activeadmin-graphql 0.2.1 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '00998f8445b9a5f9a7d4a939029d6e6460527432d658711b713df1ad293abc9e'
-  data.tar.gz: fd5f948edd2277b99e68ee384ccf7d31c8ffa8c890bf2f277837106213498652
+  metadata.gz: 3347160c32fcf8dea19214ff0bdac83b9c9650855dd58de9035b153c37e0b708
+  data.tar.gz: 757c6bcf6d659569aee20ec9a54f094795c4c0cee4700db967a294a26779ea1b
 SHA512:
-  metadata.gz: fb9a627765be0dfb70171b6c2b9be70828e35a86fb0be2c79df237b0dbadc0559376e176b04ab6a2de49d22404c9773a4f9bee1427d1007b139dc71114afb991
-  data.tar.gz: 7c2d075e817702fd05648cf0f6dee228938d7d09400be066f99d4d50b23eb4d301f8ee0ac1632974ea57317f8a2ee7bcee81f5282481e9c477c9e8fd312e5db1
+  metadata.gz: 383ff1b8d22b9ee6e6f70aa60284ac9c832d69436bf5ee10bfa9b25ce17089aad965481f0ca7149b3742e26aef24e0b2f1b24bb9b84ab26b1076b6c4d39e855a
+  data.tar.gz: 8f6b647f0201d15d2dfe4e23befad9b9c05a22b226cd9d6257678eeb36d4ef39a53de4372961e6b765fe2acc2e4bc0475f835015f24bb867a0564e58b17b4824

data/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 ## Unreleased
 
+## 0.3.0 (2026-09-21)
+
+- BREAKING: omit `created_at` and `updated_at` from default create and update inputs. List them on `permit_params` to keep them writable.
+- BREAKING: require graphql-ruby 2.6.9 or newer (parser cache Marshal fix).
+- Add `permit_params` on the per-resource `graphql` block, with nested `create` / `update` `permit_params` and `resolve` (RFC 0006).
+- Seed GraphQL mutation inputs from a static HTML `permit_params` list when graphql `permit_params` is unset.
+- Add `destroy_*` as an alias of `delete_*`.
+- Add `graphql_name` as an alias of `type_name`.
+- Put ActiveRecord validation messages on GraphQL error `extensions.errors` when create or update fails.
+- Log GraphQL execute with namespace, operation name, and error count.
+- Test ActiveAdmin 4.0.0.beta23 on Rails 8. Keep ActiveAdmin 3.5 on Rails 7.2.
+- Add `rfcs/` starter pack: process (RFC 0001), positioning (RFC 0002), and Standards Track design RFCs 0003–0005 for HTTP endpoint, schema DSL, and authorization.
+
 ## 0.2.1 (2026-07-14)
 
 - Add RBS type signatures to the published gem for Steep and other Ruby type checkers

data/CODE_OF_CONDUCT.md

@@ -1,31 +1,26 @@
 # Code of Conduct
 
-## Our Pledge
+## Pledge
 
-We pledge to make participation in the activeadmin-graphql community a harassment-free experience for everyone. We operate on principles of mutual respect, privacy, and authentic engagement. We value substantive contributions and clarity on intentions.
+Participation is a harassment-free experience. Treat each other with respect. Keep private context private.
 
-## Our Standards
+## Expected behavior
 
-Examples of behavior that contributes to a positive environment include:
+- Engage with genuine curiosity. Admit uncertainty.
+- Own every line you submit, including generated code.
+- Correct errors politely.
+- Use language that welcomes people and respects identity and privacy.
 
-- Authenticity: Engaging with genuine curiosity and admitting uncertainty rather than feigning knowledge.
-- Responsible innovation: Taking full responsibility for any content or code contributed, whether manually written or generated by automation tools.
-- Gentle correction: Responding politely to errors. We view mistakes as opportunities for learning, provided they are addressed with humility.
-- Inclusive language: Using language that welcomes diverse perspectives and respects the privacy and identity of all participants.
+## Unacceptable behavior
 
-Examples of unacceptable behavior include:
+- Harassment, trolling, or insulting comments, public or private.
+- Using jargon or volume, including automated spam, to silence others.
+- Sharing others' data or personal context without permission.
 
-- Harassment: Public or private harassment, trolling, or insulting comments.
-- Weaponized complexity: Using jargon or overwhelming volume (including automated spam) to silence others.
-- Publishing private information: Sharing others' data or personal context without explicit permission.
+## Automation
 
-## Artificial Intelligence & Automation
-
-In accordance with our commitment to collective awareness:
-
-- Contributors are responsible for the accuracy and security of any AI-generated artifacts they submit.
-- "The AI wrote it" is not a valid excuse for introducing bugs, security vulnerabilities, or bias.
+You remain responsible for bugs, security holes, and bias in generated artifacts you submit.
 
 ## Enforcement
 
-Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at contact@kiskolabs.com. All complaints will be reviewed and investigated promptly and fairly.
+Report abusive or harassing behavior to contact@kiskolabs.com. Reports are reviewed and investigated.

data/CONTRIBUTING.md

@@ -1,27 +1,23 @@
 # Contributing Guidelines
 
-Thank you for your interest in contributing to activeadmin-graphql.
+## Automation authorship
 
-## How to Contribute
+You may use AI and automation tools. You remain the author of every line you submit: review, debug, and understand the change.
 
-### 1. Reporting Issues
+Keep pull requests small enough to review. Annotate non-obvious logic.
 
-- Verify accuracy: Before posting, verify your information. Avoid generalizations.
-- Use structured inputs: Provide clear goals, constraints, and reproduction steps.
+Never send project secrets or private context to public models.
 
-### 2. Pull Request Process
+## How to contribute
 
-- Scope: Keep PRs focused on a single goal.
-- Context: Explain why the change is necessary.
-- Testing: Run the RSpec suite (see the README for Appraisal and parallel test commands).
+### Reporting issues
 
-### 3. Review Process
+Verify the facts before filing. Use issue templates for goals, constraints, and reproduction steps.
 
-- We encourage productive friction. Expect questions about your approach.
-- If a reviewer suggests a change, view it as mutual aid, not criticism.
+### Pull requests
 
-### Artificial Intelligence & Automation
+Keep one pull request to one goal. Explain why the change is needed. Run smoke tests and regression checks locally before opening the request.
 
-1. You are the author: You act as the responsible agent for any code you submit. You must review, debug, and understand every line.
-2. Manage cognitive load: Do not submit massive, unreviewed automated dumps.
-3. Security: Never feed project secrets or private context into public AI models.
+### Review
+
+Reviewers will ask about approach and trade-offs. Treat suggested changes as part of the work.

data/README.md

@@ -2,14 +2,18 @@
 
 GraphQL HTTP API for [ActiveAdmin](https://activeadmin.info), built with [graphql-ruby](https://graphql-ruby.org). Register resources as usual, optionally add a `graphql do ... end` block, enable the endpoint per namespace, and get a schema with queries and mutations aligned with ActiveAdmin authorization and filters.
 
+Design changes go through `rfcs/` (RFC 0001).
+
 ## Setup
 
 ```ruby
 # Gemfile (graphql-ruby is pulled in by activeadmin-graphql)
-gem "activeadmin"
+gem "activeadmin" # 3.5, or pin 4.0.0.beta23
 gem "activeadmin-graphql"
 ```
 
+ActiveAdmin 4.0 is still a prerelease. Pin it explicitly, for example `gem "activeadmin", "4.0.0.beta23"`. Bundler will not select a prerelease from this gem's `>= 3.2` floor. graphql-ruby must be 2.6.9 or newer.
+
 ```ruby
 # config/initializers/active_admin.rb
 ActiveAdmin.setup do |config|
@@ -38,12 +42,25 @@ rake rubocop
 rake spec
 ```
 
-Matrixed Rails versions use [Appraisal](https://github.com/thoughtbot/appraisal): `gemfiles/rails72.gemfile`, `rails8ruby34.gemfile`, and `rails8truffleruby.gemfile` pin Rails 7.2 / 8.1 (integration tests follow the `spec/dummy` app, which is tested from 7.2 upward). Run `bundle exec appraisal rspec` to execute RSpec in each gemfile context, or `bundle exec parallel_rspec spec` locally for faster multi-process runs on the current bundle.
+Matrixed Rails versions use [Appraisal](https://github.com/thoughtbot/appraisal): `gemfiles/rails72.gemfile` pins Rails 7.2 with ActiveAdmin 3.5; `rails8ruby34.gemfile` and `rails8ruby4.gemfile` pin Rails 8.1 with ActiveAdmin 4.0.0.beta23 (integration tests follow the `spec/dummy` app). Run `bundle exec appraisal rspec` to execute RSpec in each gemfile context, or `bundle exec parallel_rspec spec` locally for faster multi-process runs on the current bundle.
 
 [Trunk](https://docs.trunk.io) config lives in `.trunk/`; CI runs `trunk` via `.github/workflows/trunk.yml`. Releases: `usr/bin/release.rb` (RuboCop, Appraisal RSpec across gemfiles, `gem build` / `gem push`, git tag, `gh release`).
 
 No local ActiveAdmin checkout is required; the dummy app depends on the published `activeadmin` gem like a normal host app.
 
+## Links
+
+- [GitHub](https://github.com/amkisko/activeadmin-graphql.rb)
+- [GitLab](https://gitlab.com/amkisko/activeadmin-graphql.rb)
+- [RubyGems](https://rubygems.org/gems/activeadmin-graphql)
+- [Versions Atom](https://rubygems.org/gems/activeadmin-graphql/versions.atom) (feed id `10803975489574`)
+- [libraries.io](https://libraries.io/rubygems/activeadmin-graphql)
+- [Deps.dev](https://deps.dev/rubygems/activeadmin-graphql)
+- [SonarCloud](https://sonarcloud.io/project/overview?id=amkisko_activeadmin-graphql.rb)
+- [Snyk](https://snyk.io/test/github/amkisko/activeadmin-graphql.rb)
+- [Codecov](https://app.codecov.io/github/amkisko/activeadmin-graphql.rb)
+- [OpenSSF Scorecard](https://scorecard.dev/viewer/?uri=github.com/amkisko/activeadmin-graphql.rb)
+
 ## License
 
 MIT — see [LICENSE.md](LICENSE.md).

data/activeadmin-graphql.gemspec

@@ -11,7 +11,7 @@ Gem::Specification.new do |spec|
   spec.description = "Exposes ActiveAdmin resources and pages as a graphql-ruby schema with an HTTP endpoint per namespace."
   spec.license = "MIT"
   spec.platform = Gem::Platform::RUBY
-  spec.required_ruby_version = ">= 3.2"
+  spec.required_ruby_version = ">= 3.4"
 
   repository_url = "https://github.com/amkisko/activeadmin-graphql.rb"
 
@@ -43,27 +43,28 @@ Gem::Specification.new do |spec|
   spec.require_paths = ["lib"]
 
   spec.add_runtime_dependency "activeadmin", ">= 3.2"
-  spec.add_runtime_dependency "graphql", ">= 2.3"
+  spec.add_runtime_dependency "graphql", ">= 2.6.9"
 
   spec.add_development_dependency "appraisal", "~> 2"
   spec.add_development_dependency "bigdecimal"
   spec.add_development_dependency "bundler", ">= 2"
   spec.add_development_dependency "devise", ">= 4.9"
-  spec.add_development_dependency "parallel_tests", "~> 4.7"
+  spec.add_development_dependency "json", ">= 2.21.2", "< 3"
+  spec.add_development_dependency "parallel_tests", "~> 5.7"
   spec.add_development_dependency "rails", ">= 6.1"
   spec.add_development_dependency "rspec", "~> 3"
   spec.add_development_dependency "polyrun", ">= 2.2.0"
   spec.add_development_dependency "prosopite", "~> 2.0"
   spec.add_development_dependency "rspec-rails", ">= 6"
+  spec.add_development_dependency "rubocop", "~> 1.91"
   spec.add_development_dependency "rubocop-rails", "~> 2.34"
   spec.add_development_dependency "rubocop-rspec", "~> 3.8"
   spec.add_development_dependency "rubocop-thread_safety", "~> 0.7"
   spec.add_development_dependency "sprockets-rails", ">= 3.4"
-  spec.add_development_dependency "sqlite3", ">= 1"
-  spec.add_development_dependency "standard", "~> 1.52"
+  spec.add_development_dependency "sqlite3", ">= 2.9.6"
   spec.add_development_dependency "standard-custom", "~> 1.0"
   spec.add_development_dependency "standard-performance", "~> 1.8"
   spec.add_development_dependency "standard-rails", "~> 1.5"
   spec.add_development_dependency "standard-rspec", "~> 0.3"
-  spec.add_development_dependency "rbs", "~> 3"
+  spec.add_development_dependency "rbs", "~> 4"
 end

data/app/controllers/active_admin/graphql_controller.rb

@@ -167,6 +167,7 @@ module ActiveAdmin
       return if performed?
 
       results = schema.multiplex(payloads)
+      log_graphql_result(operation_name: "multiplex", error_count: results.count { |result| Array(result.to_h["errors"]).any? })
       render json: results.map(&:to_h), status: :ok
     end
 
@@ -182,6 +183,7 @@ module ActiveAdmin
         operation_name: operation_name,
         context: graphql_context
       )
+      log_graphql_result(operation_name: operation_name, error_count: Array(result.to_h["errors"]).size)
       render json: result.to_h, status: :ok
     end
 
@@ -216,5 +218,12 @@ module ActiveAdmin
         }
       end
     end
+
+    def log_graphql_result(operation_name:, error_count:)
+      Rails.logger.info(
+        "[activeadmin-graphql] namespace=#{active_admin_namespace.name} " \
+        "operation=#{operation_name.presence || "anonymous"} error_count=#{error_count}"
+      )
+    end
   end
 end

data/docs/graphql-api.md

@@ -10,10 +10,12 @@ Add the extension to your application (it pulls in `activeadmin` and `graphql` a
 
 ```ruby
 # Gemfile
-gem "activeadmin"
+gem "activeadmin" # 3.5, or pin 4.0.0.beta23
 gem "activeadmin-graphql"
 ```
 
+ActiveAdmin 4.0 is still a prerelease. Pin it in the host Gemfile (`gem "activeadmin", "4.0.0.beta23"`). Bundler will not pick a prerelease from this gem's `>= 3.2` floor. graphql-ruby must be 2.6.9 or newer.
+
 Bundling loads `activeadmin/graphql`, which installs the Router/Resource integration and calls `ActiveAdmin::GraphQL.load!`, so graphql-ruby is loaded at boot whenever the gem is in your bundle. The schema class for a namespace is built on demand (first request or introspection) via `ActiveAdmin::GraphQL.schema_for(namespace)`.
 
 If `graphql = true` is set for a namespace but Bundler cannot satisfy the `graphql` gem, boot fails with an ActiveAdmin dependency error until you run `bundle install`.
@@ -214,9 +216,12 @@ The `Mutation` type is present when at least one operation exists: per-resource
 resource defines the corresponding batch, member, or collection actions.
 
 Object type names default to the model name (for example `Post`). Typed input
-objects mirror `attributes_for_graphql` (see the per-resource section below):
+objects use assignable columns (see the per-resource section below):
 `PostCreateInput`, `PostUpdateInput`, `PostListFilterInput`, and `PostWhereInput`
-when the GraphQL name is `Post`.
+when the GraphQL name is `Post`. `only` / `except` cap both object fields and
+mutation keys. `permit_params` and nested `create` / `update` blocks narrow
+create and update inputs without hiding query fields. Default mutation inputs
+omit `created_at` and `updated_at`.
 
 ### Composite primary keys (Rails 7.1+)
 
@@ -270,9 +275,11 @@ These align with REST index parameters where possible:
 Typical names for a `Post` resource:
 
 * `create_post(input: PostCreateInput!)` — attribute fields match assignable
-  columns (and the nested parent param when `belongs_to` is configured).
+  columns minus `created_at` / `updated_at` unless listed in `permit_params`
+  (and the nested parent param when `belongs_to` is configured).
 * `update_post(where: PostWhereInput!, input: PostUpdateInput!)`
-* `delete_post(where: PostWhereInput!)`
+* `delete_post(where: PostWhereInput!)` — kept for existing clients.
+* `destroy_post(where: PostWhereInput!)` — Rails / ActiveAdmin action name; same resolver as `delete_post`.
 
 Nested resources require the parent id on `where`, `input`, or list `filter`
 when the association is required.
@@ -339,9 +346,16 @@ Inside `ActiveAdmin.register` you can narrow the GraphQL surface:
 ActiveAdmin.register Post do
   graphql do
     disable!                          # omit this resource from the schema
-    type_name "BlogPost"              # GraphQL object / mutation type basename
-    only :title, :body, :published_at # expose only these attributes
+    type_name "BlogPost"              # GraphQL object / mutation type basename (`graphql_name` alias)
+    only :title, :body, :published_at # expose only these attributes on queries
     exclude :internal_score           # or `except` / `exclude`
+    permit_params :title, :body       # create and update inputs (query fields stay)
+    create do
+      permit_params :title, :body     # replace the shared list for create
+    end
+    update do
+      permit_params :title            # replace the shared list for update
+    end
     configure do
       # graphql-ruby field DSL on the object type class
       field :computed, GraphQL::Types::String, null: true
@@ -352,10 +366,21 @@ end
 ```
 
 * `disable!` — resource is not included in Query or Mutation.
-* `type_name` — overrides the default GraphQL type name derived from the model
-  (object types, mutations, and Rails enum GraphQL types use this basename).
-* `only` / `except` (or `exclude`) — restrict columns on object types and
-  assignable mutation keys (the primary key remains readable as `id`).
+* `type_name` (or `graphql_name`) — overrides the default GraphQL type name
+  derived from the model (object types, mutations, and Rails enum GraphQL
+  types use this basename).
+* `only` / `except` (or `exclude`) — restrict columns on object types. These
+  names also cap mutation inputs. This is not ActiveAdmin `only:` / `except:`
+  for controller actions (`action_item only: :show`). The primary key remains
+  readable as `id`.
+* `permit_params` (or `permit`) — restrict create and update input keys without
+  hiding query fields, same name as ActiveAdmin HTML `permit_params`. Nested
+  `create` / `update` blocks replace that shared list for one operation and
+  may set `resolve`. Names outside `only` / `except` are dropped. A static HTML
+  `permit_params :title, :body` list seeds GraphQL when the graphql list is
+  unset. A request-time HTML `permit_params` block is not copied. With no list
+  set, mutation inputs omit `created_at` and `updated_at`. Empty `permit_params`
+  yields an input with no column arguments.
 * `configure` — `field` and resolver methods are evaluated on the generated
   object type class.
 

data/lib/active_admin/graphql/integration.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "resource_definition_dsl"
+require_relative "resource_methods"
 
 module ActiveAdmin
   module GraphQL
@@ -60,36 +61,34 @@ module ActiveAdmin
         end
       end
 
-      module ResourceMethods
-        def graphql_config
-          @graphql_config ||= ActiveAdmin::GraphQL::ResourceConfig.new
+      module ResourceDSLMethods
+        def graphql(&block)
+          if block
+            ActiveAdmin::GraphQL::ResourceDefinitionDSL.new(config.graphql_config).instance_exec(&block)
+          end
+          config.graphql_config
         end
 
-        def attributes_for_graphql
-          keys = resource_attributes.keys
-          cfg = graphql_config
-          if cfg.only_attributes
-            keys &= cfg.only_attributes
+        def permit_params(*args, &block)
+          unless block
+            config.graphql_config.html_permit_params_attributes = flatten_html_permit_params(args)
           end
-          keys -= cfg.exclude_attributes
-          keys
+          super
         end
 
-        def graphql_assignable_attribute_names
-          names = attributes_for_graphql.map(&:to_s)
-          pk_cols = ActiveAdmin::PrimaryKey.columns(resource_class)
-          return names if pk_cols.size > 1
-
-          names - pk_cols
-        end
-      end
+        private
 
-      module ResourceDSLMethods
-        def graphql(&block)
-          if block
-            ActiveAdmin::GraphQL::ResourceDefinitionDSL.new(config.graphql_config).instance_exec(&block)
+        def flatten_html_permit_params(args)
+          args.flat_map do |arg|
+            case arg
+            when Symbol, String
+              [arg.to_sym]
+            when Hash
+              arg.keys.map(&:to_sym)
+            else
+              []
+            end
           end
-          config.graphql_config
         end
       end
 

data/lib/active_admin/graphql/mutation_execution_error.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    module MutationExecutionError
+      module_function
+
+      def validation(record)
+        ::GraphQL::ExecutionError.new(
+          record.errors.full_messages.to_sentence,
+          extensions: {"errors" => record.errors.full_messages}
+        )
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/mutation_input_config.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    # Create or update input options set from +graphql { create do … }+ / +update do … }+.
+    class MutationInputConfig
+      attr_accessor :permit_params_attributes
+      attr_accessor :resolve_proc
+    end
+  end
+end

data/lib/active_admin/graphql/mutation_input_definition_dsl.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    # Nested DSL for +graphql { create do … }+ and +update do … }+, pairing
+    # ActiveAdmin +permit_params+ with graphql-ruby-style +resolve+.
+    class MutationInputDefinitionDSL
+      def initialize(config)
+        @config = config
+      end
+
+      def permit_params(*attrs)
+        @config.permit_params_attributes = attrs.flatten.map(&:to_sym)
+      end
+      alias_method :permit, :permit_params
+
+      def resolve(&block)
+        @config.resolve_proc = block
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/resource_config.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "run_action_mutation_config"
+require_relative "mutation_input_config"
 
 module ActiveAdmin
   module GraphQL
@@ -10,14 +11,16 @@ module ActiveAdmin
       attr_accessor :graphql_type_name
       attr_accessor :only_attributes
       attr_accessor :exclude_attributes
+      attr_accessor :permit_params_attributes
+      attr_accessor :html_permit_params_attributes
       attr_accessor :extension_block
 
       # Optional resolver overrides (set from +graphql do+). SchemaBuilder still owns field names,
       # arguments, and types; procs replace only the Ruby resolution body.
       attr_accessor :resolve_index_proc
       attr_accessor :resolve_show_proc
-      attr_accessor :resolve_create_proc
-      attr_accessor :resolve_update_proc
+      attr_writer :resolve_create_proc
+      attr_writer :resolve_update_proc
       attr_accessor :resolve_destroy_proc
 
       # Default return type for run-action mutations (+batch+, +member+, +collection+) when a kind-specific
@@ -33,6 +36,22 @@ module ActiveAdmin
         !enabled
       end
 
+      def create_input
+        @create_input ||= MutationInputConfig.new
+      end
+
+      def update_input
+        @update_input ||= MutationInputConfig.new
+      end
+
+      def resolve_create_proc
+        @resolve_create_proc || create_input.resolve_proc
+      end
+
+      def resolve_update_proc
+        @resolve_update_proc || update_input.resolve_proc
+      end
+
       def batch_run_action
         @batch_run_action ||= RunActionMutationConfig.new
       end

data/lib/active_admin/graphql/resource_definition_dsl.rb

@@ -2,6 +2,7 @@
 
 require_relative "run_action_mutation_config"
 require_relative "run_action_mutation_dsl"
+require_relative "mutation_input_definition_dsl"
 
 module ActiveAdmin
   module GraphQL
@@ -18,6 +19,7 @@ module ActiveAdmin
       def type_name(name)
         @config.graphql_type_name = name.to_s
       end
+      alias_method :graphql_name, :type_name
 
       def only(*attrs)
         @config.only_attributes = attrs.flatten.map(&:to_sym)
@@ -28,6 +30,23 @@ module ActiveAdmin
       end
       alias_method :exclude, :except
 
+      def permit_params(*attrs)
+        @config.permit_params_attributes = attrs.flatten.map(&:to_sym)
+      end
+      alias_method :permit, :permit_params
+
+      def create(&block)
+        return unless block
+
+        MutationInputDefinitionDSL.new(@config.create_input).instance_exec(&block)
+      end
+
+      def update(&block)
+        return unless block
+
+        MutationInputDefinitionDSL.new(@config.update_input).instance_exec(&block)
+      end
+
       def configure(&block)
         @config.extension_block = block
       end

data/lib/active_admin/graphql/resource_methods.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    module Integration
+      module ResourceMethods
+        SERVER_OWNED_TIMESTAMP_COLUMNS = %w[created_at updated_at].freeze
+
+        def graphql_config
+          @graphql_config ||= ActiveAdmin::GraphQL::ResourceConfig.new
+        end
+
+        def attributes_for_graphql
+          keys = resource_attributes.keys
+          cfg = graphql_config
+          if cfg.only_attributes
+            keys &= cfg.only_attributes
+          end
+          keys -= cfg.exclude_attributes
+          keys
+        end
+
+        def graphql_assignable_attribute_names
+          names = attributes_for_graphql.map(&:to_s)
+          pk_cols = ActiveAdmin::PrimaryKey.columns(resource_class)
+          return names if pk_cols.size > 1
+
+          names - pk_cols
+        end
+
+        def graphql_create_attribute_names
+          mutation_permit_params_names(
+            graphql_config.create_input.permit_params_attributes || graphql_config.permit_params_attributes
+          )
+        end
+
+        def graphql_update_attribute_names
+          mutation_permit_params_names(
+            graphql_config.update_input.permit_params_attributes || graphql_config.permit_params_attributes
+          )
+        end
+
+        private
+
+        def mutation_permit_params_names(permit_list)
+          names = graphql_assignable_attribute_names.map(&:to_s)
+          permit_list = graphql_config.html_permit_params_attributes if permit_list.nil?
+          return names - SERVER_OWNED_TIMESTAMP_COLUMNS if permit_list.nil?
+
+          names & permit_list.map(&:to_s)
+        end
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/schema_builder/graph_params.rb

@@ -28,9 +28,9 @@ module ActiveAdmin
           h
         end
 
-        def assignable_slice_from_input(aa_res, input)
+        def assignable_slice_from_input(aa_res, input, attribute_names: nil)
           blob = input.to_h.stringify_keys
-          names = aa_res.graphql_assignable_attribute_names.map(&:to_s)
+          names = (attribute_names || aa_res.graphql_assignable_attribute_names).map(&:to_s)
           if (btc = aa_res.belongs_to_config)
             names -= [btc.to_param.to_s]
           end

data/lib/active_admin/graphql/schema_builder/mutation_create.rb

@@ -29,7 +29,11 @@ module ActiveAdmin
                 namespace: ns,
                 graph_params: sb.graph_params_from_input(aa_res, input)
               )
-              attrs = sb.assignable_slice_from_input(aa_res, input)
+              attrs = sb.assignable_slice_from_input(
+                aa_res,
+                input,
+                attribute_names: aa_res.graphql_create_attribute_names
+              )
               record = if (hook = aa_res.graphql_config.resolve_create_proc)
                 hook.call(
                   proxy: proxy,
@@ -46,7 +50,7 @@ module ActiveAdmin
                 end
 
                 unless r.save
-                  raise ::GraphQL::ExecutionError, r.errors.full_messages.to_sentence
+                  raise MutationExecutionError.validation(r)
                 end
                 r
               end

data/lib/active_admin/graphql/schema_builder/mutation_update_destroy.rb

@@ -42,7 +42,11 @@ module ActiveAdmin
                 raise ::GraphQL::ExecutionError, "not authorized to update this record"
               end
 
-              attrs = sb.assignable_slice_from_input(aa_res, input)
+              attrs = sb.assignable_slice_from_input(
+                aa_res,
+                input,
+                attribute_names: aa_res.graphql_update_attribute_names
+              )
               record = if (hook = aa_res.graphql_config.resolve_update_proc)
                 hook.call(
                   proxy: proxy,
@@ -54,9 +58,9 @@ module ActiveAdmin
                   aa_resource: aa_res
                 )
               else
-                attrs = attrs.stringify_keys.slice(*aa_res.graphql_assignable_attribute_names)
+                attrs = attrs.stringify_keys.slice(*aa_res.graphql_update_attribute_names)
                 unless record.update(attrs)
-                  raise ::GraphQL::ExecutionError, record.errors.full_messages.to_sentence
+                  raise MutationExecutionError.validation(record)
                 end
                 record
               end
@@ -66,17 +70,22 @@ module ActiveAdmin
         end
 
         def mutation_destroy_field(sb, ns, aa_res, model)
-          fname = "delete_#{aa_res.resource_name.route_key.singularize.tr("-", "_")}"
+          stem = aa_res.resource_name.route_key.singularize.tr("-", "_")
+          delete_name = "delete_#{stem}"
+          destroy_name = "destroy_#{stem}"
           find_type = @find_input_types[model]
+          type_basename = sb.send(:graphql_type_name_for, aa_res)
 
           proc do
-            field fname.to_sym, ::GraphQL::Types::Boolean, null: false, camelize: false,
-              visibility: {kind: :mutation_delete, graphql_type_name: sb.send(:graphql_type_name_for, aa_res), resource: aa_res},
-              description: "Delete #{model.name}" do
-              argument :where, find_type, required: true, camelize: false
+            [delete_name, destroy_name].each do |fname|
+              field fname.to_sym, ::GraphQL::Types::Boolean, null: false, camelize: false,
+                visibility: {kind: :mutation_delete, graphql_type_name: type_basename, resource: aa_res},
+                description: "Destroy #{model.name}" do
+                argument :where, find_type, required: true, camelize: false
+              end
             end
 
-            define_method(fname.to_sym) do |where:, **|
+            define_method(delete_name.to_sym) do |where:, **|
               auth = context[:auth]
               blob = where.to_h.stringify_keys
               graph = sb.graph_params_from_find_blob(aa_res, blob)
@@ -112,6 +121,7 @@ module ActiveAdmin
               end
               true
             end
+            alias_method destroy_name.to_sym, delete_name.to_sym
           end
         end
       end

data/lib/active_admin/graphql/schema_builder/types_inputs.rb

@@ -6,10 +6,16 @@ module ActiveAdmin
       module TypesInputs
         private
 
-        def define_input_assignable_arguments!(input_class, aa_res, required:)
+        def mark_empty_input_object!(input_class)
+          return if input_class.any_arguments?
+
+          input_class.has_no_arguments(true)
+        end
+
+        def define_input_assignable_arguments!(input_class, aa_res, required:, attribute_names:)
           model = aa_res.resource_class
           cols_by_name = model.columns.index_by(&:name)
-          gassign = aa_res.graphql_assignable_attribute_names.map(&:to_s)
+          gassign = attribute_names.map(&:to_s)
           if (btc = aa_res.belongs_to_config)
             gassign -= [btc.to_param.to_s]
           end
@@ -33,12 +39,19 @@ module ActiveAdmin
             graphql_name "#{gname}CreateInput"
             description "Attributes (and nested route params) for creating #{model.name}"
 
-            builder.send(:define_input_assignable_arguments!, self, aa_res, required: false)
+            builder.send(
+              :define_input_assignable_arguments!,
+              self,
+              aa_res,
+              required: false,
+              attribute_names: aa_res.graphql_create_attribute_names
+            )
 
             if btc
               argument btc.to_param.to_sym, ::GraphQL::Types::ID, required: btc.required?, camelize: false
             end
           end
+          mark_empty_input_object!(klass)
           attach_input_object_visibility!(klass, "#{gname}CreateInput", aa_res, :create_input)
           klass
         end
@@ -53,12 +66,19 @@ module ActiveAdmin
             graphql_name "#{gname}UpdateInput"
             description "Partial attributes (and nested route params) for updating #{model.name}"
 
-            builder.send(:define_input_assignable_arguments!, self, aa_res, required: false)
+            builder.send(
+              :define_input_assignable_arguments!,
+              self,
+              aa_res,
+              required: false,
+              attribute_names: aa_res.graphql_update_attribute_names
+            )
 
             if btc
               argument btc.to_param.to_sym, ::GraphQL::Types::ID, required: false, camelize: false
             end
           end
+          mark_empty_input_object!(klass)
           attach_input_object_visibility!(klass, "#{gname}UpdateInput", aa_res, :update_input)
           klass
         end

data/lib/active_admin/graphql/version.rb

@@ -2,6 +2,6 @@
 
 module ActiveAdmin
   module GraphQL
-    VERSION = "0.2.1"
+    VERSION = "0.3.0"
   end
 end

data/lib/active_admin/graphql.rb

@@ -77,6 +77,7 @@ module ActiveAdmin
           graphql/run_action_mutation_dsl
           graphql/key_value_pair_input
           graphql/policy_set_cache
+          graphql/mutation_execution_error
           graphql/schema_builder
         ].each { |path| require_relative path }
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: activeadmin-graphql
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.3.0
 platform: ruby
 authors:
 - Andrei Makarov
@@ -29,14 +29,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '2.3'
+        version: 2.6.9
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '2.3'
+        version: 2.6.9
 - !ruby/object:Gem::Dependency
   name: appraisal
   requirement: !ruby/object:Gem::Requirement
@@ -93,20 +93,40 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '4.9'
+- !ruby/object:Gem::Dependency
+  name: json
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.21.2
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.21.2
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3'
 - !ruby/object:Gem::Dependency
   name: parallel_tests
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '4.7'
+        version: '5.7'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '4.7'
+        version: '5.7'
 - !ruby/object:Gem::Dependency
   name: rails
   requirement: !ruby/object:Gem::Requirement
@@ -177,6 +197,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '6'
+- !ruby/object:Gem::Dependency
+  name: rubocop
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.91'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.91'
 - !ruby/object:Gem::Dependency
   name: rubocop-rails
   requirement: !ruby/object:Gem::Requirement
@@ -239,28 +273,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '1'
+        version: 2.9.6
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '1'
-- !ruby/object:Gem::Dependency
-  name: standard
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.52'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.52'
+        version: 2.9.6
 - !ruby/object:Gem::Dependency
   name: standard-custom
   requirement: !ruby/object:Gem::Requirement
@@ -323,14 +343,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3'
+        version: '4'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3'
+        version: '4'
 description: Exposes ActiveAdmin resources and pages as a graphql-ruby schema with
   an HTTP endpoint per namespace.
 email:
@@ -352,12 +372,16 @@ files:
 - lib/active_admin/graphql/engine.rb
 - lib/active_admin/graphql/integration.rb
 - lib/active_admin/graphql/key_value_pair_input.rb
+- lib/active_admin/graphql/mutation_execution_error.rb
+- lib/active_admin/graphql/mutation_input_config.rb
+- lib/active_admin/graphql/mutation_input_definition_dsl.rb
 - lib/active_admin/graphql/policy_set_cache.rb
 - lib/active_admin/graphql/railtie.rb
 - lib/active_admin/graphql/record_source.rb
 - lib/active_admin/graphql/resource_config.rb
 - lib/active_admin/graphql/resource_definition_dsl.rb
 - lib/active_admin/graphql/resource_interface.rb
+- lib/active_admin/graphql/resource_methods.rb
 - lib/active_admin/graphql/resource_query_proxy.rb
 - lib/active_admin/graphql/resource_query_proxy/controller.rb
 - lib/active_admin/graphql/run_action_mutation_config.rb
@@ -407,7 +431,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '3.2'
+      version: '3.4'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="