activeadmin-graphql 0.1.2 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cc303bd74d84b05385c3a3af874e1dd66957029746729122a5d684ac9720a4cd
-  data.tar.gz: c2ab55694cb7b62773fd22db7fb219850fb3901a3d5bf9565a9ac00b0804db6e
+  metadata.gz: '00998f8445b9a5f9a7d4a939029d6e6460527432d658711b713df1ad293abc9e'
+  data.tar.gz: fd5f948edd2277b99e68ee384ccf7d31c8ffa8c890bf2f277837106213498652
 SHA512:
-  metadata.gz: 0c90194015f4ad4ff7ebf9125ad6c7b2b4c0cf800a622f7cafba0d9a88945bdc57956eca598b2991aa32ceeec66ea925c5e9e5749ab38ad56a042c22f1de6437
-  data.tar.gz: f023d72351949ed1b0817ec01839ff1ce45aeae3d5ffba51a7651307fdf51c598171e085a5f0fe9b0b183bb62ff4da09e0810c57e4afb5c54ded43db1f9b12e2
+  metadata.gz: fb9a627765be0dfb70171b6c2b9be70828e35a86fb0be2c79df237b0dbadc0559376e176b04ab6a2de49d22404c9773a4f9bee1427d1007b139dc71114afb991
+  data.tar.gz: 7c2d075e817702fd05648cf0f6dee228938d7d09400be066f99d4d50b23eb4d301f8ee0ac1632974ea57317f8a2ee7bcee81f5282481e9c477c9e8fd312e5db1

data/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## Unreleased
+
+## 0.2.1 (2026-07-14)
+
+- Add RBS type signatures to the published gem for Steep and other Ruby type checkers
+- Add Ruby 4.0 to the supported compatibility matrix
+- Return HTTP 400 with a clear error when the GraphQL request body or variables contain invalid JSON
+- Return `null` for member queries when the record id does not exist
+- Enforce read authorization on `belongs_to` association fields so denied parent records resolve as `null`
+- Build GraphQL schemas safely when `schema_for` runs concurrently
+
+## 0.2.0 (2026-04-29)
+
+- Add `activeadmin_policies` GraphQL policy surfaces:
+  - global `activeadmin_policies` for resources/pages
+  - per-object `activeadmin_policies` on resource objects
+  - preflight `activeadmin_policies_for(type_name:, ids:, path:)` for per-record checks before running queries/mutations/actions
+- Switch policy payloads to allow-lists (`allowed_actions`, `allowed_member_actions`, `allowed_collection_actions`, `allowed_batch_actions`) and add namespace customization hooks (`graphql_policy_actions`, `graphql_policy_action_mapper`, `graphql_policy_extra`, `graphql_policy_transform`)
+- Enforce authorization-by-default for custom GraphQL fields/mutations with explicit opt-out (`authorize: false` / mutation DSL `authorize false`)
+- Add namespace defaults/settings and request specs covering policies, customization hooks, and auth-toggle behavior
+
 ## 0.1.2 (2026-03-30)
 
 - Fix TruffleRuby compatibility issue with JSON.dump

data/activeadmin-graphql.gemspec

@@ -36,7 +36,8 @@ Gem::Specification.new do |spec|
     ].select { |f| File.file?(f) } +
       Dir["docs/**/*.md"] +
       Dir["app/**/*.rb"] +
-      Dir["lib/**/*.rb"]
+      Dir["lib/**/*.rb"] +
+      Dir["sig/**/*"]
   end
 
   spec.require_paths = ["lib"]
@@ -51,11 +52,12 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "parallel_tests", "~> 4.7"
   spec.add_development_dependency "rails", ">= 6.1"
   spec.add_development_dependency "rspec", "~> 3"
+  spec.add_development_dependency "polyrun", ">= 2.2.0"
+  spec.add_development_dependency "prosopite", "~> 2.0"
   spec.add_development_dependency "rspec-rails", ">= 6"
   spec.add_development_dependency "rubocop-rails", "~> 2.34"
   spec.add_development_dependency "rubocop-rspec", "~> 3.8"
   spec.add_development_dependency "rubocop-thread_safety", "~> 0.7"
-  spec.add_development_dependency "simplecov", "~> 0.22"
   spec.add_development_dependency "sprockets-rails", ">= 3.4"
   spec.add_development_dependency "sqlite3", ">= 1"
   spec.add_development_dependency "standard", "~> 1.52"
@@ -63,4 +65,5 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "standard-performance", "~> 1.8"
   spec.add_development_dependency "standard-rails", "~> 1.5"
   spec.add_development_dependency "standard-rspec", "~> 0.3"
+  spec.add_development_dependency "rbs", "~> 3"
 end

data/app/controllers/active_admin/graphql_controller.rb

@@ -9,40 +9,18 @@ module ActiveAdmin
   class GraphqlController < ApplicationController
     protect_from_forgery with: :exception
 
+    rescue_from ActionDispatch::Http::Parameters::ParseError do
+      render json: {errors: [{message: "Invalid JSON"}]}, status: :bad_request
+    end
+
     before_action :ensure_graphql_enabled!
     before_action :authenticate_graphql!
 
     def execute
       schema = ActiveAdmin::GraphQL.schema_for(active_admin_namespace)
+      return render_multiplex(schema) if multiplex_request?
 
-      if multiplex_request?
-        operations = multiplex_operations
-        max_n = active_admin_namespace.graphql_multiplex_max || 20
-        if operations.size > max_n
-          return render json: {errors: [{message: "Multiplex exceeds maximum of #{max_n}"}]},
-            status: :content_too_large
-        end
-
-        results = schema.multiplex(
-          operations.map do |op|
-            {
-              query: op[:query],
-              variables: ensure_variables(op[:variables]),
-              operation_name: op[:operation_name],
-              context: graphql_context
-            }
-          end
-        )
-        render json: results.map(&:to_h), status: :ok
-      else
-        result = schema.execute(
-          query: query_string,
-          variables: ensure_variables(variables_hash),
-          operation_name: operation_name,
-          context: graphql_context
-        )
-        render json: result.to_h, status: :ok
-      end
+      render_single(schema)
     end
 
     def active_admin_namespace
@@ -130,6 +108,8 @@ module ActiveAdmin
 
     def request_body_hash
       json = request_body_json
+      return nil if json.nil? || json == :invalid_json
+
       json if json.is_a?(Hash)
     end
 
@@ -145,13 +125,21 @@ module ActiveAdmin
           body.present? ? JSON.parse(body) : nil
         end
     rescue JSON::ParserError
-      @request_body_json = nil
+      @request_body_json = :invalid_json
+    end
+
+    def invalid_request_json?
+      request_body_json == :invalid_json
     end
 
     def ensure_variables(raw)
       case raw
       when String
-        raw.present? ? JSON.parse(raw) : {}
+        if raw.blank?
+          {}
+        else
+          JSON.parse(raw)
+        end
       when Hash
         raw
       when ActionController::Parameters
@@ -162,7 +150,71 @@ module ActiveAdmin
         {}
       end
     rescue JSON::ParserError
-      {}
+      :invalid_json
+    end
+
+    def render_invalid_json!
+      render json: {errors: [{message: "Invalid JSON"}]}, status: :bad_request
+    end
+
+    def render_multiplex(schema)
+      return render_invalid_json! if invalid_request_json?
+
+      operations = multiplex_operations
+      return render_multiplex_limit_error!(operations.size) if exceeds_multiplex_limit?(operations)
+
+      payloads = build_multiplex_payloads(operations)
+      return if performed?
+
+      results = schema.multiplex(payloads)
+      render json: results.map(&:to_h), status: :ok
+    end
+
+    def render_single(schema)
+      return render_invalid_json! if invalid_request_json?
+
+      variables = ensure_variables(variables_hash)
+      return render_invalid_json! if variables == :invalid_json
+
+      result = schema.execute(
+        query: query_string,
+        variables: variables,
+        operation_name: operation_name,
+        context: graphql_context
+      )
+      render json: result.to_h, status: :ok
+    end
+
+    def exceeds_multiplex_limit?(operations)
+      operations.size > max_multiplex_operations
+    end
+
+    def max_multiplex_operations
+      active_admin_namespace.graphql_multiplex_max || 20
+    end
+
+    def render_multiplex_limit_error!(count)
+      max_n = max_multiplex_operations
+      msg = "Multiplex exceeds maximum of #{max_n} (received #{count})"
+      render json: {errors: [{message: msg}]}, status: :content_too_large
+    end
+
+    def build_multiplex_payloads(operations)
+      context = graphql_context
+      operations.map do |operation|
+        variables = ensure_variables(operation[:variables])
+        if variables == :invalid_json
+          render_invalid_json!
+          return []
+        end
+
+        {
+          query: operation[:query],
+          variables: variables,
+          operation_name: operation[:operation_name],
+          context: context
+        }
+      end
     end
   end
 end

data/docs/graphql-api.md

@@ -46,10 +46,16 @@ Each namespace inherits these options (defaults in parentheses):
 * `graphql_path` — path segment under the namespace mount (`"graphql"`).
 * `graphql_multiplex_max` — maximum operations per multiplexed JSON array
   request (`20`).
-* `graphql_max_complexity` — passed to graphql-ruby `max_complexity` when set.
-* `graphql_max_depth` — passed to `max_depth` when set.
-* `graphql_default_page_size` / `graphql_default_max_page_size` — connection
-  defaults when set.
+* `graphql_max_complexity` — passed to graphql-ruby `max_complexity` (`300` by
+  default; set a higher value if legitimate queries are rejected). Set to
+  `nil` to disable the limit.
+* `graphql_max_depth` — passed to `max_depth` (`18` by default). Set to `nil`
+  to disable.
+* `graphql_batch_action_max_ids` — maximum length of the `ids` argument on
+  `*_batch_action` mutations (`5000` by default; set `0` to disable the cap).
+* `graphql_default_page_size` / `graphql_default_max_page_size` — schema
+  connection defaults (`25` / `100`); needed for graphql-ruby complexity scoring
+  on connection fields when `max_complexity` is enabled.
 * `graphql_dataloader` — graphql-ruby dataloader plugin (`nil` = use
   `GraphQL::Dataloader`). Set to `GraphQL::Dataloader::AsyncDataloader` when
   the [`async` gem](https://github.com/socketry/async) is loaded if you want
@@ -155,6 +161,24 @@ separate route with CSRF disabled. Treat this endpoint like any other
 The namespace `authentication_method` runs before any GraphQL work, including
 schema introspection. Unauthenticated clients should not receive a schema.
 
+If you need to turn off schema introspection entirely (even for authenticated
+sessions or specific environments), call
+[`schema.disable_introspection_entry_points`](https://graphql-ruby.org/schema/definition.html#schema-configuration)
+from `graphql_configure_schema`. The hook receives the generated schema class,
+so you can toggle introspection based on Rails environment or other app
+settings:
+
+```ruby
+ActiveAdmin.setup do |config|
+  config.namespace :admin do |admin|
+    admin.graphql = true
+    admin.graphql_configure_schema = lambda do |schema|
+      schema.disable_introspection_entry_points if Rails.env.production?
+    end
+  end
+end
+```
+
 The GraphQL context exposes the same user as `current_active_admin_user` (from
 the namespace `current_user_method`), wrapped for authorization checks.
 

data/lib/active_admin/graphql/integration.rb

@@ -31,11 +31,18 @@ module ActiveAdmin
         ns.register :graphql_visibility, nil
         ns.register :graphql_visibility_profile, nil
         ns.register :graphql_schema_visible, nil
-        ns.register :graphql_max_complexity, nil
-        ns.register :graphql_max_depth, nil
-        ns.register :graphql_default_page_size, nil
-        ns.register :graphql_default_max_page_size, nil
+        ns.register :graphql_max_complexity, 300
+        ns.register :graphql_max_depth, 18
+        ns.register :graphql_batch_action_max_ids, 5000
+        ns.register :graphql_default_page_size, 25
+        ns.register :graphql_default_max_page_size, 100
         ns.register :graphql_configure_schema, nil
+        ns.register :graphql_policy_actions, nil
+        ns.register :graphql_policy_action_mapper, nil
+        ns.register :graphql_policy_extra, nil
+        ns.register :graphql_policy_transform, nil
+        ns.register :graphql_custom_field_authorization_default, true
+        ns.register :graphql_custom_mutation_authorization_default, true
       end
 
       def register_railtie!
@@ -114,18 +121,31 @@ module ActiveAdmin
         private
 
         def define_graphql_routes
-          namespaces.each do |namespace|
-            next unless namespace.graphql
+          graphql_namespaces.each do |namespace|
+            segment = graphql_segment_for(namespace)
+            defaults = graphql_route_defaults(namespace)
+            mount_graphql_route(namespace, segment, defaults)
+          end
+        end
+
+        def graphql_namespaces
+          namespaces.select(&:graphql)
+        end
 
-            segment = namespace.graphql_path.to_s.delete_prefix("/").presence || "graphql"
-            defaults = {active_admin_namespace: namespace.name}
+        def graphql_segment_for(namespace)
+          namespace.graphql_path.to_s.delete_prefix("/").presence || "graphql"
+        end
+
+        def graphql_route_defaults(namespace)
+          {active_admin_namespace: namespace.name}
+        end
 
-            if namespace.root?
+        def mount_graphql_route(namespace, segment, defaults)
+          if namespace.root?
+            router.post segment, controller: "/active_admin/graphql", action: "execute", defaults: defaults
+          else
+            router.namespace namespace.name, **namespace.route_options.dup do
               router.post segment, controller: "/active_admin/graphql", action: "execute", defaults: defaults
-            else
-              router.namespace namespace.name, **namespace.route_options.dup do
-                router.post segment, controller: "/active_admin/graphql", action: "execute", defaults: defaults
-              end
             end
           end
         end

data/lib/active_admin/graphql/key_value_pair_input.rb

@@ -30,18 +30,26 @@ module ActiveAdmin
         end
       end
 
-      def extract_pair(e)
-        if e.respond_to?(:key) && e.respond_to?(:value) && !e.is_a?(Hash)
-          [e.key, e.value]
-        elsif e.is_a?(Hash)
-          k = e["key"] || e[:key]
-          v = e["value"] || e[:value]
-          raise ::GraphQL::ExecutionError, "key/value pair missing key" if k.nil?
-
-          [k, v]
-        else
-          raise ::GraphQL::ExecutionError, "invalid key/value pair entry: #{e.class}"
-        end
+      def extract_pair(entry)
+        return extract_from_struct(entry) if key_value_struct?(entry)
+        return extract_from_hash(entry) if entry.is_a?(Hash)
+
+        raise ::GraphQL::ExecutionError, "invalid key/value pair entry: #{entry.class}"
+      end
+
+      def key_value_struct?(entry)
+        entry.respond_to?(:key) && entry.respond_to?(:value) && !entry.is_a?(Hash)
+      end
+
+      def extract_from_struct(entry)
+        [entry.key, entry.value]
+      end
+
+      def extract_from_hash(entry)
+        key = entry["key"] || entry[:key]
+        raise ::GraphQL::ExecutionError, "key/value pair missing key" if key.nil?
+
+        [key, entry["value"] || entry[:value]]
       end
     end
   end

data/lib/active_admin/graphql/policy_set_cache.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    # Request-scoped memoization for ActiveAdmin policy sets on GraphQL objects.
+    class PolicySetCache
+      class << self
+        def fetch(context, subject_owner:, subject:)
+          namespace = context[:namespace]
+          unless namespace
+            return policy_builder(context).send(
+              :build_policy_set,
+              auth: context[:auth],
+              subject_owner: subject_owner,
+              subject: subject,
+              context: context
+            )
+          end
+
+          cache = context[:policy_set_cache] ||= {}
+          key = cache_key(subject_owner, subject)
+          cache[key] ||= policy_builder(context).send(
+            :build_policy_set,
+            auth: context[:auth],
+            subject_owner: subject_owner,
+            subject: subject,
+            context: context
+          )
+        end
+
+        def policy_builder(context)
+          context[:policy_schema_builder] ||= SchemaBuilder.new(context[:namespace])
+        end
+
+        def cache_key(subject_owner, subject)
+          owner_key = subject_owner_key(subject_owner)
+          "#{owner_key}:#{subject_key(subject)}"
+        end
+
+        private
+
+        def subject_owner_key(subject_owner)
+          if subject_owner.is_a?(ActiveAdmin::Page)
+            "page-owner:#{subject_owner.name}"
+          else
+            "resource-owner:#{subject_owner.resource_class.name}"
+          end
+        end
+
+        def subject_key(subject)
+          if subject.is_a?(Class)
+            "class:#{subject.name}"
+          elsif subject.is_a?(ActiveAdmin::Page)
+            "page:#{subject.name}"
+          elsif subject.is_a?(ActiveRecord::Base)
+            "record:#{subject.class.name}:#{PrimaryKey.graphql_id_value(subject)}"
+          else
+            "object:#{subject.object_id}"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/record_source.rb

@@ -10,21 +10,34 @@ module ActiveAdmin
       end
 
       def fetch(ids)
-        keys = ids.map { |raw| raw.nil? ? nil : ActiveAdmin::PrimaryKey.dataloader_tuple(@model_class, raw) }
+        keys = normalized_keys(ids)
         uniq = keys.compact.uniq
-        return ids.map { nil } if uniq.empty?
+        return Array.new(ids.size) { nil } if uniq.empty?
 
-        if ActiveAdmin::PrimaryKey.composite?(@model_class)
-          records = @model_class.where(@pk => uniq).to_a
-          by_tuple = records.index_by { |r| ActiveAdmin::PrimaryKey.dataloader_tuple_from_record(r) }
-          keys.map { |t| t.nil? ? nil : by_tuple[t] }
-        else
-          pk_sym = @pk.to_sym
-          records = @model_class.where(pk_sym => uniq).to_a
-          by_id = records.index_by { |r| r.public_send(pk_sym) }
-          keys.map { |k| k.nil? ? nil : by_id[k] }
+        indexed = load_records(uniq)
+        keys.map { |key| key.nil? ? nil : indexed[key] }
+      end
+
+      def normalized_keys(ids)
+        ids.map do |raw|
+          raw.nil? ? nil : ActiveAdmin::PrimaryKey.dataloader_tuple(@model_class, raw)
         end
       end
+
+      def load_records(keys)
+        ActiveAdmin::PrimaryKey.composite?(@model_class) ? composite_index(keys) : single_column_index(keys)
+      end
+
+      def composite_index(keys)
+        records = @model_class.where(@pk => keys).to_a
+        records.index_by { |record| ActiveAdmin::PrimaryKey.dataloader_tuple_from_record(record) }
+      end
+
+      def single_column_index(keys)
+        pk_sym = @pk.to_sym
+        records = @model_class.where(pk_sym => keys).to_a
+        records.index_by { |record| record.public_send(pk_sym) }
+      end
     end
   end
 end

data/lib/active_admin/graphql/resource_query_proxy/controller.rb

@@ -12,15 +12,24 @@ module ActiveAdmin
         end
 
         def param_hash_for(action, extra)
+          base_graphql_params(action)
+            .merge(extra.stringify_keys)
+            .yield_self { |params| merge_graph_params!(params) }
+        end
+
+        def base_graphql_params(action)
           {
             "action" => action,
             "controller" => "active_admin/graphql"
-          }.merge(extra.stringify_keys).tap do |h|
-            merge_ransack!(h)
-            h["scope"] = @graph_params["scope"].to_s if @graph_params["scope"].present?
-            h["order"] = @graph_params["order"].to_s if @graph_params["order"].present?
-            merge_belongs_to!(h)
-          end
+          }
+        end
+
+        def merge_graph_params!(hash)
+          merge_ransack!(hash)
+          assign_if_present!(hash, "scope", @graph_params["scope"])
+          assign_if_present!(hash, "order", @graph_params["order"])
+          merge_belongs_to!(hash)
+          hash
         end
 
         def merge_ransack!(h)
@@ -50,6 +59,13 @@ module ActiveAdmin
           h[key] = val.to_s if val.present?
         end
 
+        def assign_if_present!(hash, key, value)
+          return hash if value.blank?
+
+          hash[key] = value.to_s
+          hash
+        end
+
         def stub_controller!(controller, hash)
           user = @user
           params_obj = ActionController::Parameters.new(hash)

data/lib/active_admin/graphql/resource_query_proxy.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "rack/mock"
+require "stringio"
 
 require_relative "resource_query_proxy/controller"
 
@@ -26,6 +27,26 @@ module ActiveAdmin
       def find_member(id)
         extra = member_route_params_for_find(id)
         controller_for("show", extra).send(:find_resource)
+      rescue ActiveRecord::RecordNotFound
+        nil
+      end
+
+      def find_members(ids)
+        string_ids = Array(ids).map(&:to_s).uniq
+        return {} if string_ids.empty?
+
+        model = @aa_resource.resource_class
+        if ActiveAdmin::PrimaryKey.composite?(model)
+          return string_ids.index_with { |identifier| find_member(identifier) }
+        end
+
+        controller = controller_for("index")
+        relation = controller.send(:apply_authorization_scope, controller.send(:scoped_collection))
+        primary_key = model.primary_key.to_sym
+        indexed = relation.where(primary_key => string_ids).index_by do |record|
+          record.public_send(primary_key).to_s
+        end
+        string_ids.index_with { |identifier| indexed[identifier] }
       end
 
       def build_new(attributes)
@@ -49,10 +70,9 @@ module ActiveAdmin
         extra = {
           "batch_action" => batch_sym.to_s,
           "collection_selection" => Array(ids).map(&:to_s),
-          # JSON.generate/to_json can attempt to append to a frozen literal on TruffleRuby.
-          # Using JSON.dump with an explicit mutable buffer avoids mutating the gem's internal
-          # literals while still serializing to the string that ActiveAdmin expects.
-          "batch_action_inputs" => JSON.dump(inputs, +"")
+          # TruffleRuby freezes JSON's internal "{}" buffer, so Hash#to_json raises FrozenError.
+          # Dumping into a dedicated StringIO avoids mutating the shared literal.
+          "batch_action_inputs" => dump_batch_inputs(inputs)
         }
         c = controller_for("batch_action", extra)
         perform_controller_command!(c) { c.send(:batch_action) }
@@ -110,6 +130,14 @@ module ActiveAdmin
         stub_controller!(c, h)
         c
       end
+
+      def dump_batch_inputs(hash)
+        buffer = StringIO.new
+        JSON.dump(hash, buffer)
+        buffer.string
+      rescue FrozenError
+        JSON.generate(hash)
+      end
     end
   end
 end

data/lib/active_admin/graphql/run_action_mutation_config.rb

@@ -12,6 +12,8 @@ module ActiveAdmin
       attr_accessor :resolve_proc
       # Optional block evaluated in the graphql-ruby +field+ DSL context (+argument+, …) for per-action fields.
       attr_accessor :arguments_proc
+      # Optional authorization toggle for this mutation configuration. +nil+ means namespace default.
+      attr_accessor :authorize
 
       def self.ensure_graphql_object_subclass!(type)
         unless type.is_a?(Class) && type < ::GraphQL::Schema::Object

data/lib/active_admin/graphql/run_action_mutation_dsl.rb

@@ -27,6 +27,10 @@ module ActiveAdmin
       def arguments(&block)
         @mutation_config.arguments_proc = block
       end
+
+      def authorize(value = true)
+        @mutation_config.authorize = !!value
+      end
     end
   end
 end

data/lib/active_admin/graphql/run_action_payload.rb

@@ -21,7 +21,8 @@ module ActiveAdmin
       field :body, ::GraphQL::Types::String, null: true,
         description: "Response body text when the action rendered (e.g. JSON)."
 
-      Result = Struct.new(:ok, :status, :location, :body, keyword_init: true)
+      # keyword_init required for Ruby 3.2 consumers; cop targets 3.4 default Struct behavior
+      Result = Struct.new(:ok, :status, :location, :body, keyword_init: true) # rubocop:disable Style/RedundantStructKeywordInit
     end
   end
 end

data/lib/active_admin/graphql/schema_builder/mutation_batch.rb

@@ -29,7 +29,9 @@ module ActiveAdmin
             define_method(fname.to_sym) do |batch_action:, ids:, inputs: nil, **kw|
               auth = context[:auth]
               mdl = aa_res.resource_class
-              unless auth.authorized?(aa_res, ActiveAdmin::Authorization::READ, mdl)
+              cfg = aa_res.graphql_config.batch_run_action
+              auth_enabled = cfg.authorize.nil? ? (ns.graphql_custom_mutation_authorization_default != false) : cfg.authorize
+              if auth_enabled && !auth.authorized?(aa_res, ActiveAdmin::Authorization::READ, mdl)
                 raise ::GraphQL::ExecutionError, "not authorized to read #{mdl.name}"
               end
 
@@ -38,6 +40,12 @@ module ActiveAdmin
                 raise ::GraphQL::ExecutionError, "Unknown batch_action #{ba.inspect} for #{plural}"
               end
 
+              max_ids = ns.graphql_batch_action_max_ids
+              if max_ids.is_a?(Integer) && max_ids.positive? && ids.size > max_ids
+                raise ::GraphQL::ExecutionError,
+                  "ids cannot exceed #{max_ids} entries (received #{ids.size})"
+              end
+
               proxy = ResourceQueryProxy.new(
                 aa_resource: aa_res,
                 user: context[:auth].user,