activeadmin-graphql 0.3.2 → 0.3.3

data/lib/active_admin/graphql/resource_capability_dsl.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+require_relative "capability_definition_dsl"
+
+module ActiveAdmin
+  module GraphQL
+    # +capability+ entry on {ResourceDefinitionDSL} (RFC 0008).
+    module ResourceCapabilityDSL
+      def capability(
+        name,
+        fields: nil,
+        queries: nil,
+        mutations: nil,
+        member_actions: nil,
+        batch_actions: nil,
+        collection_actions: nil,
+        &block
+      )
+        body = CapabilityDefinitionDSL.new(@config, name)
+        body.fields(*fields) if fields
+        body.queries(*queries) if queries
+        body.mutations(*mutations) if mutations
+        body.member_actions(*member_actions) if member_actions
+        body.batch_actions(*batch_actions) if batch_actions
+        body.collection_actions(*collection_actions) if collection_actions
+        body.instance_exec(&block) if block
+        name.to_sym
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/resource_capability_maps.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    # Capability → member maps on {ResourceConfig} (RFC 0008).
+    module ResourceCapabilityMaps
+      def field_capabilities
+        @field_capabilities ||= {}
+      end
+
+      def query_capabilities
+        @query_capabilities ||= {}
+      end
+
+      def mutation_capabilities
+        @mutation_capabilities ||= {}
+      end
+
+      def capability_for_field(name)
+        field_capabilities[name.to_sym]
+      end
+
+      def capability_for_query(kind)
+        query_capabilities[kind.to_sym]
+      end
+
+      def capability_for_mutation(kind)
+        mutation_capabilities[kind.to_sym]
+      end
+
+      def assign_field_capabilities!(capability_name, names)
+        assign_capabilities!(field_capabilities, capability_name, names, label: "field")
+      end
+
+      def assign_query_capabilities!(capability_name, names)
+        assign_capabilities!(query_capabilities, capability_name, names, label: "query")
+      end
+
+      def assign_mutation_capabilities!(capability_name, names)
+        assign_capabilities!(mutation_capabilities, capability_name, names, label: "mutation")
+      end
+
+      private
+
+      def assign_capabilities!(map, capability_name, names, label:)
+        capability = capability_name.to_sym
+        names.flatten.each do |name|
+          key = name.to_sym
+          existing = map[key]
+          if existing && existing != capability
+            raise ArgumentError,
+              "GraphQL #{label} #{key.inspect} already requires capability #{existing.inspect}"
+          end
+          map[key] = capability
+        end
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/resource_config.rb

@@ -2,12 +2,19 @@
 
 require_relative "run_action_mutation_config"
 require_relative "mutation_input_config"
+require_relative "resource_capability_maps"
 
 module ActiveAdmin
   module GraphQL
     # Per-resource GraphQL options set via +graphql+ in +ActiveAdmin.register+.
     class ResourceConfig
+      include ResourceCapabilityMaps
+
       attr_accessor :enabled
+      attr_accessor :queries_enabled
+      attr_accessor :mutations_enabled
+      attr_accessor :run_actions_enabled
+      attr_accessor :policies_enabled
       attr_accessor :graphql_type_name
       attr_accessor :only_attributes
       attr_accessor :exclude_attributes
@@ -31,8 +38,18 @@ module ActiveAdmin
       # {RunActionMutationConfig#payload_type} is not set. Falls back to {RunActionPayload}.
       attr_accessor :run_action_payload_type
 
-      def initialize
-        @enabled = true
+      def initialize(
+        enabled: true,
+        queries_enabled: true,
+        mutations_enabled: true,
+        run_actions_enabled: true,
+        policies_enabled: true
+      )
+        @enabled = enabled
+        @queries_enabled = queries_enabled
+        @mutations_enabled = mutations_enabled
+        @run_actions_enabled = run_actions_enabled
+        @policies_enabled = policies_enabled
         @exclude_attributes = []
       end
 

data/lib/active_admin/graphql/resource_definition_dsl.rb

@@ -3,19 +3,20 @@
 require_relative "run_action_mutation_config"
 require_relative "run_action_mutation_dsl"
 require_relative "mutation_input_definition_dsl"
+require_relative "resource_surface_dsl"
+require_relative "resource_capability_dsl"
 
 module ActiveAdmin
   module GraphQL
     # DSL for +graphql do ... end+ inside +ActiveAdmin.register+.
     class ResourceDefinitionDSL
+      include ResourceSurfaceDSL
+      include ResourceCapabilityDSL
+
       def initialize(config)
         @config = config
       end
 
-      def disable!
-        @config.enabled = false
-      end
-
       # Declare GraphQL identity columns when ActiveRecord has no primary key / id column.
       # See RFC 0007.
       def identity(*columns, separator: nil, encode: nil, decode: nil)

data/lib/active_admin/graphql/resource_methods.rb

@@ -7,7 +7,13 @@ module ActiveAdmin
         SERVER_OWNED_TIMESTAMP_COLUMNS = %w[created_at updated_at].freeze
 
         def graphql_config
-          @graphql_config ||= ActiveAdmin::GraphQL::ResourceConfig.new
+          @graphql_config ||= ActiveAdmin::GraphQL::ResourceConfig.new(
+            enabled: namespace.graphql_resource_enabled_default,
+            queries_enabled: namespace.graphql_queries_enabled_default,
+            mutations_enabled: namespace.graphql_mutations_enabled_default,
+            run_actions_enabled: namespace.graphql_run_actions_enabled_default,
+            policies_enabled: namespace.graphql_policies_enabled_default
+          )
         end
 
         def attributes_for_graphql

data/lib/active_admin/graphql/resource_surface_dsl.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    # Inclusion and schema-surface toggles for +graphql do ... end+.
+    module ResourceSurfaceDSL
+      def enable!
+        @config.enabled = true
+      end
+
+      def disable!
+        @config.enabled = false
+      end
+
+      def enable_queries!
+        @config.queries_enabled = true
+      end
+
+      def disable_queries!
+        @config.queries_enabled = false
+      end
+
+      def enable_mutations!
+        @config.mutations_enabled = true
+      end
+
+      def disable_mutations!
+        @config.mutations_enabled = false
+      end
+
+      def enable_run_actions!
+        @config.run_actions_enabled = true
+      end
+
+      def disable_run_actions!
+        @config.run_actions_enabled = false
+      end
+
+      def enable_policies!
+        @config.policies_enabled = true
+      end
+
+      def disable_policies!
+        @config.policies_enabled = false
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/schema_builder/build.rb

@@ -25,7 +25,8 @@ module ActiveAdmin
             @aa_by_graphql_type_name[graphql_type_name_for(aa_res)] = aa_res
           end
 
-          wire_belongs_to_associations
+          wire_belongs_to_associations if @namespace.graphql_belongs_to_associations_enabled
+          verify_field_capabilities!
 
           active_resources.each do |aa_res|
             model = aa_res.resource_class
@@ -35,9 +36,10 @@ module ActiveAdmin
             @find_input_types[model] = build_find_input_type(aa_res)
           end
 
-          union_members = @object_types.values.uniq
+          queryable = queryable_resources
+          union_members = queryable.filter_map { |aa_res| @object_types[aa_res.resource_class] }.uniq
           registered_resource_union =
-            if union_members.any?
+            if @namespace.graphql_registered_resource_enabled && union_members.any?
               u = Class.new(::GraphQL::Schema::Union) do
                 graphql_name "ActiveAdminRegisteredResource"
                 description "Any resource object type registered for GraphQL in this namespace."
@@ -47,10 +49,12 @@ module ActiveAdmin
               u
             end
 
+          ensure_query_surface!(registered_resource_union: registered_resource_union)
           query_type = build_query_type(registered_resource_union: registered_resource_union)
           mutation_type = build_mutation_type
 
           model_to_type = @object_types
+          queryable_models = queryable.map(&:resource_class)
 
           schema = Class.new(::GraphQL::Schema)
           schema.query(query_type)
@@ -61,6 +65,11 @@ module ActiveAdmin
           if registered_resource_union
             schema.define_singleton_method(:resolve_type) do |abstract_type, obj, ctx|
               if abstract_type == registered_resource_union
+                unless queryable_models.include?(obj.class)
+                  raise ::GraphQL::ExecutionError,
+                    "ActiveAdminRegisteredResource could not resolve type for #{obj.class.name}"
+                end
+
                 typ = model_to_type[obj.class]
                 unless typ
                   raise ::GraphQL::ExecutionError,
@@ -78,6 +87,46 @@ module ActiveAdmin
           hook.call(schema) if hook.respond_to?(:call)
           schema
         end
+
+        private
+
+        def ensure_query_surface!(registered_resource_union:)
+          return if registered_resource_union
+          return if queryable_resources.any?
+          return if policy_adapter
+          return if namespace_page_graphql_fields?
+
+          raise ActiveAdmin::DependencyError,
+            "GraphQL Query type has no fields for namespace #{@namespace.name.inspect}. " \
+            "Enable list/show (graphql_queries_enabled_default / enable_queries!), " \
+            "policies (graphql_policies_enabled), registered_resource, " \
+            "or a page graphql_field — or turn off graphql for this namespace."
+        end
+
+        def namespace_page_graphql_fields?
+          @namespace.resources.any? do |resource|
+            resource.is_a?(ActiveAdmin::Page) && resource.graphql_fields.any?
+          end
+        end
+
+        def verify_field_capabilities!
+          @object_types.each do |model, type_class|
+            aa_res = @aa_by_model[model]
+            next unless aa_res
+
+            declared = aa_res.graphql_config.field_capabilities.keys
+            next if declared.empty?
+
+            present = type_class.own_fields.keys.map { |name| name.to_s.to_sym }
+            unknown = declared - present
+            next if unknown.empty?
+
+            raise ActiveAdmin::DependencyError,
+              "GraphQL capability fields #{unknown.map(&:inspect).join(", ")} are not on " \
+              "#{type_class.graphql_name} (resource #{aa_res.resource_name}). " \
+              "Use a generated attribute, belongs_to association, or configure field name."
+          end
+        end
       end
     end
   end

data/lib/active_admin/graphql/schema_builder/mutation_batch.rb

@@ -15,6 +15,7 @@ module ActiveAdmin
           proc do
             field fname.to_sym, batch_payload_t, null: false, camelize: false,
               visibility: {kind: :mutation_batch_action, graphql_type_name: sb.send(:graphql_type_name_for, aa_res), resource: aa_res, field_name: fname},
+              capability: aa_res.graphql_config.capability_for_mutation(:batch_action),
               description: "Run a batch action registered on #{aa_res.resource_name} (+batch_action+ DSL), " \
                     "same as the index batch UI (+collection_selection+ / +batch_action_inputs+)." do
               argument :batch_action, ::GraphQL::Types::String, required: true, camelize: false
@@ -39,6 +40,12 @@ module ActiveAdmin
               unless allowed.include?(ba)
                 raise ::GraphQL::ExecutionError, "Unknown batch_action #{ba.inspect} for #{plural}"
               end
+              unless Capability.granted?(
+                context,
+                aa_res.graphql_config.capability_for_mutation(:"batch_#{ba.tr("-", "_")}")
+              )
+                raise ::GraphQL::ExecutionError, "not authorized for batch action #{ba}"
+              end
 
               max_ids = ns.graphql_batch_action_max_ids
               if max_ids.is_a?(Integer) && max_ids.positive? && ids.size > max_ids

data/lib/active_admin/graphql/schema_builder/mutation_collection.rb

@@ -21,6 +21,7 @@ module ActiveAdmin
           proc do
             field fname.to_sym, collection_payload_t, null: false, camelize: false,
               visibility: {kind: :mutation_collection_action, graphql_type_name: sb.send(:graphql_type_name_for, aa_res), resource: aa_res, field_name: fname, aggregate: true},
+              capability: aa_res.graphql_config.capability_for_mutation(:collection_action),
               description: "Invoke a +collection_action+ on #{aa_res.resource_name} by name (same scoping as REST +index+). Prefer per-action fields +#{plural}_collection_<action>+ for distinct inputs or return types." do
               argument :action, ::GraphQL::Types::String, required: true, camelize: false
               argument :params, [KeyValuePairInput], required: false, camelize: false,
@@ -43,6 +44,12 @@ module ActiveAdmin
               unless allowed.include?(act)
                 raise ::GraphQL::ExecutionError, "Unknown collection action #{act.inspect} for #{plural}"
               end
+              unless Capability.granted?(
+                context,
+                aa_res.graphql_config.capability_for_mutation(:"collection_#{act.tr("-", "_")}")
+              )
+                raise ::GraphQL::ExecutionError, "not authorized for collection action #{act}"
+              end
 
               proxy = ResourceQueryProxy.new(
                 aa_resource: aa_res,
@@ -79,6 +86,7 @@ module ActiveAdmin
                 field_name: field_name,
                 collection_action: action_name
               },
+              capability: aa_res.graphql_config.capability_for_mutation(:"collection_#{action_name.tr("-", "_")}"),
               description: "Invoke +collection_action+ #{action_name} on #{aa_res.resource_name} (same scoping as REST +index+)." do
               argument :params, [KeyValuePairInput], required: false, camelize: false,
                 description: "Extra request params as flat key/value pairs."

data/lib/active_admin/graphql/schema_builder/mutation_create.rb

@@ -13,6 +13,7 @@ module ActiveAdmin
           proc do
             field fname.to_sym, type_c, null: true, camelize: false,
               visibility: {kind: :mutation_create, graphql_type_name: sb.send(:graphql_type_name_for, aa_res), resource: aa_res},
+              capability: aa_res.graphql_config.capability_for_mutation(:create),
               description: "Create #{model.name}" do
               argument :input, create_input, required: true, camelize: false
             end

data/lib/active_admin/graphql/schema_builder/mutation_member.rb

@@ -21,6 +21,7 @@ module ActiveAdmin
           proc do
             field fname.to_sym, member_payload_t, null: false, camelize: false,
               visibility: {kind: :mutation_member_action, graphql_type_name: sb.send(:graphql_type_name_for, aa_res), resource: aa_res, field_name: fname, aggregate: true},
+              capability: aa_res.graphql_config.capability_for_mutation(:member_action),
               description: "Invoke a +member_action+ on #{aa_res.resource_name} by name (same scoping as REST +show+). Prefer per-action fields +#{plural}_member_<action>+ for distinct inputs or return types." do
               argument :action, ::GraphQL::Types::String, required: true, camelize: false
               argument :id, ::GraphQL::Types::ID, required: true, camelize: false
@@ -44,6 +45,12 @@ module ActiveAdmin
               unless allowed.include?(act)
                 raise ::GraphQL::ExecutionError, "Unknown member action #{act.inspect} for #{plural}"
               end
+              unless Capability.granted?(
+                context,
+                aa_res.graphql_config.capability_for_mutation(:"member_#{act.tr("-", "_")}")
+              )
+                raise ::GraphQL::ExecutionError, "not authorized for member action #{act}"
+              end
 
               proxy = ResourceQueryProxy.new(
                 aa_resource: aa_res,
@@ -81,6 +88,7 @@ module ActiveAdmin
                 field_name: field_name,
                 member_action: action_name
               },
+              capability: aa_res.graphql_config.capability_for_mutation(:"member_#{action_name.tr("-", "_")}"),
               description: "Invoke +member_action+ #{action_name} on #{aa_res.resource_name} (same scoping as REST +show+)." do
               argument :id, ::GraphQL::Types::ID, required: true, camelize: false
               argument :params, [KeyValuePairInput], required: false, camelize: false,

data/lib/active_admin/graphql/schema_builder/mutation_type_builder.rb

@@ -16,18 +16,23 @@ module ActiveAdmin
             type_c = @object_types[model]
             next unless type_c
 
-            actions = defined_actions_for(aa_res)
-
-            if actions.include?(:create)
-              mutations << mutation_create_field(sb, ns, aa_res, model, type_c)
-            end
-            if actions.include?(:update)
-              mutations << mutation_update_field(sb, ns, aa_res, model, type_c)
-            end
-            if actions.include?(:destroy)
-              mutations << mutation_destroy_field(sb, ns, aa_res, model)
+            cfg = aa_res.graphql_config
+            if cfg.mutations_enabled
+              actions = defined_actions_for(aa_res)
+
+              if actions.include?(:create)
+                mutations << mutation_create_field(sb, ns, aa_res, model, type_c)
+              end
+              if actions.include?(:update)
+                mutations << mutation_update_field(sb, ns, aa_res, model, type_c)
+              end
+              if actions.include?(:destroy)
+                mutations << mutation_destroy_field(sb, ns, aa_res, model)
+              end
             end
 
+            next unless cfg.run_actions_enabled
+
             if aa_res.batch_actions_enabled? && aa_res.batch_actions.any?
               mutations << mutation_batch_field(sb, ns, aa_res)
             end

data/lib/active_admin/graphql/schema_builder/mutation_update_destroy.rb

@@ -14,6 +14,7 @@ module ActiveAdmin
           proc do
             field fname.to_sym, type_c, null: true, camelize: false,
               visibility: {kind: :mutation_update, graphql_type_name: sb.send(:graphql_type_name_for, aa_res), resource: aa_res},
+              capability: aa_res.graphql_config.capability_for_mutation(:update),
               description: "Update #{model.name}" do
               argument :where, find_type, required: true, camelize: false
               argument :input, update_input, required: true, camelize: false
@@ -80,6 +81,7 @@ module ActiveAdmin
             [delete_name, destroy_name].each do |fname|
               field fname.to_sym, ::GraphQL::Types::Boolean, null: false, camelize: false,
                 visibility: {kind: :mutation_delete, graphql_type_name: type_basename, resource: aa_res},
+                capability: aa_res.graphql_config.capability_for_mutation(:destroy),
                 description: "Destroy #{model.name}" do
                 argument :where, find_type, required: true, camelize: false
               end

data/lib/active_admin/graphql/schema_builder/query_type.rb

@@ -16,6 +16,7 @@ module ActiveAdmin
           aa_by_model = @aa_by_model
           object_types = @object_types
           aa_by_graphql_type_name = @aa_by_graphql_type_name
+          query_type_name_map = aa_by_graphql_type_name_for_queries
           list_filter_input_types = @list_filter_input_types
           find_input_types = @find_input_types
 
@@ -31,7 +32,7 @@ module ActiveAdmin
                 builder: builder,
                 ns: ns,
                 registered_resource_union: registered_resource_union,
-                aa_by_graphql_type_name: aa_by_graphql_type_name
+                aa_by_graphql_type_name: query_type_name_map
               )
             end
 

data/lib/active_admin/graphql/schema_builder/query_type_collection.rb

@@ -7,6 +7,8 @@ module ActiveAdmin
         def add_model_query_fields!(query_class, builder:, ns:, aa_by_model:, object_types:,
           list_filter_input_types:, find_input_types:)
           aa_by_model.each do |model, aa_res|
+            next unless aa_res.graphql_config.queries_enabled
+
             builder.define_query_collection_field!(
               query_class, model, aa_res, builder, ns, object_types, list_filter_input_types
             )
@@ -32,6 +34,7 @@ module ActiveAdmin
                 field_name: plural_route,
                 resource: aa_res
               },
+              capability: aa_res.graphql_config.capability_for_query(:collection),
               description: "Paginated list of #{model.name} (#{aa_res.resource_name.human}); " \
                 "pass +filter+ or legacy +q+ / +scope+ / +order+ (Ransack +q+ matches the JSON index param). " \
                 "Nested resources require the parent foreign key (same as REST route params)." do

data/lib/active_admin/graphql/schema_builder/query_type_member.rb

@@ -19,6 +19,7 @@ module ActiveAdmin
                 field_name: singular,
                 resource: aa_res
               },
+              capability: aa_res.graphql_config.capability_for_query(:member),
               description: "Find #{model.name} by id (same scoping chain as REST +show+). Use +where+ or legacy +id+." do
               argument :where, find_type, required: false, camelize: false
               if ActiveAdmin::PrimaryKey.composite?(model)

data/lib/active_admin/graphql/schema_builder/query_type_policies.rb

@@ -4,14 +4,10 @@ module ActiveAdmin
   module GraphQL
     class SchemaBuilder
       module QueryTypePolicies
-        POLICY_ACTIONS = {
-          read: ActiveAdmin::Authorization::READ,
-          create: ActiveAdmin::Authorization::CREATE,
-          update: ActiveAdmin::Authorization::UPDATE,
-          destroy: ActiveAdmin::Authorization::DESTROY
-        }.freeze
-
         def add_activeadmin_policies_query_field!(query_class, builder:, ns:, aa_by_graphql_type_name:)
+          adapter = builder.send(:policy_adapter)
+          return unless adapter
+
           resource_policy_type = Class.new(::GraphQL::Schema::Object) do
             graphql_name "ActiveAdminResourcePolicies"
             field :type_name, ::GraphQL::Types::String, null: false, camelize: false
@@ -48,7 +44,9 @@ module ActiveAdmin
             end
 
             define_method(:activeadmin_policies) do
-              resources = builder.send(:active_resources).map do |aa_res|
+              resources = builder.send(:active_resources).filter_map do |aa_res|
+                next unless adapter.include_resource?(aa_res)
+
                 {
                   type_name: builder.send(:graphql_type_name_for, aa_res),
                   activeadmin_policies: ActiveAdmin::GraphQL::PolicySetCache.fetch(
@@ -74,6 +72,9 @@ module ActiveAdmin
             define_method(:activeadmin_policies_for) do |type_name:, ids:, path: nil|
               aa_res = aa_by_graphql_type_name[type_name.to_s]
               raise ::GraphQL::ExecutionError, "unknown resource type_name #{type_name.inspect}" unless aa_res
+              unless adapter.include_resource?(aa_res)
+                raise ::GraphQL::ExecutionError, "policies disabled for #{type_name.inspect}"
+              end
 
               proxy = ResourceQueryProxy.new(
                 aa_resource: aa_res,
@@ -99,61 +100,6 @@ module ActiveAdmin
             end
           end
         end
-
-        private
-
-        def policy_action_pairs
-          hook = @namespace.graphql_policy_actions
-          if hook.respond_to?(:call)
-            raw = hook.call(@namespace)
-            return raw.to_h.transform_keys(&:to_sym) if raw.respond_to?(:to_h)
-          end
-          POLICY_ACTIONS
-        end
-
-        def allowed_base_actions(auth:, subject_owner:, subject:, context:)
-          action_mapper = @namespace.graphql_policy_action_mapper
-          policy_action_pairs.each_with_object([]) do |(name, default_action), out|
-            allowed = if action_mapper.respond_to?(:call)
-              action_mapper.call(context, subject_owner, subject, name, default_action)
-            else
-              auth.authorized?(subject_owner, default_action, subject)
-            end
-            out << name.to_s if allowed
-          end
-        end
-
-        def build_policy_set(auth:, subject_owner:, subject:, context:)
-          base = {
-            allowed_actions: allowed_base_actions(auth: auth, subject_owner: subject_owner, subject: subject, context: context),
-            allowed_member_actions: [],
-            allowed_collection_actions: [],
-            allowed_batch_actions: []
-          }
-
-          if subject_owner.is_a?(ActiveAdmin::Resource)
-            class_subject = subject_owner.resource_class
-            if subject.is_a?(Class)
-              if auth.authorized?(subject_owner, ActiveAdmin::Authorization::READ, class_subject)
-                base[:allowed_member_actions] = subject_owner.member_actions.map { |a| a.name.to_s }
-                base[:allowed_collection_actions] = subject_owner.collection_actions.map { |a| a.name.to_s }
-                base[:allowed_batch_actions] = subject_owner.batch_actions.map { |a| a.sym.to_s }
-              end
-            elsif auth.authorized?(subject_owner, ActiveAdmin::Authorization::READ, subject)
-              base[:allowed_member_actions] = subject_owner.member_actions.map { |a| a.name.to_s }
-            end
-          end
-
-          if (extra = @namespace.graphql_policy_extra).respond_to?(:call)
-            out = extra.call(context, subject_owner, subject, base)
-            base = out if out.is_a?(Hash)
-          end
-          if (transform = @namespace.graphql_policy_transform).respond_to?(:call)
-            out = transform.call(context, subject_owner, subject, base)
-            base = out if out.is_a?(Hash)
-          end
-          base
-        end
       end
     end
   end

data/lib/active_admin/graphql/schema_builder/resources.rb

@@ -28,6 +28,40 @@ module ActiveAdmin
           aa_res.attributes_for_graphql
         end
 
+        # +nil+ when policy fields are off (+graphql_policies_enabled+ false).
+        def policy_adapter
+          return @policy_adapter if defined?(@policy_adapter)
+
+          unless @namespace.graphql_policies_enabled
+            @policy_adapter = nil
+            return @policy_adapter
+          end
+
+          raw = @namespace.graphql_policy_adapter
+          klass = case raw
+          when nil, true, :default
+            PolicyAdapter
+          when String
+            raw.constantize
+          when Class
+            raw
+          else
+            raise ActiveAdmin::DependencyError,
+              "graphql_policy_adapter must be a Class, String, or nil (got #{raw.inspect})"
+          end
+          @policy_adapter = klass.new(namespace: @namespace)
+        end
+
+        def queryable_resources
+          active_resources.select { |r| r.graphql_config.queries_enabled }
+        end
+
+        def aa_by_graphql_type_name_for_queries
+          queryable_resources.each_with_object({}) do |aa_res, map|
+            map[graphql_type_name_for(aa_res)] = aa_res
+          end
+        end
+
         def configure_schema_plugins(schema)
           if (c = @namespace.graphql_max_complexity)
             schema.max_complexity(c)