activeadmin-graphql 0.3.3 → 0.4.0

data/lib/active_admin/graphql/run_action_capability.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    # Resolves the capability for batch / member / collection run-action fields (RFC 0012).
+    module RunActionCapability
+      KINDS = %i[batch member collection].freeze
+
+      module_function
+
+      # @param kind [Symbol] +:batch+, +:member+, or +:collection+
+      # @param action_name [String, Symbol, nil] per-action name; +nil+ for the aggregate field
+      def resolve(namespace, aa_res, kind, action_name = nil)
+        kind = kind.to_sym
+        unless KINDS.include?(kind)
+          raise ArgumentError, "run-action kind must be one of #{KINDS.inspect}, got #{kind.inspect}"
+        end
+
+        if action_name
+          per_capability = per_action_config_capability(aa_res, kind, action_name)
+          return per_capability if per_capability
+
+          mapped = aa_res.graphql_config.capability_for_mutation(
+            :"#{kind}_#{action_name.to_s.tr("-", "_")}"
+          )
+        else
+          aggregate_capability = aggregate_config_capability(aa_res, kind)
+          return aggregate_capability if aggregate_capability
+
+          mapped = aa_res.graphql_config.capability_for_mutation(:"#{kind}_action")
+        end
+        return mapped if mapped
+
+        namespace.public_send(:"graphql_#{kind}_action_capability_default")&.to_sym
+      end
+
+      def per_action_config_capability(aa_res, kind, action_name)
+        map =
+          case kind
+          when :member then aa_res.graphql_config.member_action_mutations
+          when :collection then aa_res.graphql_config.collection_action_mutations
+          when :batch then nil
+          end
+        return nil unless map
+
+        map[action_name.to_s]&.capability
+      end
+      module_function :per_action_config_capability
+
+      def aggregate_config_capability(aa_res, kind)
+        cfg =
+          case kind
+          when :member then aa_res.graphql_config.member_run_action
+          when :batch then aa_res.graphql_config.batch_run_action
+          when :collection then aa_res.graphql_config.collection_run_action
+          end
+        cfg&.capability
+      end
+      module_function :aggregate_config_capability
+    end
+  end
+end

data/lib/active_admin/graphql/run_action_control_extension.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    # Confirm gate and optional preview short-circuit for custom run-action fields (RFC 0013).
+    class RunActionControlExtension < ::GraphQL::Schema::FieldExtension
+      def resolve(arguments:, context:, object: nil, objects: nil)
+        if options[:confirm] && !arguments[:dry_run] && !arguments[:confirm]
+          result = RunActionPayload::Result.new(
+            ok: false, status: 422, location: nil, body: "confirm_required"
+          )
+          audit!(context, result, dry_run: false)
+          return result
+        end
+
+        preview_proc = options[:preview]
+        if preview_proc
+          preview_result = run_preview(preview_proc, arguments, context)
+
+          if arguments[:dry_run]
+            result = preview_result || default_dry_run_result
+            audit!(context, result, dry_run: true)
+            return result
+          end
+
+          if preview_result&.respond_to?(:ok) && !preview_result.ok
+            audit!(context, preview_result, dry_run: false)
+            return preview_result
+          end
+        end
+
+        yield(object.nil? ? objects : object, arguments, nil)
+      end
+
+      private
+
+      def run_preview(preview_proc, arguments, context)
+        kwargs = arguments.respond_to?(:to_h) ? arguments.to_h : arguments
+        kwargs = kwargs.merge(context: context)
+        RunActionPreview.call(preview_proc, **kwargs.transform_keys(&:to_sym))
+      end
+
+      def default_dry_run_result
+        RunActionPayload::Result.new(
+          ok: true,
+          status: 200,
+          location: nil,
+          body: "would_run:#{field.graphql_name}"
+        )
+      end
+
+      def audit!(context, result, dry_run:)
+        hook = context[:namespace]&.graphql_run_action_audit
+        return if hook.nil?
+
+        hook.call(
+          context,
+          {
+            action: field.graphql_name,
+            id: nil,
+            status: result.respond_to?(:status) ? result.status : nil,
+            dry_run: dry_run,
+            ok: result.respond_to?(:ok) ? result.ok : nil,
+            reason: result.respond_to?(:body) ? result.body : nil
+          }
+        )
+      rescue
+        nil
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/run_action_field.rb

@@ -0,0 +1,103 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    # DSL sugar for custom run-action mutation fields (RFC 0013).
+    #
+    #   ActiveAdmin::GraphQL::RunActionField.define(schema.mutation, :create_batch,
+    #     dry_run: true, confirm: true, capability: :support_act) do
+    #     argument :q, GraphQL::Types::JSON, required: true, camelize: false
+    #     preview { |**| ok("would_run:create_batch") }
+    #     resolve { |q:, **| HostService.call(q: q) }
+    #   end
+    module RunActionField
+      module_function
+
+      def define(
+        owner,
+        name,
+        type: RunActionPayload,
+        null: false,
+        camelize: false,
+        dry_run: false,
+        confirm: false,
+        capability: nil,
+        authorize: false,
+        visibility: nil,
+        **kwargs,
+        &block
+      )
+        definition = Definition.new
+        definition.instance_exec(&block) if block
+        unless definition.resolve_proc
+          raise ArgumentError, "run_action_field #{name.inspect} requires a resolve block"
+        end
+
+        owner.field(
+          name,
+          type,
+          null: null,
+          camelize: camelize,
+          dry_run: dry_run,
+          confirm: confirm,
+          preview: definition.preview_proc,
+          capability: capability,
+          authorize: authorize,
+          visibility: visibility,
+          **kwargs,
+          &definition.field_configuration_block
+        )
+
+        resolve_proc = definition.resolve_proc
+        owner.define_method(name) do |**args|
+          resolve_proc.call(**args)
+        end
+      end
+
+      # Block body for {RunActionField.define}.
+      class Definition
+        attr_reader :preview_proc, :resolve_proc
+
+        def initialize
+          @argument_calls = []
+          @arguments_proc = nil
+        end
+
+        def argument(*args, **kwargs)
+          @argument_calls << [args, kwargs]
+        end
+
+        def arguments(&block)
+          @arguments_proc = block
+        end
+
+        def preview(&block)
+          @preview_proc = block
+        end
+
+        def resolve(&block)
+          @resolve_proc = block
+        end
+
+        def ok(body, status: 200)
+          RunActionPreview.new.ok(body, status: status)
+        end
+
+        def refuse(body, status: 422)
+          RunActionPreview.new.refuse(body, status: status)
+        end
+
+        def field_configuration_block
+          argument_calls = @argument_calls
+          arguments_proc = @arguments_proc
+          proc do
+            instance_exec(&arguments_proc) if arguments_proc
+            argument_calls.each do |args, kwargs|
+              argument(*args, **kwargs)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/run_action_mutation_config.rb

@@ -14,6 +14,14 @@ module ActiveAdmin
       attr_accessor :arguments_proc
       # Optional authorization toggle for this mutation configuration. +nil+ means namespace default.
       attr_accessor :authorize
+      # When true, inject +dry_run+ and honor +preview+ (RFC 0010).
+      attr_accessor :dry_run
+      # @return [Proc, nil] preview block for dry-run / refuse-before-run
+      attr_accessor :preview_proc
+      # @return [Array<String>, nil] allowlisted extra GraphQL kwargs forwarded into AA params
+      attr_accessor :extra_param_keys
+      # Optional capability override for this action field (RFC 0012).
+      attr_accessor :capability
 
       def self.ensure_graphql_object_subclass!(type)
         unless type.is_a?(Class) && type < ::GraphQL::Schema::Object

data/lib/active_admin/graphql/run_action_mutation_dsl.rb

@@ -31,6 +31,24 @@ module ActiveAdmin
       def authorize(value = true)
         @mutation_config.authorize = !!value
       end
+
+      # Preview before run / dry-run short-circuit (RFC 0010). Block receives the member record.
+      def preview(&block)
+        @mutation_config.preview_proc = block
+      end
+
+      # Allowlisted GraphQL kwargs forwarded into the ActiveAdmin request (never +id+).
+      def extra_params(*names)
+        @mutation_config.extra_param_keys = names.flatten.map(&:to_s)
+      end
+
+      def ok(body, status: 200)
+        RunActionPreview.new.ok(body, status: status)
+      end
+
+      def refuse(body, status: 422)
+        RunActionPreview.new.refuse(body, status: status)
+      end
     end
   end
 end

data/lib/active_admin/graphql/run_action_preview.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    # Shared +ok+ / +refuse+ helpers for run-action preview blocks (RFC 0010, RFC 0013).
+    class RunActionPreview
+      def ok(body, status: 200)
+        RunActionPayload::Result.new(ok: true, status: status, location: nil, body: body.to_s)
+      end
+
+      def refuse(body, status: 422)
+        RunActionPayload::Result.new(ok: false, status: status, location: nil, body: body.to_s)
+      end
+
+      def self.call(preview_proc, **kwargs)
+        new.instance_exec(**kwargs, &preview_proc)
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/schema_builder/mutation_batch.rb

@@ -15,7 +15,7 @@ module ActiveAdmin
           proc do
             field fname.to_sym, batch_payload_t, null: false, camelize: false,
               visibility: {kind: :mutation_batch_action, graphql_type_name: sb.send(:graphql_type_name_for, aa_res), resource: aa_res, field_name: fname},
-              capability: aa_res.graphql_config.capability_for_mutation(:batch_action),
+              capability: RunActionCapability.resolve(ns, aa_res, :batch),
               description: "Run a batch action registered on #{aa_res.resource_name} (+batch_action+ DSL), " \
                     "same as the index batch UI (+collection_selection+ / +batch_action_inputs+)." do
               argument :batch_action, ::GraphQL::Types::String, required: true, camelize: false
@@ -42,7 +42,7 @@ module ActiveAdmin
               end
               unless Capability.granted?(
                 context,
-                aa_res.graphql_config.capability_for_mutation(:"batch_#{ba.tr("-", "_")}")
+                RunActionCapability.resolve(ns, aa_res, :batch, ba)
               )
                 raise ::GraphQL::ExecutionError, "not authorized for batch action #{ba}"
               end

data/lib/active_admin/graphql/schema_builder/mutation_collection.rb

@@ -21,7 +21,7 @@ module ActiveAdmin
           proc do
             field fname.to_sym, collection_payload_t, null: false, camelize: false,
               visibility: {kind: :mutation_collection_action, graphql_type_name: sb.send(:graphql_type_name_for, aa_res), resource: aa_res, field_name: fname, aggregate: true},
-              capability: aa_res.graphql_config.capability_for_mutation(:collection_action),
+              capability: RunActionCapability.resolve(ns, aa_res, :collection),
               description: "Invoke a +collection_action+ on #{aa_res.resource_name} by name (same scoping as REST +index+). Prefer per-action fields +#{plural}_collection_<action>+ for distinct inputs or return types." do
               argument :action, ::GraphQL::Types::String, required: true, camelize: false
               argument :params, [KeyValuePairInput], required: false, camelize: false,
@@ -46,7 +46,7 @@ module ActiveAdmin
               end
               unless Capability.granted?(
                 context,
-                aa_res.graphql_config.capability_for_mutation(:"collection_#{act.tr("-", "_")}")
+                RunActionCapability.resolve(ns, aa_res, :collection, act)
               )
                 raise ::GraphQL::ExecutionError, "not authorized for collection action #{act}"
               end
@@ -76,6 +76,7 @@ module ActiveAdmin
           fname = field_name.to_sym
           per_cfg = aa_res.graphql_config.collection_action_mutations[action_name]
           collection_payload_t = collection_action_return_type(aa_res, action_name)
+          capability = RunActionCapability.resolve(ns, aa_res, :collection, action_name)
 
           proc do
             field fname, collection_payload_t, null: false, camelize: false,
@@ -86,7 +87,7 @@ module ActiveAdmin
                 field_name: field_name,
                 collection_action: action_name
               },
-              capability: aa_res.graphql_config.capability_for_mutation(:"collection_#{action_name.tr("-", "_")}"),
+              capability: capability,
               description: "Invoke +collection_action+ #{action_name} on #{aa_res.resource_name} (same scoping as REST +index+)." do
               argument :params, [KeyValuePairInput], required: false, camelize: false,
                 description: "Extra request params as flat key/value pairs."

data/lib/active_admin/graphql/schema_builder/mutation_member.rb

@@ -21,7 +21,7 @@ module ActiveAdmin
           proc do
             field fname.to_sym, member_payload_t, null: false, camelize: false,
               visibility: {kind: :mutation_member_action, graphql_type_name: sb.send(:graphql_type_name_for, aa_res), resource: aa_res, field_name: fname, aggregate: true},
-              capability: aa_res.graphql_config.capability_for_mutation(:member_action),
+              capability: MemberActionCapability.resolve(ns, aa_res),
               description: "Invoke a +member_action+ on #{aa_res.resource_name} by name (same scoping as REST +show+). Prefer per-action fields +#{plural}_member_<action>+ for distinct inputs or return types." do
               argument :action, ::GraphQL::Types::String, required: true, camelize: false
               argument :id, ::GraphQL::Types::ID, required: true, camelize: false
@@ -47,7 +47,7 @@ module ActiveAdmin
               end
               unless Capability.granted?(
                 context,
-                aa_res.graphql_config.capability_for_mutation(:"member_#{act.tr("-", "_")}")
+                MemberActionCapability.resolve(ns, aa_res, act)
               )
                 raise ::GraphQL::ExecutionError, "not authorized for member action #{act}"
               end
@@ -78,6 +78,7 @@ module ActiveAdmin
           fname = field_name.to_sym
           per_cfg = aa_res.graphql_config.member_action_mutations[action_name]
           member_payload_t = member_action_return_type(aa_res, action_name)
+          capability = MemberActionCapability.resolve(ns, aa_res, action_name)
 
           proc do
             field fname, member_payload_t, null: false, camelize: false,
@@ -88,11 +89,15 @@ module ActiveAdmin
                 field_name: field_name,
                 member_action: action_name
               },
-              capability: aa_res.graphql_config.capability_for_mutation(:"member_#{action_name.tr("-", "_")}"),
+              capability: capability,
               description: "Invoke +member_action+ #{action_name} on #{aa_res.resource_name} (same scoping as REST +show+)." do
               argument :id, ::GraphQL::Types::ID, required: true, camelize: false
               argument :params, [KeyValuePairInput], required: false, camelize: false,
                 description: "Extra request params as flat key/value pairs."
+              if per_cfg&.dry_run
+                argument :dry_run, ::GraphQL::Types::Boolean, required: false, default_value: false, camelize: false,
+                  description: "When true, preview without performing the member action."
+              end
               if (btc = aa_res.belongs_to_config)
                 argument btc.to_param.to_sym, ::GraphQL::Types::ID, required: btc.required?, camelize: false
               end

data/lib/active_admin/graphql/schema_builder/resolvers.rb

@@ -4,22 +4,29 @@ module ActiveAdmin
   module GraphQL
     class SchemaBuilder
       module Resolvers
-        def mutation_extra_keyword_params(aa_res, kw)
+        def mutation_extra_keyword_params(aa_res, kw, allowlist: nil)
           skip =
             if (btc = aa_res.belongs_to_config)
               [btc.to_param.to_s]
             else
               []
             end
+          skip << "id"
+          skip << "dry_run"
+          allow = allowlist&.map(&:to_s)
+
           kw.each_with_object({}) do |(key, val), h|
             ks = key.to_s
             next if skip.include?(ks)
+            next if allow && !allow.include?(ks)
 
             h[ks] = val
           end
         end
 
         def graphql_resolve_index(aa_res, proxy:, context:, graph_params:, **field_kwargs)
+          invoke_collection_query_policy!(aa_res, context, field_kwargs)
+
           proc_ = aa_res.graphql_config.resolve_index_proc
           base_kwargs = {graph_params: graph_params}.merge(field_kwargs)
           if proc_
@@ -57,9 +64,26 @@ module ActiveAdmin
         end
 
         def graphql_resolve_member_action(aa_res, proxy:, context:, action:, id:, params: nil, **kw)
-          extras = mutation_extra_keyword_params(aa_res, kw)
-          params_h = coerce_action_param_map(params).merge(extras.transform_keys(&:to_s))
           per = aa_res.graphql_config.member_action_mutations[action.to_s]
+          dry_run = !!kw[:dry_run]
+          extras = mutation_extra_keyword_params(aa_res, kw, allowlist: per&.extra_param_keys)
+          params_h = coerce_action_param_map(params).merge(extras.transform_keys(&:to_s))
+          params_h.delete("id")
+
+          if per&.dry_run
+            return MemberActionDryRun.resolve(
+              aa_res,
+              proxy: proxy,
+              context: context,
+              action: action,
+              id: id,
+              params_h: params_h,
+              extras: extras.transform_keys(&:to_sym),
+              per: per,
+              dry_run: dry_run
+            )
+          end
+
           resolve = per&.resolve_proc || aa_res.graphql_config.member_run_action.resolve_proc
           if resolve
             resolve.call(
@@ -70,7 +94,7 @@ module ActiveAdmin
               action: action,
               id: id,
               params: params_h,
-              **extras
+              **extras.transform_keys(&:to_sym)
             )
           else
             proxy.run_member_action(action, id, extra_params: params_h)
@@ -78,9 +102,10 @@ module ActiveAdmin
         end
 
         def graphql_resolve_collection_action(aa_res, proxy:, context:, action:, params: nil, **kw)
-          extras = mutation_extra_keyword_params(aa_res, kw)
-          params_h = coerce_action_param_map(params).merge(extras.transform_keys(&:to_s))
           per = aa_res.graphql_config.collection_action_mutations[action.to_s]
+          extras = mutation_extra_keyword_params(aa_res, kw, allowlist: per&.extra_param_keys)
+          params_h = coerce_action_param_map(params).merge(extras.transform_keys(&:to_s))
+          params_h.delete("id")
           resolve = per&.resolve_proc || aa_res.graphql_config.collection_run_action.resolve_proc
           if resolve
             resolve.call(
@@ -90,7 +115,7 @@ module ActiveAdmin
               auth: context[:auth],
               action: action,
               params: params_h,
-              **extras
+              **extras.transform_keys(&:to_sym)
             )
           else
             proxy.run_collection_action(action, extra_params: params_h)
@@ -105,6 +130,20 @@ module ActiveAdmin
           h.stringify_keys
         end
 
+        def invoke_collection_query_policy!(aa_res, context, field_kwargs)
+          hook = context[:namespace]&.graphql_collection_query_policy
+          return if hook.nil?
+
+          meta = field_kwargs.merge(
+            aa_resource: aa_res,
+            q: field_kwargs[:q],
+            scope: field_kwargs[:scope],
+            order: field_kwargs[:order],
+            filter: field_kwargs[:filter]
+          )
+          hook.call(context, meta)
+        end
+
         public :graphql_resolve_index,
           :graphql_resolve_show,
           :graphql_resolve_batch_action,

data/lib/active_admin/graphql/schema_builder/types_object.rb

@@ -119,7 +119,8 @@ module ActiveAdmin
               null: true,
               camelize: false,
               authorize: false,
-              capability: aa_res.graphql_config.capability_for_field(name)
+              capability: aa_res.graphql_config.capability_for_field(name),
+              capability_mode: aa_res.graphql_config.capability_mode_for_field(name)
             )
 
             type_class.define_method(name.to_sym) { object.public_send(name) }

data/lib/active_admin/graphql/schema_builder/wire.rb

@@ -22,7 +22,8 @@ module ActiveAdmin
 
               type_class.field field_name, @object_types[target], null: true, camelize: false,
                 authorize: false,
-                capability: aa_res.graphql_config.capability_for_field(field_name)
+                capability: aa_res.graphql_config.capability_for_field(field_name),
+                capability_mode: aa_res.graphql_config.capability_mode_for_field(field_name)
 
               type_class.define_method(field_name) do
                 fk_val = object.public_send(fk)

data/lib/active_admin/graphql/schema_field.rb

@@ -2,17 +2,36 @@
 
 module ActiveAdmin
   module GraphQL
-    # Subclass of {::GraphQL::Schema::Field} for namespace +Query+ / +Mutation+ fields.
+    # Subclass of {::GraphQL::Schema::Field} for namespace +Query+ / +Mutation+ fields
+    # and resource object fields.
     #
     # The +visibility:+ keyword accepts an optional Hash of metadata forwarded to
     # +graphql_schema_visible+ (second argument) when {GraphQL::Schema::Visibility} is enabled.
-    # That hook runs from {#visible?}; it does not replace graphql-ruby's visibility system—it
-    # composes with +super+ like any custom +Field+ class.
     #
-    # +capability:+ (RFC 0008) gates +visible?+ and +authorized?+ via +context[:capabilities]+.
+    # +capability:+ (RFC 0008) and +capability_mode:+ (RFC 0009) gate +visible?+ /
+    # +authorized?+ via +context[:capabilities]+. +graphql_field_visible+ may omit fields.
+    # +dry_run:+ / +confirm:+ / +preview:+ (RFC 0013) control custom run-action fields.
     class SchemaField < ::GraphQL::Schema::Field
-      def initialize(visibility: nil, authorize: nil, authorize_action: nil, capability: nil, **kwargs, &block)
+      CAPABILITY_MODES = %i[omit null].freeze
+
+      def initialize(
+        visibility: nil,
+        authorize: nil,
+        authorize_action: nil,
+        capability: nil,
+        capability_mode: nil,
+        dry_run: false,
+        confirm: false,
+        preview: nil,
+        extensions: ::GraphQL::EmptyObjects::EMPTY_ARRAY,
+        **kwargs,
+        &block
+      )
         @capability = capability&.to_sym
+        @capability_mode = normalize_capability_mode(capability_mode)
+        @inject_dry_run = dry_run
+        @inject_confirm = confirm
+        @preview_proc = preview
         @visibility =
           if @capability && visibility.is_a?(Hash) && !visibility.key?(:capability)
             visibility.merge(capability: @capability)
@@ -21,16 +40,30 @@ module ActiveAdmin
           end
         @authorize = authorize
         @authorize_action = authorize_action
-        super(**kwargs, &block)
+        field_extensions = Array(extensions)
+        if @inject_confirm || @preview_proc
+          field_extensions += [{
+            RunActionControlExtension => {confirm: @inject_confirm, preview: @preview_proc}
+          }]
+        end
+        if @inject_dry_run || @inject_confirm || @preview_proc || block
+          super(extensions: field_extensions, **kwargs) do
+            inject_run_action_control_arguments!
+            instance_exec(&block) if block
+          end
+        else
+          super(extensions: field_extensions, **kwargs)
+        end
       end
 
       def visible?(ctx)
         return false unless super
+        return false unless field_visible_by_hook?(ctx)
 
-        # Gate introspection only when Schema::Visibility is enabled; otherwise
-        # capability is enforced in +authorized?+ so hosts without the plugin
-        # do not trip graphql-ruby's legacy Warden +visible?+ path.
-        if ctx[:namespace]&.graphql_visibility && !Capability.granted?(ctx, @capability)
+        if ctx[:namespace]&.graphql_visibility &&
+            @capability &&
+            !Capability.granted?(ctx, @capability) &&
+            capability_mode_for(ctx) == :omit
           return false
         end
 
@@ -60,6 +93,48 @@ module ActiveAdmin
         action = @authorize_action || ActiveAdmin::Authorization::READ
         !!ctx[:auth]&.authorized?(aa_resource, action, object)
       end
+
+      private
+
+      def inject_run_action_control_arguments!
+        if @inject_dry_run
+          argument :dry_run, ::GraphQL::Types::Boolean, required: false, default_value: false, camelize: false,
+            description: "When true, preview without performing the side-effecting action."
+        end
+        if @inject_confirm
+          argument :confirm, ::GraphQL::Types::Boolean, required: false, default_value: false, camelize: false,
+            description: "When false and dry_run is false, refuse with body confirm_required."
+        end
+      end
+
+      def normalize_capability_mode(mode)
+        return nil if mode.nil?
+
+        sym = mode.to_sym
+        unless CAPABILITY_MODES.include?(sym)
+          raise ArgumentError, "capability_mode must be :omit or :null, got #{mode.inspect}"
+        end
+        sym
+      end
+
+      def capability_mode_for(ctx)
+        mode = @capability_mode || ctx[:namespace]&.graphql_field_capability_mode_default || :omit
+        mode.to_sym
+      end
+
+      def field_visible_by_hook?(ctx)
+        hook = ctx[:namespace]&.graphql_field_visible
+        return true if hook.nil?
+
+        owner = self.owner
+        meta = {
+          graphql_type_name: owner.respond_to?(:graphql_name) ? owner.graphql_name : nil,
+          field_name: graphql_name,
+          resource: owner.respond_to?(:activeadmin_graphql_resource) ? owner.activeadmin_graphql_resource : nil
+        }
+        meta = meta.merge(@visibility) if @visibility.is_a?(Hash)
+        !!hook.call(ctx, meta)
+      end
     end
   end
 end

data/lib/active_admin/graphql/version.rb

@@ -2,6 +2,6 @@
 
 module ActiveAdmin
   module GraphQL
-    VERSION = "0.3.3"
+    VERSION = "0.4.0"
   end
 end