activeadmin-graphql 0.1.2 → 0.2.1

data/lib/active_admin/graphql/schema_builder/mutation_collection.rb

@@ -33,7 +33,9 @@ module ActiveAdmin
             define_method(fname.to_sym) do |action:, params: nil, **kw|
               auth = context[:auth]
               mdl = aa_res.resource_class
-              unless auth.authorized?(aa_res, ActiveAdmin::Authorization::READ, mdl)
+              cfg = aa_res.graphql_config.collection_run_action
+              auth_enabled = cfg.authorize.nil? ? (ns.graphql_custom_mutation_authorization_default != false) : cfg.authorize
+              if auth_enabled && !auth.authorized?(aa_res, ActiveAdmin::Authorization::READ, mdl)
                 raise ::GraphQL::ExecutionError, "not authorized to read #{mdl.name}"
               end
 
@@ -91,7 +93,14 @@ module ActiveAdmin
             define_method(fname) do |params: nil, **kw|
               auth = context[:auth]
               mdl = aa_res.resource_class
-              unless auth.authorized?(aa_res, ActiveAdmin::Authorization::READ, mdl)
+              auth_enabled =
+                if per_cfg&.authorize.nil?
+                  base_cfg = aa_res.graphql_config.collection_run_action
+                  base_cfg.authorize.nil? ? (ns.graphql_custom_mutation_authorization_default != false) : base_cfg.authorize
+                else
+                  per_cfg.authorize
+                end
+              if auth_enabled && !auth.authorized?(aa_res, ActiveAdmin::Authorization::READ, mdl)
                 raise ::GraphQL::ExecutionError, "not authorized to read #{mdl.name}"
               end
 

data/lib/active_admin/graphql/schema_builder/mutation_member.rb

@@ -34,7 +34,9 @@ module ActiveAdmin
             define_method(fname.to_sym) do |action:, id:, params: nil, **kw|
               auth = context[:auth]
               mdl = aa_res.resource_class
-              unless auth.authorized?(aa_res, ActiveAdmin::Authorization::READ, mdl)
+              cfg = aa_res.graphql_config.member_run_action
+              auth_enabled = cfg.authorize.nil? ? (ns.graphql_custom_mutation_authorization_default != false) : cfg.authorize
+              if auth_enabled && !auth.authorized?(aa_res, ActiveAdmin::Authorization::READ, mdl)
                 raise ::GraphQL::ExecutionError, "not authorized to read #{mdl.name}"
               end
 
@@ -94,7 +96,14 @@ module ActiveAdmin
             define_method(fname) do |id:, params: nil, **kw|
               auth = context[:auth]
               mdl = aa_res.resource_class
-              unless auth.authorized?(aa_res, ActiveAdmin::Authorization::READ, mdl)
+              auth_enabled =
+                if per_cfg&.authorize.nil?
+                  base_cfg = aa_res.graphql_config.member_run_action
+                  base_cfg.authorize.nil? ? (ns.graphql_custom_mutation_authorization_default != false) : base_cfg.authorize
+                else
+                  per_cfg.authorize
+                end
+              if auth_enabled && !auth.authorized?(aa_res, ActiveAdmin::Authorization::READ, mdl)
                 raise ::GraphQL::ExecutionError, "not authorized to read #{mdl.name}"
               end
 

data/lib/active_admin/graphql/schema_builder/query_type.rb

@@ -8,6 +8,7 @@ module ActiveAdmin
         include QueryTypeCollection
         include QueryTypeMember
         include QueryTypePages
+        include QueryTypePolicies
 
         def build_query_type(registered_resource_union:)
           builder = self
@@ -45,6 +46,12 @@ module ActiveAdmin
             )
 
             builder.add_page_query_fields!(self, builder: builder, ns: ns)
+            builder.add_activeadmin_policies_query_field!(
+              self,
+              builder: builder,
+              ns: ns,
+              aa_by_graphql_type_name: aa_by_graphql_type_name
+            )
           end
         end
       end

data/lib/active_admin/graphql/schema_builder/query_type_policies.rb

@@ -0,0 +1,160 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    class SchemaBuilder
+      module QueryTypePolicies
+        POLICY_ACTIONS = {
+          read: ActiveAdmin::Authorization::READ,
+          create: ActiveAdmin::Authorization::CREATE,
+          update: ActiveAdmin::Authorization::UPDATE,
+          destroy: ActiveAdmin::Authorization::DESTROY
+        }.freeze
+
+        def add_activeadmin_policies_query_field!(query_class, builder:, ns:, aa_by_graphql_type_name:)
+          resource_policy_type = Class.new(::GraphQL::Schema::Object) do
+            graphql_name "ActiveAdminResourcePolicies"
+            field :type_name, ::GraphQL::Types::String, null: false, camelize: false
+            field :activeadmin_policies, builder.send(:policy_set_type), null: false, camelize: false
+          end
+
+          page_policy_type = Class.new(::GraphQL::Schema::Object) do
+            graphql_name "ActiveAdminPagePolicies"
+            field :name, ::GraphQL::Types::String, null: false, camelize: false
+            field :activeadmin_policies, builder.send(:policy_set_type), null: false, camelize: false
+          end
+
+          record_policy_type = Class.new(::GraphQL::Schema::Object) do
+            graphql_name "ActiveAdminRecordPolicies"
+            field :id, ::GraphQL::Types::ID, null: false, camelize: false
+            field :activeadmin_policies, builder.send(:policy_set_type), null: false, camelize: false
+          end
+
+          matrix_type = Class.new(::GraphQL::Schema::Object) do
+            graphql_name "ActiveAdminPolicies"
+            field :resources, [resource_policy_type], null: false, camelize: false
+            field :pages, [page_policy_type], null: false, camelize: false
+          end
+
+          query_class.class_eval do
+            field :activeadmin_policies, matrix_type, null: false, camelize: false,
+              visibility: {kind: :query_activeadmin_policies}
+
+            field :activeadmin_policies_for, [record_policy_type], null: false, camelize: false,
+              visibility: {kind: :query_activeadmin_policies_for} do
+              argument :type_name, ::GraphQL::Types::String, required: true, camelize: false
+              argument :ids, [::GraphQL::Types::ID], required: true, camelize: false
+              argument :path, [KeyValuePairInput], required: false, camelize: false
+            end
+
+            define_method(:activeadmin_policies) do
+              resources = builder.send(:active_resources).map do |aa_res|
+                {
+                  type_name: builder.send(:graphql_type_name_for, aa_res),
+                  activeadmin_policies: ActiveAdmin::GraphQL::PolicySetCache.fetch(
+                    context,
+                    subject_owner: aa_res,
+                    subject: aa_res.resource_class
+                  )
+                }
+              end
+              pages = ns.resources.select { |r| r.is_a?(ActiveAdmin::Page) }.map do |page|
+                {
+                  name: page.name,
+                  activeadmin_policies: ActiveAdmin::GraphQL::PolicySetCache.fetch(
+                    context,
+                    subject_owner: page,
+                    subject: page
+                  )
+                }
+              end
+              {resources: resources, pages: pages}
+            end
+
+            define_method(:activeadmin_policies_for) do |type_name:, ids:, path: nil|
+              aa_res = aa_by_graphql_type_name[type_name.to_s]
+              raise ::GraphQL::ExecutionError, "unknown resource type_name #{type_name.inspect}" unless aa_res
+
+              proxy = ResourceQueryProxy.new(
+                aa_resource: aa_res,
+                user: context[:auth].user,
+                namespace: ns,
+                graph_params: KeyValuePairs.to_hash(path)
+              )
+
+              records_by_id = proxy.find_members(ids.map(&:to_s))
+              ids.map do |id|
+                record = records_by_id[id.to_s]
+                raise ::GraphQL::ExecutionError, "not found" unless record
+
+                {
+                  id: id.to_s,
+                  activeadmin_policies: ActiveAdmin::GraphQL::PolicySetCache.fetch(
+                    context,
+                    subject_owner: aa_res,
+                    subject: record
+                  )
+                }
+              end
+            end
+          end
+        end
+
+        private
+
+        def policy_action_pairs
+          hook = @namespace.graphql_policy_actions
+          if hook.respond_to?(:call)
+            raw = hook.call(@namespace)
+            return raw.to_h.transform_keys(&:to_sym) if raw.respond_to?(:to_h)
+          end
+          POLICY_ACTIONS
+        end
+
+        def allowed_base_actions(auth:, subject_owner:, subject:, context:)
+          action_mapper = @namespace.graphql_policy_action_mapper
+          policy_action_pairs.each_with_object([]) do |(name, default_action), out|
+            allowed = if action_mapper.respond_to?(:call)
+              action_mapper.call(context, subject_owner, subject, name, default_action)
+            else
+              auth.authorized?(subject_owner, default_action, subject)
+            end
+            out << name.to_s if allowed
+          end
+        end
+
+        def build_policy_set(auth:, subject_owner:, subject:, context:)
+          base = {
+            allowed_actions: allowed_base_actions(auth: auth, subject_owner: subject_owner, subject: subject, context: context),
+            allowed_member_actions: [],
+            allowed_collection_actions: [],
+            allowed_batch_actions: []
+          }
+
+          if subject_owner.is_a?(ActiveAdmin::Resource)
+            class_subject = subject_owner.resource_class
+            if subject.is_a?(Class)
+              if auth.authorized?(subject_owner, ActiveAdmin::Authorization::READ, class_subject)
+                base[:allowed_member_actions] = subject_owner.member_actions.map { |a| a.name.to_s }
+                base[:allowed_collection_actions] = subject_owner.collection_actions.map { |a| a.name.to_s }
+                base[:allowed_batch_actions] = subject_owner.batch_actions.map { |a| a.sym.to_s }
+              end
+            elsif auth.authorized?(subject_owner, ActiveAdmin::Authorization::READ, subject)
+              base[:allowed_member_actions] = subject_owner.member_actions.map { |a| a.name.to_s }
+            end
+          end
+
+          if (extra = @namespace.graphql_policy_extra).respond_to?(:call)
+            out = extra.call(context, subject_owner, subject, base)
+            base = out if out.is_a?(Hash)
+          end
+          if (transform = @namespace.graphql_policy_transform).respond_to?(:call)
+            out = transform.call(context, subject_owner, subject, base)
+            base = out if out.is_a?(Hash)
+          end
+          base
+        end
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/schema_builder/types_object.rb

@@ -6,6 +6,19 @@ module ActiveAdmin
       module TypesObject
         private
 
+        def policy_set_type
+          @policy_set_type ||= Class.new(::GraphQL::Schema::Object) do
+            graphql_name "ActiveAdminPolicySet"
+            description "Allowed ActiveAdmin actions for this subject."
+
+            field :allowed_actions, [::GraphQL::Types::String], null: false, camelize: false
+            field :allowed_member_actions, [::GraphQL::Types::String], null: false, camelize: false
+            field :allowed_collection_actions, [::GraphQL::Types::String], null: false, camelize: false
+            field :allowed_batch_actions, [::GraphQL::Types::String], null: false, camelize: false
+            field :extra, ::GraphQL::Types::JSON, null: true, camelize: false
+          end
+        end
+
         def build_enum_type(aa_res, column_name, mapping)
           key = [aa_res.resource_class.name, column_name.to_s]
           return @enum_types[key] if @enum_types[key]
@@ -61,14 +74,17 @@ module ActiveAdmin
           attr_names = attributes_for(aa_res).map(&:to_s)
 
           type_class = Class.new(::GraphQL::Schema::Object) do
+            field_class ::ActiveAdmin::GraphQL::SchemaField
             graphql_name gname
             description "ActiveAdmin resource `#{aa_res.resource_name}`"
             implements ::ActiveAdmin::GraphQL::ResourceInterface
+
+            define_singleton_method(:activeadmin_graphql_resource) { aa_res }
           end
 
           pk_cols = ActiveAdmin::PrimaryKey.columns(model)
 
-          type_class.field :id, ::GraphQL::Types::ID, null: false
+          type_class.field :id, ::GraphQL::Types::ID, null: false, authorize: false
           type_class.define_method(:id) { ActiveAdmin::PrimaryKey.graphql_id_value(object) }
 
           attr_names.each do |name|
@@ -78,11 +94,20 @@ module ActiveAdmin
             next unless col
 
             gql_t = graphql_scalar_for_column(aa_res, model, col)
-            type_class.field(name.to_sym, gql_t, null: true, camelize: false)
+            type_class.field(name.to_sym, gql_t, null: true, camelize: false, authorize: false)
 
             type_class.define_method(name.to_sym) { object.public_send(name) }
           end
 
+          type_class.field :activeadmin_policies, policy_set_type, null: false, camelize: false, authorize: false
+          type_class.define_method(:activeadmin_policies) do
+            ActiveAdmin::GraphQL::PolicySetCache.fetch(
+              context,
+              subject_owner: aa_res,
+              subject: object
+            )
+          end
+
           if (ext = aa_res.graphql_config.extension_block)
             type_class.class_eval(&ext)
           end

data/lib/active_admin/graphql/schema_builder/wire.rb

@@ -14,6 +14,7 @@ module ActiveAdmin
             model.reflect_on_all_associations(:belongs_to).each do |ref|
               next if ref.polymorphic?
               target = ref.klass
+              target_aa_res = @aa_by_model[target]
               next unless @object_types[target]
 
               field_name = ref.name.to_sym
@@ -25,7 +26,16 @@ module ActiveAdmin
                 fk_val = object.public_send(fk)
                 next nil if fk_val.nil?
 
-                dataloader.with(ActiveAdmin::GraphQL::RecordSource, target).load(fk_val)
+                record = dataloader.with(ActiveAdmin::GraphQL::RecordSource, target).load(fk_val)
+                next nil unless record
+
+                auth = context[:auth]
+                if target_aa_res && auth &&
+                    !auth.authorized?(target_aa_res, ActiveAdmin::Authorization::READ, record)
+                  next nil
+                end
+
+                record
               end
             end
           end

data/lib/active_admin/graphql/schema_builder.rb

@@ -17,6 +17,7 @@ require_relative "schema_builder/query_type_registered"
 require_relative "schema_builder/query_type_collection"
 require_relative "schema_builder/query_type_member"
 require_relative "schema_builder/query_type_pages"
+require_relative "schema_builder/query_type_policies"
 require_relative "schema_builder/query_type"
 require_relative "schema_builder/resolvers"
 require_relative "schema_builder/mutation_action_types"

data/lib/active_admin/graphql/schema_field.rb

@@ -9,8 +9,10 @@ module ActiveAdmin
     # That hook runs from {#visible?}; it does not replace graphql-ruby's visibility system—it
     # composes with +super+ like any custom +Field+ class.
     class SchemaField < ::GraphQL::Schema::Field
-      def initialize(visibility: nil, **kwargs, &block)
+      def initialize(visibility: nil, authorize: nil, authorize_action: nil, **kwargs, &block)
         @visibility = visibility
+        @authorize = authorize
+        @authorize_action = authorize_action
         super(**kwargs, &block)
       end
 
@@ -24,6 +26,24 @@ module ActiveAdmin
 
         !!hook.call(ctx, @visibility)
       end
+
+      def authorized?(object, args, ctx)
+        return false unless super
+
+        owner = self.owner
+        aa_resource = owner.respond_to?(:activeadmin_graphql_resource) ? owner.activeadmin_graphql_resource : nil
+        return true unless aa_resource
+
+        enabled = if @authorize.nil?
+          ctx[:namespace]&.graphql_custom_field_authorization_default != false
+        else
+          @authorize
+        end
+        return true unless enabled
+
+        action = @authorize_action || ActiveAdmin::Authorization::READ
+        !!ctx[:auth]&.authorized?(aa_resource, action, object)
+      end
     end
   end
 end

data/lib/active_admin/graphql/version.rb

@@ -2,6 +2,6 @@
 
 module ActiveAdmin
   module GraphQL
-    VERSION = "0.1.2"
+    VERSION = "0.2.1"
   end
 end

data/lib/active_admin/graphql.rb

@@ -14,6 +14,7 @@ module ActiveAdmin
   #
   module GraphQL
     SCHEMA_CACHE = {}
+    SCHEMA_CACHE_MUTEX = Mutex.new
   end
 end
 
@@ -28,28 +29,25 @@ module ActiveAdmin
 
         @graphql_features_loaded = true
         ActiveAdmin::Dependency["graphql"].spec!
-        require "graphql"
-        require "graphql/types/json"
-        require "graphql/types/iso_8601_date_time"
-        require "graphql/types/iso_8601_date"
-        require_relative "graphql/resource_interface"
-        require_relative "graphql/schema_field"
-        require_relative "graphql/auth_context"
-        require_relative "graphql/record_source"
-        require_relative "graphql/resource_query_proxy"
-        require_relative "graphql/run_action_payload"
-        require_relative "graphql/run_action_mutation_config"
-        require_relative "graphql/run_action_mutation_dsl"
-        require_relative "graphql/key_value_pair_input"
-        require_relative "graphql/schema_builder"
+        require_graphql_dependencies!
+        require_active_admin_graphql_components!
       end
 
       # @param namespace [ActiveAdmin::Namespace]
       # @return [Class] schema class (subclass of GraphQL::Schema)
+      #
+      # Cached per namespace for the process. In development, call
+      # {clear_schema_cache!} or {clear_schema_for!} after ActiveAdmin +unload!+
+      # (already wired in {Integration::ApplicationUnloadClearsGraphQLSchema}) or
+      # when admin registrations change without a full unload.
       def schema_for(namespace)
         cache_key = namespace.name
-        SCHEMA_CACHE.delete(cache_key) if defined?(Rails) && Rails.env.development?
-        SCHEMA_CACHE[cache_key] ||= SchemaBuilder.new(namespace).build
+        cached = SCHEMA_CACHE[cache_key]
+        return cached if cached
+
+        SCHEMA_CACHE_MUTEX.synchronize do
+          SCHEMA_CACHE[cache_key] ||= SchemaBuilder.new(namespace).build
+        end
       end
 
       def clear_schema_cache!
@@ -59,6 +57,29 @@ module ActiveAdmin
       def clear_schema_for!(namespace)
         SCHEMA_CACHE.delete(namespace.name)
       end
+
+      def require_graphql_dependencies!
+        require "graphql"
+        require "graphql/types/json"
+        require "graphql/types/iso_8601_date_time"
+        require "graphql/types/iso_8601_date"
+      end
+
+      def require_active_admin_graphql_components!
+        %w[
+          graphql/resource_interface
+          graphql/schema_field
+          graphql/auth_context
+          graphql/record_source
+          graphql/resource_query_proxy
+          graphql/run_action_payload
+          graphql/run_action_mutation_config
+          graphql/run_action_mutation_dsl
+          graphql/key_value_pair_input
+          graphql/policy_set_cache
+          graphql/schema_builder
+        ].each { |path| require_relative path }
+      end
     end
   end
 end

data/lib/active_admin/primary_key.rb

@@ -23,28 +23,37 @@ unless defined?(ActiveAdmin::PrimaryKey)
 
       def composite_attribute_hash(model, id_param)
         cols = ordered_columns(model)
-        h =
-          case id_param
-          when Hash
-            id_param.stringify_keys.slice(*cols)
-          when String
-            parsed = JSON.parse(id_param)
-            raise ArgumentError, "composite id must be a JSON object" unless parsed.is_a?(Hash)
-
-            parsed.stringify_keys.slice(*cols)
-          when Array
-            cols.zip(id_param).to_h
-          else
-            raise ArgumentError, "unsupported composite id type"
-          end
-
-        missing = cols - h.keys
+        hash = normalize_composite_input(cols, id_param)
+        validate_composite_keys!(cols, hash)
+        hash
+      end
+
+      def normalize_composite_input(cols, id_param)
+        case id_param
+        when Hash
+          id_param.stringify_keys.slice(*cols)
+        when String
+          extract_composite_json(cols, id_param)
+        when Array
+          cols.zip(id_param).to_h
+        else
+          raise ArgumentError, "unsupported composite id type"
+        end
+      end
+
+      def extract_composite_json(cols, payload)
+        parsed = JSON.parse(payload)
+        raise ArgumentError, "composite id must be a JSON object" unless parsed.is_a?(Hash)
+
+        parsed.stringify_keys.slice(*cols)
+      end
+
+      def validate_composite_keys!(cols, hash)
+        missing = cols - hash.keys
         raise ArgumentError, "composite id missing keys: #{missing.join(", ")}" if missing.any?
 
-        absent = cols.select { |c| h[c].nil? }
+        absent = cols.select { |c| hash[c].nil? }
         raise ArgumentError, "composite id missing values for: #{absent.join(", ")}" if absent.any?
-
-        h
       end
 
       def find_attributes(model, id_param)
@@ -82,36 +91,49 @@ unless defined?(ActiveAdmin::PrimaryKey)
         blob = blob.stringify_keys
         cols = ordered_columns(model)
         if cols.size == 1
-          id = blob["id"]
-          raise ArgumentError, "id is required" if id.blank?
-
-          {"id" => id.to_s}
-        elsif blob["id"].present?
-          find_attributes(model, blob["id"]).stringify_keys
-        elsif cols.all? { |c| blob.key?(c) && blob[c].present? }
-          cols.to_h { |c| [c, blob[c]] }
+          single_member_param(blob)
         else
-          raise ArgumentError, "composite id requires id (JSON) or all primary key columns"
+          composite_member_param(model, blob, cols)
         end
       end
 
+      def single_member_param(blob)
+        id = blob["id"]
+        raise ArgumentError, "id is required" if id.blank?
+
+        {"id" => id.to_s}
+      end
+
+      def composite_member_param(model, blob, cols)
+        return find_attributes(model, blob["id"]).stringify_keys if blob["id"].present?
+        return cols.to_h { |c| [c, blob[c]] } if cols.all? { |c| blob.key?(c) && blob[c].present? }
+
+        raise ArgumentError, "composite id requires id (JSON) or all primary key columns"
+      end
+
       def field_kw_to_param_hash(model, id:, **kw)
         cols = ordered_columns(model)
         if cols.size == 1
-          raise ArgumentError, "id is required" if id.blank?
-
-          {"id" => id.to_s}
-        elsif id.present?
-          find_attributes(model, id).stringify_keys
+          single_field_hash(id)
         else
-          out = cols.to_h { |c| [c, kw[c.to_sym] || kw[c]] }
-          if cols.all? { |c| !out[c].nil? }
-            out.transform_values(&:to_s)
-          else
-            raise ArgumentError, "composite id requires id (JSON) or all primary key fields as arguments"
-          end
+          composite_field_hash(model, cols, id, kw)
         end
       end
+
+      def single_field_hash(id)
+        raise ArgumentError, "id is required" if id.blank?
+
+        {"id" => id.to_s}
+      end
+
+      def composite_field_hash(model, cols, id, kw)
+        return find_attributes(model, id).stringify_keys if id.present?
+
+        out = cols.to_h { |c| [c, kw[c.to_sym] || kw[c]] }
+        return out.transform_values(&:to_s) if cols.all? { |c| !out[c].nil? }
+
+        raise ArgumentError, "composite id requires id (JSON) or all primary key fields as arguments"
+      end
     end
   end
 end

data/sig/active_admin/graphql.rbs

@@ -0,0 +1,7 @@
+module ActiveAdmin
+  module GraphQL
+    VERSION: String
+
+    def self.load!: () -> void
+  end
+end