activeadmin-graphql 0.3.2 → 0.3.3

data/lib/active_admin/graphql/schema_builder/types_object.rb

@@ -113,18 +113,28 @@ module ActiveAdmin
             next unless col
 
             gql_t = graphql_scalar_for_column(aa_res, model, col)
-            type_class.field(name.to_sym, gql_t, null: true, camelize: false, authorize: false)
+            type_class.field(
+              name.to_sym,
+              gql_t,
+              null: true,
+              camelize: false,
+              authorize: false,
+              capability: aa_res.graphql_config.capability_for_field(name)
+            )
 
             type_class.define_method(name.to_sym) { object.public_send(name) }
           end
 
-          type_class.field :activeadmin_policies, policy_set_type, null: false, camelize: false, authorize: false
-          type_class.define_method(:activeadmin_policies) do
-            ActiveAdmin::GraphQL::PolicySetCache.fetch(
-              context,
-              subject_owner: aa_res,
-              subject: object
-            )
+          adapter = policy_adapter
+          if adapter&.include_resource?(aa_res)
+            type_class.field :activeadmin_policies, policy_set_type, null: false, camelize: false, authorize: false
+            type_class.define_method(:activeadmin_policies) do
+              ActiveAdmin::GraphQL::PolicySetCache.fetch(
+                context,
+                subject_owner: aa_res,
+                subject: object
+              )
+            end
           end
 
           if (ext = aa_res.graphql_config.extension_block)

data/lib/active_admin/graphql/schema_builder/visibility.rb

@@ -10,14 +10,29 @@ module ActiveAdmin
           vis = @namespace.graphql_visibility
           return if vis.nil?
 
-          if vis == true
-            schema.use(::GraphQL::Schema::Visibility)
-          elsif vis.is_a?(Hash)
-            schema.use(::GraphQL::Schema::Visibility, **vis.symbolize_keys)
-          else
-            raise ActiveAdmin::DependencyError,
-              "namespace graphql_visibility must be nil, true, or a Hash of GraphQL::Schema::Visibility options"
+          options =
+            case vis
+            when true
+              {}
+            when Hash
+              vis.symbolize_keys
+            else
+              raise ActiveAdmin::DependencyError,
+                "namespace graphql_visibility must be nil, true, or a Hash of GraphQL::Schema::Visibility options"
+            end
+
+          if @namespace.graphql_capabilities.respond_to?(:call)
+            profiles = options[:profiles]
+            if profiles.respond_to?(:any?) && profiles.any?
+              raise ActiveAdmin::DependencyError,
+                "graphql_capabilities cannot be combined with named GraphQL visibility profiles " \
+                "(named profiles cache a fixed context and ignore per-request capabilities). " \
+                "Omit profiles: and use dynamic visibility, or drop graphql_capabilities."
+            end
+            options = options.merge(dynamic: true)
           end
+
+          schema.use(::GraphQL::Schema::Visibility, **options)
         end
 
         def attach_registered_resource_union_visibility!(union_class)

data/lib/active_admin/graphql/schema_builder/wire.rb

@@ -20,7 +20,9 @@ module ActiveAdmin
               field_name = ref.name.to_sym
               fk = ref.foreign_key.to_s
 
-              type_class.field field_name, @object_types[target], null: true, camelize: false
+              type_class.field field_name, @object_types[target], null: true, camelize: false,
+                authorize: false,
+                capability: aa_res.graphql_config.capability_for_field(field_name)
 
               type_class.define_method(field_name) do
                 fk_val = object.public_send(fk)

data/lib/active_admin/graphql/schema_field.rb

@@ -8,9 +8,17 @@ module ActiveAdmin
     # +graphql_schema_visible+ (second argument) when {GraphQL::Schema::Visibility} is enabled.
     # That hook runs from {#visible?}; it does not replace graphql-ruby's visibility system—it
     # composes with +super+ like any custom +Field+ class.
+    #
+    # +capability:+ (RFC 0008) gates +visible?+ and +authorized?+ via +context[:capabilities]+.
     class SchemaField < ::GraphQL::Schema::Field
-      def initialize(visibility: nil, authorize: nil, authorize_action: nil, **kwargs, &block)
-        @visibility = visibility
+      def initialize(visibility: nil, authorize: nil, authorize_action: nil, capability: nil, **kwargs, &block)
+        @capability = capability&.to_sym
+        @visibility =
+          if @capability && visibility.is_a?(Hash) && !visibility.key?(:capability)
+            visibility.merge(capability: @capability)
+          else
+            visibility
+          end
         @authorize = authorize
         @authorize_action = authorize_action
         super(**kwargs, &block)
@@ -19,6 +27,13 @@ module ActiveAdmin
       def visible?(ctx)
         return false unless super
 
+        # Gate introspection only when Schema::Visibility is enabled; otherwise
+        # capability is enforced in +authorized?+ so hosts without the plugin
+        # do not trip graphql-ruby's legacy Warden +visible?+ path.
+        if ctx[:namespace]&.graphql_visibility && !Capability.granted?(ctx, @capability)
+          return false
+        end
+
         return true unless @visibility
 
         hook = ctx[:namespace]&.graphql_schema_visible
@@ -29,6 +44,7 @@ module ActiveAdmin
 
       def authorized?(object, args, ctx)
         return false unless super
+        return false unless Capability.granted?(ctx, @capability)
 
         owner = self.owner
         aa_resource = owner.respond_to?(:activeadmin_graphql_resource) ? owner.activeadmin_graphql_resource : nil

data/lib/active_admin/graphql/version.rb

@@ -2,6 +2,6 @@
 
 module ActiveAdmin
   module GraphQL
-    VERSION = "0.3.2"
+    VERSION = "0.3.3"
   end
 end

data/lib/active_admin/graphql.rb

@@ -68,6 +68,7 @@ module ActiveAdmin
       def require_active_admin_graphql_components!
         %w[
           graphql/resource_interface
+          graphql/capability
           graphql/schema_field
           graphql/auth_context
           graphql/record_source
@@ -77,6 +78,7 @@ module ActiveAdmin
           graphql/run_action_mutation_config
           graphql/run_action_mutation_dsl
           graphql/key_value_pair_input
+          graphql/policy_adapter
           graphql/policy_set_cache
           graphql/mutation_execution_error
           graphql/schema_builder

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: activeadmin-graphql
 version: !ruby/object:Gem::Version
-  version: 0.3.2
+  version: 0.3.3
 platform: ruby
 authors:
 - Andrei Makarov
@@ -374,10 +374,14 @@ files:
 - docs/changelogs/20260921111000_release-0-3-0.md
 - docs/changelogs/20260921112800_drop-standard-rubocop-direct.md
 - docs/changelogs/20260921120000_graphql-floor-and-activeadmin-4.md
+- docs/changelogs/20261010091415_graphql-resource-enabled-default.md
 - docs/changelogs/20261010101500_nonconventional-id-fields.md
 - docs/changelogs/20261010103800_release-0-3-1.md
 - docs/changelogs/20261010110600_graphql-identity-dsl.md
 - docs/changelogs/20261010111800_release-0-3-2.md
+- docs/changelogs/20261012050051_graphql-surface-toggles.md
+- docs/changelogs/20261012064500_graphql-capabilities.md
+- docs/changelogs/20261012113500_release-0-3-3.md
 - docs/dependencies/20260907141000_json-cve-2026-71847.md
 - docs/dependencies/20260907141000_sqlite3-ghsa-mwm8-39rw-8826.md
 - docs/dependencies/20260921114000_rails-json-parse-kwargs.md
@@ -396,15 +400,20 @@ files:
 - docs/plan/20260817201500_rfc-starter.md
 - lib/active_admin/graphql.rb
 - lib/active_admin/graphql/auth_context.rb
+- lib/active_admin/graphql/capability.rb
+- lib/active_admin/graphql/capability_definition_dsl.rb
 - lib/active_admin/graphql/engine.rb
 - lib/active_admin/graphql/integration.rb
 - lib/active_admin/graphql/key_value_pair_input.rb
 - lib/active_admin/graphql/mutation_execution_error.rb
 - lib/active_admin/graphql/mutation_input_config.rb
 - lib/active_admin/graphql/mutation_input_definition_dsl.rb
+- lib/active_admin/graphql/policy_adapter.rb
 - lib/active_admin/graphql/policy_set_cache.rb
 - lib/active_admin/graphql/railtie.rb
 - lib/active_admin/graphql/record_source.rb
+- lib/active_admin/graphql/resource_capability_dsl.rb
+- lib/active_admin/graphql/resource_capability_maps.rb
 - lib/active_admin/graphql/resource_config.rb
 - lib/active_admin/graphql/resource_definition_dsl.rb
 - lib/active_admin/graphql/resource_identity.rb
@@ -413,6 +422,7 @@ files:
 - lib/active_admin/graphql/resource_query_proxy.rb
 - lib/active_admin/graphql/resource_query_proxy/controller.rb
 - lib/active_admin/graphql/resource_query_proxy/identity.rb
+- lib/active_admin/graphql/resource_surface_dsl.rb
 - lib/active_admin/graphql/run_action_mutation_config.rb
 - lib/active_admin/graphql/run_action_mutation_dsl.rb
 - lib/active_admin/graphql/run_action_payload.rb