activeadmin-graphql 0.3.2 → 0.4.0

data/lib/active_admin/graphql/capability_definition_dsl.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    # Block body for +capability :name do ... end+ (RFC 0008, RFC 0009).
+    class CapabilityDefinitionDSL
+      QUERY_ALIASES = {
+        index: :collection,
+        list: :collection,
+        show: :member
+      }.freeze
+
+      MUTATION_ALIASES = {
+        delete: :destroy
+      }.freeze
+
+      def initialize(config, capability_name, mode: nil)
+        @config = config
+        @capability_name = capability_name.to_sym
+        @mode = mode
+      end
+
+      def fields(*names, mode: nil)
+        @config.assign_field_capabilities!(
+          @capability_name,
+          names,
+          mode: mode.nil? ? @mode : mode
+        )
+      end
+
+      def queries(*names)
+        keys = names.flatten.map { |name| normalize_query_key(name) }
+        @config.assign_query_capabilities!(@capability_name, keys)
+      end
+
+      def mutations(*names)
+        keys = names.flatten.map { |name| normalize_mutation_key(name) }
+        @config.assign_mutation_capabilities!(@capability_name, keys)
+      end
+
+      def member_actions(*names)
+        keys = names.flatten.map { |name| :"member_#{name.to_s.tr("-", "_")}" }
+        @config.assign_mutation_capabilities!(@capability_name, keys)
+      end
+
+      def batch_actions(*names)
+        keys = names.flatten.map { |name| :"batch_#{name.to_s.tr("-", "_")}" }
+        @config.assign_mutation_capabilities!(@capability_name, keys)
+      end
+
+      def collection_actions(*names)
+        keys = names.flatten.map { |name| :"collection_#{name.to_s.tr("-", "_")}" }
+        @config.assign_mutation_capabilities!(@capability_name, keys)
+      end
+
+      private
+
+      def normalize_query_key(name)
+        key = name.to_sym
+        QUERY_ALIASES.fetch(key, key)
+      end
+
+      def normalize_mutation_key(name)
+        key = name.to_sym
+        MUTATION_ALIASES.fetch(key, key)
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/collection_query_policy.rb

@@ -0,0 +1,103 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    # Built-in helpers for +graphql_collection_query_policy+ (RFC 0011).
+    module CollectionQueryPolicy
+      module_function
+
+      def require_visible_fields!(
+        context:,
+        aa_resource:,
+        q: nil,
+        order: nil,
+        allow_q_keys: [],
+        field_grants: {},
+        infer_field_grants: true
+      )
+        allow = Array(allow_q_keys).map(&:to_s)
+        grants = merge_field_grants(aa_resource, field_grants, infer: infer_field_grants)
+
+        normalize_q(q).each_key do |raw_key|
+          key = raw_key.to_s
+          next if allow.include?(key)
+
+          field_name = field_from_predicate_key(key)
+          unless field_name
+            raise ::GraphQL::ExecutionError, "unsupported collection filter key #{key.inspect}"
+          end
+
+          assert_field_filterable!(context, aa_resource, field_name, grants)
+        end
+
+        assert_order_filterable!(context, aa_resource, order, grants) if order.present?
+      end
+
+      def merge_field_grants(aa_resource, field_grants, infer: true)
+        explicit = field_grants.to_h.transform_keys(&:to_s).transform_values(&:to_sym)
+        return explicit unless infer
+
+        inferred = aa_resource.graphql_config.field_capabilities.to_h do |name, capability|
+          [name.to_s, capability.to_sym]
+        end
+        inferred.merge(explicit)
+      end
+
+      def normalize_q(q)
+        return {} if q.nil?
+        return q.to_unsafe_h if q.respond_to?(:to_unsafe_h)
+
+        q.respond_to?(:to_h) ? q.to_h : {}
+      end
+
+      def field_from_predicate_key(key)
+        predicates = ransack_predicate_names
+        predicates.sort_by(&:length).reverse_each do |predicate|
+          suffix = "_#{predicate}"
+          return key[0...-suffix.length] if key.end_with?(suffix) && key.length > suffix.length
+        end
+        nil
+      end
+
+      def ransack_predicate_names
+        if defined?(Ransack) && Ransack.respond_to?(:predicates)
+          Ransack.predicates.keys.map(&:to_s)
+        else
+          %w[eq cont start end gt lt gteq lteq in not_in null present blank matches does_not_match]
+        end
+      end
+
+      def assert_order_filterable!(context, aa_resource, order, grants)
+        column = order.to_s.sub(/_(asc|desc|ascs|descs)\z/i, "")
+        return if column.blank?
+
+        assert_field_filterable!(context, aa_resource, column, grants)
+      end
+
+      def assert_field_filterable!(context, aa_resource, field_name, grants)
+        unless field_schema_visible?(context, aa_resource, field_name)
+          raise ::GraphQL::ExecutionError, "not authorized to filter on #{field_name}"
+        end
+
+        capability = grants[field_name.to_s]
+        return if capability.nil?
+        return if Capability.granted?(context, capability)
+
+        raise ::GraphQL::ExecutionError, "not authorized to filter on #{field_name}"
+      end
+
+      def field_schema_visible?(context, aa_resource, field_name)
+        type_name = graphql_type_name_for(aa_resource)
+        type = context.schema.get_type(type_name, context)
+        return false unless type
+
+        !context.schema.get_field(type, field_name.to_s, context).nil?
+      end
+
+      def graphql_type_name_for(aa_resource)
+        aa_resource.graphql_config.graphql_type_name.presence ||
+          aa_resource.resource_class.name.delete_prefix("::").gsub("::", "__")
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/integration.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require_relative "policy_adapter"
 require_relative "resource_definition_dsl"
 require_relative "resource_methods"
 
@@ -25,13 +26,51 @@ module ActiveAdmin
 
       def register_namespace_settings!
         ns = ActiveAdmin::NamespaceSettings
+        register_surface_namespace_settings!(ns)
+        register_capability_namespace_settings!(ns)
+        register_limit_namespace_settings!(ns)
+      end
+
+      def register_surface_namespace_settings!(ns)
         ns.register :graphql, false
+        # true preserves 0.3.x: every ActiveRecord resource is in the schema once the namespace endpoint is on.
+        # Set false for opt-in per resource (empty graphql block or enable!).
+        ns.register :graphql_resource_enabled_default, true
+        ns.register :graphql_queries_enabled_default, true
+        ns.register :graphql_mutations_enabled_default, true
+        ns.register :graphql_run_actions_enabled_default, true
+        ns.register :graphql_policies_enabled, true
+        ns.register :graphql_policies_enabled_default, true
+        # Payload builder for policy fields when graphql_policies_enabled is true.
+        ns.register :graphql_policy_adapter, ActiveAdmin::GraphQL::PolicyAdapter
+        ns.register :graphql_registered_resource_enabled, true
+        ns.register :graphql_belongs_to_associations_enabled, true
         ns.register :graphql_path, "graphql"
         ns.register :graphql_multiplex_max, 20
         ns.register :graphql_dataloader, nil
         ns.register :graphql_visibility, nil
         ns.register :graphql_visibility_profile, nil
         ns.register :graphql_schema_visible, nil
+      end
+
+      def register_capability_namespace_settings!(ns)
+        # Optional Proc +(context_hash) -> Enumerable+ of capability names (RFC 0008).
+        ns.register :graphql_capabilities, nil
+        # RFC 0009: default field capability mode (:omit or :null).
+        ns.register :graphql_field_capability_mode_default, :omit
+        # RFC 0009: optional Proc +(context, meta) -> Boolean+ to omit object/root fields.
+        ns.register :graphql_field_visible, nil
+        # RFC 0010: optional Proc +(context, meta) -> void+ after run-action outcomes.
+        ns.register :graphql_run_action_audit, nil
+        # RFC 0011: optional Proc +(context, meta) -> void+ at collection resolve start.
+        ns.register :graphql_collection_query_policy, nil
+        # RFC 0012: optional default capabilities for run-action mutation fields.
+        ns.register :graphql_member_action_capability_default, nil
+        ns.register :graphql_batch_action_capability_default, nil
+        ns.register :graphql_collection_action_capability_default, nil
+      end
+
+      def register_limit_namespace_settings!(ns)
         ns.register :graphql_max_complexity, 300
         ns.register :graphql_max_depth, 18
         ns.register :graphql_batch_action_max_ids, 5000
@@ -64,7 +103,10 @@ module ActiveAdmin
       module ResourceDSLMethods
         def graphql(&block)
           if block
-            ActiveAdmin::GraphQL::ResourceDefinitionDSL.new(config.graphql_config).instance_exec(&block)
+            cfg = config.graphql_config
+            # Presence of a graphql block is an intentional opt-in when the namespace default is false.
+            cfg.enabled = true
+            ActiveAdmin::GraphQL::ResourceDefinitionDSL.new(cfg).instance_exec(&block)
           end
           config.graphql_config
         end

data/lib/active_admin/graphql/member_action_capability.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    # Compatibility wrapper around {RunActionCapability} for member actions (RFC 0012).
+    module MemberActionCapability
+      module_function
+
+      def resolve(namespace, aa_res, action_name = nil)
+        RunActionCapability.resolve(namespace, aa_res, :member, action_name)
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/member_action_dry_run.rb

@@ -0,0 +1,121 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    # Preview context and resolve helpers for +member_action_mutation dry_run:+ (RFC 0010).
+    class MemberActionDryRun
+      PreviewContext = RunActionPreview
+
+      def self.resolve(
+        aa_res,
+        proxy:,
+        context:,
+        action:,
+        id:,
+        params_h:,
+        extras:,
+        per:,
+        dry_run:
+      )
+        new(aa_res, proxy:, context:, action:, id:, params_h:, extras:, per:, dry_run:).call
+      end
+
+      def initialize(aa_res, proxy:, context:, action:, id:, params_h:, extras:, per:, dry_run:)
+        @aa_res = aa_res
+        @proxy = proxy
+        @context = context
+        @action = action
+        @id = id
+        @params_h = params_h
+        @extras = extras
+        @per = per
+        @dry_run = dry_run
+      end
+
+      def call
+        record = @proxy.find_member(@id)
+        preview_result = run_preview(record)
+
+        if @dry_run
+          result = preview_result || default_dry_run_result(record)
+          audit!(result, dry_run: true)
+          return result
+        end
+
+        if preview_result && !preview_result.ok
+          audit!(preview_result, dry_run: false)
+          return preview_result
+        end
+
+        result = run_action
+        audit!(result, dry_run: false)
+        result
+      end
+
+      private
+
+      def run_preview(record)
+        return nil unless @per.preview_proc
+
+        PreviewContext.new.instance_exec(
+          record,
+          proxy: @proxy,
+          context: @context,
+          aa_resource: @aa_res,
+          auth: @context[:auth],
+          action: @action,
+          id: @id,
+          params: @params_h,
+          **@extras,
+          &@per.preview_proc
+        )
+      end
+
+      def default_dry_run_result(record)
+        body = if record
+          "would_run:#{@action}:#{record.id}"
+        else
+          "would_run:#{@action}"
+        end
+        RunActionPayload::Result.new(ok: true, status: 200, location: nil, body: body)
+      end
+
+      def run_action
+        resolve = @per.resolve_proc || @aa_res.graphql_config.member_run_action.resolve_proc
+        if resolve
+          resolve.call(
+            proxy: @proxy,
+            context: @context,
+            aa_resource: @aa_res,
+            auth: @context[:auth],
+            action: @action,
+            id: @id,
+            params: @params_h,
+            **@extras
+          )
+        else
+          @proxy.run_member_action(@action, @id, extra_params: @params_h)
+        end
+      end
+
+      def audit!(result, dry_run:)
+        hook = @context[:namespace]&.graphql_run_action_audit
+        return if hook.nil?
+
+        hook.call(
+          @context,
+          {
+            action: @action,
+            id: @id,
+            status: result.respond_to?(:status) ? result.status : nil,
+            dry_run: dry_run,
+            ok: result.respond_to?(:ok) ? result.ok : nil,
+            reason: result.respond_to?(:body) ? result.body : nil
+          }
+        )
+      rescue
+        nil
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/policy_adapter.rb

@@ -0,0 +1,94 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    # Builds +activeadmin_policies+ payloads for a namespace.
+    #
+    # Set +graphql_policy_adapter+ to this class (default), another subclass, or a
+    # constant name +String+. Omit policy fields with +graphql_policies_enabled = false+.
+    class PolicyAdapter
+      POLICY_ACTIONS = {
+        read: ActiveAdmin::Authorization::READ,
+        create: ActiveAdmin::Authorization::CREATE,
+        update: ActiveAdmin::Authorization::UPDATE,
+        destroy: ActiveAdmin::Authorization::DESTROY
+      }.freeze
+
+      attr_reader :namespace
+
+      def initialize(namespace:)
+        @namespace = namespace
+      end
+
+      # Whether this resource gets an object +activeadmin_policies+ field and a
+      # row in the +activeadmin_policies+ resources matrix.
+      def include_resource?(aa_resource)
+        aa_resource.graphql_config.policies_enabled
+      end
+
+      def policy_set(auth:, subject_owner:, subject:, context:)
+        base = {
+          allowed_actions: allowed_base_actions(
+            auth: auth,
+            subject_owner: subject_owner,
+            subject: subject,
+            context: context
+          ),
+          allowed_member_actions: [],
+          allowed_collection_actions: [],
+          allowed_batch_actions: []
+        }
+
+        append_resource_action_names!(base, auth: auth, subject_owner: subject_owner, subject: subject)
+
+        if (extra = namespace.graphql_policy_extra).respond_to?(:call)
+          out = extra.call(context, subject_owner, subject, base)
+          base = out if out.is_a?(Hash)
+        end
+        if (transform = namespace.graphql_policy_transform).respond_to?(:call)
+          out = transform.call(context, subject_owner, subject, base)
+          base = out if out.is_a?(Hash)
+        end
+        base
+      end
+
+      private
+
+      def policy_action_pairs
+        hook = namespace.graphql_policy_actions
+        if hook.respond_to?(:call)
+          raw = hook.call(namespace)
+          return raw.to_h.transform_keys(&:to_sym) if raw.respond_to?(:to_h)
+        end
+        POLICY_ACTIONS
+      end
+
+      def allowed_base_actions(auth:, subject_owner:, subject:, context:)
+        action_mapper = namespace.graphql_policy_action_mapper
+        policy_action_pairs.each_with_object([]) do |(name, default_action), out|
+          allowed = if action_mapper.respond_to?(:call)
+            action_mapper.call(context, subject_owner, subject, name, default_action)
+          else
+            auth.authorized?(subject_owner, default_action, subject)
+          end
+          out << name.to_s if allowed
+        end
+      end
+
+      def append_resource_action_names!(base, auth:, subject_owner:, subject:)
+        return unless subject_owner.is_a?(ActiveAdmin::Resource)
+
+        class_subject = subject_owner.resource_class
+        if subject.is_a?(Class)
+          return unless auth.authorized?(subject_owner, ActiveAdmin::Authorization::READ, class_subject)
+
+          base[:allowed_member_actions] = subject_owner.member_actions.map { |a| a.name.to_s }
+          base[:allowed_collection_actions] = subject_owner.collection_actions.map { |a| a.name.to_s }
+          base[:allowed_batch_actions] = subject_owner.batch_actions.map { |a| a.sym.to_s }
+        elsif auth.authorized?(subject_owner, ActiveAdmin::Authorization::READ, subject)
+          base[:allowed_member_actions] = subject_owner.member_actions.map { |a| a.name.to_s }
+        end
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/policy_set_cache.rb

@@ -6,10 +6,11 @@ module ActiveAdmin
     class PolicySetCache
       class << self
         def fetch(context, subject_owner:, subject:)
-          namespace = context[:namespace]
-          unless namespace
-            return policy_builder(context).send(
-              :build_policy_set,
+          adapter = policy_adapter(context)
+          raise ActiveAdmin::DependencyError, "graphql_policy_adapter is disabled" unless adapter
+
+          unless context[:namespace]
+            return adapter.policy_set(
               auth: context[:auth],
               subject_owner: subject_owner,
               subject: subject,
@@ -19,8 +20,7 @@ module ActiveAdmin
 
           cache = context[:policy_set_cache] ||= {}
           key = cache_key(subject_owner, subject)
-          cache[key] ||= policy_builder(context).send(
-            :build_policy_set,
+          cache[key] ||= adapter.policy_set(
             auth: context[:auth],
             subject_owner: subject_owner,
             subject: subject,
@@ -28,6 +28,10 @@ module ActiveAdmin
           )
         end
 
+        def policy_adapter(context)
+          policy_builder(context).send(:policy_adapter)
+        end
+
         def policy_builder(context)
           context[:policy_schema_builder] ||= SchemaBuilder.new(context[:namespace])
         end

data/lib/active_admin/graphql/resource_capability_dsl.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+require_relative "capability_definition_dsl"
+
+module ActiveAdmin
+  module GraphQL
+    # +capability+ entry on {ResourceDefinitionDSL} (RFC 0008, RFC 0009).
+    module ResourceCapabilityDSL
+      def capability(
+        name,
+        fields: nil,
+        queries: nil,
+        mutations: nil,
+        member_actions: nil,
+        batch_actions: nil,
+        collection_actions: nil,
+        mode: nil,
+        &block
+      )
+        body = CapabilityDefinitionDSL.new(@config, name, mode: mode)
+        body.fields(*fields, mode: mode) if fields
+        body.queries(*queries) if queries
+        body.mutations(*mutations) if mutations
+        body.member_actions(*member_actions) if member_actions
+        body.batch_actions(*batch_actions) if batch_actions
+        body.collection_actions(*collection_actions) if collection_actions
+        body.instance_exec(&block) if block
+        name.to_sym
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/resource_capability_maps.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    # Capability → member maps on {ResourceConfig} (RFC 0008, RFC 0009).
+    module ResourceCapabilityMaps
+      def field_capabilities
+        @field_capabilities ||= {}
+      end
+
+      def field_capability_modes
+        @field_capability_modes ||= {}
+      end
+
+      def query_capabilities
+        @query_capabilities ||= {}
+      end
+
+      def mutation_capabilities
+        @mutation_capabilities ||= {}
+      end
+
+      def capability_for_field(name)
+        field_capabilities[name.to_sym]
+      end
+
+      def capability_mode_for_field(name)
+        field_capability_modes[name.to_sym]
+      end
+
+      def capability_for_query(kind)
+        query_capabilities[kind.to_sym]
+      end
+
+      def capability_for_mutation(kind)
+        mutation_capabilities[kind.to_sym]
+      end
+
+      def assign_field_capabilities!(capability_name, names, mode: nil)
+        assign_capabilities!(field_capabilities, capability_name, names, label: "field")
+        return if mode.nil?
+
+        resolved = mode.to_sym
+        unless %i[omit null].include?(resolved)
+          raise ArgumentError, "capability mode must be :omit or :null, got #{mode.inspect}"
+        end
+
+        names.flatten.each do |name|
+          field_capability_modes[name.to_sym] = resolved
+        end
+      end
+
+      def assign_query_capabilities!(capability_name, names)
+        assign_capabilities!(query_capabilities, capability_name, names, label: "query")
+      end
+
+      def assign_mutation_capabilities!(capability_name, names)
+        assign_capabilities!(mutation_capabilities, capability_name, names, label: "mutation")
+      end
+
+      private
+
+      def assign_capabilities!(map, capability_name, names, label:)
+        capability = capability_name.to_sym
+        names.flatten.each do |name|
+          key = name.to_sym
+          existing = map[key]
+          if existing && existing != capability
+            raise ArgumentError,
+              "GraphQL #{label} #{key.inspect} already requires capability #{existing.inspect}"
+          end
+          map[key] = capability
+        end
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/resource_config.rb

@@ -2,12 +2,19 @@
 
 require_relative "run_action_mutation_config"
 require_relative "mutation_input_config"
+require_relative "resource_capability_maps"
 
 module ActiveAdmin
   module GraphQL
     # Per-resource GraphQL options set via +graphql+ in +ActiveAdmin.register+.
     class ResourceConfig
+      include ResourceCapabilityMaps
+
       attr_accessor :enabled
+      attr_accessor :queries_enabled
+      attr_accessor :mutations_enabled
+      attr_accessor :run_actions_enabled
+      attr_accessor :policies_enabled
       attr_accessor :graphql_type_name
       attr_accessor :only_attributes
       attr_accessor :exclude_attributes
@@ -31,8 +38,18 @@ module ActiveAdmin
       # {RunActionMutationConfig#payload_type} is not set. Falls back to {RunActionPayload}.
       attr_accessor :run_action_payload_type
 
-      def initialize
-        @enabled = true
+      def initialize(
+        enabled: true,
+        queries_enabled: true,
+        mutations_enabled: true,
+        run_actions_enabled: true,
+        policies_enabled: true
+      )
+        @enabled = enabled
+        @queries_enabled = queries_enabled
+        @mutations_enabled = mutations_enabled
+        @run_actions_enabled = run_actions_enabled
+        @policies_enabled = policies_enabled
         @exclude_attributes = []
       end