activeadmin-graphql 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 15355b8548053d83cb751fc238ff2f9d4c910be902cf3aab25c2c91741a33fa9
-  data.tar.gz: 8d76e29dcfe43079b171d19b817d52f13327c286a234688dd32c7e04efcc1522
+  metadata.gz: 3347160c32fcf8dea19214ff0bdac83b9c9650855dd58de9035b153c37e0b708
+  data.tar.gz: 757c6bcf6d659569aee20ec9a54f094795c4c0cee4700db967a294a26779ea1b
 SHA512:
-  metadata.gz: a8a5472cfd32ac45a662733ee46fe1b0f918ea96e71db5bdf25ff9191a3c808c7b9ec047b4e4e2e0b52269a2a3aba20ff7d5cce39607bdf28448f85139beff39
-  data.tar.gz: 873a5814296d27af34ac8a6742ada804d61e4f855c33d0b5a092793ec7260625c68c54d8831977b88e59a7d7299a5cb22f77b502ab81b504e2d523b01e505cae
+  metadata.gz: 383ff1b8d22b9ee6e6f70aa60284ac9c832d69436bf5ee10bfa9b25ce17089aad965481f0ca7149b3742e26aef24e0b2f1b24bb9b84ab26b1076b6c4d39e855a
+  data.tar.gz: 8f6b647f0201d15d2dfe4e23befad9b9c05a22b226cd9d6257678eeb36d4ef39a53de4372961e6b765fe2acc2e4bc0475f835015f24bb867a0564e58b17b4824

data/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## Unreleased
+
+## 0.3.0 (2026-09-21)
+
+- BREAKING: omit `created_at` and `updated_at` from default create and update inputs. List them on `permit_params` to keep them writable.
+- BREAKING: require graphql-ruby 2.6.9 or newer (parser cache Marshal fix).
+- Add `permit_params` on the per-resource `graphql` block, with nested `create` / `update` `permit_params` and `resolve` (RFC 0006).
+- Seed GraphQL mutation inputs from a static HTML `permit_params` list when graphql `permit_params` is unset.
+- Add `destroy_*` as an alias of `delete_*`.
+- Add `graphql_name` as an alias of `type_name`.
+- Put ActiveRecord validation messages on GraphQL error `extensions.errors` when create or update fails.
+- Log GraphQL execute with namespace, operation name, and error count.
+- Test ActiveAdmin 4.0.0.beta23 on Rails 8. Keep ActiveAdmin 3.5 on Rails 7.2.
+- Add `rfcs/` starter pack: process (RFC 0001), positioning (RFC 0002), and Standards Track design RFCs 0003–0005 for HTTP endpoint, schema DSL, and authorization.
+
+## 0.2.1 (2026-07-14)
+
+- Add RBS type signatures to the published gem for Steep and other Ruby type checkers
+- Add Ruby 4.0 to the supported compatibility matrix
+- Return HTTP 400 with a clear error when the GraphQL request body or variables contain invalid JSON
+- Return `null` for member queries when the record id does not exist
+- Enforce read authorization on `belongs_to` association fields so denied parent records resolve as `null`
+- Build GraphQL schemas safely when `schema_for` runs concurrently
+
 ## 0.2.0 (2026-04-29)
 
 - Add `activeadmin_policies` GraphQL policy surfaces:

data/CODE_OF_CONDUCT.md

@@ -1,31 +1,26 @@
 # Code of Conduct
 
-## Our Pledge
+## Pledge
 
-We pledge to make participation in the activeadmin-graphql community a harassment-free experience for everyone. We operate on principles of mutual respect, privacy, and authentic engagement. We value substantive contributions and clarity on intentions.
+Participation is a harassment-free experience. Treat each other with respect. Keep private context private.
 
-## Our Standards
+## Expected behavior
 
-Examples of behavior that contributes to a positive environment include:
+- Engage with genuine curiosity. Admit uncertainty.
+- Own every line you submit, including generated code.
+- Correct errors politely.
+- Use language that welcomes people and respects identity and privacy.
 
-- Authenticity: Engaging with genuine curiosity and admitting uncertainty rather than feigning knowledge.
-- Responsible innovation: Taking full responsibility for any content or code contributed, whether manually written or generated by automation tools.
-- Gentle correction: Responding politely to errors. We view mistakes as opportunities for learning, provided they are addressed with humility.
-- Inclusive language: Using language that welcomes diverse perspectives and respects the privacy and identity of all participants.
+## Unacceptable behavior
 
-Examples of unacceptable behavior include:
+- Harassment, trolling, or insulting comments, public or private.
+- Using jargon or volume, including automated spam, to silence others.
+- Sharing others' data or personal context without permission.
 
-- Harassment: Public or private harassment, trolling, or insulting comments.
-- Weaponized complexity: Using jargon or overwhelming volume (including automated spam) to silence others.
-- Publishing private information: Sharing others' data or personal context without explicit permission.
+## Automation
 
-## Artificial Intelligence & Automation
-
-In accordance with our commitment to collective awareness:
-
-- Contributors are responsible for the accuracy and security of any AI-generated artifacts they submit.
-- "The AI wrote it" is not a valid excuse for introducing bugs, security vulnerabilities, or bias.
+You remain responsible for bugs, security holes, and bias in generated artifacts you submit.
 
 ## Enforcement
 
-Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at contact@kiskolabs.com. All complaints will be reviewed and investigated promptly and fairly.
+Report abusive or harassing behavior to contact@kiskolabs.com. Reports are reviewed and investigated.

data/CONTRIBUTING.md

@@ -1,27 +1,23 @@
 # Contributing Guidelines
 
-Thank you for your interest in contributing to activeadmin-graphql.
+## Automation authorship
 
-## How to Contribute
+You may use AI and automation tools. You remain the author of every line you submit: review, debug, and understand the change.
 
-### 1. Reporting Issues
+Keep pull requests small enough to review. Annotate non-obvious logic.
 
-- Verify accuracy: Before posting, verify your information. Avoid generalizations.
-- Use structured inputs: Provide clear goals, constraints, and reproduction steps.
+Never send project secrets or private context to public models.
 
-### 2. Pull Request Process
+## How to contribute
 
-- Scope: Keep PRs focused on a single goal.
-- Context: Explain why the change is necessary.
-- Testing: Run the RSpec suite (see the README for Appraisal and parallel test commands).
+### Reporting issues
 
-### 3. Review Process
+Verify the facts before filing. Use issue templates for goals, constraints, and reproduction steps.
 
-- We encourage productive friction. Expect questions about your approach.
-- If a reviewer suggests a change, view it as mutual aid, not criticism.
+### Pull requests
 
-### Artificial Intelligence & Automation
+Keep one pull request to one goal. Explain why the change is needed. Run smoke tests and regression checks locally before opening the request.
 
-1. You are the author: You act as the responsible agent for any code you submit. You must review, debug, and understand every line.
-2. Manage cognitive load: Do not submit massive, unreviewed automated dumps.
-3. Security: Never feed project secrets or private context into public AI models.
+### Review
+
+Reviewers will ask about approach and trade-offs. Treat suggested changes as part of the work.

data/README.md

@@ -2,14 +2,18 @@
 
 GraphQL HTTP API for [ActiveAdmin](https://activeadmin.info), built with [graphql-ruby](https://graphql-ruby.org). Register resources as usual, optionally add a `graphql do ... end` block, enable the endpoint per namespace, and get a schema with queries and mutations aligned with ActiveAdmin authorization and filters.
 
+Design changes go through `rfcs/` (RFC 0001).
+
 ## Setup
 
 ```ruby
 # Gemfile (graphql-ruby is pulled in by activeadmin-graphql)
-gem "activeadmin"
+gem "activeadmin" # 3.5, or pin 4.0.0.beta23
 gem "activeadmin-graphql"
 ```
 
+ActiveAdmin 4.0 is still a prerelease. Pin it explicitly, for example `gem "activeadmin", "4.0.0.beta23"`. Bundler will not select a prerelease from this gem's `>= 3.2` floor. graphql-ruby must be 2.6.9 or newer.
+
 ```ruby
 # config/initializers/active_admin.rb
 ActiveAdmin.setup do |config|
@@ -38,12 +42,25 @@ rake rubocop
 rake spec
 ```
 
-Matrixed Rails versions use [Appraisal](https://github.com/thoughtbot/appraisal): `gemfiles/rails72.gemfile`, `rails8ruby34.gemfile`, and `rails8truffleruby.gemfile` pin Rails 7.2 / 8.1 (integration tests follow the `spec/dummy` app, which is tested from 7.2 upward). Run `bundle exec appraisal rspec` to execute RSpec in each gemfile context, or `bundle exec parallel_rspec spec` locally for faster multi-process runs on the current bundle.
+Matrixed Rails versions use [Appraisal](https://github.com/thoughtbot/appraisal): `gemfiles/rails72.gemfile` pins Rails 7.2 with ActiveAdmin 3.5; `rails8ruby34.gemfile` and `rails8ruby4.gemfile` pin Rails 8.1 with ActiveAdmin 4.0.0.beta23 (integration tests follow the `spec/dummy` app). Run `bundle exec appraisal rspec` to execute RSpec in each gemfile context, or `bundle exec parallel_rspec spec` locally for faster multi-process runs on the current bundle.
 
 [Trunk](https://docs.trunk.io) config lives in `.trunk/`; CI runs `trunk` via `.github/workflows/trunk.yml`. Releases: `usr/bin/release.rb` (RuboCop, Appraisal RSpec across gemfiles, `gem build` / `gem push`, git tag, `gh release`).
 
 No local ActiveAdmin checkout is required; the dummy app depends on the published `activeadmin` gem like a normal host app.
 
+## Links
+
+- [GitHub](https://github.com/amkisko/activeadmin-graphql.rb)
+- [GitLab](https://gitlab.com/amkisko/activeadmin-graphql.rb)
+- [RubyGems](https://rubygems.org/gems/activeadmin-graphql)
+- [Versions Atom](https://rubygems.org/gems/activeadmin-graphql/versions.atom) (feed id `10803975489574`)
+- [libraries.io](https://libraries.io/rubygems/activeadmin-graphql)
+- [Deps.dev](https://deps.dev/rubygems/activeadmin-graphql)
+- [SonarCloud](https://sonarcloud.io/project/overview?id=amkisko_activeadmin-graphql.rb)
+- [Snyk](https://snyk.io/test/github/amkisko/activeadmin-graphql.rb)
+- [Codecov](https://app.codecov.io/github/amkisko/activeadmin-graphql.rb)
+- [OpenSSF Scorecard](https://scorecard.dev/viewer/?uri=github.com/amkisko/activeadmin-graphql.rb)
+
 ## License
 
 MIT — see [LICENSE.md](LICENSE.md).

data/activeadmin-graphql.gemspec

@@ -11,7 +11,7 @@ Gem::Specification.new do |spec|
   spec.description = "Exposes ActiveAdmin resources and pages as a graphql-ruby schema with an HTTP endpoint per namespace."
   spec.license = "MIT"
   spec.platform = Gem::Platform::RUBY
-  spec.required_ruby_version = ">= 3.2"
+  spec.required_ruby_version = ">= 3.4"
 
   repository_url = "https://github.com/amkisko/activeadmin-graphql.rb"
 
@@ -36,31 +36,35 @@ Gem::Specification.new do |spec|
     ].select { |f| File.file?(f) } +
       Dir["docs/**/*.md"] +
       Dir["app/**/*.rb"] +
-      Dir["lib/**/*.rb"]
+      Dir["lib/**/*.rb"] +
+      Dir["sig/**/*"]
   end
 
   spec.require_paths = ["lib"]
 
   spec.add_runtime_dependency "activeadmin", ">= 3.2"
-  spec.add_runtime_dependency "graphql", ">= 2.3"
+  spec.add_runtime_dependency "graphql", ">= 2.6.9"
 
   spec.add_development_dependency "appraisal", "~> 2"
   spec.add_development_dependency "bigdecimal"
   spec.add_development_dependency "bundler", ">= 2"
   spec.add_development_dependency "devise", ">= 4.9"
-  spec.add_development_dependency "parallel_tests", "~> 4.7"
+  spec.add_development_dependency "json", ">= 2.21.2", "< 3"
+  spec.add_development_dependency "parallel_tests", "~> 5.7"
   spec.add_development_dependency "rails", ">= 6.1"
   spec.add_development_dependency "rspec", "~> 3"
+  spec.add_development_dependency "polyrun", ">= 2.2.0"
+  spec.add_development_dependency "prosopite", "~> 2.0"
   spec.add_development_dependency "rspec-rails", ">= 6"
+  spec.add_development_dependency "rubocop", "~> 1.91"
   spec.add_development_dependency "rubocop-rails", "~> 2.34"
   spec.add_development_dependency "rubocop-rspec", "~> 3.8"
   spec.add_development_dependency "rubocop-thread_safety", "~> 0.7"
-  spec.add_development_dependency "simplecov", "~> 0.22"
   spec.add_development_dependency "sprockets-rails", ">= 3.4"
-  spec.add_development_dependency "sqlite3", ">= 1"
-  spec.add_development_dependency "standard", "~> 1.52"
+  spec.add_development_dependency "sqlite3", ">= 2.9.6"
   spec.add_development_dependency "standard-custom", "~> 1.0"
   spec.add_development_dependency "standard-performance", "~> 1.8"
   spec.add_development_dependency "standard-rails", "~> 1.5"
   spec.add_development_dependency "standard-rspec", "~> 0.3"
+  spec.add_development_dependency "rbs", "~> 4"
 end

data/app/controllers/active_admin/graphql_controller.rb

@@ -9,6 +9,10 @@ module ActiveAdmin
   class GraphqlController < ApplicationController
     protect_from_forgery with: :exception
 
+    rescue_from ActionDispatch::Http::Parameters::ParseError do
+      render json: {errors: [{message: "Invalid JSON"}]}, status: :bad_request
+    end
+
     before_action :ensure_graphql_enabled!
     before_action :authenticate_graphql!
 
@@ -104,6 +108,8 @@ module ActiveAdmin
 
     def request_body_hash
       json = request_body_json
+      return nil if json.nil? || json == :invalid_json
+
       json if json.is_a?(Hash)
     end
 
@@ -119,13 +125,21 @@ module ActiveAdmin
           body.present? ? JSON.parse(body) : nil
         end
     rescue JSON::ParserError
-      @request_body_json = nil
+      @request_body_json = :invalid_json
+    end
+
+    def invalid_request_json?
+      request_body_json == :invalid_json
     end
 
     def ensure_variables(raw)
       case raw
       when String
-        raw.present? ? JSON.parse(raw) : {}
+        if raw.blank?
+          {}
+        else
+          JSON.parse(raw)
+        end
       when Hash
         raw
       when ActionController::Parameters
@@ -136,25 +150,40 @@ module ActiveAdmin
         {}
       end
     rescue JSON::ParserError
-      {}
+      :invalid_json
+    end
+
+    def render_invalid_json!
+      render json: {errors: [{message: "Invalid JSON"}]}, status: :bad_request
     end
 
     def render_multiplex(schema)
+      return render_invalid_json! if invalid_request_json?
+
       operations = multiplex_operations
       return render_multiplex_limit_error!(operations.size) if exceeds_multiplex_limit?(operations)
 
       payloads = build_multiplex_payloads(operations)
+      return if performed?
+
       results = schema.multiplex(payloads)
+      log_graphql_result(operation_name: "multiplex", error_count: results.count { |result| Array(result.to_h["errors"]).any? })
       render json: results.map(&:to_h), status: :ok
     end
 
     def render_single(schema)
+      return render_invalid_json! if invalid_request_json?
+
+      variables = ensure_variables(variables_hash)
+      return render_invalid_json! if variables == :invalid_json
+
       result = schema.execute(
         query: query_string,
-        variables: ensure_variables(variables_hash),
+        variables: variables,
         operation_name: operation_name,
         context: graphql_context
       )
+      log_graphql_result(operation_name: operation_name, error_count: Array(result.to_h["errors"]).size)
       render json: result.to_h, status: :ok
     end
 
@@ -174,14 +203,27 @@ module ActiveAdmin
 
     def build_multiplex_payloads(operations)
       context = graphql_context
-      operations.map do |op|
+      operations.map do |operation|
+        variables = ensure_variables(operation[:variables])
+        if variables == :invalid_json
+          render_invalid_json!
+          return []
+        end
+
         {
-          query: op[:query],
-          variables: ensure_variables(op[:variables]),
-          operation_name: op[:operation_name],
+          query: operation[:query],
+          variables: variables,
+          operation_name: operation[:operation_name],
           context: context
         }
       end
     end
+
+    def log_graphql_result(operation_name:, error_count:)
+      Rails.logger.info(
+        "[activeadmin-graphql] namespace=#{active_admin_namespace.name} " \
+        "operation=#{operation_name.presence || "anonymous"} error_count=#{error_count}"
+      )
+    end
   end
 end

data/docs/graphql-api.md

@@ -10,10 +10,12 @@ Add the extension to your application (it pulls in `activeadmin` and `graphql` a
 
 ```ruby
 # Gemfile
-gem "activeadmin"
+gem "activeadmin" # 3.5, or pin 4.0.0.beta23
 gem "activeadmin-graphql"
 ```
 
+ActiveAdmin 4.0 is still a prerelease. Pin it in the host Gemfile (`gem "activeadmin", "4.0.0.beta23"`). Bundler will not pick a prerelease from this gem's `>= 3.2` floor. graphql-ruby must be 2.6.9 or newer.
+
 Bundling loads `activeadmin/graphql`, which installs the Router/Resource integration and calls `ActiveAdmin::GraphQL.load!`, so graphql-ruby is loaded at boot whenever the gem is in your bundle. The schema class for a namespace is built on demand (first request or introspection) via `ActiveAdmin::GraphQL.schema_for(namespace)`.
 
 If `graphql = true` is set for a namespace but Bundler cannot satisfy the `graphql` gem, boot fails with an ActiveAdmin dependency error until you run `bundle install`.
@@ -214,9 +216,12 @@ The `Mutation` type is present when at least one operation exists: per-resource
 resource defines the corresponding batch, member, or collection actions.
 
 Object type names default to the model name (for example `Post`). Typed input
-objects mirror `attributes_for_graphql` (see the per-resource section below):
+objects use assignable columns (see the per-resource section below):
 `PostCreateInput`, `PostUpdateInput`, `PostListFilterInput`, and `PostWhereInput`
-when the GraphQL name is `Post`.
+when the GraphQL name is `Post`. `only` / `except` cap both object fields and
+mutation keys. `permit_params` and nested `create` / `update` blocks narrow
+create and update inputs without hiding query fields. Default mutation inputs
+omit `created_at` and `updated_at`.
 
 ### Composite primary keys (Rails 7.1+)
 
@@ -270,9 +275,11 @@ These align with REST index parameters where possible:
 Typical names for a `Post` resource:
 
 * `create_post(input: PostCreateInput!)` — attribute fields match assignable
-  columns (and the nested parent param when `belongs_to` is configured).
+  columns minus `created_at` / `updated_at` unless listed in `permit_params`
+  (and the nested parent param when `belongs_to` is configured).
 * `update_post(where: PostWhereInput!, input: PostUpdateInput!)`
-* `delete_post(where: PostWhereInput!)`
+* `delete_post(where: PostWhereInput!)` — kept for existing clients.
+* `destroy_post(where: PostWhereInput!)` — Rails / ActiveAdmin action name; same resolver as `delete_post`.
 
 Nested resources require the parent id on `where`, `input`, or list `filter`
 when the association is required.
@@ -339,9 +346,16 @@ Inside `ActiveAdmin.register` you can narrow the GraphQL surface:
 ActiveAdmin.register Post do
   graphql do
     disable!                          # omit this resource from the schema
-    type_name "BlogPost"              # GraphQL object / mutation type basename
-    only :title, :body, :published_at # expose only these attributes
+    type_name "BlogPost"              # GraphQL object / mutation type basename (`graphql_name` alias)
+    only :title, :body, :published_at # expose only these attributes on queries
     exclude :internal_score           # or `except` / `exclude`
+    permit_params :title, :body       # create and update inputs (query fields stay)
+    create do
+      permit_params :title, :body     # replace the shared list for create
+    end
+    update do
+      permit_params :title            # replace the shared list for update
+    end
     configure do
       # graphql-ruby field DSL on the object type class
       field :computed, GraphQL::Types::String, null: true
@@ -352,10 +366,21 @@ end
 ```
 
 * `disable!` — resource is not included in Query or Mutation.
-* `type_name` — overrides the default GraphQL type name derived from the model
-  (object types, mutations, and Rails enum GraphQL types use this basename).
-* `only` / `except` (or `exclude`) — restrict columns on object types and
-  assignable mutation keys (the primary key remains readable as `id`).
+* `type_name` (or `graphql_name`) — overrides the default GraphQL type name
+  derived from the model (object types, mutations, and Rails enum GraphQL
+  types use this basename).
+* `only` / `except` (or `exclude`) — restrict columns on object types. These
+  names also cap mutation inputs. This is not ActiveAdmin `only:` / `except:`
+  for controller actions (`action_item only: :show`). The primary key remains
+  readable as `id`.
+* `permit_params` (or `permit`) — restrict create and update input keys without
+  hiding query fields, same name as ActiveAdmin HTML `permit_params`. Nested
+  `create` / `update` blocks replace that shared list for one operation and
+  may set `resolve`. Names outside `only` / `except` are dropped. A static HTML
+  `permit_params :title, :body` list seeds GraphQL when the graphql list is
+  unset. A request-time HTML `permit_params` block is not copied. With no list
+  set, mutation inputs omit `created_at` and `updated_at`. Empty `permit_params`
+  yields an input with no column arguments.
 * `configure` — `field` and resolver methods are evaluated on the generated
   object type class.
 

data/lib/active_admin/graphql/integration.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "resource_definition_dsl"
+require_relative "resource_methods"
 
 module ActiveAdmin
   module GraphQL
@@ -60,36 +61,34 @@ module ActiveAdmin
         end
       end
 
-      module ResourceMethods
-        def graphql_config
-          @graphql_config ||= ActiveAdmin::GraphQL::ResourceConfig.new
+      module ResourceDSLMethods
+        def graphql(&block)
+          if block
+            ActiveAdmin::GraphQL::ResourceDefinitionDSL.new(config.graphql_config).instance_exec(&block)
+          end
+          config.graphql_config
         end
 
-        def attributes_for_graphql
-          keys = resource_attributes.keys
-          cfg = graphql_config
-          if cfg.only_attributes
-            keys &= cfg.only_attributes
+        def permit_params(*args, &block)
+          unless block
+            config.graphql_config.html_permit_params_attributes = flatten_html_permit_params(args)
           end
-          keys -= cfg.exclude_attributes
-          keys
+          super
         end
 
-        def graphql_assignable_attribute_names
-          names = attributes_for_graphql.map(&:to_s)
-          pk_cols = ActiveAdmin::PrimaryKey.columns(resource_class)
-          return names if pk_cols.size > 1
-
-          names - pk_cols
-        end
-      end
+        private
 
-      module ResourceDSLMethods
-        def graphql(&block)
-          if block
-            ActiveAdmin::GraphQL::ResourceDefinitionDSL.new(config.graphql_config).instance_exec(&block)
+        def flatten_html_permit_params(args)
+          args.flat_map do |arg|
+            case arg
+            when Symbol, String
+              [arg.to_sym]
+            when Hash
+              arg.keys.map(&:to_sym)
+            else
+              []
+            end
           end
-          config.graphql_config
         end
       end
 

data/lib/active_admin/graphql/mutation_execution_error.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    module MutationExecutionError
+      module_function
+
+      def validation(record)
+        ::GraphQL::ExecutionError.new(
+          record.errors.full_messages.to_sentence,
+          extensions: {"errors" => record.errors.full_messages}
+        )
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/mutation_input_config.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    # Create or update input options set from +graphql { create do … }+ / +update do … }+.
+    class MutationInputConfig
+      attr_accessor :permit_params_attributes
+      attr_accessor :resolve_proc
+    end
+  end
+end

data/lib/active_admin/graphql/mutation_input_definition_dsl.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    # Nested DSL for +graphql { create do … }+ and +update do … }+, pairing
+    # ActiveAdmin +permit_params+ with graphql-ruby-style +resolve+.
+    class MutationInputDefinitionDSL
+      def initialize(config)
+        @config = config
+      end
+
+      def permit_params(*attrs)
+        @config.permit_params_attributes = attrs.flatten.map(&:to_sym)
+      end
+      alias_method :permit, :permit_params
+
+      def resolve(&block)
+        @config.resolve_proc = block
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/policy_set_cache.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    # Request-scoped memoization for ActiveAdmin policy sets on GraphQL objects.
+    class PolicySetCache
+      class << self
+        def fetch(context, subject_owner:, subject:)
+          namespace = context[:namespace]
+          unless namespace
+            return policy_builder(context).send(
+              :build_policy_set,
+              auth: context[:auth],
+              subject_owner: subject_owner,
+              subject: subject,
+              context: context
+            )
+          end
+
+          cache = context[:policy_set_cache] ||= {}
+          key = cache_key(subject_owner, subject)
+          cache[key] ||= policy_builder(context).send(
+            :build_policy_set,
+            auth: context[:auth],
+            subject_owner: subject_owner,
+            subject: subject,
+            context: context
+          )
+        end
+
+        def policy_builder(context)
+          context[:policy_schema_builder] ||= SchemaBuilder.new(context[:namespace])
+        end
+
+        def cache_key(subject_owner, subject)
+          owner_key = subject_owner_key(subject_owner)
+          "#{owner_key}:#{subject_key(subject)}"
+        end
+
+        private
+
+        def subject_owner_key(subject_owner)
+          if subject_owner.is_a?(ActiveAdmin::Page)
+            "page-owner:#{subject_owner.name}"
+          else
+            "resource-owner:#{subject_owner.resource_class.name}"
+          end
+        end
+
+        def subject_key(subject)
+          if subject.is_a?(Class)
+            "class:#{subject.name}"
+          elsif subject.is_a?(ActiveAdmin::Page)
+            "page:#{subject.name}"
+          elsif subject.is_a?(ActiveRecord::Base)
+            "record:#{subject.class.name}:#{PrimaryKey.graphql_id_value(subject)}"
+          else
+            "object:#{subject.object_id}"
+          end
+        end
+      end
+    end
+  end
+end