activeadmin-graphql 0.2.0 → 0.3.0

data/lib/active_admin/graphql/resource_config.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "run_action_mutation_config"
+require_relative "mutation_input_config"
 
 module ActiveAdmin
   module GraphQL
@@ -10,14 +11,16 @@ module ActiveAdmin
       attr_accessor :graphql_type_name
       attr_accessor :only_attributes
       attr_accessor :exclude_attributes
+      attr_accessor :permit_params_attributes
+      attr_accessor :html_permit_params_attributes
       attr_accessor :extension_block
 
       # Optional resolver overrides (set from +graphql do+). SchemaBuilder still owns field names,
       # arguments, and types; procs replace only the Ruby resolution body.
       attr_accessor :resolve_index_proc
       attr_accessor :resolve_show_proc
-      attr_accessor :resolve_create_proc
-      attr_accessor :resolve_update_proc
+      attr_writer :resolve_create_proc
+      attr_writer :resolve_update_proc
       attr_accessor :resolve_destroy_proc
 
       # Default return type for run-action mutations (+batch+, +member+, +collection+) when a kind-specific
@@ -33,6 +36,22 @@ module ActiveAdmin
         !enabled
       end
 
+      def create_input
+        @create_input ||= MutationInputConfig.new
+      end
+
+      def update_input
+        @update_input ||= MutationInputConfig.new
+      end
+
+      def resolve_create_proc
+        @resolve_create_proc || create_input.resolve_proc
+      end
+
+      def resolve_update_proc
+        @resolve_update_proc || update_input.resolve_proc
+      end
+
       def batch_run_action
         @batch_run_action ||= RunActionMutationConfig.new
       end

data/lib/active_admin/graphql/resource_definition_dsl.rb

@@ -2,6 +2,7 @@
 
 require_relative "run_action_mutation_config"
 require_relative "run_action_mutation_dsl"
+require_relative "mutation_input_definition_dsl"
 
 module ActiveAdmin
   module GraphQL
@@ -18,6 +19,7 @@ module ActiveAdmin
       def type_name(name)
         @config.graphql_type_name = name.to_s
       end
+      alias_method :graphql_name, :type_name
 
       def only(*attrs)
         @config.only_attributes = attrs.flatten.map(&:to_sym)
@@ -28,6 +30,23 @@ module ActiveAdmin
       end
       alias_method :exclude, :except
 
+      def permit_params(*attrs)
+        @config.permit_params_attributes = attrs.flatten.map(&:to_sym)
+      end
+      alias_method :permit, :permit_params
+
+      def create(&block)
+        return unless block
+
+        MutationInputDefinitionDSL.new(@config.create_input).instance_exec(&block)
+      end
+
+      def update(&block)
+        return unless block
+
+        MutationInputDefinitionDSL.new(@config.update_input).instance_exec(&block)
+      end
+
       def configure(&block)
         @config.extension_block = block
       end

data/lib/active_admin/graphql/resource_methods.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    module Integration
+      module ResourceMethods
+        SERVER_OWNED_TIMESTAMP_COLUMNS = %w[created_at updated_at].freeze
+
+        def graphql_config
+          @graphql_config ||= ActiveAdmin::GraphQL::ResourceConfig.new
+        end
+
+        def attributes_for_graphql
+          keys = resource_attributes.keys
+          cfg = graphql_config
+          if cfg.only_attributes
+            keys &= cfg.only_attributes
+          end
+          keys -= cfg.exclude_attributes
+          keys
+        end
+
+        def graphql_assignable_attribute_names
+          names = attributes_for_graphql.map(&:to_s)
+          pk_cols = ActiveAdmin::PrimaryKey.columns(resource_class)
+          return names if pk_cols.size > 1
+
+          names - pk_cols
+        end
+
+        def graphql_create_attribute_names
+          mutation_permit_params_names(
+            graphql_config.create_input.permit_params_attributes || graphql_config.permit_params_attributes
+          )
+        end
+
+        def graphql_update_attribute_names
+          mutation_permit_params_names(
+            graphql_config.update_input.permit_params_attributes || graphql_config.permit_params_attributes
+          )
+        end
+
+        private
+
+        def mutation_permit_params_names(permit_list)
+          names = graphql_assignable_attribute_names.map(&:to_s)
+          permit_list = graphql_config.html_permit_params_attributes if permit_list.nil?
+          return names - SERVER_OWNED_TIMESTAMP_COLUMNS if permit_list.nil?
+
+          names & permit_list.map(&:to_s)
+        end
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/resource_query_proxy.rb

@@ -27,6 +27,26 @@ module ActiveAdmin
       def find_member(id)
         extra = member_route_params_for_find(id)
         controller_for("show", extra).send(:find_resource)
+      rescue ActiveRecord::RecordNotFound
+        nil
+      end
+
+      def find_members(ids)
+        string_ids = Array(ids).map(&:to_s).uniq
+        return {} if string_ids.empty?
+
+        model = @aa_resource.resource_class
+        if ActiveAdmin::PrimaryKey.composite?(model)
+          return string_ids.index_with { |identifier| find_member(identifier) }
+        end
+
+        controller = controller_for("index")
+        relation = controller.send(:apply_authorization_scope, controller.send(:scoped_collection))
+        primary_key = model.primary_key.to_sym
+        indexed = relation.where(primary_key => string_ids).index_by do |record|
+          record.public_send(primary_key).to_s
+        end
+        string_ids.index_with { |identifier| indexed[identifier] }
       end
 
       def build_new(attributes)

data/lib/active_admin/graphql/run_action_payload.rb

@@ -21,7 +21,8 @@ module ActiveAdmin
       field :body, ::GraphQL::Types::String, null: true,
         description: "Response body text when the action rendered (e.g. JSON)."
 
-      Result = Struct.new(:ok, :status, :location, :body, keyword_init: true)
+      # keyword_init required for Ruby 3.2 consumers; cop targets 3.4 default Struct behavior
+      Result = Struct.new(:ok, :status, :location, :body, keyword_init: true) # rubocop:disable Style/RedundantStructKeywordInit
     end
   end
 end

data/lib/active_admin/graphql/schema_builder/graph_params.rb

@@ -28,9 +28,9 @@ module ActiveAdmin
           h
         end
 
-        def assignable_slice_from_input(aa_res, input)
+        def assignable_slice_from_input(aa_res, input, attribute_names: nil)
           blob = input.to_h.stringify_keys
-          names = aa_res.graphql_assignable_attribute_names.map(&:to_s)
+          names = (attribute_names || aa_res.graphql_assignable_attribute_names).map(&:to_s)
           if (btc = aa_res.belongs_to_config)
             names -= [btc.to_param.to_s]
           end

data/lib/active_admin/graphql/schema_builder/mutation_create.rb

@@ -29,7 +29,11 @@ module ActiveAdmin
                 namespace: ns,
                 graph_params: sb.graph_params_from_input(aa_res, input)
               )
-              attrs = sb.assignable_slice_from_input(aa_res, input)
+              attrs = sb.assignable_slice_from_input(
+                aa_res,
+                input,
+                attribute_names: aa_res.graphql_create_attribute_names
+              )
               record = if (hook = aa_res.graphql_config.resolve_create_proc)
                 hook.call(
                   proxy: proxy,
@@ -46,7 +50,7 @@ module ActiveAdmin
                 end
 
                 unless r.save
-                  raise ::GraphQL::ExecutionError, r.errors.full_messages.to_sentence
+                  raise MutationExecutionError.validation(r)
                 end
                 r
               end

data/lib/active_admin/graphql/schema_builder/mutation_update_destroy.rb

@@ -42,7 +42,11 @@ module ActiveAdmin
                 raise ::GraphQL::ExecutionError, "not authorized to update this record"
               end
 
-              attrs = sb.assignable_slice_from_input(aa_res, input)
+              attrs = sb.assignable_slice_from_input(
+                aa_res,
+                input,
+                attribute_names: aa_res.graphql_update_attribute_names
+              )
               record = if (hook = aa_res.graphql_config.resolve_update_proc)
                 hook.call(
                   proxy: proxy,
@@ -54,9 +58,9 @@ module ActiveAdmin
                   aa_resource: aa_res
                 )
               else
-                attrs = attrs.stringify_keys.slice(*aa_res.graphql_assignable_attribute_names)
+                attrs = attrs.stringify_keys.slice(*aa_res.graphql_update_attribute_names)
                 unless record.update(attrs)
-                  raise ::GraphQL::ExecutionError, record.errors.full_messages.to_sentence
+                  raise MutationExecutionError.validation(record)
                 end
                 record
               end
@@ -66,17 +70,22 @@ module ActiveAdmin
         end
 
         def mutation_destroy_field(sb, ns, aa_res, model)
-          fname = "delete_#{aa_res.resource_name.route_key.singularize.tr("-", "_")}"
+          stem = aa_res.resource_name.route_key.singularize.tr("-", "_")
+          delete_name = "delete_#{stem}"
+          destroy_name = "destroy_#{stem}"
           find_type = @find_input_types[model]
+          type_basename = sb.send(:graphql_type_name_for, aa_res)
 
           proc do
-            field fname.to_sym, ::GraphQL::Types::Boolean, null: false, camelize: false,
-              visibility: {kind: :mutation_delete, graphql_type_name: sb.send(:graphql_type_name_for, aa_res), resource: aa_res},
-              description: "Delete #{model.name}" do
-              argument :where, find_type, required: true, camelize: false
+            [delete_name, destroy_name].each do |fname|
+              field fname.to_sym, ::GraphQL::Types::Boolean, null: false, camelize: false,
+                visibility: {kind: :mutation_delete, graphql_type_name: type_basename, resource: aa_res},
+                description: "Destroy #{model.name}" do
+                argument :where, find_type, required: true, camelize: false
+              end
             end
 
-            define_method(fname.to_sym) do |where:, **|
+            define_method(delete_name.to_sym) do |where:, **|
               auth = context[:auth]
               blob = where.to_h.stringify_keys
               graph = sb.graph_params_from_find_blob(aa_res, blob)
@@ -112,6 +121,7 @@ module ActiveAdmin
               end
               true
             end
+            alias_method destroy_name.to_sym, delete_name.to_sym
           end
         end
       end

data/lib/active_admin/graphql/schema_builder/query_type_policies.rb

@@ -48,17 +48,24 @@ module ActiveAdmin
             end
 
             define_method(:activeadmin_policies) do
-              auth = context[:auth]
               resources = builder.send(:active_resources).map do |aa_res|
                 {
                   type_name: builder.send(:graphql_type_name_for, aa_res),
-                  activeadmin_policies: builder.send(:build_policy_set, auth: auth, subject_owner: aa_res, subject: aa_res.resource_class, context: context)
+                  activeadmin_policies: ActiveAdmin::GraphQL::PolicySetCache.fetch(
+                    context,
+                    subject_owner: aa_res,
+                    subject: aa_res.resource_class
+                  )
                 }
               end
               pages = ns.resources.select { |r| r.is_a?(ActiveAdmin::Page) }.map do |page|
                 {
                   name: page.name,
-                  activeadmin_policies: builder.send(:build_policy_set, auth: auth, subject_owner: page, subject: page, context: context)
+                  activeadmin_policies: ActiveAdmin::GraphQL::PolicySetCache.fetch(
+                    context,
+                    subject_owner: page,
+                    subject: page
+                  )
                 }
               end
               {resources: resources, pages: pages}
@@ -75,13 +82,18 @@ module ActiveAdmin
                 graph_params: KeyValuePairs.to_hash(path)
               )
 
+              records_by_id = proxy.find_members(ids.map(&:to_s))
               ids.map do |id|
-                record = proxy.find_member(id.to_s)
+                record = records_by_id[id.to_s]
                 raise ::GraphQL::ExecutionError, "not found" unless record
 
                 {
                   id: id.to_s,
-                  activeadmin_policies: builder.send(:build_policy_set, auth: context[:auth], subject_owner: aa_res, subject: record, context: context)
+                  activeadmin_policies: ActiveAdmin::GraphQL::PolicySetCache.fetch(
+                    context,
+                    subject_owner: aa_res,
+                    subject: record
+                  )
                 }
               end
             end

data/lib/active_admin/graphql/schema_builder/types_inputs.rb

@@ -6,10 +6,16 @@ module ActiveAdmin
       module TypesInputs
         private
 
-        def define_input_assignable_arguments!(input_class, aa_res, required:)
+        def mark_empty_input_object!(input_class)
+          return if input_class.any_arguments?
+
+          input_class.has_no_arguments(true)
+        end
+
+        def define_input_assignable_arguments!(input_class, aa_res, required:, attribute_names:)
           model = aa_res.resource_class
           cols_by_name = model.columns.index_by(&:name)
-          gassign = aa_res.graphql_assignable_attribute_names.map(&:to_s)
+          gassign = attribute_names.map(&:to_s)
           if (btc = aa_res.belongs_to_config)
             gassign -= [btc.to_param.to_s]
           end
@@ -33,12 +39,19 @@ module ActiveAdmin
             graphql_name "#{gname}CreateInput"
             description "Attributes (and nested route params) for creating #{model.name}"
 
-            builder.send(:define_input_assignable_arguments!, self, aa_res, required: false)
+            builder.send(
+              :define_input_assignable_arguments!,
+              self,
+              aa_res,
+              required: false,
+              attribute_names: aa_res.graphql_create_attribute_names
+            )
 
             if btc
               argument btc.to_param.to_sym, ::GraphQL::Types::ID, required: btc.required?, camelize: false
             end
           end
+          mark_empty_input_object!(klass)
           attach_input_object_visibility!(klass, "#{gname}CreateInput", aa_res, :create_input)
           klass
         end
@@ -53,12 +66,19 @@ module ActiveAdmin
             graphql_name "#{gname}UpdateInput"
             description "Partial attributes (and nested route params) for updating #{model.name}"
 
-            builder.send(:define_input_assignable_arguments!, self, aa_res, required: false)
+            builder.send(
+              :define_input_assignable_arguments!,
+              self,
+              aa_res,
+              required: false,
+              attribute_names: aa_res.graphql_update_attribute_names
+            )
 
             if btc
               argument btc.to_param.to_sym, ::GraphQL::Types::ID, required: false, camelize: false
             end
           end
+          mark_empty_input_object!(klass)
           attach_input_object_visibility!(klass, "#{gname}UpdateInput", aa_res, :update_input)
           klass
         end

data/lib/active_admin/graphql/schema_builder/types_object.rb

@@ -101,8 +101,11 @@ module ActiveAdmin
 
           type_class.field :activeadmin_policies, policy_set_type, null: false, camelize: false, authorize: false
           type_class.define_method(:activeadmin_policies) do
-            builder = context[:namespace] && ActiveAdmin::GraphQL::SchemaBuilder.new(context[:namespace])
-            builder.send(:build_policy_set, auth: context[:auth], subject_owner: aa_res, subject: object, context: context)
+            ActiveAdmin::GraphQL::PolicySetCache.fetch(
+              context,
+              subject_owner: aa_res,
+              subject: object
+            )
           end
 
           if (ext = aa_res.graphql_config.extension_block)

data/lib/active_admin/graphql/schema_builder/wire.rb

@@ -14,6 +14,7 @@ module ActiveAdmin
             model.reflect_on_all_associations(:belongs_to).each do |ref|
               next if ref.polymorphic?
               target = ref.klass
+              target_aa_res = @aa_by_model[target]
               next unless @object_types[target]
 
               field_name = ref.name.to_sym
@@ -25,7 +26,16 @@ module ActiveAdmin
                 fk_val = object.public_send(fk)
                 next nil if fk_val.nil?
 
-                dataloader.with(ActiveAdmin::GraphQL::RecordSource, target).load(fk_val)
+                record = dataloader.with(ActiveAdmin::GraphQL::RecordSource, target).load(fk_val)
+                next nil unless record
+
+                auth = context[:auth]
+                if target_aa_res && auth &&
+                    !auth.authorized?(target_aa_res, ActiveAdmin::Authorization::READ, record)
+                  next nil
+                end
+
+                record
               end
             end
           end

data/lib/active_admin/graphql/version.rb

@@ -2,6 +2,6 @@
 
 module ActiveAdmin
   module GraphQL
-    VERSION = "0.2.0"
+    VERSION = "0.3.0"
   end
 end

data/lib/active_admin/graphql.rb

@@ -14,6 +14,7 @@ module ActiveAdmin
   #
   module GraphQL
     SCHEMA_CACHE = {}
+    SCHEMA_CACHE_MUTEX = Mutex.new
   end
 end
 
@@ -41,7 +42,12 @@ module ActiveAdmin
       # when admin registrations change without a full unload.
       def schema_for(namespace)
         cache_key = namespace.name
-        SCHEMA_CACHE[cache_key] ||= SchemaBuilder.new(namespace).build
+        cached = SCHEMA_CACHE[cache_key]
+        return cached if cached
+
+        SCHEMA_CACHE_MUTEX.synchronize do
+          SCHEMA_CACHE[cache_key] ||= SchemaBuilder.new(namespace).build
+        end
       end
 
       def clear_schema_cache!
@@ -70,6 +76,8 @@ module ActiveAdmin
           graphql/run_action_mutation_config
           graphql/run_action_mutation_dsl
           graphql/key_value_pair_input
+          graphql/policy_set_cache
+          graphql/mutation_execution_error
           graphql/schema_builder
         ].each { |path| require_relative path }
       end

data/sig/active_admin/graphql.rbs

@@ -0,0 +1,7 @@
+module ActiveAdmin
+  module GraphQL
+    VERSION: String
+
+    def self.load!: () -> void
+  end
+end