activeadmin-graphql 0.3.2 → 0.3.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 95e56a00a0c78ea55f44c186012af72c1ba6ff80ada2adbf905ce9b2d190c47d
-  data.tar.gz: 1e1dc89e1ffd41d05c6f2962a83857188a239ba677e6f492dbc304a09bb123b9
+  metadata.gz: 36bec145bd90193ae32e34aa54b7a6ed01dff13a8b104269b771f797262b2480
+  data.tar.gz: 82724e08af33a67a1a9146813965e5d836006620ff503099842addcdeaab16cb
 SHA512:
-  metadata.gz: 02533503de4c86355e28bc7212115b043a9d7da293db40d1134251f7892539fca8257d6c03140c110d12da8e4de1b4112668c7e6fc2d721273c990d9fff930e3
-  data.tar.gz: 6e13f9a69b6cc7df900cf9883ab60600be21bfea50196209c7324306030d74784cb3e66082ffc3ec225192c3c0c385fffb3f24840061e9f12415b60479de9d3c
+  metadata.gz: 0b9ddc6e9d85447807e5cbbf9d1e5c9b5c87b756eaa8325cb57fe8ce291e221b40e1afd200ddb683a73cba036b83b6eac6f8f5ab3e0ff9788c1864e7f550cc16
+  data.tar.gz: 806443d03640f31e48d893998cd9f693bafd5efce162798ff406ed2eee2ad43d7c0c588467b8fbd37fdab4a3a6049a9efcbadffbe337469cac7bc5ff958bf36f

data/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## Unreleased
 
+## 0.3.3 (2026-10-12)
+
+- Add `graphql { capability ... }` and namespace `graphql_capabilities` so one named grant can gate many fields, queries, and mutations (RFC 0008).
+- Apply `fields:` capabilities to wired `belongs_to` associations; reject unknown capability field names and named visibility `profiles:` combined with `graphql_capabilities`.
+- Add namespace setting `graphql_resource_enabled_default` (`true` by default) and `graphql { enable! }` so apps can opt resources into the schema instead of opting out with `disable!`.
+- Add namespace toggles for `registered_resource` and `belongs_to` wiring (`graphql_registered_resource_enabled`, `graphql_belongs_to_associations_enabled`; both `true` by default).
+- Add `graphql_policies_enabled` / `graphql_policies_enabled_default` for policy field publishing and per-resource seeds, plus `graphql_policy_adapter` (default `ActiveAdmin::GraphQL::PolicyAdapter`) for payload construction.
+- Add per-resource surface defaults and DSL (`graphql_queries_enabled_default`, `graphql_mutations_enabled_default`, `graphql_run_actions_enabled_default`, plus `enable_*!` / `disable_*!`) so apps can trim list/show, CRUD, run-action, and policy fields without disabling the whole resource.
+- Treat `queries_enabled` as the read surface: omit `registered_resource` union membership when queries are off; fail schema build when `Query` would have no fields.
+
 ## 0.3.2 (2026-10-10)
 
 - Add `graphql { identity ... }` so keyless views can declare GraphQL id columns, optional `separator`, and `encode` / `decode` (RFC 0007).

data/app/controllers/active_admin/graphql_controller.rb

@@ -51,16 +51,31 @@ module ActiveAdmin
 
     def graphql_context
       ns = active_admin_namespace
-      {
+      context = {
         auth: ActiveAdmin::GraphQL::AuthContext.new(
           user: current_active_admin_user,
           namespace: ns
         ),
         namespace: ns,
         request: request,
-        current_user: current_active_admin_user,
-        visibility_profile: graphql_visibility_profile_for(ns)
-      }.compact
+        current_user: current_active_admin_user
+      }
+      # Named visibility profiles cache a fixed context; per-request capabilities
+      # need the live request context (dynamic visibility). Skip the profile key.
+      unless ns.graphql_capabilities.respond_to?(:call)
+        profile = graphql_visibility_profile_for(ns)
+        context[:visibility_profile] = profile if profile
+      end
+      capabilities = graphql_capabilities_for(ns, context)
+      context[:capabilities] = capabilities unless capabilities.nil?
+      context
+    end
+
+    def graphql_capabilities_for(ns, context)
+      hook = ns.graphql_capabilities
+      return nil unless hook.respond_to?(:call)
+
+      ActiveAdmin::GraphQL::Capability.normalize_set(hook.call(context))
     end
 
     def graphql_visibility_profile_for(ns)

data/docs/changelogs/20261010091415_graphql-resource-enabled-default.md

@@ -0,0 +1,34 @@
+# GraphQL resource enabled default
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+Add namespace setting `graphql_resource_enabled_default`, default `true`, so
+0.3.x behavior stays: turning on the namespace endpoint still includes every
+ActiveRecord resource unless `graphql { disable! }` is set.
+
+Apps that want support-style opt-in set the setting to `false`. Then a resource
+enters the schema only when registration runs `graphql { }` or
+`graphql { enable! }`. `disable!` still omits.
+
+`ResourceConfig` takes the initial `enabled` flag from the namespace setting.
+Entering a `graphql` block sets `enabled = true` before the block body runs so
+an empty block is a conscious opt-in.
+
+## Effects
+
+New request specs cover default true, default false without a block, empty
+block, `enable!`, and `disable!`.
+
+## Next
+
+Folded into 0.3.3 release metadata.
+
+## Source
+
+CHANGELOG 0.3.3. docs/graphql-api.md namespace settings and per-resource
+DSL. spec/requests/graphql_resource_enabled_default_spec.rb.
+docs/changelogs/20261012113500_release-0-3-3.md.

data/docs/changelogs/20261012050051_graphql-surface-toggles.md

@@ -0,0 +1,40 @@
+# GraphQL surface toggles
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+Add namespace and per-resource controls for schema surfaces that were always on
+once a resource was enabled. Defaults stay `true` so 0.3.x behavior is
+unchanged.
+
+Namespace-only switches: `graphql_registered_resource_enabled`,
+`graphql_belongs_to_associations_enabled`, `graphql_policies_enabled`.
+Policy payloads use `graphql_policy_adapter` (default `PolicyAdapter`).
+Per-resource policy seed is `graphql_policies_enabled_default`.
+
+Per-resource seeds from namespace defaults: queries, mutations (CRUD),
+run-actions, and policies. Resource DSL exposes matching `enable_*!` /
+`disable_*!` methods. `queries_enabled` also gates `registered_resource`
+membership. Schema build raises if `Query` would have no fields.
+
+## Effects
+
+Schema builder skips policy query fields, registered_resource union, belongs_to
+wiring, list/show fields, CRUD mutations, and run-action mutations when the
+matching flag is off. Request specs cover the new settings and DSL, including
+empty-Query rejection and registered_resource gating by queries.
+
+## Next
+
+Folded into 0.3.3 release metadata.
+
+## Source
+
+CHANGELOG 0.3.3. docs/graphql-api.md.
+spec/requests/graphql_surface_toggles_spec.rb.
+spec/requests/graphql_policy_surface_spec.rb.
+spec/requests/graphql_query_surface_contract_spec.rb.
+docs/changelogs/20261012113500_release-0-3-3.md.

data/docs/changelogs/20261012064500_graphql-capabilities.md

@@ -0,0 +1,35 @@
+# GraphQL capabilities
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+Add RFC 0008 capability grants. Resource DSL `capability` associates many
+object fields, queries, and mutations with one name. Namespace
+`graphql_capabilities` fills `context[:capabilities]` per request. SchemaField
+checks capability in `visible?` and `authorized?`. Capabilities do not replace
+ActiveAdmin authorization. Subscriptions stay out of scope.
+
+## Effects
+
+Gated members fail closed without the grant. With `graphql_visibility`,
+introspection omits them. Aggregate run-action resolvers also check
+per-action capability keys (`member_*`, `batch_*`, `collection_*`).
+`belongs_to` association fields honor `fields:` capabilities. Schema build
+rejects unknown capability field names and rejects named visibility profiles
+combined with `graphql_capabilities` (dynamic visibility required).
+
+## Next
+
+Folded into 0.3.3 release metadata. Follow-ons remain: policy payloads listing
+field capabilities, mutation input attribute maps, and transport gates if
+subscriptions ship later.
+
+## Source
+
+RFC 0008. CHANGELOG 0.3.3. docs/graphql-api.md. spec/unit/capability_spec.rb,
+spec/unit/capability_dsl_spec.rb, spec/requests/graphql_capabilities_spec.rb,
+spec/requests/graphql_capabilities_edge_spec.rb.
+docs/changelogs/20261012113500_release-0-3-3.md.

data/docs/changelogs/20261012113500_release-0-3-3.md

@@ -0,0 +1,45 @@
+# Release 0.3.3 metadata
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+Cut 0.3.3 after published 0.3.2. User-visible work since the 0.3.2 tag:
+`graphql_resource_enabled_default` and `enable!` opt-in, surface toggles for
+queries, mutations, run-actions, policies, `registered_resource`, and
+`belongs_to`, plus GraphQL capabilities (RFC 0008). Defaults stay `true` so
+0.3.x schema shape is unchanged unless an app opts in to narrower surfaces.
+
+CHANGELOG Unreleased bullets moved under 0.3.3 dated 2026-10-12.
+
+Version constant is 0.3.3. Path gem pins in Gemfile.lock and appraisal
+lockfiles match.
+
+Internal `stringify_attrs` safe-navigation cleanup stays out of CHANGELOG.md.
+
+make release (usr/bin/release.rb) still owns gem build, gem push, git tag, and
+GitHub release. This pass only prepares metadata.
+
+## Effects
+
+lib/active_admin/graphql/version.rb VERSION is 0.3.3.
+
+CHANGELOG surface-toggle and capability bullets live under 0.3.3.
+
+PATH specs for activeadmin-graphql in Gemfile.lock,
+gemfiles/rails72.gemfile.lock, gemfiles/rails8ruby4.gemfile.lock, and
+gemfiles/rails8ruby34.gemfile.lock are 0.3.3.
+
+## Next
+
+Run make release from a clean tree when ready to push the gem and tag 0.3.3.
+
+## Source
+
+docs/changelogs/20261010091415_graphql-resource-enabled-default.md
+docs/changelogs/20261012050051_graphql-surface-toggles.md
+docs/changelogs/20261012064500_graphql-capabilities.md
+rfcs/0008-graphql-capabilities.md
+usr/bin/release.rb

data/docs/graphql-api.md

@@ -33,6 +33,12 @@ ActiveAdmin.setup do |config|
     admin.graphql = true
     # Optional — default is "graphql", i.e. POST /admin/graphql
     # admin.graphql_path = "graphql"
+    # Optional — set false so only resources with a graphql block enter the schema
+    # admin.graphql_resource_enabled_default = false
+    # Optional — trim always-on surfaces for a narrow API
+    # admin.graphql_policies_enabled = false
+    # admin.graphql_registered_resource_enabled = false
+    # admin.graphql_belongs_to_associations_enabled = false
   end
 end
 ```
@@ -45,6 +51,33 @@ Run `bin/rails active_admin:install` or reload routes if needed so
 Each namespace inherits these options (defaults in parentheses):
 
 * `graphql` — set to `true` to mount the endpoint (`false` by default).
+* `graphql_resource_enabled_default` — whether each registered ActiveRecord
+  resource is included in the schema without a `graphql` block (`true` by
+  default, matching 0.3.x). Set to `false` for opt-in: only resources that call
+  `graphql { }` (or `graphql { enable! }`) appear in the schema. `disable!`
+  still omits a resource.
+* `graphql_queries_enabled_default` — seed for per-resource read fields
+  (`true` by default): named list/show fields and membership in
+  `registered_resource` / `ActiveAdminRegisteredResource`. Set `false` and use
+  `enable_queries!` for opt-in reads. Object types may still exist for mutations.
+* `graphql_mutations_enabled_default` — seed for per-resource CRUD mutations
+  (`true` by default). Set `false` and use `enable_mutations!` for opt-in writes.
+* `graphql_run_actions_enabled_default` — seed for batch/member/collection
+  action mutations (`true` by default).
+* `graphql_policies_enabled` — publish `activeadmin_policies` query fields and
+  allow per-object policy fields (`true` by default).
+* `graphql_policies_enabled_default` — seed for per-resource `policies_enabled`
+  (`true` by default). Use `enable_policies!` / `disable_policies!` per resource.
+* `graphql_policy_adapter` — class that builds `activeadmin_policies` payloads
+  (`ActiveAdmin::GraphQL::PolicyAdapter` by default). Set a subclass (or constant
+  `String`) to replace payload logic; the default adapter still honors
+  `graphql_policy_actions` / `graphql_policy_action_mapper` /
+  `graphql_policy_extra` / `graphql_policy_transform`.
+* `graphql_registered_resource_enabled` — include `registered_resource` and the
+  `ActiveAdminRegisteredResource` union when at least one queryable resource
+  exists (`true` by default).
+* `graphql_belongs_to_associations_enabled` — wire non-polymorphic `belongs_to`
+  fields between registered resource types (`true` by default).
 * `graphql_path` — path segment under the namespace mount (`"graphql"`).
 * `graphql_multiplex_max` — maximum operations per multiplexed JSON array
   request (`20`).
@@ -70,6 +103,11 @@ Each namespace inherits these options (defaults in parentheses):
   default `context[:visibility_profile]` for each HTTP request (symbols accepted).
 * `graphql_schema_visible` — optional `Proc` `(context, meta) -> Boolean` when
   `graphql_visibility` is enabled; see Schema visibility below.
+* `graphql_capabilities` — optional `Proc` `(context) -> Enumerable` of capability
+  names for the request (RFC 0008). Normalized into `context[:capabilities]`.
+  Cannot be combined with named `graphql_visibility` `profiles:`; schema build
+  forces `dynamic: true` and omits `visibility_profile` from the request context
+  so introspection uses the live capability set.
 * `graphql_configure_schema` — `Proc` receiving the schema class after build
   (extensions, extra types, and so on).
 
@@ -199,21 +237,90 @@ UI, including any `authorize!` or `authorize_resource!` calls.
 
 See the ActiveAdmin guide [Authorization adapter](https://activeadmin.info/13-authorization-adapter) for adapter setup; the same rules apply to GraphQL.
 
+Policy preflight fields (`activeadmin_policies`, `activeadmin_policies_for`, and
+per-object `activeadmin_policies`) are published when `graphql_policies_enabled`
+is true. Payloads come from `graphql_policy_adapter`. The default
+`ActiveAdmin::GraphQL::PolicyAdapter` asks the authorization adapter which
+actions are allowed and applies the optional `graphql_policy_*` hooks. Assign a
+subclass that implements `policy_set` (and optionally `include_resource?`) to
+replace the payload builder.
+
+### Capabilities (RFC 0008)
+
+Associate many object fields, queries, and mutations with one named capability
+inside `graphql do`. The same capability name can cover a mixed set of members:
+
+```ruby
+ActiveAdmin.register Post do
+  graphql do
+    capability :pii do
+      fields :body
+    end
+
+    capability :editor do
+      fields :title
+      queries :index, :show
+      mutations :create, :update, :destroy
+    end
+
+    capability :publish, member_actions: %i[publish]
+  end
+end
+```
+
+Kwargs (`fields:`, `queries:`, `mutations:`, `member_actions:`,
+`batch_actions:`, `collection_actions:`) work without a block. Query aliases:
+`index` / `list` → collection, `show` → member. Mutation alias: `delete` →
+`destroy`. Run-action sugar builds keys like `member_publish`.
+
+Grant capabilities per request with `graphql_capabilities`. Map OAuth scopes or
+roles there; the gem stores a symbol set on `context[:capabilities]`:
+
+```ruby
+admin.graphql_capabilities = lambda { |ctx|
+  Array(ctx[:current_user]&.oauth_scopes)
+}
+```
+
+A gated member fails closed when the capability is missing from that set:
+resolve returns null for the field (graphql-ruby unauthorized field). Enable
+`graphql_visibility` so introspection and validation also omit ungated members.
+`fields:` applies to generated attributes and wired `belongs_to` associations.
+Unknown field names raise at schema build. Capabilities do not replace the
+authorization adapter.
+
+Custom `SchemaField` definitions may pass `capability: :name` the same way.
+Do not use named visibility `profiles:` together with `graphql_capabilities`
+(cached profile context ignores per-request grants).
+
 ## Schema overview
 
-The `Query` type includes one Relay-style connection field per resource route
-(for example `posts`), plus a singular field for a single record (for example
-`post`). Optional `graphql_field` entries on `register_page` appear here too,
-plus `registered_resource` (returning the `ActiveAdminRegisteredResource` union)
-when at least one resource is exposed.
+With the default surface flags (`true`), the `Query` type includes one
+Relay-style connection field per resource route (for example `posts`), plus a
+singular field for a single record (for example `post`). Optional
+`graphql_field` entries on `register_page` appear here too, plus
+`registered_resource` (returning the `ActiveAdminRegisteredResource` union)
+when at least one queryable resource exists.
+
+List and show fields require per-resource `queries_enabled` (seeded from
+`graphql_queries_enabled_default`). Turning queries off still leaves the object
+type available for mutations. `registered_resource` and the union also require
+`graphql_registered_resource_enabled`. Policy preflight fields require
+`graphql_policies_enabled`. Schema build fails when `Query` would have no
+fields: no list/show, no policies, no `registered_resource`, and no page
+`graphql_field`.
 
 Every resource object type implements the `ActiveAdminResource` interface
 (`id: ID!`) so clients can share fragments or rely on a common shape.
+Non-polymorphic `belongs_to` fields between registered types are wired when
+`graphql_belongs_to_associations_enabled` is true.
 
 The `Mutation` type is present when at least one operation exists: per-resource
-`create_*`, `update_*`, and `delete_*` when those controller actions exist, plus
-`*_batch_action`, `*_member_action`, and `*_collection_action` fields when the
-resource defines the corresponding batch, member, or collection actions.
+`create_*`, `update_*`, and `delete_*` when those controller actions exist and
+`mutations_enabled` is true, plus `*_batch_action`, `*_member_action`, and
+`*_collection_action` fields when the resource defines the corresponding batch,
+member, or collection actions and `run_actions_enabled` is true. Both flags are
+seeded from the matching namespace defaults.
 
 Object type names default to the model name (for example `Post`). Typed input
 objects use assignable columns (see the per-resource section below):
@@ -405,7 +512,16 @@ ActiveAdmin.register Post do
 end
 ```
 
+* `enable!` — include this resource when `graphql_resource_enabled_default` is
+  `false`. An empty `graphql` block has the same effect.
 * `disable!` — resource is not included in Query or Mutation.
+* `enable_queries!` / `disable_queries!` — list/show fields and
+  `registered_resource` membership for this resource.
+* `enable_mutations!` / `disable_mutations!` — create/update/delete mutations.
+* `enable_run_actions!` / `disable_run_actions!` — batch/member/collection
+  action mutations.
+* `enable_policies!` / `disable_policies!` — object `activeadmin_policies` and
+  inclusion in the `activeadmin_policies` resources matrix.
 * `identity` — declare GraphQL id columns (and optional `separator`, `encode`,
   `decode`) when the model has no ActiveRecord primary key and no `id` column
   (RFC 0007).

data/lib/active_admin/graphql/capability.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    # Named grants carried in GraphQL +context[:capabilities]+ (RFC 0008).
+    module Capability
+      module_function
+
+      def normalize_set(raw)
+        return nil if raw.nil?
+
+        Set.new(
+          Array(raw).filter_map do |item|
+            next if item.nil?
+
+            name = item.to_s.strip
+            next if name.empty?
+
+            name.to_sym
+          end
+        )
+      end
+
+      def granted?(context, capability_name)
+        return true if capability_name.nil?
+
+        caps = context[:capabilities]
+        return false if caps.nil?
+
+        caps = normalize_set(caps) unless caps.is_a?(Set)
+        caps.include?(capability_name.to_sym)
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/capability_definition_dsl.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    # Block body for +capability :name do ... end+ (RFC 0008).
+    class CapabilityDefinitionDSL
+      QUERY_ALIASES = {
+        index: :collection,
+        list: :collection,
+        show: :member
+      }.freeze
+
+      MUTATION_ALIASES = {
+        delete: :destroy
+      }.freeze
+
+      def initialize(config, capability_name)
+        @config = config
+        @capability_name = capability_name.to_sym
+      end
+
+      def fields(*names)
+        @config.assign_field_capabilities!(@capability_name, names)
+      end
+
+      def queries(*names)
+        keys = names.flatten.map { |name| normalize_query_key(name) }
+        @config.assign_query_capabilities!(@capability_name, keys)
+      end
+
+      def mutations(*names)
+        keys = names.flatten.map { |name| normalize_mutation_key(name) }
+        @config.assign_mutation_capabilities!(@capability_name, keys)
+      end
+
+      def member_actions(*names)
+        keys = names.flatten.map { |name| :"member_#{name.to_s.tr("-", "_")}" }
+        @config.assign_mutation_capabilities!(@capability_name, keys)
+      end
+
+      def batch_actions(*names)
+        keys = names.flatten.map { |name| :"batch_#{name.to_s.tr("-", "_")}" }
+        @config.assign_mutation_capabilities!(@capability_name, keys)
+      end
+
+      def collection_actions(*names)
+        keys = names.flatten.map { |name| :"collection_#{name.to_s.tr("-", "_")}" }
+        @config.assign_mutation_capabilities!(@capability_name, keys)
+      end
+
+      private
+
+      def normalize_query_key(name)
+        key = name.to_sym
+        QUERY_ALIASES.fetch(key, key)
+      end
+
+      def normalize_mutation_key(name)
+        key = name.to_sym
+        MUTATION_ALIASES.fetch(key, key)
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/integration.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require_relative "policy_adapter"
 require_relative "resource_definition_dsl"
 require_relative "resource_methods"
 
@@ -26,12 +27,26 @@ module ActiveAdmin
       def register_namespace_settings!
         ns = ActiveAdmin::NamespaceSettings
         ns.register :graphql, false
+        # true preserves 0.3.x: every ActiveRecord resource is in the schema once the namespace endpoint is on.
+        # Set false for opt-in per resource (empty graphql block or enable!).
+        ns.register :graphql_resource_enabled_default, true
+        ns.register :graphql_queries_enabled_default, true
+        ns.register :graphql_mutations_enabled_default, true
+        ns.register :graphql_run_actions_enabled_default, true
+        ns.register :graphql_policies_enabled, true
+        ns.register :graphql_policies_enabled_default, true
+        # Payload builder for policy fields when graphql_policies_enabled is true.
+        ns.register :graphql_policy_adapter, ActiveAdmin::GraphQL::PolicyAdapter
+        ns.register :graphql_registered_resource_enabled, true
+        ns.register :graphql_belongs_to_associations_enabled, true
         ns.register :graphql_path, "graphql"
         ns.register :graphql_multiplex_max, 20
         ns.register :graphql_dataloader, nil
         ns.register :graphql_visibility, nil
         ns.register :graphql_visibility_profile, nil
         ns.register :graphql_schema_visible, nil
+        # Optional Proc +(context_hash) -> Enumerable+ of capability names (RFC 0008).
+        ns.register :graphql_capabilities, nil
         ns.register :graphql_max_complexity, 300
         ns.register :graphql_max_depth, 18
         ns.register :graphql_batch_action_max_ids, 5000
@@ -64,7 +79,10 @@ module ActiveAdmin
       module ResourceDSLMethods
         def graphql(&block)
           if block
-            ActiveAdmin::GraphQL::ResourceDefinitionDSL.new(config.graphql_config).instance_exec(&block)
+            cfg = config.graphql_config
+            # Presence of a graphql block is an intentional opt-in when the namespace default is false.
+            cfg.enabled = true
+            ActiveAdmin::GraphQL::ResourceDefinitionDSL.new(cfg).instance_exec(&block)
           end
           config.graphql_config
         end

data/lib/active_admin/graphql/policy_adapter.rb

@@ -0,0 +1,94 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    # Builds +activeadmin_policies+ payloads for a namespace.
+    #
+    # Set +graphql_policy_adapter+ to this class (default), another subclass, or a
+    # constant name +String+. Omit policy fields with +graphql_policies_enabled = false+.
+    class PolicyAdapter
+      POLICY_ACTIONS = {
+        read: ActiveAdmin::Authorization::READ,
+        create: ActiveAdmin::Authorization::CREATE,
+        update: ActiveAdmin::Authorization::UPDATE,
+        destroy: ActiveAdmin::Authorization::DESTROY
+      }.freeze
+
+      attr_reader :namespace
+
+      def initialize(namespace:)
+        @namespace = namespace
+      end
+
+      # Whether this resource gets an object +activeadmin_policies+ field and a
+      # row in the +activeadmin_policies+ resources matrix.
+      def include_resource?(aa_resource)
+        aa_resource.graphql_config.policies_enabled
+      end
+
+      def policy_set(auth:, subject_owner:, subject:, context:)
+        base = {
+          allowed_actions: allowed_base_actions(
+            auth: auth,
+            subject_owner: subject_owner,
+            subject: subject,
+            context: context
+          ),
+          allowed_member_actions: [],
+          allowed_collection_actions: [],
+          allowed_batch_actions: []
+        }
+
+        append_resource_action_names!(base, auth: auth, subject_owner: subject_owner, subject: subject)
+
+        if (extra = namespace.graphql_policy_extra).respond_to?(:call)
+          out = extra.call(context, subject_owner, subject, base)
+          base = out if out.is_a?(Hash)
+        end
+        if (transform = namespace.graphql_policy_transform).respond_to?(:call)
+          out = transform.call(context, subject_owner, subject, base)
+          base = out if out.is_a?(Hash)
+        end
+        base
+      end
+
+      private
+
+      def policy_action_pairs
+        hook = namespace.graphql_policy_actions
+        if hook.respond_to?(:call)
+          raw = hook.call(namespace)
+          return raw.to_h.transform_keys(&:to_sym) if raw.respond_to?(:to_h)
+        end
+        POLICY_ACTIONS
+      end
+
+      def allowed_base_actions(auth:, subject_owner:, subject:, context:)
+        action_mapper = namespace.graphql_policy_action_mapper
+        policy_action_pairs.each_with_object([]) do |(name, default_action), out|
+          allowed = if action_mapper.respond_to?(:call)
+            action_mapper.call(context, subject_owner, subject, name, default_action)
+          else
+            auth.authorized?(subject_owner, default_action, subject)
+          end
+          out << name.to_s if allowed
+        end
+      end
+
+      def append_resource_action_names!(base, auth:, subject_owner:, subject:)
+        return unless subject_owner.is_a?(ActiveAdmin::Resource)
+
+        class_subject = subject_owner.resource_class
+        if subject.is_a?(Class)
+          return unless auth.authorized?(subject_owner, ActiveAdmin::Authorization::READ, class_subject)
+
+          base[:allowed_member_actions] = subject_owner.member_actions.map { |a| a.name.to_s }
+          base[:allowed_collection_actions] = subject_owner.collection_actions.map { |a| a.name.to_s }
+          base[:allowed_batch_actions] = subject_owner.batch_actions.map { |a| a.sym.to_s }
+        elsif auth.authorized?(subject_owner, ActiveAdmin::Authorization::READ, subject)
+          base[:allowed_member_actions] = subject_owner.member_actions.map { |a| a.name.to_s }
+        end
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/policy_set_cache.rb

@@ -6,10 +6,11 @@ module ActiveAdmin
     class PolicySetCache
       class << self
         def fetch(context, subject_owner:, subject:)
-          namespace = context[:namespace]
-          unless namespace
-            return policy_builder(context).send(
-              :build_policy_set,
+          adapter = policy_adapter(context)
+          raise ActiveAdmin::DependencyError, "graphql_policy_adapter is disabled" unless adapter
+
+          unless context[:namespace]
+            return adapter.policy_set(
               auth: context[:auth],
               subject_owner: subject_owner,
               subject: subject,
@@ -19,8 +20,7 @@ module ActiveAdmin
 
           cache = context[:policy_set_cache] ||= {}
           key = cache_key(subject_owner, subject)
-          cache[key] ||= policy_builder(context).send(
-            :build_policy_set,
+          cache[key] ||= adapter.policy_set(
             auth: context[:auth],
             subject_owner: subject_owner,
             subject: subject,
@@ -28,6 +28,10 @@ module ActiveAdmin
           )
         end
 
+        def policy_adapter(context)
+          policy_builder(context).send(:policy_adapter)
+        end
+
         def policy_builder(context)
           context[:policy_schema_builder] ||= SchemaBuilder.new(context[:namespace])
         end