activeadmin-graphql 0.3.2 → 0.4.0

data/lib/active_admin/graphql/resource_definition_dsl.rb

@@ -3,19 +3,20 @@
 require_relative "run_action_mutation_config"
 require_relative "run_action_mutation_dsl"
 require_relative "mutation_input_definition_dsl"
+require_relative "resource_surface_dsl"
+require_relative "resource_capability_dsl"
 
 module ActiveAdmin
   module GraphQL
     # DSL for +graphql do ... end+ inside +ActiveAdmin.register+.
     class ResourceDefinitionDSL
+      include ResourceSurfaceDSL
+      include ResourceCapabilityDSL
+
       def initialize(config)
         @config = config
       end
 
-      def disable!
-        @config.enabled = false
-      end
-
       # Declare GraphQL identity columns when ActiveRecord has no primary key / id column.
       # See RFC 0007.
       def identity(*columns, separator: nil, encode: nil, decode: nil)
@@ -102,21 +103,32 @@ module ActiveAdmin
       end
 
       # Pair +type+ and +resolve+ for +posts_batch_action+ (graphql-ruby-style block).
-      def batch_action_mutation(&block)
-        RunActionMutationDSL.new(@config.batch_run_action).instance_exec(&block)
+      # +capability:+ overrides the resource map / namespace default for the aggregate field (RFC 0012).
+      def batch_action_mutation(capability: nil, &block)
+        cfg = @config.batch_run_action
+        cfg.capability = capability.to_sym if capability
+        RunActionMutationDSL.new(cfg).instance_exec(&block) if block
+        cfg
       end
 
       # With no name: configures the aggregate +posts_member_action(action: …)+ field.
       # With a symbol/string: configures +posts_member_<action>+ (one field per +member_action+), so each
       # action can use its own +type+, +resolve+, +arguments+, and GraphQL inputs.
-      def member_action_mutation(name = nil, &block)
+      # +dry_run:+ / +capability:+ apply to named per-action fields (RFC 0010, RFC 0012).
+      def member_action_mutation(name = nil, dry_run: false, capability: nil, &block)
         cfg = name.nil? ? @config.member_run_action : @config.member_action_mutation_for(name)
-        RunActionMutationDSL.new(cfg).instance_exec(&block)
+        cfg.dry_run = true if dry_run
+        cfg.capability = capability.to_sym if capability
+        RunActionMutationDSL.new(cfg).instance_exec(&block) if block
+        cfg
       end
 
-      def collection_action_mutation(name = nil, &block)
+      def collection_action_mutation(name = nil, dry_run: false, capability: nil, &block)
         cfg = name.nil? ? @config.collection_run_action : @config.collection_action_mutation_for(name)
-        RunActionMutationDSL.new(cfg).instance_exec(&block)
+        cfg.dry_run = true if dry_run
+        cfg.capability = capability.to_sym if capability
+        RunActionMutationDSL.new(cfg).instance_exec(&block) if block
+        cfg
       end
 
       # Default return type for all run-action fields unless a kind-specific +type+ is set inside

data/lib/active_admin/graphql/resource_methods.rb

@@ -7,7 +7,13 @@ module ActiveAdmin
         SERVER_OWNED_TIMESTAMP_COLUMNS = %w[created_at updated_at].freeze
 
         def graphql_config
-          @graphql_config ||= ActiveAdmin::GraphQL::ResourceConfig.new
+          @graphql_config ||= ActiveAdmin::GraphQL::ResourceConfig.new(
+            enabled: namespace.graphql_resource_enabled_default,
+            queries_enabled: namespace.graphql_queries_enabled_default,
+            mutations_enabled: namespace.graphql_mutations_enabled_default,
+            run_actions_enabled: namespace.graphql_run_actions_enabled_default,
+            policies_enabled: namespace.graphql_policies_enabled_default
+          )
         end
 
         def attributes_for_graphql

data/lib/active_admin/graphql/resource_surface_dsl.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    # Inclusion and schema-surface toggles for +graphql do ... end+.
+    module ResourceSurfaceDSL
+      def enable!
+        @config.enabled = true
+      end
+
+      def disable!
+        @config.enabled = false
+      end
+
+      def enable_queries!
+        @config.queries_enabled = true
+      end
+
+      def disable_queries!
+        @config.queries_enabled = false
+      end
+
+      def enable_mutations!
+        @config.mutations_enabled = true
+      end
+
+      def disable_mutations!
+        @config.mutations_enabled = false
+      end
+
+      def enable_run_actions!
+        @config.run_actions_enabled = true
+      end
+
+      def disable_run_actions!
+        @config.run_actions_enabled = false
+      end
+
+      def enable_policies!
+        @config.policies_enabled = true
+      end
+
+      def disable_policies!
+        @config.policies_enabled = false
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/run_action_capability.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    # Resolves the capability for batch / member / collection run-action fields (RFC 0012).
+    module RunActionCapability
+      KINDS = %i[batch member collection].freeze
+
+      module_function
+
+      # @param kind [Symbol] +:batch+, +:member+, or +:collection+
+      # @param action_name [String, Symbol, nil] per-action name; +nil+ for the aggregate field
+      def resolve(namespace, aa_res, kind, action_name = nil)
+        kind = kind.to_sym
+        unless KINDS.include?(kind)
+          raise ArgumentError, "run-action kind must be one of #{KINDS.inspect}, got #{kind.inspect}"
+        end
+
+        if action_name
+          per_capability = per_action_config_capability(aa_res, kind, action_name)
+          return per_capability if per_capability
+
+          mapped = aa_res.graphql_config.capability_for_mutation(
+            :"#{kind}_#{action_name.to_s.tr("-", "_")}"
+          )
+        else
+          aggregate_capability = aggregate_config_capability(aa_res, kind)
+          return aggregate_capability if aggregate_capability
+
+          mapped = aa_res.graphql_config.capability_for_mutation(:"#{kind}_action")
+        end
+        return mapped if mapped
+
+        namespace.public_send(:"graphql_#{kind}_action_capability_default")&.to_sym
+      end
+
+      def per_action_config_capability(aa_res, kind, action_name)
+        map =
+          case kind
+          when :member then aa_res.graphql_config.member_action_mutations
+          when :collection then aa_res.graphql_config.collection_action_mutations
+          when :batch then nil
+          end
+        return nil unless map
+
+        map[action_name.to_s]&.capability
+      end
+      module_function :per_action_config_capability
+
+      def aggregate_config_capability(aa_res, kind)
+        cfg =
+          case kind
+          when :member then aa_res.graphql_config.member_run_action
+          when :batch then aa_res.graphql_config.batch_run_action
+          when :collection then aa_res.graphql_config.collection_run_action
+          end
+        cfg&.capability
+      end
+      module_function :aggregate_config_capability
+    end
+  end
+end

data/lib/active_admin/graphql/run_action_control_extension.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    # Confirm gate and optional preview short-circuit for custom run-action fields (RFC 0013).
+    class RunActionControlExtension < ::GraphQL::Schema::FieldExtension
+      def resolve(arguments:, context:, object: nil, objects: nil)
+        if options[:confirm] && !arguments[:dry_run] && !arguments[:confirm]
+          result = RunActionPayload::Result.new(
+            ok: false, status: 422, location: nil, body: "confirm_required"
+          )
+          audit!(context, result, dry_run: false)
+          return result
+        end
+
+        preview_proc = options[:preview]
+        if preview_proc
+          preview_result = run_preview(preview_proc, arguments, context)
+
+          if arguments[:dry_run]
+            result = preview_result || default_dry_run_result
+            audit!(context, result, dry_run: true)
+            return result
+          end
+
+          if preview_result&.respond_to?(:ok) && !preview_result.ok
+            audit!(context, preview_result, dry_run: false)
+            return preview_result
+          end
+        end
+
+        yield(object.nil? ? objects : object, arguments, nil)
+      end
+
+      private
+
+      def run_preview(preview_proc, arguments, context)
+        kwargs = arguments.respond_to?(:to_h) ? arguments.to_h : arguments
+        kwargs = kwargs.merge(context: context)
+        RunActionPreview.call(preview_proc, **kwargs.transform_keys(&:to_sym))
+      end
+
+      def default_dry_run_result
+        RunActionPayload::Result.new(
+          ok: true,
+          status: 200,
+          location: nil,
+          body: "would_run:#{field.graphql_name}"
+        )
+      end
+
+      def audit!(context, result, dry_run:)
+        hook = context[:namespace]&.graphql_run_action_audit
+        return if hook.nil?
+
+        hook.call(
+          context,
+          {
+            action: field.graphql_name,
+            id: nil,
+            status: result.respond_to?(:status) ? result.status : nil,
+            dry_run: dry_run,
+            ok: result.respond_to?(:ok) ? result.ok : nil,
+            reason: result.respond_to?(:body) ? result.body : nil
+          }
+        )
+      rescue
+        nil
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/run_action_field.rb

@@ -0,0 +1,103 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    # DSL sugar for custom run-action mutation fields (RFC 0013).
+    #
+    #   ActiveAdmin::GraphQL::RunActionField.define(schema.mutation, :create_batch,
+    #     dry_run: true, confirm: true, capability: :support_act) do
+    #     argument :q, GraphQL::Types::JSON, required: true, camelize: false
+    #     preview { |**| ok("would_run:create_batch") }
+    #     resolve { |q:, **| HostService.call(q: q) }
+    #   end
+    module RunActionField
+      module_function
+
+      def define(
+        owner,
+        name,
+        type: RunActionPayload,
+        null: false,
+        camelize: false,
+        dry_run: false,
+        confirm: false,
+        capability: nil,
+        authorize: false,
+        visibility: nil,
+        **kwargs,
+        &block
+      )
+        definition = Definition.new
+        definition.instance_exec(&block) if block
+        unless definition.resolve_proc
+          raise ArgumentError, "run_action_field #{name.inspect} requires a resolve block"
+        end
+
+        owner.field(
+          name,
+          type,
+          null: null,
+          camelize: camelize,
+          dry_run: dry_run,
+          confirm: confirm,
+          preview: definition.preview_proc,
+          capability: capability,
+          authorize: authorize,
+          visibility: visibility,
+          **kwargs,
+          &definition.field_configuration_block
+        )
+
+        resolve_proc = definition.resolve_proc
+        owner.define_method(name) do |**args|
+          resolve_proc.call(**args)
+        end
+      end
+
+      # Block body for {RunActionField.define}.
+      class Definition
+        attr_reader :preview_proc, :resolve_proc
+
+        def initialize
+          @argument_calls = []
+          @arguments_proc = nil
+        end
+
+        def argument(*args, **kwargs)
+          @argument_calls << [args, kwargs]
+        end
+
+        def arguments(&block)
+          @arguments_proc = block
+        end
+
+        def preview(&block)
+          @preview_proc = block
+        end
+
+        def resolve(&block)
+          @resolve_proc = block
+        end
+
+        def ok(body, status: 200)
+          RunActionPreview.new.ok(body, status: status)
+        end
+
+        def refuse(body, status: 422)
+          RunActionPreview.new.refuse(body, status: status)
+        end
+
+        def field_configuration_block
+          argument_calls = @argument_calls
+          arguments_proc = @arguments_proc
+          proc do
+            instance_exec(&arguments_proc) if arguments_proc
+            argument_calls.each do |args, kwargs|
+              argument(*args, **kwargs)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/run_action_mutation_config.rb

@@ -14,6 +14,14 @@ module ActiveAdmin
       attr_accessor :arguments_proc
       # Optional authorization toggle for this mutation configuration. +nil+ means namespace default.
       attr_accessor :authorize
+      # When true, inject +dry_run+ and honor +preview+ (RFC 0010).
+      attr_accessor :dry_run
+      # @return [Proc, nil] preview block for dry-run / refuse-before-run
+      attr_accessor :preview_proc
+      # @return [Array<String>, nil] allowlisted extra GraphQL kwargs forwarded into AA params
+      attr_accessor :extra_param_keys
+      # Optional capability override for this action field (RFC 0012).
+      attr_accessor :capability
 
       def self.ensure_graphql_object_subclass!(type)
         unless type.is_a?(Class) && type < ::GraphQL::Schema::Object

data/lib/active_admin/graphql/run_action_mutation_dsl.rb

@@ -31,6 +31,24 @@ module ActiveAdmin
       def authorize(value = true)
         @mutation_config.authorize = !!value
       end
+
+      # Preview before run / dry-run short-circuit (RFC 0010). Block receives the member record.
+      def preview(&block)
+        @mutation_config.preview_proc = block
+      end
+
+      # Allowlisted GraphQL kwargs forwarded into the ActiveAdmin request (never +id+).
+      def extra_params(*names)
+        @mutation_config.extra_param_keys = names.flatten.map(&:to_s)
+      end
+
+      def ok(body, status: 200)
+        RunActionPreview.new.ok(body, status: status)
+      end
+
+      def refuse(body, status: 422)
+        RunActionPreview.new.refuse(body, status: status)
+      end
     end
   end
 end

data/lib/active_admin/graphql/run_action_preview.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    # Shared +ok+ / +refuse+ helpers for run-action preview blocks (RFC 0010, RFC 0013).
+    class RunActionPreview
+      def ok(body, status: 200)
+        RunActionPayload::Result.new(ok: true, status: status, location: nil, body: body.to_s)
+      end
+
+      def refuse(body, status: 422)
+        RunActionPayload::Result.new(ok: false, status: status, location: nil, body: body.to_s)
+      end
+
+      def self.call(preview_proc, **kwargs)
+        new.instance_exec(**kwargs, &preview_proc)
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/schema_builder/build.rb

@@ -25,7 +25,8 @@ module ActiveAdmin
             @aa_by_graphql_type_name[graphql_type_name_for(aa_res)] = aa_res
           end
 
-          wire_belongs_to_associations
+          wire_belongs_to_associations if @namespace.graphql_belongs_to_associations_enabled
+          verify_field_capabilities!
 
           active_resources.each do |aa_res|
             model = aa_res.resource_class
@@ -35,9 +36,10 @@ module ActiveAdmin
             @find_input_types[model] = build_find_input_type(aa_res)
           end
 
-          union_members = @object_types.values.uniq
+          queryable = queryable_resources
+          union_members = queryable.filter_map { |aa_res| @object_types[aa_res.resource_class] }.uniq
           registered_resource_union =
-            if union_members.any?
+            if @namespace.graphql_registered_resource_enabled && union_members.any?
               u = Class.new(::GraphQL::Schema::Union) do
                 graphql_name "ActiveAdminRegisteredResource"
                 description "Any resource object type registered for GraphQL in this namespace."
@@ -47,10 +49,12 @@ module ActiveAdmin
               u
             end
 
+          ensure_query_surface!(registered_resource_union: registered_resource_union)
           query_type = build_query_type(registered_resource_union: registered_resource_union)
           mutation_type = build_mutation_type
 
           model_to_type = @object_types
+          queryable_models = queryable.map(&:resource_class)
 
           schema = Class.new(::GraphQL::Schema)
           schema.query(query_type)
@@ -61,6 +65,11 @@ module ActiveAdmin
           if registered_resource_union
             schema.define_singleton_method(:resolve_type) do |abstract_type, obj, ctx|
               if abstract_type == registered_resource_union
+                unless queryable_models.include?(obj.class)
+                  raise ::GraphQL::ExecutionError,
+                    "ActiveAdminRegisteredResource could not resolve type for #{obj.class.name}"
+                end
+
                 typ = model_to_type[obj.class]
                 unless typ
                   raise ::GraphQL::ExecutionError,
@@ -78,6 +87,46 @@ module ActiveAdmin
           hook.call(schema) if hook.respond_to?(:call)
           schema
         end
+
+        private
+
+        def ensure_query_surface!(registered_resource_union:)
+          return if registered_resource_union
+          return if queryable_resources.any?
+          return if policy_adapter
+          return if namespace_page_graphql_fields?
+
+          raise ActiveAdmin::DependencyError,
+            "GraphQL Query type has no fields for namespace #{@namespace.name.inspect}. " \
+            "Enable list/show (graphql_queries_enabled_default / enable_queries!), " \
+            "policies (graphql_policies_enabled), registered_resource, " \
+            "or a page graphql_field — or turn off graphql for this namespace."
+        end
+
+        def namespace_page_graphql_fields?
+          @namespace.resources.any? do |resource|
+            resource.is_a?(ActiveAdmin::Page) && resource.graphql_fields.any?
+          end
+        end
+
+        def verify_field_capabilities!
+          @object_types.each do |model, type_class|
+            aa_res = @aa_by_model[model]
+            next unless aa_res
+
+            declared = aa_res.graphql_config.field_capabilities.keys
+            next if declared.empty?
+
+            present = type_class.own_fields.keys.map { |name| name.to_s.to_sym }
+            unknown = declared - present
+            next if unknown.empty?
+
+            raise ActiveAdmin::DependencyError,
+              "GraphQL capability fields #{unknown.map(&:inspect).join(", ")} are not on " \
+              "#{type_class.graphql_name} (resource #{aa_res.resource_name}). " \
+              "Use a generated attribute, belongs_to association, or configure field name."
+          end
+        end
       end
     end
   end

data/lib/active_admin/graphql/schema_builder/mutation_batch.rb

@@ -15,6 +15,7 @@ module ActiveAdmin
           proc do
             field fname.to_sym, batch_payload_t, null: false, camelize: false,
               visibility: {kind: :mutation_batch_action, graphql_type_name: sb.send(:graphql_type_name_for, aa_res), resource: aa_res, field_name: fname},
+              capability: RunActionCapability.resolve(ns, aa_res, :batch),
               description: "Run a batch action registered on #{aa_res.resource_name} (+batch_action+ DSL), " \
                     "same as the index batch UI (+collection_selection+ / +batch_action_inputs+)." do
               argument :batch_action, ::GraphQL::Types::String, required: true, camelize: false
@@ -39,6 +40,12 @@ module ActiveAdmin
               unless allowed.include?(ba)
                 raise ::GraphQL::ExecutionError, "Unknown batch_action #{ba.inspect} for #{plural}"
               end
+              unless Capability.granted?(
+                context,
+                RunActionCapability.resolve(ns, aa_res, :batch, ba)
+              )
+                raise ::GraphQL::ExecutionError, "not authorized for batch action #{ba}"
+              end
 
               max_ids = ns.graphql_batch_action_max_ids
               if max_ids.is_a?(Integer) && max_ids.positive? && ids.size > max_ids

data/lib/active_admin/graphql/schema_builder/mutation_collection.rb

@@ -21,6 +21,7 @@ module ActiveAdmin
           proc do
             field fname.to_sym, collection_payload_t, null: false, camelize: false,
               visibility: {kind: :mutation_collection_action, graphql_type_name: sb.send(:graphql_type_name_for, aa_res), resource: aa_res, field_name: fname, aggregate: true},
+              capability: RunActionCapability.resolve(ns, aa_res, :collection),
               description: "Invoke a +collection_action+ on #{aa_res.resource_name} by name (same scoping as REST +index+). Prefer per-action fields +#{plural}_collection_<action>+ for distinct inputs or return types." do
               argument :action, ::GraphQL::Types::String, required: true, camelize: false
               argument :params, [KeyValuePairInput], required: false, camelize: false,
@@ -43,6 +44,12 @@ module ActiveAdmin
               unless allowed.include?(act)
                 raise ::GraphQL::ExecutionError, "Unknown collection action #{act.inspect} for #{plural}"
               end
+              unless Capability.granted?(
+                context,
+                RunActionCapability.resolve(ns, aa_res, :collection, act)
+              )
+                raise ::GraphQL::ExecutionError, "not authorized for collection action #{act}"
+              end
 
               proxy = ResourceQueryProxy.new(
                 aa_resource: aa_res,
@@ -69,6 +76,7 @@ module ActiveAdmin
           fname = field_name.to_sym
           per_cfg = aa_res.graphql_config.collection_action_mutations[action_name]
           collection_payload_t = collection_action_return_type(aa_res, action_name)
+          capability = RunActionCapability.resolve(ns, aa_res, :collection, action_name)
 
           proc do
             field fname, collection_payload_t, null: false, camelize: false,
@@ -79,6 +87,7 @@ module ActiveAdmin
                 field_name: field_name,
                 collection_action: action_name
               },
+              capability: capability,
               description: "Invoke +collection_action+ #{action_name} on #{aa_res.resource_name} (same scoping as REST +index+)." do
               argument :params, [KeyValuePairInput], required: false, camelize: false,
                 description: "Extra request params as flat key/value pairs."

data/lib/active_admin/graphql/schema_builder/mutation_create.rb

@@ -13,6 +13,7 @@ module ActiveAdmin
           proc do
             field fname.to_sym, type_c, null: true, camelize: false,
               visibility: {kind: :mutation_create, graphql_type_name: sb.send(:graphql_type_name_for, aa_res), resource: aa_res},
+              capability: aa_res.graphql_config.capability_for_mutation(:create),
               description: "Create #{model.name}" do
               argument :input, create_input, required: true, camelize: false
             end

data/lib/active_admin/graphql/schema_builder/mutation_member.rb

@@ -21,6 +21,7 @@ module ActiveAdmin
           proc do
             field fname.to_sym, member_payload_t, null: false, camelize: false,
               visibility: {kind: :mutation_member_action, graphql_type_name: sb.send(:graphql_type_name_for, aa_res), resource: aa_res, field_name: fname, aggregate: true},
+              capability: MemberActionCapability.resolve(ns, aa_res),
               description: "Invoke a +member_action+ on #{aa_res.resource_name} by name (same scoping as REST +show+). Prefer per-action fields +#{plural}_member_<action>+ for distinct inputs or return types." do
               argument :action, ::GraphQL::Types::String, required: true, camelize: false
               argument :id, ::GraphQL::Types::ID, required: true, camelize: false
@@ -44,6 +45,12 @@ module ActiveAdmin
               unless allowed.include?(act)
                 raise ::GraphQL::ExecutionError, "Unknown member action #{act.inspect} for #{plural}"
               end
+              unless Capability.granted?(
+                context,
+                MemberActionCapability.resolve(ns, aa_res, act)
+              )
+                raise ::GraphQL::ExecutionError, "not authorized for member action #{act}"
+              end
 
               proxy = ResourceQueryProxy.new(
                 aa_resource: aa_res,
@@ -71,6 +78,7 @@ module ActiveAdmin
           fname = field_name.to_sym
           per_cfg = aa_res.graphql_config.member_action_mutations[action_name]
           member_payload_t = member_action_return_type(aa_res, action_name)
+          capability = MemberActionCapability.resolve(ns, aa_res, action_name)
 
           proc do
             field fname, member_payload_t, null: false, camelize: false,
@@ -81,10 +89,15 @@ module ActiveAdmin
                 field_name: field_name,
                 member_action: action_name
               },
+              capability: capability,
               description: "Invoke +member_action+ #{action_name} on #{aa_res.resource_name} (same scoping as REST +show+)." do
               argument :id, ::GraphQL::Types::ID, required: true, camelize: false
               argument :params, [KeyValuePairInput], required: false, camelize: false,
                 description: "Extra request params as flat key/value pairs."
+              if per_cfg&.dry_run
+                argument :dry_run, ::GraphQL::Types::Boolean, required: false, default_value: false, camelize: false,
+                  description: "When true, preview without performing the member action."
+              end
               if (btc = aa_res.belongs_to_config)
                 argument btc.to_param.to_sym, ::GraphQL::Types::ID, required: btc.required?, camelize: false
               end

data/lib/active_admin/graphql/schema_builder/mutation_type_builder.rb

@@ -16,18 +16,23 @@ module ActiveAdmin
             type_c = @object_types[model]
             next unless type_c
 
-            actions = defined_actions_for(aa_res)
-
-            if actions.include?(:create)
-              mutations << mutation_create_field(sb, ns, aa_res, model, type_c)
-            end
-            if actions.include?(:update)
-              mutations << mutation_update_field(sb, ns, aa_res, model, type_c)
-            end
-            if actions.include?(:destroy)
-              mutations << mutation_destroy_field(sb, ns, aa_res, model)
+            cfg = aa_res.graphql_config
+            if cfg.mutations_enabled
+              actions = defined_actions_for(aa_res)
+
+              if actions.include?(:create)
+                mutations << mutation_create_field(sb, ns, aa_res, model, type_c)
+              end
+              if actions.include?(:update)
+                mutations << mutation_update_field(sb, ns, aa_res, model, type_c)
+              end
+              if actions.include?(:destroy)
+                mutations << mutation_destroy_field(sb, ns, aa_res, model)
+              end
             end
 
+            next unless cfg.run_actions_enabled
+
             if aa_res.batch_actions_enabled? && aa_res.batch_actions.any?
               mutations << mutation_batch_field(sb, ns, aa_res)
             end