a flash that arrived from another action across the extra hop" do
+    visit "/admin/posts/poke"
+
+    expect(query_of(page.current_url)["q"]).to include("status_eq" => "published")
+    expect(page).to have_content("poked")
+  end
+
+  # Without this the redirect would silently eat every notice: the flash is set on the request
+  # the defaults apply to, and that is the one that answers 302 - so it has to travel.
+  describe "a declared default_filters_notice" do
+    it "survives the redirect" do
+      visit "/admin/notice_posts"
+
+      expect(query_of(page.current_url)["q"]).to eq("status_eq" => "published")
+      expect(page).to have_content("Showing published posts by default")
+    end
+
+    it "does not eat a flash that arrived from another action" do
+      # Writing the notice loads the flash, and a loaded flash sweeps what came in with the
+      # request when it commits - here, on a 302 that renders nothing. The redirect keeps the
+      # arriving entries, so a batch action's message and the notice land together.
+      visit "/admin/notice_posts/poke"
+
+      expect(query_of(page.current_url)["q"]).to eq("status_eq" => "published")
+      expect(page).to have_content("poked")
+      expect(page).to have_content("Showing published posts by default")
+    end
+
+    it "yields its shared flash key to a message that arrived from another action" do
+      # On the default :notice key the notice and a batch action's message collide; the
+      # arriving one names what just happened, so it is the one the admin must see.
+      visit "/admin/colliding_notice_posts/poke"
+
+      expect(page).to have_content("poked")
+    end
+
+    it "still greets a bare visit on its default flash key" do
+      visit "/admin/colliding_notice_posts"
+
+      expect(page).to have_content("Showing published posts by default")
+    end
+
+    it "stays quiet on a widened request that overrode every default" do
+      # filter_defaults_apply? says yes, but the request answered every defaulted key itself -
+      # no default reached the search, and the notice must not claim otherwise.
+      visit "/admin/widened_notice_posts?q%5Bstatus_eq%5D=draft&q%5Btitle_cont%5D=drop"
+
+      expect(page).to have_content("drop me")
+      expect(page).to have_no_content("Showing published posts by default")
+    end
+
+    it "greets a widened request the defaults actually reached" do
+      visit "/admin/widened_notice_posts?q%5Btitle_cont%5D=keep"
+
+      expect(query_of(page.current_url)["q"])
+        .to eq("title_cont" => "keep", "status_eq" => "published")
+      expect(page).to have_content("Showing published posts by default")
+    end
+
+    it "does not greet a URL that already says what it shows" do
+      # The redirected-to URL opened directly - a pasted link. The recipient asked for exactly
+      # what the address says, so there is nothing to explain.
+      visit "/admin/notice_posts?q%5Bstatus_eq%5D=published"
+
+      expect(page).to have_no_content("Showing published posts by default")
+    end
+  end
+
+end

data/spec/integration/require_any_filter_spec.rb

@@ -0,0 +1,132 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+
+# `require_any_filter` - an index that answers no question until it is asked one: a bare
+# visit renders an empty collection with the notice instead of the whole table (or, in one
+# inventoried case, instead of a silent model-level `return []`).
+RSpec.describe "require_any_filter", type: :feature do
+  before do
+    Post.create!(title: "keep me", body: "keep body", status: "published",
+                 position: 20, published_date: Date.new(2026, 6, 1), starred: true)
+    Post.create!(title: "drop me", body: "drop body", status: "draft",
+                 position: 1, published_date: Date.new(2020, 1, 1), starred: false)
+  end
+
+  it "renders nothing on a bare visit, and says why" do
+    visit "/admin/picky_posts"
+
+    expect(page).to have_content("You must specify at least one filter")
+    expect(page).to have_no_content("keep me")
+    expect(page).to have_no_content("drop me")
+  end
+
+  it "renders an empty result, not Active Admin's blank slate" do
+    # The guard blanks the collection; with no `q` in the request Active Admin reads that as
+    # "this table has no rows at all" and offers a Create link beside the warning.
+    visit "/admin/picky_posts"
+
+    expect(page).to have_content("No Picky Posts found")
+    expect(page).to have_no_content("There are no Picky Posts yet")
+    expect(page).to have_no_link("Create one")
+  end
+
+  it "answers once asked" do
+    visit "/admin/picky_posts?q%5Btitle_cont%5D=keep"
+
+    expect(page).to have_no_content("You must specify at least one filter")
+    expect(page).to have_content("keep me")
+  end
+
+  it "treats a blank filters-form submission as still unasked" do
+    visit "/admin/picky_posts?commit=Filter"
+
+    expect(page).to have_content("You must specify at least one filter")
+    expect(page).to have_no_content("keep me")
+  end
+
+  it "treats an array of blanks as unasked" do
+    visit "/admin/picky_posts?q%5Bstatus_eq%5D%5B%5D="
+
+    expect(page).to have_content("You must specify at least one filter")
+    expect(page).to have_no_content("keep me")
+  end
+
+  it "treats a blank-valued filter as unasked" do
+    visit "/admin/picky_posts?q%5Btitle_cont%5D="
+
+    expect(page).to have_content("You must specify at least one filter")
+    expect(page).to have_no_content("keep me")
+  end
+
+  it "treats a key no declared filter submits as unasked" do
+    # Ransack silently ignores an unknown condition - junk, a stale bookmark after a filter
+    # rename - so counting it as a question renders the unfiltered dump behind a valid-looking
+    # URL.
+    visit "/admin/picky_posts?q%5Bjunk%5D=1"
+
+    expect(page).to have_content("You must specify at least one filter")
+    expect(page).to have_no_content("keep me")
+    expect(page).to have_no_content("drop me")
+  end
+
+  it "treats a predicate-less stem of a declared filter as unasked" do
+    # q[title] stems to the declared title_cont, but Ransack ignores a key with no
+    # predicate - counting it renders the unfiltered dump behind a plausible URL.
+    visit "/admin/picky_posts?q%5Btitle%5D=keep"
+
+    expect(page).to have_content("You must specify at least one filter")
+    expect(page).to have_no_content("keep me")
+  end
+
+  it "counts a scope tab as asked" do
+    # Active Admin puts a count on the tab, so rendering it empty beside "specify at least one
+    # filter" contradicted the tab the admin had just clicked.
+    visit "/admin/picky_posts?scope=published"
+
+    expect(page).to have_no_content("You must specify at least one filter")
+    expect(page).to have_content("keep me")
+    expect(page).to have_no_content("drop me")
+  end
+
+  it "treats a scope no resource declares as unasked" do
+    # Active Admin resolves an unknown scope id to nothing and applies no scope, so counting
+    # its mere presence hands back the whole table behind a scope-shaped URL.
+    visit "/admin/picky_posts?scope=does_not_exist"
+
+    expect(page).to have_content("You must specify at least one filter")
+    expect(page).to have_no_content("keep me")
+    expect(page).to have_no_content("drop me")
+  end
+
+  it "treats a scope no resource declares as unasked on CSV too" do
+    # The format that gets no canonicalizing hop - and no warning to read either.
+    visit "/admin/picky_posts.csv?scope=does_not_exist"
+
+    expect(page.body).not_to include("keep me")
+    expect(page.body).not_to include("drop me")
+  end
+
+  it "counts a sibling predicate of a declared filter as asked" do
+    visit "/admin/picky_posts?q%5Btitle_eq%5D=keep%20me"
+
+    expect(page).to have_no_content("You must specify at least one filter")
+    expect(page).to have_content("keep me")
+  end
+
+  it "falls back to the shipped text for a notice key no locale defines" do
+    visit "/admin/banana_notice_key_posts"
+
+    expect(page).to have_content("You must specify at least one filter")
+    expect(page).to have_no_content("translation missing")
+  end
+
+  it "notices when a policy just reset the only question" do
+    # The validator empties q; without re-checking afterwards the whole table renders with no
+    # warning - the unfiltered dump the guard was declared to forbid.
+    visit "/admin/picky_posts?q%5Btitle_cont%5D=zz9"
+
+    expect(page).to have_content("You must specify at least one filter")
+    expect(page).to have_no_content("keep me")
+  end
+end