activeadmin-graphql 0.1.2 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cc303bd74d84b05385c3a3af874e1dd66957029746729122a5d684ac9720a4cd
-  data.tar.gz: c2ab55694cb7b62773fd22db7fb219850fb3901a3d5bf9565a9ac00b0804db6e
+  metadata.gz: 15355b8548053d83cb751fc238ff2f9d4c910be902cf3aab25c2c91741a33fa9
+  data.tar.gz: 8d76e29dcfe43079b171d19b817d52f13327c286a234688dd32c7e04efcc1522
 SHA512:
-  metadata.gz: 0c90194015f4ad4ff7ebf9125ad6c7b2b4c0cf800a622f7cafba0d9a88945bdc57956eca598b2991aa32ceeec66ea925c5e9e5749ab38ad56a042c22f1de6437
-  data.tar.gz: f023d72351949ed1b0817ec01839ff1ce45aeae3d5ffba51a7651307fdf51c598171e085a5f0fe9b0b183bb62ff4da09e0810c57e4afb5c54ded43db1f9b12e2
+  metadata.gz: a8a5472cfd32ac45a662733ee46fe1b0f918ea96e71db5bdf25ff9191a3c808c7b9ec047b4e4e2e0b52269a2a3aba20ff7d5cce39607bdf28448f85139beff39
+  data.tar.gz: 873a5814296d27af34ac8a6742ada804d61e4f855c33d0b5a092793ec7260625c68c54d8831977b88e59a7d7299a5cb22f77b502ab81b504e2d523b01e505cae

data/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.2.0 (2026-04-29)
+
+- Add `activeadmin_policies` GraphQL policy surfaces:
+  - global `activeadmin_policies` for resources/pages
+  - per-object `activeadmin_policies` on resource objects
+  - preflight `activeadmin_policies_for(type_name:, ids:, path:)` for per-record checks before running queries/mutations/actions
+- Switch policy payloads to allow-lists (`allowed_actions`, `allowed_member_actions`, `allowed_collection_actions`, `allowed_batch_actions`) and add namespace customization hooks (`graphql_policy_actions`, `graphql_policy_action_mapper`, `graphql_policy_extra`, `graphql_policy_transform`)
+- Enforce authorization-by-default for custom GraphQL fields/mutations with explicit opt-out (`authorize: false` / mutation DSL `authorize false`)
+- Add namespace defaults/settings and request specs covering policies, customization hooks, and auth-toggle behavior
+
 ## 0.1.2 (2026-03-30)
 
 - Fix TruffleRuby compatibility issue with JSON.dump

data/app/controllers/active_admin/graphql_controller.rb

@@ -14,35 +14,9 @@ module ActiveAdmin
 
     def execute
       schema = ActiveAdmin::GraphQL.schema_for(active_admin_namespace)
+      return render_multiplex(schema) if multiplex_request?
 
-      if multiplex_request?
-        operations = multiplex_operations
-        max_n = active_admin_namespace.graphql_multiplex_max || 20
-        if operations.size > max_n
-          return render json: {errors: [{message: "Multiplex exceeds maximum of #{max_n}"}]},
-            status: :content_too_large
-        end
-
-        results = schema.multiplex(
-          operations.map do |op|
-            {
-              query: op[:query],
-              variables: ensure_variables(op[:variables]),
-              operation_name: op[:operation_name],
-              context: graphql_context
-            }
-          end
-        )
-        render json: results.map(&:to_h), status: :ok
-      else
-        result = schema.execute(
-          query: query_string,
-          variables: ensure_variables(variables_hash),
-          operation_name: operation_name,
-          context: graphql_context
-        )
-        render json: result.to_h, status: :ok
-      end
+      render_single(schema)
     end
 
     def active_admin_namespace
@@ -164,5 +138,50 @@ module ActiveAdmin
     rescue JSON::ParserError
       {}
     end
+
+    def render_multiplex(schema)
+      operations = multiplex_operations
+      return render_multiplex_limit_error!(operations.size) if exceeds_multiplex_limit?(operations)
+
+      payloads = build_multiplex_payloads(operations)
+      results = schema.multiplex(payloads)
+      render json: results.map(&:to_h), status: :ok
+    end
+
+    def render_single(schema)
+      result = schema.execute(
+        query: query_string,
+        variables: ensure_variables(variables_hash),
+        operation_name: operation_name,
+        context: graphql_context
+      )
+      render json: result.to_h, status: :ok
+    end
+
+    def exceeds_multiplex_limit?(operations)
+      operations.size > max_multiplex_operations
+    end
+
+    def max_multiplex_operations
+      active_admin_namespace.graphql_multiplex_max || 20
+    end
+
+    def render_multiplex_limit_error!(count)
+      max_n = max_multiplex_operations
+      msg = "Multiplex exceeds maximum of #{max_n} (received #{count})"
+      render json: {errors: [{message: msg}]}, status: :content_too_large
+    end
+
+    def build_multiplex_payloads(operations)
+      context = graphql_context
+      operations.map do |op|
+        {
+          query: op[:query],
+          variables: ensure_variables(op[:variables]),
+          operation_name: op[:operation_name],
+          context: context
+        }
+      end
+    end
   end
 end

data/docs/graphql-api.md

@@ -46,10 +46,16 @@ Each namespace inherits these options (defaults in parentheses):
 * `graphql_path` — path segment under the namespace mount (`"graphql"`).
 * `graphql_multiplex_max` — maximum operations per multiplexed JSON array
   request (`20`).
-* `graphql_max_complexity` — passed to graphql-ruby `max_complexity` when set.
-* `graphql_max_depth` — passed to `max_depth` when set.
-* `graphql_default_page_size` / `graphql_default_max_page_size` — connection
-  defaults when set.
+* `graphql_max_complexity` — passed to graphql-ruby `max_complexity` (`300` by
+  default; set a higher value if legitimate queries are rejected). Set to
+  `nil` to disable the limit.
+* `graphql_max_depth` — passed to `max_depth` (`18` by default). Set to `nil`
+  to disable.
+* `graphql_batch_action_max_ids` — maximum length of the `ids` argument on
+  `*_batch_action` mutations (`5000` by default; set `0` to disable the cap).
+* `graphql_default_page_size` / `graphql_default_max_page_size` — schema
+  connection defaults (`25` / `100`); needed for graphql-ruby complexity scoring
+  on connection fields when `max_complexity` is enabled.
 * `graphql_dataloader` — graphql-ruby dataloader plugin (`nil` = use
   `GraphQL::Dataloader`). Set to `GraphQL::Dataloader::AsyncDataloader` when
   the [`async` gem](https://github.com/socketry/async) is loaded if you want
@@ -155,6 +161,24 @@ separate route with CSRF disabled. Treat this endpoint like any other
 The namespace `authentication_method` runs before any GraphQL work, including
 schema introspection. Unauthenticated clients should not receive a schema.
 
+If you need to turn off schema introspection entirely (even for authenticated
+sessions or specific environments), call
+[`schema.disable_introspection_entry_points`](https://graphql-ruby.org/schema/definition.html#schema-configuration)
+from `graphql_configure_schema`. The hook receives the generated schema class,
+so you can toggle introspection based on Rails environment or other app
+settings:
+
+```ruby
+ActiveAdmin.setup do |config|
+  config.namespace :admin do |admin|
+    admin.graphql = true
+    admin.graphql_configure_schema = lambda do |schema|
+      schema.disable_introspection_entry_points if Rails.env.production?
+    end
+  end
+end
+```
+
 The GraphQL context exposes the same user as `current_active_admin_user` (from
 the namespace `current_user_method`), wrapped for authorization checks.
 

data/lib/active_admin/graphql/integration.rb

@@ -31,11 +31,18 @@ module ActiveAdmin
         ns.register :graphql_visibility, nil
         ns.register :graphql_visibility_profile, nil
         ns.register :graphql_schema_visible, nil
-        ns.register :graphql_max_complexity, nil
-        ns.register :graphql_max_depth, nil
-        ns.register :graphql_default_page_size, nil
-        ns.register :graphql_default_max_page_size, nil
+        ns.register :graphql_max_complexity, 300
+        ns.register :graphql_max_depth, 18
+        ns.register :graphql_batch_action_max_ids, 5000
+        ns.register :graphql_default_page_size, 25
+        ns.register :graphql_default_max_page_size, 100
         ns.register :graphql_configure_schema, nil
+        ns.register :graphql_policy_actions, nil
+        ns.register :graphql_policy_action_mapper, nil
+        ns.register :graphql_policy_extra, nil
+        ns.register :graphql_policy_transform, nil
+        ns.register :graphql_custom_field_authorization_default, true
+        ns.register :graphql_custom_mutation_authorization_default, true
       end
 
       def register_railtie!
@@ -114,18 +121,31 @@ module ActiveAdmin
         private
 
         def define_graphql_routes
-          namespaces.each do |namespace|
-            next unless namespace.graphql
+          graphql_namespaces.each do |namespace|
+            segment = graphql_segment_for(namespace)
+            defaults = graphql_route_defaults(namespace)
+            mount_graphql_route(namespace, segment, defaults)
+          end
+        end
+
+        def graphql_namespaces
+          namespaces.select(&:graphql)
+        end
 
-            segment = namespace.graphql_path.to_s.delete_prefix("/").presence || "graphql"
-            defaults = {active_admin_namespace: namespace.name}
+        def graphql_segment_for(namespace)
+          namespace.graphql_path.to_s.delete_prefix("/").presence || "graphql"
+        end
+
+        def graphql_route_defaults(namespace)
+          {active_admin_namespace: namespace.name}
+        end
 
-            if namespace.root?
+        def mount_graphql_route(namespace, segment, defaults)
+          if namespace.root?
+            router.post segment, controller: "/active_admin/graphql", action: "execute", defaults: defaults
+          else
+            router.namespace namespace.name, **namespace.route_options.dup do
               router.post segment, controller: "/active_admin/graphql", action: "execute", defaults: defaults
-            else
-              router.namespace namespace.name, **namespace.route_options.dup do
-                router.post segment, controller: "/active_admin/graphql", action: "execute", defaults: defaults
-              end
             end
           end
         end

data/lib/active_admin/graphql/key_value_pair_input.rb

@@ -30,18 +30,26 @@ module ActiveAdmin
         end
       end
 
-      def extract_pair(e)
-        if e.respond_to?(:key) && e.respond_to?(:value) && !e.is_a?(Hash)
-          [e.key, e.value]
-        elsif e.is_a?(Hash)
-          k = e["key"] || e[:key]
-          v = e["value"] || e[:value]
-          raise ::GraphQL::ExecutionError, "key/value pair missing key" if k.nil?
-
-          [k, v]
-        else
-          raise ::GraphQL::ExecutionError, "invalid key/value pair entry: #{e.class}"
-        end
+      def extract_pair(entry)
+        return extract_from_struct(entry) if key_value_struct?(entry)
+        return extract_from_hash(entry) if entry.is_a?(Hash)
+
+        raise ::GraphQL::ExecutionError, "invalid key/value pair entry: #{entry.class}"
+      end
+
+      def key_value_struct?(entry)
+        entry.respond_to?(:key) && entry.respond_to?(:value) && !entry.is_a?(Hash)
+      end
+
+      def extract_from_struct(entry)
+        [entry.key, entry.value]
+      end
+
+      def extract_from_hash(entry)
+        key = entry["key"] || entry[:key]
+        raise ::GraphQL::ExecutionError, "key/value pair missing key" if key.nil?
+
+        [key, entry["value"] || entry[:value]]
       end
     end
   end

data/lib/active_admin/graphql/record_source.rb

@@ -10,21 +10,34 @@ module ActiveAdmin
       end
 
       def fetch(ids)
-        keys = ids.map { |raw| raw.nil? ? nil : ActiveAdmin::PrimaryKey.dataloader_tuple(@model_class, raw) }
+        keys = normalized_keys(ids)
         uniq = keys.compact.uniq
-        return ids.map { nil } if uniq.empty?
+        return Array.new(ids.size) { nil } if uniq.empty?
 
-        if ActiveAdmin::PrimaryKey.composite?(@model_class)
-          records = @model_class.where(@pk => uniq).to_a
-          by_tuple = records.index_by { |r| ActiveAdmin::PrimaryKey.dataloader_tuple_from_record(r) }
-          keys.map { |t| t.nil? ? nil : by_tuple[t] }
-        else
-          pk_sym = @pk.to_sym
-          records = @model_class.where(pk_sym => uniq).to_a
-          by_id = records.index_by { |r| r.public_send(pk_sym) }
-          keys.map { |k| k.nil? ? nil : by_id[k] }
+        indexed = load_records(uniq)
+        keys.map { |key| key.nil? ? nil : indexed[key] }
+      end
+
+      def normalized_keys(ids)
+        ids.map do |raw|
+          raw.nil? ? nil : ActiveAdmin::PrimaryKey.dataloader_tuple(@model_class, raw)
         end
       end
+
+      def load_records(keys)
+        ActiveAdmin::PrimaryKey.composite?(@model_class) ? composite_index(keys) : single_column_index(keys)
+      end
+
+      def composite_index(keys)
+        records = @model_class.where(@pk => keys).to_a
+        records.index_by { |record| ActiveAdmin::PrimaryKey.dataloader_tuple_from_record(record) }
+      end
+
+      def single_column_index(keys)
+        pk_sym = @pk.to_sym
+        records = @model_class.where(pk_sym => keys).to_a
+        records.index_by { |record| record.public_send(pk_sym) }
+      end
     end
   end
 end

data/lib/active_admin/graphql/resource_query_proxy/controller.rb

@@ -12,15 +12,24 @@ module ActiveAdmin
         end
 
         def param_hash_for(action, extra)
+          base_graphql_params(action)
+            .merge(extra.stringify_keys)
+            .yield_self { |params| merge_graph_params!(params) }
+        end
+
+        def base_graphql_params(action)
           {
             "action" => action,
             "controller" => "active_admin/graphql"
-          }.merge(extra.stringify_keys).tap do |h|
-            merge_ransack!(h)
-            h["scope"] = @graph_params["scope"].to_s if @graph_params["scope"].present?
-            h["order"] = @graph_params["order"].to_s if @graph_params["order"].present?
-            merge_belongs_to!(h)
-          end
+          }
+        end
+
+        def merge_graph_params!(hash)
+          merge_ransack!(hash)
+          assign_if_present!(hash, "scope", @graph_params["scope"])
+          assign_if_present!(hash, "order", @graph_params["order"])
+          merge_belongs_to!(hash)
+          hash
         end
 
         def merge_ransack!(h)
@@ -50,6 +59,13 @@ module ActiveAdmin
           h[key] = val.to_s if val.present?
         end
 
+        def assign_if_present!(hash, key, value)
+          return hash if value.blank?
+
+          hash[key] = value.to_s
+          hash
+        end
+
         def stub_controller!(controller, hash)
           user = @user
           params_obj = ActionController::Parameters.new(hash)

data/lib/active_admin/graphql/resource_query_proxy.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "rack/mock"
+require "stringio"
 
 require_relative "resource_query_proxy/controller"
 
@@ -49,10 +50,9 @@ module ActiveAdmin
         extra = {
           "batch_action" => batch_sym.to_s,
           "collection_selection" => Array(ids).map(&:to_s),
-          # JSON.generate/to_json can attempt to append to a frozen literal on TruffleRuby.
-          # Using JSON.dump with an explicit mutable buffer avoids mutating the gem's internal
-          # literals while still serializing to the string that ActiveAdmin expects.
-          "batch_action_inputs" => JSON.dump(inputs, +"")
+          # TruffleRuby freezes JSON's internal "{}" buffer, so Hash#to_json raises FrozenError.
+          # Dumping into a dedicated StringIO avoids mutating the shared literal.
+          "batch_action_inputs" => dump_batch_inputs(inputs)
         }
         c = controller_for("batch_action", extra)
         perform_controller_command!(c) { c.send(:batch_action) }
@@ -110,6 +110,14 @@ module ActiveAdmin
         stub_controller!(c, h)
         c
       end
+
+      def dump_batch_inputs(hash)
+        buffer = StringIO.new
+        JSON.dump(hash, buffer)
+        buffer.string
+      rescue FrozenError
+        JSON.generate(hash)
+      end
     end
   end
 end

data/lib/active_admin/graphql/run_action_mutation_config.rb

@@ -12,6 +12,8 @@ module ActiveAdmin
       attr_accessor :resolve_proc
       # Optional block evaluated in the graphql-ruby +field+ DSL context (+argument+, …) for per-action fields.
       attr_accessor :arguments_proc
+      # Optional authorization toggle for this mutation configuration. +nil+ means namespace default.
+      attr_accessor :authorize
 
       def self.ensure_graphql_object_subclass!(type)
         unless type.is_a?(Class) && type < ::GraphQL::Schema::Object

data/lib/active_admin/graphql/run_action_mutation_dsl.rb

@@ -27,6 +27,10 @@ module ActiveAdmin
       def arguments(&block)
         @mutation_config.arguments_proc = block
       end
+
+      def authorize(value = true)
+        @mutation_config.authorize = !!value
+      end
     end
   end
 end

data/lib/active_admin/graphql/schema_builder/mutation_batch.rb

@@ -29,7 +29,9 @@ module ActiveAdmin
             define_method(fname.to_sym) do |batch_action:, ids:, inputs: nil, **kw|
               auth = context[:auth]
               mdl = aa_res.resource_class
-              unless auth.authorized?(aa_res, ActiveAdmin::Authorization::READ, mdl)
+              cfg = aa_res.graphql_config.batch_run_action
+              auth_enabled = cfg.authorize.nil? ? (ns.graphql_custom_mutation_authorization_default != false) : cfg.authorize
+              if auth_enabled && !auth.authorized?(aa_res, ActiveAdmin::Authorization::READ, mdl)
                 raise ::GraphQL::ExecutionError, "not authorized to read #{mdl.name}"
               end
 
@@ -38,6 +40,12 @@ module ActiveAdmin
                 raise ::GraphQL::ExecutionError, "Unknown batch_action #{ba.inspect} for #{plural}"
               end
 
+              max_ids = ns.graphql_batch_action_max_ids
+              if max_ids.is_a?(Integer) && max_ids.positive? && ids.size > max_ids
+                raise ::GraphQL::ExecutionError,
+                  "ids cannot exceed #{max_ids} entries (received #{ids.size})"
+              end
+
               proxy = ResourceQueryProxy.new(
                 aa_resource: aa_res,
                 user: context[:auth].user,

data/lib/active_admin/graphql/schema_builder/mutation_collection.rb

@@ -33,7 +33,9 @@ module ActiveAdmin
             define_method(fname.to_sym) do |action:, params: nil, **kw|
               auth = context[:auth]
               mdl = aa_res.resource_class
-              unless auth.authorized?(aa_res, ActiveAdmin::Authorization::READ, mdl)
+              cfg = aa_res.graphql_config.collection_run_action
+              auth_enabled = cfg.authorize.nil? ? (ns.graphql_custom_mutation_authorization_default != false) : cfg.authorize
+              if auth_enabled && !auth.authorized?(aa_res, ActiveAdmin::Authorization::READ, mdl)
                 raise ::GraphQL::ExecutionError, "not authorized to read #{mdl.name}"
               end
 
@@ -91,7 +93,14 @@ module ActiveAdmin
             define_method(fname) do |params: nil, **kw|
               auth = context[:auth]
               mdl = aa_res.resource_class
-              unless auth.authorized?(aa_res, ActiveAdmin::Authorization::READ, mdl)
+              auth_enabled =
+                if per_cfg&.authorize.nil?
+                  base_cfg = aa_res.graphql_config.collection_run_action
+                  base_cfg.authorize.nil? ? (ns.graphql_custom_mutation_authorization_default != false) : base_cfg.authorize
+                else
+                  per_cfg.authorize
+                end
+              if auth_enabled && !auth.authorized?(aa_res, ActiveAdmin::Authorization::READ, mdl)
                 raise ::GraphQL::ExecutionError, "not authorized to read #{mdl.name}"
               end
 

data/lib/active_admin/graphql/schema_builder/mutation_member.rb

@@ -34,7 +34,9 @@ module ActiveAdmin
             define_method(fname.to_sym) do |action:, id:, params: nil, **kw|
               auth = context[:auth]
               mdl = aa_res.resource_class
-              unless auth.authorized?(aa_res, ActiveAdmin::Authorization::READ, mdl)
+              cfg = aa_res.graphql_config.member_run_action
+              auth_enabled = cfg.authorize.nil? ? (ns.graphql_custom_mutation_authorization_default != false) : cfg.authorize
+              if auth_enabled && !auth.authorized?(aa_res, ActiveAdmin::Authorization::READ, mdl)
                 raise ::GraphQL::ExecutionError, "not authorized to read #{mdl.name}"
               end
 
@@ -94,7 +96,14 @@ module ActiveAdmin
             define_method(fname) do |id:, params: nil, **kw|
               auth = context[:auth]
               mdl = aa_res.resource_class
-              unless auth.authorized?(aa_res, ActiveAdmin::Authorization::READ, mdl)
+              auth_enabled =
+                if per_cfg&.authorize.nil?
+                  base_cfg = aa_res.graphql_config.member_run_action
+                  base_cfg.authorize.nil? ? (ns.graphql_custom_mutation_authorization_default != false) : base_cfg.authorize
+                else
+                  per_cfg.authorize
+                end
+              if auth_enabled && !auth.authorized?(aa_res, ActiveAdmin::Authorization::READ, mdl)
                 raise ::GraphQL::ExecutionError, "not authorized to read #{mdl.name}"
               end
 

data/lib/active_admin/graphql/schema_builder/query_type.rb

@@ -8,6 +8,7 @@ module ActiveAdmin
         include QueryTypeCollection
         include QueryTypeMember
         include QueryTypePages
+        include QueryTypePolicies
 
         def build_query_type(registered_resource_union:)
           builder = self
@@ -45,6 +46,12 @@ module ActiveAdmin
             )
 
             builder.add_page_query_fields!(self, builder: builder, ns: ns)
+            builder.add_activeadmin_policies_query_field!(
+              self,
+              builder: builder,
+              ns: ns,
+              aa_by_graphql_type_name: aa_by_graphql_type_name
+            )
           end
         end
       end

data/lib/active_admin/graphql/schema_builder/query_type_policies.rb

@@ -0,0 +1,148 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    class SchemaBuilder
+      module QueryTypePolicies
+        POLICY_ACTIONS = {
+          read: ActiveAdmin::Authorization::READ,
+          create: ActiveAdmin::Authorization::CREATE,
+          update: ActiveAdmin::Authorization::UPDATE,
+          destroy: ActiveAdmin::Authorization::DESTROY
+        }.freeze
+
+        def add_activeadmin_policies_query_field!(query_class, builder:, ns:, aa_by_graphql_type_name:)
+          resource_policy_type = Class.new(::GraphQL::Schema::Object) do
+            graphql_name "ActiveAdminResourcePolicies"
+            field :type_name, ::GraphQL::Types::String, null: false, camelize: false
+            field :activeadmin_policies, builder.send(:policy_set_type), null: false, camelize: false
+          end
+
+          page_policy_type = Class.new(::GraphQL::Schema::Object) do
+            graphql_name "ActiveAdminPagePolicies"
+            field :name, ::GraphQL::Types::String, null: false, camelize: false
+            field :activeadmin_policies, builder.send(:policy_set_type), null: false, camelize: false
+          end
+
+          record_policy_type = Class.new(::GraphQL::Schema::Object) do
+            graphql_name "ActiveAdminRecordPolicies"
+            field :id, ::GraphQL::Types::ID, null: false, camelize: false
+            field :activeadmin_policies, builder.send(:policy_set_type), null: false, camelize: false
+          end
+
+          matrix_type = Class.new(::GraphQL::Schema::Object) do
+            graphql_name "ActiveAdminPolicies"
+            field :resources, [resource_policy_type], null: false, camelize: false
+            field :pages, [page_policy_type], null: false, camelize: false
+          end
+
+          query_class.class_eval do
+            field :activeadmin_policies, matrix_type, null: false, camelize: false,
+              visibility: {kind: :query_activeadmin_policies}
+
+            field :activeadmin_policies_for, [record_policy_type], null: false, camelize: false,
+              visibility: {kind: :query_activeadmin_policies_for} do
+              argument :type_name, ::GraphQL::Types::String, required: true, camelize: false
+              argument :ids, [::GraphQL::Types::ID], required: true, camelize: false
+              argument :path, [KeyValuePairInput], required: false, camelize: false
+            end
+
+            define_method(:activeadmin_policies) do
+              auth = context[:auth]
+              resources = builder.send(:active_resources).map do |aa_res|
+                {
+                  type_name: builder.send(:graphql_type_name_for, aa_res),
+                  activeadmin_policies: builder.send(:build_policy_set, auth: auth, subject_owner: aa_res, subject: aa_res.resource_class, context: context)
+                }
+              end
+              pages = ns.resources.select { |r| r.is_a?(ActiveAdmin::Page) }.map do |page|
+                {
+                  name: page.name,
+                  activeadmin_policies: builder.send(:build_policy_set, auth: auth, subject_owner: page, subject: page, context: context)
+                }
+              end
+              {resources: resources, pages: pages}
+            end
+
+            define_method(:activeadmin_policies_for) do |type_name:, ids:, path: nil|
+              aa_res = aa_by_graphql_type_name[type_name.to_s]
+              raise ::GraphQL::ExecutionError, "unknown resource type_name #{type_name.inspect}" unless aa_res
+
+              proxy = ResourceQueryProxy.new(
+                aa_resource: aa_res,
+                user: context[:auth].user,
+                namespace: ns,
+                graph_params: KeyValuePairs.to_hash(path)
+              )
+
+              ids.map do |id|
+                record = proxy.find_member(id.to_s)
+                raise ::GraphQL::ExecutionError, "not found" unless record
+
+                {
+                  id: id.to_s,
+                  activeadmin_policies: builder.send(:build_policy_set, auth: context[:auth], subject_owner: aa_res, subject: record, context: context)
+                }
+              end
+            end
+          end
+        end
+
+        private
+
+        def policy_action_pairs
+          hook = @namespace.graphql_policy_actions
+          if hook.respond_to?(:call)
+            raw = hook.call(@namespace)
+            return raw.to_h.transform_keys(&:to_sym) if raw.respond_to?(:to_h)
+          end
+          POLICY_ACTIONS
+        end
+
+        def allowed_base_actions(auth:, subject_owner:, subject:, context:)
+          action_mapper = @namespace.graphql_policy_action_mapper
+          policy_action_pairs.each_with_object([]) do |(name, default_action), out|
+            allowed = if action_mapper.respond_to?(:call)
+              action_mapper.call(context, subject_owner, subject, name, default_action)
+            else
+              auth.authorized?(subject_owner, default_action, subject)
+            end
+            out << name.to_s if allowed
+          end
+        end
+
+        def build_policy_set(auth:, subject_owner:, subject:, context:)
+          base = {
+            allowed_actions: allowed_base_actions(auth: auth, subject_owner: subject_owner, subject: subject, context: context),
+            allowed_member_actions: [],
+            allowed_collection_actions: [],
+            allowed_batch_actions: []
+          }
+
+          if subject_owner.is_a?(ActiveAdmin::Resource)
+            class_subject = subject_owner.resource_class
+            if subject.is_a?(Class)
+              if auth.authorized?(subject_owner, ActiveAdmin::Authorization::READ, class_subject)
+                base[:allowed_member_actions] = subject_owner.member_actions.map { |a| a.name.to_s }
+                base[:allowed_collection_actions] = subject_owner.collection_actions.map { |a| a.name.to_s }
+                base[:allowed_batch_actions] = subject_owner.batch_actions.map { |a| a.sym.to_s }
+              end
+            elsif auth.authorized?(subject_owner, ActiveAdmin::Authorization::READ, subject)
+              base[:allowed_member_actions] = subject_owner.member_actions.map { |a| a.name.to_s }
+            end
+          end
+
+          if (extra = @namespace.graphql_policy_extra).respond_to?(:call)
+            out = extra.call(context, subject_owner, subject, base)
+            base = out if out.is_a?(Hash)
+          end
+          if (transform = @namespace.graphql_policy_transform).respond_to?(:call)
+            out = transform.call(context, subject_owner, subject, base)
+            base = out if out.is_a?(Hash)
+          end
+          base
+        end
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/schema_builder/types_object.rb

@@ -6,6 +6,19 @@ module ActiveAdmin
       module TypesObject
         private
 
+        def policy_set_type
+          @policy_set_type ||= Class.new(::GraphQL::Schema::Object) do
+            graphql_name "ActiveAdminPolicySet"
+            description "Allowed ActiveAdmin actions for this subject."
+
+            field :allowed_actions, [::GraphQL::Types::String], null: false, camelize: false
+            field :allowed_member_actions, [::GraphQL::Types::String], null: false, camelize: false
+            field :allowed_collection_actions, [::GraphQL::Types::String], null: false, camelize: false
+            field :allowed_batch_actions, [::GraphQL::Types::String], null: false, camelize: false
+            field :extra, ::GraphQL::Types::JSON, null: true, camelize: false
+          end
+        end
+
         def build_enum_type(aa_res, column_name, mapping)
           key = [aa_res.resource_class.name, column_name.to_s]
           return @enum_types[key] if @enum_types[key]
@@ -61,14 +74,17 @@ module ActiveAdmin
           attr_names = attributes_for(aa_res).map(&:to_s)
 
           type_class = Class.new(::GraphQL::Schema::Object) do
+            field_class ::ActiveAdmin::GraphQL::SchemaField
             graphql_name gname
             description "ActiveAdmin resource `#{aa_res.resource_name}`"
             implements ::ActiveAdmin::GraphQL::ResourceInterface
+
+            define_singleton_method(:activeadmin_graphql_resource) { aa_res }
           end
 
           pk_cols = ActiveAdmin::PrimaryKey.columns(model)
 
-          type_class.field :id, ::GraphQL::Types::ID, null: false
+          type_class.field :id, ::GraphQL::Types::ID, null: false, authorize: false
           type_class.define_method(:id) { ActiveAdmin::PrimaryKey.graphql_id_value(object) }
 
           attr_names.each do |name|
@@ -78,11 +94,17 @@ module ActiveAdmin
             next unless col
 
             gql_t = graphql_scalar_for_column(aa_res, model, col)
-            type_class.field(name.to_sym, gql_t, null: true, camelize: false)
+            type_class.field(name.to_sym, gql_t, null: true, camelize: false, authorize: false)
 
             type_class.define_method(name.to_sym) { object.public_send(name) }
           end
 
+          type_class.field :activeadmin_policies, policy_set_type, null: false, camelize: false, authorize: false
+          type_class.define_method(:activeadmin_policies) do
+            builder = context[:namespace] && ActiveAdmin::GraphQL::SchemaBuilder.new(context[:namespace])
+            builder.send(:build_policy_set, auth: context[:auth], subject_owner: aa_res, subject: object, context: context)
+          end
+
           if (ext = aa_res.graphql_config.extension_block)
             type_class.class_eval(&ext)
           end

data/lib/active_admin/graphql/schema_builder.rb

@@ -17,6 +17,7 @@ require_relative "schema_builder/query_type_registered"
 require_relative "schema_builder/query_type_collection"
 require_relative "schema_builder/query_type_member"
 require_relative "schema_builder/query_type_pages"
+require_relative "schema_builder/query_type_policies"
 require_relative "schema_builder/query_type"
 require_relative "schema_builder/resolvers"
 require_relative "schema_builder/mutation_action_types"

data/lib/active_admin/graphql/schema_field.rb

@@ -9,8 +9,10 @@ module ActiveAdmin
     # That hook runs from {#visible?}; it does not replace graphql-ruby's visibility system—it
     # composes with +super+ like any custom +Field+ class.
     class SchemaField < ::GraphQL::Schema::Field
-      def initialize(visibility: nil, **kwargs, &block)
+      def initialize(visibility: nil, authorize: nil, authorize_action: nil, **kwargs, &block)
         @visibility = visibility
+        @authorize = authorize
+        @authorize_action = authorize_action
         super(**kwargs, &block)
       end
 
@@ -24,6 +26,24 @@ module ActiveAdmin
 
         !!hook.call(ctx, @visibility)
       end
+
+      def authorized?(object, args, ctx)
+        return false unless super
+
+        owner = self.owner
+        aa_resource = owner.respond_to?(:activeadmin_graphql_resource) ? owner.activeadmin_graphql_resource : nil
+        return true unless aa_resource
+
+        enabled = if @authorize.nil?
+          ctx[:namespace]&.graphql_custom_field_authorization_default != false
+        else
+          @authorize
+        end
+        return true unless enabled
+
+        action = @authorize_action || ActiveAdmin::Authorization::READ
+        !!ctx[:auth]&.authorized?(aa_resource, action, object)
+      end
     end
   end
 end

data/lib/active_admin/graphql/version.rb

@@ -2,6 +2,6 @@
 
 module ActiveAdmin
   module GraphQL
-    VERSION = "0.1.2"
+    VERSION = "0.2.0"
   end
 end

data/lib/active_admin/graphql.rb

@@ -28,27 +28,19 @@ module ActiveAdmin
 
         @graphql_features_loaded = true
         ActiveAdmin::Dependency["graphql"].spec!
-        require "graphql"
-        require "graphql/types/json"
-        require "graphql/types/iso_8601_date_time"
-        require "graphql/types/iso_8601_date"
-        require_relative "graphql/resource_interface"
-        require_relative "graphql/schema_field"
-        require_relative "graphql/auth_context"
-        require_relative "graphql/record_source"
-        require_relative "graphql/resource_query_proxy"
-        require_relative "graphql/run_action_payload"
-        require_relative "graphql/run_action_mutation_config"
-        require_relative "graphql/run_action_mutation_dsl"
-        require_relative "graphql/key_value_pair_input"
-        require_relative "graphql/schema_builder"
+        require_graphql_dependencies!
+        require_active_admin_graphql_components!
       end
 
       # @param namespace [ActiveAdmin::Namespace]
       # @return [Class] schema class (subclass of GraphQL::Schema)
+      #
+      # Cached per namespace for the process. In development, call
+      # {clear_schema_cache!} or {clear_schema_for!} after ActiveAdmin +unload!+
+      # (already wired in {Integration::ApplicationUnloadClearsGraphQLSchema}) or
+      # when admin registrations change without a full unload.
       def schema_for(namespace)
         cache_key = namespace.name
-        SCHEMA_CACHE.delete(cache_key) if defined?(Rails) && Rails.env.development?
         SCHEMA_CACHE[cache_key] ||= SchemaBuilder.new(namespace).build
       end
 
@@ -59,6 +51,28 @@ module ActiveAdmin
       def clear_schema_for!(namespace)
         SCHEMA_CACHE.delete(namespace.name)
       end
+
+      def require_graphql_dependencies!
+        require "graphql"
+        require "graphql/types/json"
+        require "graphql/types/iso_8601_date_time"
+        require "graphql/types/iso_8601_date"
+      end
+
+      def require_active_admin_graphql_components!
+        %w[
+          graphql/resource_interface
+          graphql/schema_field
+          graphql/auth_context
+          graphql/record_source
+          graphql/resource_query_proxy
+          graphql/run_action_payload
+          graphql/run_action_mutation_config
+          graphql/run_action_mutation_dsl
+          graphql/key_value_pair_input
+          graphql/schema_builder
+        ].each { |path| require_relative path }
+      end
     end
   end
 end

data/lib/active_admin/primary_key.rb

@@ -23,28 +23,37 @@ unless defined?(ActiveAdmin::PrimaryKey)
 
       def composite_attribute_hash(model, id_param)
         cols = ordered_columns(model)
-        h =
-          case id_param
-          when Hash
-            id_param.stringify_keys.slice(*cols)
-          when String
-            parsed = JSON.parse(id_param)
-            raise ArgumentError, "composite id must be a JSON object" unless parsed.is_a?(Hash)
-
-            parsed.stringify_keys.slice(*cols)
-          when Array
-            cols.zip(id_param).to_h
-          else
-            raise ArgumentError, "unsupported composite id type"
-          end
-
-        missing = cols - h.keys
+        hash = normalize_composite_input(cols, id_param)
+        validate_composite_keys!(cols, hash)
+        hash
+      end
+
+      def normalize_composite_input(cols, id_param)
+        case id_param
+        when Hash
+          id_param.stringify_keys.slice(*cols)
+        when String
+          extract_composite_json(cols, id_param)
+        when Array
+          cols.zip(id_param).to_h
+        else
+          raise ArgumentError, "unsupported composite id type"
+        end
+      end
+
+      def extract_composite_json(cols, payload)
+        parsed = JSON.parse(payload)
+        raise ArgumentError, "composite id must be a JSON object" unless parsed.is_a?(Hash)
+
+        parsed.stringify_keys.slice(*cols)
+      end
+
+      def validate_composite_keys!(cols, hash)
+        missing = cols - hash.keys
         raise ArgumentError, "composite id missing keys: #{missing.join(", ")}" if missing.any?
 
-        absent = cols.select { |c| h[c].nil? }
+        absent = cols.select { |c| hash[c].nil? }
         raise ArgumentError, "composite id missing values for: #{absent.join(", ")}" if absent.any?
-
-        h
       end
 
       def find_attributes(model, id_param)
@@ -82,36 +91,49 @@ unless defined?(ActiveAdmin::PrimaryKey)
         blob = blob.stringify_keys
         cols = ordered_columns(model)
         if cols.size == 1
-          id = blob["id"]
-          raise ArgumentError, "id is required" if id.blank?
-
-          {"id" => id.to_s}
-        elsif blob["id"].present?
-          find_attributes(model, blob["id"]).stringify_keys
-        elsif cols.all? { |c| blob.key?(c) && blob[c].present? }
-          cols.to_h { |c| [c, blob[c]] }
+          single_member_param(blob)
         else
-          raise ArgumentError, "composite id requires id (JSON) or all primary key columns"
+          composite_member_param(model, blob, cols)
         end
       end
 
+      def single_member_param(blob)
+        id = blob["id"]
+        raise ArgumentError, "id is required" if id.blank?
+
+        {"id" => id.to_s}
+      end
+
+      def composite_member_param(model, blob, cols)
+        return find_attributes(model, blob["id"]).stringify_keys if blob["id"].present?
+        return cols.to_h { |c| [c, blob[c]] } if cols.all? { |c| blob.key?(c) && blob[c].present? }
+
+        raise ArgumentError, "composite id requires id (JSON) or all primary key columns"
+      end
+
       def field_kw_to_param_hash(model, id:, **kw)
         cols = ordered_columns(model)
         if cols.size == 1
-          raise ArgumentError, "id is required" if id.blank?
-
-          {"id" => id.to_s}
-        elsif id.present?
-          find_attributes(model, id).stringify_keys
+          single_field_hash(id)
         else
-          out = cols.to_h { |c| [c, kw[c.to_sym] || kw[c]] }
-          if cols.all? { |c| !out[c].nil? }
-            out.transform_values(&:to_s)
-          else
-            raise ArgumentError, "composite id requires id (JSON) or all primary key fields as arguments"
-          end
+          composite_field_hash(model, cols, id, kw)
         end
       end
+
+      def single_field_hash(id)
+        raise ArgumentError, "id is required" if id.blank?
+
+        {"id" => id.to_s}
+      end
+
+      def composite_field_hash(model, cols, id, kw)
+        return find_attributes(model, id).stringify_keys if id.present?
+
+        out = cols.to_h { |c| [c, kw[c.to_sym] || kw[c]] }
+        return out.transform_values(&:to_s) if cols.all? { |c| !out[c].nil? }
+
+        raise ArgumentError, "composite id requires id (JSON) or all primary key fields as arguments"
+      end
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: activeadmin-graphql
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.2.0
 platform: ruby
 authors:
 - Andrei Makarov
@@ -348,6 +348,7 @@ files:
 - lib/active_admin/graphql/schema_builder/query_type_collection.rb
 - lib/active_admin/graphql/schema_builder/query_type_member.rb
 - lib/active_admin/graphql/schema_builder/query_type_pages.rb
+- lib/active_admin/graphql/schema_builder/query_type_policies.rb
 - lib/active_admin/graphql/schema_builder/query_type_registered.rb
 - lib/active_admin/graphql/schema_builder/resolvers.rb
 - lib/active_admin/graphql/schema_builder/resources.rb
@@ -383,7 +384,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.4
 specification_version: 4
 summary: GraphQL API extension for ActiveAdmin (graphql-ruby).
 test_files: []