activeadmin-graphql 0.3.1 → 0.3.3

data/lib/active_admin/graphql/resource_identity.rb

@@ -0,0 +1,98 @@
+# frozen_string_literal: true
+
+require "json"
+
+module ActiveAdmin
+  module GraphQL
+    # Resolves GraphQL identity columns and id encode/decode for a registered resource.
+    # Prefer `graphql { identity ... }` when ActiveRecord has no primary key / id column.
+    module ResourceIdentity
+      module_function
+
+      def configured?(aa_res)
+        aa_res.graphql_config.identity_columns.present?
+      end
+
+      def columns(aa_res)
+        configured = aa_res.graphql_config.identity_columns
+        return configured if configured.present?
+
+        ActiveAdmin::PrimaryKey.columns(aa_res.resource_class)
+      end
+
+      def graphql_id_value(aa_res, record)
+        cfg = aa_res.graphql_config
+        if (encode = cfg.identity_encode_proc)
+          return encode.call(record).to_s
+        end
+
+        cols = columns(aa_res)
+        return ActiveAdmin::PrimaryKey.graphql_id_value(record) unless configured?(aa_res)
+
+        encode_columns(record, cols, cfg.identity_separator)
+      end
+
+      def attributes_for_id(aa_res, id)
+        cfg = aa_res.graphql_config
+        if (decode = cfg.identity_decode_proc)
+          return stringify_attrs(decode.call(id))
+        end
+
+        cols = columns(aa_res)
+        return ActiveAdmin::PrimaryKey.find_attributes(aa_res.resource_class, id) unless configured?(aa_res)
+
+        decode_columns(cols, id, cfg.identity_separator)
+      end
+
+      def encode_columns(record, cols, separator)
+        if cols.size == 1
+          record.public_send(cols.first).to_s
+        elsif separator
+          cols.map { |c| record.public_send(c) }.join(separator)
+        else
+          payload = cols.each_with_object({}) { |c, memo| memo[c] = record.read_attribute(c) }
+          JSON.generate(payload)
+        end
+      end
+
+      def decode_columns(cols, id, separator)
+        if cols.size == 1
+          {cols.first => id.to_s}
+        elsif separator
+          parts = id.to_s.split(separator, cols.size)
+          raise ArgumentError, "identity id segment count mismatch" if parts.size != cols.size
+
+          cols.zip(parts).to_h
+        else
+          parsed = JSON.parse(id.to_s)
+          raise ArgumentError, "composite id must be a JSON object" unless parsed.is_a?(Hash)
+
+          parsed.stringify_keys.slice(*cols)
+        end
+      end
+
+      def field_kw_to_param_hash(aa_res, id:, **kw)
+        return ActiveAdmin::PrimaryKey.field_kw_to_param_hash(aa_res.resource_class, id: id, **kw) unless configured?(aa_res)
+
+        raise ArgumentError, "id is required" if id.blank?
+
+        {"id" => id.to_s}
+      end
+
+      def member_param_hash(aa_res, blob)
+        return ActiveAdmin::PrimaryKey.member_param_hash(aa_res.resource_class, blob) unless configured?(aa_res)
+
+        blob = blob.stringify_keys
+        raise ArgumentError, "id is required" if blob["id"].blank?
+
+        {"id" => blob["id"].to_s}
+      end
+
+      def stringify_attrs(hash)
+        raise ArgumentError, "identity decode must return a Hash" unless hash.is_a?(Hash)
+
+        hash.stringify_keys.transform_values { |value| value&.to_s }
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/resource_methods.rb

@@ -7,7 +7,13 @@ module ActiveAdmin
         SERVER_OWNED_TIMESTAMP_COLUMNS = %w[created_at updated_at].freeze
 
         def graphql_config
-          @graphql_config ||= ActiveAdmin::GraphQL::ResourceConfig.new
+          @graphql_config ||= ActiveAdmin::GraphQL::ResourceConfig.new(
+            enabled: namespace.graphql_resource_enabled_default,
+            queries_enabled: namespace.graphql_queries_enabled_default,
+            mutations_enabled: namespace.graphql_mutations_enabled_default,
+            run_actions_enabled: namespace.graphql_run_actions_enabled_default,
+            policies_enabled: namespace.graphql_policies_enabled_default
+          )
         end
 
         def attributes_for_graphql
@@ -22,7 +28,7 @@ module ActiveAdmin
 
         def graphql_assignable_attribute_names
           names = attributes_for_graphql.map(&:to_s)
-          pk_cols = ActiveAdmin::PrimaryKey.columns(resource_class)
+          pk_cols = ActiveAdmin::GraphQL::ResourceIdentity.columns(self)
           return names if pk_cols.size > 1
 
           names - pk_cols

data/lib/active_admin/graphql/resource_query_proxy/identity.rb

@@ -6,11 +6,11 @@ module ActiveAdmin
       module Identity
         private
 
-        def find_inferred_member(controller, model, id)
-          primary_key = ActiveAdmin::PrimaryKey.columns(model).first
-          raise ActiveRecord::RecordNotFound unless primary_key
+        def find_identity_member(controller, model, id)
+          attrs = ActiveAdmin::GraphQL::ResourceIdentity.attributes_for_id(@aa_resource, id)
+          raise ActiveRecord::RecordNotFound if attrs.blank?
 
-          records = controller.send(:scoped_collection).where(primary_key => id).limit(2).to_a
+          records = controller.send(:scoped_collection).where(attrs).limit(2).to_a
           raise_ambiguous_id!(model) if records.size > 1
 
           records.first || raise(ActiveRecord::RecordNotFound)

data/lib/active_admin/graphql/resource_query_proxy.rb

@@ -31,8 +31,8 @@ module ActiveAdmin
         finder = controller.send(:method_for_find)
         return controller.send(:find_resource) if model.primary_key.present? || finder != :find
 
-        find_inferred_member(controller, model, extra.fetch("id"))
-      rescue ActiveRecord::RecordNotFound
+        find_identity_member(controller, model, extra.fetch("id"))
+      rescue ActiveRecord::RecordNotFound, ArgumentError
         nil
       end
 
@@ -41,13 +41,14 @@ module ActiveAdmin
         return {} if string_ids.empty?
 
         model = @aa_resource.resource_class
-        if ActiveAdmin::PrimaryKey.composite?(model)
+        identity_cols = ActiveAdmin::GraphQL::ResourceIdentity.columns(@aa_resource)
+        if ActiveAdmin::PrimaryKey.composite?(model) || identity_cols.size > 1
           return string_ids.index_with { |identifier| find_member(identifier) }
         end
 
         controller = controller_for("index")
         relation = controller.send(:apply_authorization_scope, controller.send(:scoped_collection))
-        primary_key = ActiveAdmin::PrimaryKey.columns(model).first&.to_sym
+        primary_key = identity_cols.first&.to_sym
         return string_ids.index_with { nil } if primary_key.nil?
 
         indexed = index_records_by_id(relation.where(primary_key => string_ids), model, primary_key)

data/lib/active_admin/graphql/resource_surface_dsl.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    # Inclusion and schema-surface toggles for +graphql do ... end+.
+    module ResourceSurfaceDSL
+      def enable!
+        @config.enabled = true
+      end
+
+      def disable!
+        @config.enabled = false
+      end
+
+      def enable_queries!
+        @config.queries_enabled = true
+      end
+
+      def disable_queries!
+        @config.queries_enabled = false
+      end
+
+      def enable_mutations!
+        @config.mutations_enabled = true
+      end
+
+      def disable_mutations!
+        @config.mutations_enabled = false
+      end
+
+      def enable_run_actions!
+        @config.run_actions_enabled = true
+      end
+
+      def disable_run_actions!
+        @config.run_actions_enabled = false
+      end
+
+      def enable_policies!
+        @config.policies_enabled = true
+      end
+
+      def disable_policies!
+        @config.policies_enabled = false
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/schema_builder/build.rb

@@ -25,7 +25,8 @@ module ActiveAdmin
             @aa_by_graphql_type_name[graphql_type_name_for(aa_res)] = aa_res
           end
 
-          wire_belongs_to_associations
+          wire_belongs_to_associations if @namespace.graphql_belongs_to_associations_enabled
+          verify_field_capabilities!
 
           active_resources.each do |aa_res|
             model = aa_res.resource_class
@@ -35,9 +36,10 @@ module ActiveAdmin
             @find_input_types[model] = build_find_input_type(aa_res)
           end
 
-          union_members = @object_types.values.uniq
+          queryable = queryable_resources
+          union_members = queryable.filter_map { |aa_res| @object_types[aa_res.resource_class] }.uniq
           registered_resource_union =
-            if union_members.any?
+            if @namespace.graphql_registered_resource_enabled && union_members.any?
               u = Class.new(::GraphQL::Schema::Union) do
                 graphql_name "ActiveAdminRegisteredResource"
                 description "Any resource object type registered for GraphQL in this namespace."
@@ -47,10 +49,12 @@ module ActiveAdmin
               u
             end
 
+          ensure_query_surface!(registered_resource_union: registered_resource_union)
           query_type = build_query_type(registered_resource_union: registered_resource_union)
           mutation_type = build_mutation_type
 
           model_to_type = @object_types
+          queryable_models = queryable.map(&:resource_class)
 
           schema = Class.new(::GraphQL::Schema)
           schema.query(query_type)
@@ -61,6 +65,11 @@ module ActiveAdmin
           if registered_resource_union
             schema.define_singleton_method(:resolve_type) do |abstract_type, obj, ctx|
               if abstract_type == registered_resource_union
+                unless queryable_models.include?(obj.class)
+                  raise ::GraphQL::ExecutionError,
+                    "ActiveAdminRegisteredResource could not resolve type for #{obj.class.name}"
+                end
+
                 typ = model_to_type[obj.class]
                 unless typ
                   raise ::GraphQL::ExecutionError,
@@ -78,6 +87,46 @@ module ActiveAdmin
           hook.call(schema) if hook.respond_to?(:call)
           schema
         end
+
+        private
+
+        def ensure_query_surface!(registered_resource_union:)
+          return if registered_resource_union
+          return if queryable_resources.any?
+          return if policy_adapter
+          return if namespace_page_graphql_fields?
+
+          raise ActiveAdmin::DependencyError,
+            "GraphQL Query type has no fields for namespace #{@namespace.name.inspect}. " \
+            "Enable list/show (graphql_queries_enabled_default / enable_queries!), " \
+            "policies (graphql_policies_enabled), registered_resource, " \
+            "or a page graphql_field — or turn off graphql for this namespace."
+        end
+
+        def namespace_page_graphql_fields?
+          @namespace.resources.any? do |resource|
+            resource.is_a?(ActiveAdmin::Page) && resource.graphql_fields.any?
+          end
+        end
+
+        def verify_field_capabilities!
+          @object_types.each do |model, type_class|
+            aa_res = @aa_by_model[model]
+            next unless aa_res
+
+            declared = aa_res.graphql_config.field_capabilities.keys
+            next if declared.empty?
+
+            present = type_class.own_fields.keys.map { |name| name.to_s.to_sym }
+            unknown = declared - present
+            next if unknown.empty?
+
+            raise ActiveAdmin::DependencyError,
+              "GraphQL capability fields #{unknown.map(&:inspect).join(", ")} are not on " \
+              "#{type_class.graphql_name} (resource #{aa_res.resource_name}). " \
+              "Use a generated attribute, belongs_to association, or configure field name."
+          end
+        end
       end
     end
   end

data/lib/active_admin/graphql/schema_builder/mutation_batch.rb

@@ -15,6 +15,7 @@ module ActiveAdmin
           proc do
             field fname.to_sym, batch_payload_t, null: false, camelize: false,
               visibility: {kind: :mutation_batch_action, graphql_type_name: sb.send(:graphql_type_name_for, aa_res), resource: aa_res, field_name: fname},
+              capability: aa_res.graphql_config.capability_for_mutation(:batch_action),
               description: "Run a batch action registered on #{aa_res.resource_name} (+batch_action+ DSL), " \
                     "same as the index batch UI (+collection_selection+ / +batch_action_inputs+)." do
               argument :batch_action, ::GraphQL::Types::String, required: true, camelize: false
@@ -39,6 +40,12 @@ module ActiveAdmin
               unless allowed.include?(ba)
                 raise ::GraphQL::ExecutionError, "Unknown batch_action #{ba.inspect} for #{plural}"
               end
+              unless Capability.granted?(
+                context,
+                aa_res.graphql_config.capability_for_mutation(:"batch_#{ba.tr("-", "_")}")
+              )
+                raise ::GraphQL::ExecutionError, "not authorized for batch action #{ba}"
+              end
 
               max_ids = ns.graphql_batch_action_max_ids
               if max_ids.is_a?(Integer) && max_ids.positive? && ids.size > max_ids

data/lib/active_admin/graphql/schema_builder/mutation_collection.rb

@@ -21,6 +21,7 @@ module ActiveAdmin
           proc do
             field fname.to_sym, collection_payload_t, null: false, camelize: false,
               visibility: {kind: :mutation_collection_action, graphql_type_name: sb.send(:graphql_type_name_for, aa_res), resource: aa_res, field_name: fname, aggregate: true},
+              capability: aa_res.graphql_config.capability_for_mutation(:collection_action),
               description: "Invoke a +collection_action+ on #{aa_res.resource_name} by name (same scoping as REST +index+). Prefer per-action fields +#{plural}_collection_<action>+ for distinct inputs or return types." do
               argument :action, ::GraphQL::Types::String, required: true, camelize: false
               argument :params, [KeyValuePairInput], required: false, camelize: false,
@@ -43,6 +44,12 @@ module ActiveAdmin
               unless allowed.include?(act)
                 raise ::GraphQL::ExecutionError, "Unknown collection action #{act.inspect} for #{plural}"
               end
+              unless Capability.granted?(
+                context,
+                aa_res.graphql_config.capability_for_mutation(:"collection_#{act.tr("-", "_")}")
+              )
+                raise ::GraphQL::ExecutionError, "not authorized for collection action #{act}"
+              end
 
               proxy = ResourceQueryProxy.new(
                 aa_resource: aa_res,
@@ -79,6 +86,7 @@ module ActiveAdmin
                 field_name: field_name,
                 collection_action: action_name
               },
+              capability: aa_res.graphql_config.capability_for_mutation(:"collection_#{action_name.tr("-", "_")}"),
               description: "Invoke +collection_action+ #{action_name} on #{aa_res.resource_name} (same scoping as REST +index+)." do
               argument :params, [KeyValuePairInput], required: false, camelize: false,
                 description: "Extra request params as flat key/value pairs."

data/lib/active_admin/graphql/schema_builder/mutation_create.rb

@@ -13,6 +13,7 @@ module ActiveAdmin
           proc do
             field fname.to_sym, type_c, null: true, camelize: false,
               visibility: {kind: :mutation_create, graphql_type_name: sb.send(:graphql_type_name_for, aa_res), resource: aa_res},
+              capability: aa_res.graphql_config.capability_for_mutation(:create),
               description: "Create #{model.name}" do
               argument :input, create_input, required: true, camelize: false
             end

data/lib/active_admin/graphql/schema_builder/mutation_member.rb

@@ -21,6 +21,7 @@ module ActiveAdmin
           proc do
             field fname.to_sym, member_payload_t, null: false, camelize: false,
               visibility: {kind: :mutation_member_action, graphql_type_name: sb.send(:graphql_type_name_for, aa_res), resource: aa_res, field_name: fname, aggregate: true},
+              capability: aa_res.graphql_config.capability_for_mutation(:member_action),
               description: "Invoke a +member_action+ on #{aa_res.resource_name} by name (same scoping as REST +show+). Prefer per-action fields +#{plural}_member_<action>+ for distinct inputs or return types." do
               argument :action, ::GraphQL::Types::String, required: true, camelize: false
               argument :id, ::GraphQL::Types::ID, required: true, camelize: false
@@ -44,6 +45,12 @@ module ActiveAdmin
               unless allowed.include?(act)
                 raise ::GraphQL::ExecutionError, "Unknown member action #{act.inspect} for #{plural}"
               end
+              unless Capability.granted?(
+                context,
+                aa_res.graphql_config.capability_for_mutation(:"member_#{act.tr("-", "_")}")
+              )
+                raise ::GraphQL::ExecutionError, "not authorized for member action #{act}"
+              end
 
               proxy = ResourceQueryProxy.new(
                 aa_resource: aa_res,
@@ -81,6 +88,7 @@ module ActiveAdmin
                 field_name: field_name,
                 member_action: action_name
               },
+              capability: aa_res.graphql_config.capability_for_mutation(:"member_#{action_name.tr("-", "_")}"),
               description: "Invoke +member_action+ #{action_name} on #{aa_res.resource_name} (same scoping as REST +show+)." do
               argument :id, ::GraphQL::Types::ID, required: true, camelize: false
               argument :params, [KeyValuePairInput], required: false, camelize: false,

data/lib/active_admin/graphql/schema_builder/mutation_type_builder.rb

@@ -16,18 +16,23 @@ module ActiveAdmin
             type_c = @object_types[model]
             next unless type_c
 
-            actions = defined_actions_for(aa_res)
-
-            if actions.include?(:create)
-              mutations << mutation_create_field(sb, ns, aa_res, model, type_c)
-            end
-            if actions.include?(:update)
-              mutations << mutation_update_field(sb, ns, aa_res, model, type_c)
-            end
-            if actions.include?(:destroy)
-              mutations << mutation_destroy_field(sb, ns, aa_res, model)
+            cfg = aa_res.graphql_config
+            if cfg.mutations_enabled
+              actions = defined_actions_for(aa_res)
+
+              if actions.include?(:create)
+                mutations << mutation_create_field(sb, ns, aa_res, model, type_c)
+              end
+              if actions.include?(:update)
+                mutations << mutation_update_field(sb, ns, aa_res, model, type_c)
+              end
+              if actions.include?(:destroy)
+                mutations << mutation_destroy_field(sb, ns, aa_res, model)
+              end
             end
 
+            next unless cfg.run_actions_enabled
+
             if aa_res.batch_actions_enabled? && aa_res.batch_actions.any?
               mutations << mutation_batch_field(sb, ns, aa_res)
             end

data/lib/active_admin/graphql/schema_builder/mutation_update_destroy.rb

@@ -14,6 +14,7 @@ module ActiveAdmin
           proc do
             field fname.to_sym, type_c, null: true, camelize: false,
               visibility: {kind: :mutation_update, graphql_type_name: sb.send(:graphql_type_name_for, aa_res), resource: aa_res},
+              capability: aa_res.graphql_config.capability_for_mutation(:update),
               description: "Update #{model.name}" do
               argument :where, find_type, required: true, camelize: false
               argument :input, update_input, required: true, camelize: false
@@ -24,7 +25,7 @@ module ActiveAdmin
               blob = where.to_h.stringify_keys
               graph = sb.graph_params_from_find_blob(aa_res, blob)
               begin
-                rid = ActiveAdmin::PrimaryKey.member_param_hash(model, blob)
+                rid = ActiveAdmin::GraphQL::ResourceIdentity.member_param_hash(aa_res, blob)
               rescue ArgumentError => e
                 raise ::GraphQL::ExecutionError, e.message
               end
@@ -80,6 +81,7 @@ module ActiveAdmin
             [delete_name, destroy_name].each do |fname|
               field fname.to_sym, ::GraphQL::Types::Boolean, null: false, camelize: false,
                 visibility: {kind: :mutation_delete, graphql_type_name: type_basename, resource: aa_res},
+                capability: aa_res.graphql_config.capability_for_mutation(:destroy),
                 description: "Destroy #{model.name}" do
                 argument :where, find_type, required: true, camelize: false
               end
@@ -90,7 +92,7 @@ module ActiveAdmin
               blob = where.to_h.stringify_keys
               graph = sb.graph_params_from_find_blob(aa_res, blob)
               begin
-                rid = ActiveAdmin::PrimaryKey.member_param_hash(model, blob)
+                rid = ActiveAdmin::GraphQL::ResourceIdentity.member_param_hash(aa_res, blob)
               rescue ArgumentError => e
                 raise ::GraphQL::ExecutionError, e.message
               end

data/lib/active_admin/graphql/schema_builder/query_type.rb

@@ -16,6 +16,7 @@ module ActiveAdmin
           aa_by_model = @aa_by_model
           object_types = @object_types
           aa_by_graphql_type_name = @aa_by_graphql_type_name
+          query_type_name_map = aa_by_graphql_type_name_for_queries
           list_filter_input_types = @list_filter_input_types
           find_input_types = @find_input_types
 
@@ -31,7 +32,7 @@ module ActiveAdmin
                 builder: builder,
                 ns: ns,
                 registered_resource_union: registered_resource_union,
-                aa_by_graphql_type_name: aa_by_graphql_type_name
+                aa_by_graphql_type_name: query_type_name_map
               )
             end
 

data/lib/active_admin/graphql/schema_builder/query_type_collection.rb

@@ -7,6 +7,8 @@ module ActiveAdmin
         def add_model_query_fields!(query_class, builder:, ns:, aa_by_model:, object_types:,
           list_filter_input_types:, find_input_types:)
           aa_by_model.each do |model, aa_res|
+            next unless aa_res.graphql_config.queries_enabled
+
             builder.define_query_collection_field!(
               query_class, model, aa_res, builder, ns, object_types, list_filter_input_types
             )
@@ -32,6 +34,7 @@ module ActiveAdmin
                 field_name: plural_route,
                 resource: aa_res
               },
+              capability: aa_res.graphql_config.capability_for_query(:collection),
               description: "Paginated list of #{model.name} (#{aa_res.resource_name.human}); " \
                 "pass +filter+ or legacy +q+ / +scope+ / +order+ (Ransack +q+ matches the JSON index param). " \
                 "Nested resources require the parent foreign key (same as REST route params)." do

data/lib/active_admin/graphql/schema_builder/query_type_member.rb

@@ -19,6 +19,7 @@ module ActiveAdmin
                 field_name: singular,
                 resource: aa_res
               },
+              capability: aa_res.graphql_config.capability_for_query(:member),
               description: "Find #{model.name} by id (same scoping chain as REST +show+). Use +where+ or legacy +id+." do
               argument :where, find_type, required: false, camelize: false
               if ActiveAdmin::PrimaryKey.composite?(model)
@@ -51,10 +52,12 @@ module ActiveAdmin
                 if where
                   blob = where.to_h.stringify_keys
                   graph = builder.graph_params_from_find_blob(aa_res, blob)
-                  rid = ActiveAdmin::PrimaryKey.member_param_hash(model, blob)
+                  rid = ActiveAdmin::GraphQL::ResourceIdentity.member_param_hash(aa_res, blob)
                 else
                   graph = builder.graph_params_for_mutation(aa_res, kw)
-                  rid = ActiveAdmin::PrimaryKey.field_kw_to_param_hash(model, id: id, **kw)
+                  rid = ActiveAdmin::GraphQL::ResourceIdentity.field_kw_to_param_hash(
+                    aa_res, id: id, **kw
+                  )
                 end
               rescue ArgumentError => e
                 raise ::GraphQL::ExecutionError, e.message

data/lib/active_admin/graphql/schema_builder/query_type_policies.rb

@@ -4,14 +4,10 @@ module ActiveAdmin
   module GraphQL
     class SchemaBuilder
       module QueryTypePolicies
-        POLICY_ACTIONS = {
-          read: ActiveAdmin::Authorization::READ,
-          create: ActiveAdmin::Authorization::CREATE,
-          update: ActiveAdmin::Authorization::UPDATE,
-          destroy: ActiveAdmin::Authorization::DESTROY
-        }.freeze
-
         def add_activeadmin_policies_query_field!(query_class, builder:, ns:, aa_by_graphql_type_name:)
+          adapter = builder.send(:policy_adapter)
+          return unless adapter
+
           resource_policy_type = Class.new(::GraphQL::Schema::Object) do
             graphql_name "ActiveAdminResourcePolicies"
             field :type_name, ::GraphQL::Types::String, null: false, camelize: false
@@ -48,7 +44,9 @@ module ActiveAdmin
             end
 
             define_method(:activeadmin_policies) do
-              resources = builder.send(:active_resources).map do |aa_res|
+              resources = builder.send(:active_resources).filter_map do |aa_res|
+                next unless adapter.include_resource?(aa_res)
+
                 {
                   type_name: builder.send(:graphql_type_name_for, aa_res),
                   activeadmin_policies: ActiveAdmin::GraphQL::PolicySetCache.fetch(
@@ -74,6 +72,9 @@ module ActiveAdmin
             define_method(:activeadmin_policies_for) do |type_name:, ids:, path: nil|
               aa_res = aa_by_graphql_type_name[type_name.to_s]
               raise ::GraphQL::ExecutionError, "unknown resource type_name #{type_name.inspect}" unless aa_res
+              unless adapter.include_resource?(aa_res)
+                raise ::GraphQL::ExecutionError, "policies disabled for #{type_name.inspect}"
+              end
 
               proxy = ResourceQueryProxy.new(
                 aa_resource: aa_res,
@@ -99,61 +100,6 @@ module ActiveAdmin
             end
           end
         end
-
-        private
-
-        def policy_action_pairs
-          hook = @namespace.graphql_policy_actions
-          if hook.respond_to?(:call)
-            raw = hook.call(@namespace)
-            return raw.to_h.transform_keys(&:to_sym) if raw.respond_to?(:to_h)
-          end
-          POLICY_ACTIONS
-        end
-
-        def allowed_base_actions(auth:, subject_owner:, subject:, context:)
-          action_mapper = @namespace.graphql_policy_action_mapper
-          policy_action_pairs.each_with_object([]) do |(name, default_action), out|
-            allowed = if action_mapper.respond_to?(:call)
-              action_mapper.call(context, subject_owner, subject, name, default_action)
-            else
-              auth.authorized?(subject_owner, default_action, subject)
-            end
-            out << name.to_s if allowed
-          end
-        end
-
-        def build_policy_set(auth:, subject_owner:, subject:, context:)
-          base = {
-            allowed_actions: allowed_base_actions(auth: auth, subject_owner: subject_owner, subject: subject, context: context),
-            allowed_member_actions: [],
-            allowed_collection_actions: [],
-            allowed_batch_actions: []
-          }
-
-          if subject_owner.is_a?(ActiveAdmin::Resource)
-            class_subject = subject_owner.resource_class
-            if subject.is_a?(Class)
-              if auth.authorized?(subject_owner, ActiveAdmin::Authorization::READ, class_subject)
-                base[:allowed_member_actions] = subject_owner.member_actions.map { |a| a.name.to_s }
-                base[:allowed_collection_actions] = subject_owner.collection_actions.map { |a| a.name.to_s }
-                base[:allowed_batch_actions] = subject_owner.batch_actions.map { |a| a.sym.to_s }
-              end
-            elsif auth.authorized?(subject_owner, ActiveAdmin::Authorization::READ, subject)
-              base[:allowed_member_actions] = subject_owner.member_actions.map { |a| a.name.to_s }
-            end
-          end
-
-          if (extra = @namespace.graphql_policy_extra).respond_to?(:call)
-            out = extra.call(context, subject_owner, subject, base)
-            base = out if out.is_a?(Hash)
-          end
-          if (transform = @namespace.graphql_policy_transform).respond_to?(:call)
-            out = transform.call(context, subject_owner, subject, base)
-            base = out if out.is_a?(Hash)
-          end
-          base
-        end
       end
     end
   end

data/lib/active_admin/graphql/schema_builder/resources.rb

@@ -28,6 +28,40 @@ module ActiveAdmin
           aa_res.attributes_for_graphql
         end
 
+        # +nil+ when policy fields are off (+graphql_policies_enabled+ false).
+        def policy_adapter
+          return @policy_adapter if defined?(@policy_adapter)
+
+          unless @namespace.graphql_policies_enabled
+            @policy_adapter = nil
+            return @policy_adapter
+          end
+
+          raw = @namespace.graphql_policy_adapter
+          klass = case raw
+          when nil, true, :default
+            PolicyAdapter
+          when String
+            raw.constantize
+          when Class
+            raw
+          else
+            raise ActiveAdmin::DependencyError,
+              "graphql_policy_adapter must be a Class, String, or nil (got #{raw.inspect})"
+          end
+          @policy_adapter = klass.new(namespace: @namespace)
+        end
+
+        def queryable_resources
+          active_resources.select { |r| r.graphql_config.queries_enabled }
+        end
+
+        def aa_by_graphql_type_name_for_queries
+          queryable_resources.each_with_object({}) do |aa_res, map|
+            map[graphql_type_name_for(aa_res)] = aa_res
+          end
+        end
+
         def configure_schema_plugins(schema)
           if (c = @namespace.graphql_max_complexity)
             schema.max_complexity(c)