activeadmin-graphql 0.2.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 15355b8548053d83cb751fc238ff2f9d4c910be902cf3aab25c2c91741a33fa9
-  data.tar.gz: 8d76e29dcfe43079b171d19b817d52f13327c286a234688dd32c7e04efcc1522
+  metadata.gz: '00998f8445b9a5f9a7d4a939029d6e6460527432d658711b713df1ad293abc9e'
+  data.tar.gz: fd5f948edd2277b99e68ee384ccf7d31c8ffa8c890bf2f277837106213498652
 SHA512:
-  metadata.gz: a8a5472cfd32ac45a662733ee46fe1b0f918ea96e71db5bdf25ff9191a3c808c7b9ec047b4e4e2e0b52269a2a3aba20ff7d5cce39607bdf28448f85139beff39
-  data.tar.gz: 873a5814296d27af34ac8a6742ada804d61e4f855c33d0b5a092793ec7260625c68c54d8831977b88e59a7d7299a5cb22f77b502ab81b504e2d523b01e505cae
+  metadata.gz: fb9a627765be0dfb70171b6c2b9be70828e35a86fb0be2c79df237b0dbadc0559376e176b04ab6a2de49d22404c9773a4f9bee1427d1007b139dc71114afb991
+  data.tar.gz: 7c2d075e817702fd05648cf0f6dee228938d7d09400be066f99d4d50b23eb4d301f8ee0ac1632974ea57317f8a2ee7bcee81f5282481e9c477c9e8fd312e5db1

data/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## Unreleased
+
+## 0.2.1 (2026-07-14)
+
+- Add RBS type signatures to the published gem for Steep and other Ruby type checkers
+- Add Ruby 4.0 to the supported compatibility matrix
+- Return HTTP 400 with a clear error when the GraphQL request body or variables contain invalid JSON
+- Return `null` for member queries when the record id does not exist
+- Enforce read authorization on `belongs_to` association fields so denied parent records resolve as `null`
+- Build GraphQL schemas safely when `schema_for` runs concurrently
+
 ## 0.2.0 (2026-04-29)
 
 - Add `activeadmin_policies` GraphQL policy surfaces:

data/activeadmin-graphql.gemspec

@@ -36,7 +36,8 @@ Gem::Specification.new do |spec|
     ].select { |f| File.file?(f) } +
       Dir["docs/**/*.md"] +
       Dir["app/**/*.rb"] +
-      Dir["lib/**/*.rb"]
+      Dir["lib/**/*.rb"] +
+      Dir["sig/**/*"]
   end
 
   spec.require_paths = ["lib"]
@@ -51,11 +52,12 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "parallel_tests", "~> 4.7"
   spec.add_development_dependency "rails", ">= 6.1"
   spec.add_development_dependency "rspec", "~> 3"
+  spec.add_development_dependency "polyrun", ">= 2.2.0"
+  spec.add_development_dependency "prosopite", "~> 2.0"
   spec.add_development_dependency "rspec-rails", ">= 6"
   spec.add_development_dependency "rubocop-rails", "~> 2.34"
   spec.add_development_dependency "rubocop-rspec", "~> 3.8"
   spec.add_development_dependency "rubocop-thread_safety", "~> 0.7"
-  spec.add_development_dependency "simplecov", "~> 0.22"
   spec.add_development_dependency "sprockets-rails", ">= 3.4"
   spec.add_development_dependency "sqlite3", ">= 1"
   spec.add_development_dependency "standard", "~> 1.52"
@@ -63,4 +65,5 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "standard-performance", "~> 1.8"
   spec.add_development_dependency "standard-rails", "~> 1.5"
   spec.add_development_dependency "standard-rspec", "~> 0.3"
+  spec.add_development_dependency "rbs", "~> 3"
 end

data/app/controllers/active_admin/graphql_controller.rb

@@ -9,6 +9,10 @@ module ActiveAdmin
   class GraphqlController < ApplicationController
     protect_from_forgery with: :exception
 
+    rescue_from ActionDispatch::Http::Parameters::ParseError do
+      render json: {errors: [{message: "Invalid JSON"}]}, status: :bad_request
+    end
+
     before_action :ensure_graphql_enabled!
     before_action :authenticate_graphql!
 
@@ -104,6 +108,8 @@ module ActiveAdmin
 
     def request_body_hash
       json = request_body_json
+      return nil if json.nil? || json == :invalid_json
+
       json if json.is_a?(Hash)
     end
 
@@ -119,13 +125,21 @@ module ActiveAdmin
           body.present? ? JSON.parse(body) : nil
         end
     rescue JSON::ParserError
-      @request_body_json = nil
+      @request_body_json = :invalid_json
+    end
+
+    def invalid_request_json?
+      request_body_json == :invalid_json
     end
 
     def ensure_variables(raw)
       case raw
       when String
-        raw.present? ? JSON.parse(raw) : {}
+        if raw.blank?
+          {}
+        else
+          JSON.parse(raw)
+        end
       when Hash
         raw
       when ActionController::Parameters
@@ -136,22 +150,35 @@ module ActiveAdmin
         {}
       end
     rescue JSON::ParserError
-      {}
+      :invalid_json
+    end
+
+    def render_invalid_json!
+      render json: {errors: [{message: "Invalid JSON"}]}, status: :bad_request
     end
 
     def render_multiplex(schema)
+      return render_invalid_json! if invalid_request_json?
+
       operations = multiplex_operations
       return render_multiplex_limit_error!(operations.size) if exceeds_multiplex_limit?(operations)
 
       payloads = build_multiplex_payloads(operations)
+      return if performed?
+
       results = schema.multiplex(payloads)
       render json: results.map(&:to_h), status: :ok
     end
 
     def render_single(schema)
+      return render_invalid_json! if invalid_request_json?
+
+      variables = ensure_variables(variables_hash)
+      return render_invalid_json! if variables == :invalid_json
+
       result = schema.execute(
         query: query_string,
-        variables: ensure_variables(variables_hash),
+        variables: variables,
         operation_name: operation_name,
         context: graphql_context
       )
@@ -174,11 +201,17 @@ module ActiveAdmin
 
     def build_multiplex_payloads(operations)
       context = graphql_context
-      operations.map do |op|
+      operations.map do |operation|
+        variables = ensure_variables(operation[:variables])
+        if variables == :invalid_json
+          render_invalid_json!
+          return []
+        end
+
         {
-          query: op[:query],
-          variables: ensure_variables(op[:variables]),
-          operation_name: op[:operation_name],
+          query: operation[:query],
+          variables: variables,
+          operation_name: operation[:operation_name],
           context: context
         }
       end

data/lib/active_admin/graphql/policy_set_cache.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    # Request-scoped memoization for ActiveAdmin policy sets on GraphQL objects.
+    class PolicySetCache
+      class << self
+        def fetch(context, subject_owner:, subject:)
+          namespace = context[:namespace]
+          unless namespace
+            return policy_builder(context).send(
+              :build_policy_set,
+              auth: context[:auth],
+              subject_owner: subject_owner,
+              subject: subject,
+              context: context
+            )
+          end
+
+          cache = context[:policy_set_cache] ||= {}
+          key = cache_key(subject_owner, subject)
+          cache[key] ||= policy_builder(context).send(
+            :build_policy_set,
+            auth: context[:auth],
+            subject_owner: subject_owner,
+            subject: subject,
+            context: context
+          )
+        end
+
+        def policy_builder(context)
+          context[:policy_schema_builder] ||= SchemaBuilder.new(context[:namespace])
+        end
+
+        def cache_key(subject_owner, subject)
+          owner_key = subject_owner_key(subject_owner)
+          "#{owner_key}:#{subject_key(subject)}"
+        end
+
+        private
+
+        def subject_owner_key(subject_owner)
+          if subject_owner.is_a?(ActiveAdmin::Page)
+            "page-owner:#{subject_owner.name}"
+          else
+            "resource-owner:#{subject_owner.resource_class.name}"
+          end
+        end
+
+        def subject_key(subject)
+          if subject.is_a?(Class)
+            "class:#{subject.name}"
+          elsif subject.is_a?(ActiveAdmin::Page)
+            "page:#{subject.name}"
+          elsif subject.is_a?(ActiveRecord::Base)
+            "record:#{subject.class.name}:#{PrimaryKey.graphql_id_value(subject)}"
+          else
+            "object:#{subject.object_id}"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/resource_query_proxy.rb

@@ -27,6 +27,26 @@ module ActiveAdmin
       def find_member(id)
         extra = member_route_params_for_find(id)
         controller_for("show", extra).send(:find_resource)
+      rescue ActiveRecord::RecordNotFound
+        nil
+      end
+
+      def find_members(ids)
+        string_ids = Array(ids).map(&:to_s).uniq
+        return {} if string_ids.empty?
+
+        model = @aa_resource.resource_class
+        if ActiveAdmin::PrimaryKey.composite?(model)
+          return string_ids.index_with { |identifier| find_member(identifier) }
+        end
+
+        controller = controller_for("index")
+        relation = controller.send(:apply_authorization_scope, controller.send(:scoped_collection))
+        primary_key = model.primary_key.to_sym
+        indexed = relation.where(primary_key => string_ids).index_by do |record|
+          record.public_send(primary_key).to_s
+        end
+        string_ids.index_with { |identifier| indexed[identifier] }
       end
 
       def build_new(attributes)

data/lib/active_admin/graphql/run_action_payload.rb

@@ -21,7 +21,8 @@ module ActiveAdmin
       field :body, ::GraphQL::Types::String, null: true,
         description: "Response body text when the action rendered (e.g. JSON)."
 
-      Result = Struct.new(:ok, :status, :location, :body, keyword_init: true)
+      # keyword_init required for Ruby 3.2 consumers; cop targets 3.4 default Struct behavior
+      Result = Struct.new(:ok, :status, :location, :body, keyword_init: true) # rubocop:disable Style/RedundantStructKeywordInit
     end
   end
 end

data/lib/active_admin/graphql/schema_builder/query_type_policies.rb

@@ -48,17 +48,24 @@ module ActiveAdmin
             end
 
             define_method(:activeadmin_policies) do
-              auth = context[:auth]
               resources = builder.send(:active_resources).map do |aa_res|
                 {
                   type_name: builder.send(:graphql_type_name_for, aa_res),
-                  activeadmin_policies: builder.send(:build_policy_set, auth: auth, subject_owner: aa_res, subject: aa_res.resource_class, context: context)
+                  activeadmin_policies: ActiveAdmin::GraphQL::PolicySetCache.fetch(
+                    context,
+                    subject_owner: aa_res,
+                    subject: aa_res.resource_class
+                  )
                 }
               end
               pages = ns.resources.select { |r| r.is_a?(ActiveAdmin::Page) }.map do |page|
                 {
                   name: page.name,
-                  activeadmin_policies: builder.send(:build_policy_set, auth: auth, subject_owner: page, subject: page, context: context)
+                  activeadmin_policies: ActiveAdmin::GraphQL::PolicySetCache.fetch(
+                    context,
+                    subject_owner: page,
+                    subject: page
+                  )
                 }
               end
               {resources: resources, pages: pages}
@@ -75,13 +82,18 @@ module ActiveAdmin
                 graph_params: KeyValuePairs.to_hash(path)
               )
 
+              records_by_id = proxy.find_members(ids.map(&:to_s))
               ids.map do |id|
-                record = proxy.find_member(id.to_s)
+                record = records_by_id[id.to_s]
                 raise ::GraphQL::ExecutionError, "not found" unless record
 
                 {
                   id: id.to_s,
-                  activeadmin_policies: builder.send(:build_policy_set, auth: context[:auth], subject_owner: aa_res, subject: record, context: context)
+                  activeadmin_policies: ActiveAdmin::GraphQL::PolicySetCache.fetch(
+                    context,
+                    subject_owner: aa_res,
+                    subject: record
+                  )
                 }
               end
             end

data/lib/active_admin/graphql/schema_builder/types_object.rb

@@ -101,8 +101,11 @@ module ActiveAdmin
 
           type_class.field :activeadmin_policies, policy_set_type, null: false, camelize: false, authorize: false
           type_class.define_method(:activeadmin_policies) do
-            builder = context[:namespace] && ActiveAdmin::GraphQL::SchemaBuilder.new(context[:namespace])
-            builder.send(:build_policy_set, auth: context[:auth], subject_owner: aa_res, subject: object, context: context)
+            ActiveAdmin::GraphQL::PolicySetCache.fetch(
+              context,
+              subject_owner: aa_res,
+              subject: object
+            )
           end
 
           if (ext = aa_res.graphql_config.extension_block)

data/lib/active_admin/graphql/schema_builder/wire.rb

@@ -14,6 +14,7 @@ module ActiveAdmin
             model.reflect_on_all_associations(:belongs_to).each do |ref|
               next if ref.polymorphic?
               target = ref.klass
+              target_aa_res = @aa_by_model[target]
               next unless @object_types[target]
 
               field_name = ref.name.to_sym
@@ -25,7 +26,16 @@ module ActiveAdmin
                 fk_val = object.public_send(fk)
                 next nil if fk_val.nil?
 
-                dataloader.with(ActiveAdmin::GraphQL::RecordSource, target).load(fk_val)
+                record = dataloader.with(ActiveAdmin::GraphQL::RecordSource, target).load(fk_val)
+                next nil unless record
+
+                auth = context[:auth]
+                if target_aa_res && auth &&
+                    !auth.authorized?(target_aa_res, ActiveAdmin::Authorization::READ, record)
+                  next nil
+                end
+
+                record
               end
             end
           end

data/lib/active_admin/graphql/version.rb

@@ -2,6 +2,6 @@
 
 module ActiveAdmin
   module GraphQL
-    VERSION = "0.2.0"
+    VERSION = "0.2.1"
   end
 end

data/lib/active_admin/graphql.rb

@@ -14,6 +14,7 @@ module ActiveAdmin
   #
   module GraphQL
     SCHEMA_CACHE = {}
+    SCHEMA_CACHE_MUTEX = Mutex.new
   end
 end
 
@@ -41,7 +42,12 @@ module ActiveAdmin
       # when admin registrations change without a full unload.
       def schema_for(namespace)
         cache_key = namespace.name
-        SCHEMA_CACHE[cache_key] ||= SchemaBuilder.new(namespace).build
+        cached = SCHEMA_CACHE[cache_key]
+        return cached if cached
+
+        SCHEMA_CACHE_MUTEX.synchronize do
+          SCHEMA_CACHE[cache_key] ||= SchemaBuilder.new(namespace).build
+        end
       end
 
       def clear_schema_cache!
@@ -70,6 +76,7 @@ module ActiveAdmin
           graphql/run_action_mutation_config
           graphql/run_action_mutation_dsl
           graphql/key_value_pair_input
+          graphql/policy_set_cache
           graphql/schema_builder
         ].each { |path| require_relative path }
       end

data/sig/active_admin/graphql.rbs

@@ -0,0 +1,7 @@
+module ActiveAdmin
+  module GraphQL
+    VERSION: String
+
+    def self.load!: () -> void
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: activeadmin-graphql
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
 platform: ruby
 authors:
 - Andrei Makarov
@@ -135,6 +135,34 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '3'
+- !ruby/object:Gem::Dependency
+  name: polyrun
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.2.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.2.0
+- !ruby/object:Gem::Dependency
+  name: prosopite
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: rspec-rails
   requirement: !ruby/object:Gem::Requirement
@@ -191,20 +219,6 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.7'
-- !ruby/object:Gem::Dependency
-  name: simplecov
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.22'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.22'
 - !ruby/object:Gem::Dependency
   name: sprockets-rails
   requirement: !ruby/object:Gem::Requirement
@@ -303,6 +317,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.3'
+- !ruby/object:Gem::Dependency
+  name: rbs
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3'
 description: Exposes ActiveAdmin resources and pages as a graphql-ruby schema with
   an HTTP endpoint per namespace.
 email:
@@ -324,6 +352,7 @@ files:
 - lib/active_admin/graphql/engine.rb
 - lib/active_admin/graphql/integration.rb
 - lib/active_admin/graphql/key_value_pair_input.rb
+- lib/active_admin/graphql/policy_set_cache.rb
 - lib/active_admin/graphql/railtie.rb
 - lib/active_admin/graphql/record_source.rb
 - lib/active_admin/graphql/resource_config.rb
@@ -360,6 +389,7 @@ files:
 - lib/active_admin/graphql/version.rb
 - lib/active_admin/primary_key.rb
 - lib/activeadmin/graphql.rb
+- sig/active_admin/graphql.rbs
 homepage: https://github.com/amkisko/activeadmin-graphql.rb
 licenses:
 - MIT
@@ -384,7 +414,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.4
+rubygems_version: 4.0.6
 specification_version: 4
 summary: GraphQL API extension for ActiveAdmin (graphql-ruby).
 test_files: []