activeadmin-graphql 0.3.3 → 0.4.1

data/docs/issues/20260921114500_dependency-audit.md

@@ -4,7 +4,7 @@ Full audit: recon, security, freshness, ecosystem. Depth reached: full for hot-p
 
 ## Participants
 
-Andrei Makarov
+Andrei Makarov (@amkisko)
 
 ## Decisions
 
@@ -20,18 +20,6 @@ Stay on ActiveAdmin 3.5.2. It is the latest stable on RubyGems. 4.0.0.beta23 (20
 
 Do not reverse the 2026-09-17 choice to keep bundle-audit off test.yml. The on-demand workflow remains the gate. Makefile still has no audit target that mirrors that workflow.
 
-## Effects
-
-ruby-advisory-db update: 1245 advisories, last updated 2026-09-16 10:35:37 -0400, commit 44784c295391577f25d198a9205eae4ba73ec4da.
-
-bundle-audit check failed on all four lockfiles with GHSA-rmxg-5p3r-j6hh (graphql 2.6.7, solution >= 2.6.9). No other scanner matches.
-
-bundle outdated --strict on the root Gemfile listed 16 outdated specs. graphql 2.6.7 vs 2.6.10 is the only outdated hot-path direct runtime gem.
-
-Libyears from Gemfile.lock vs RubyGems stable (compact-graph band: about 10 low, about 100 medium): 124 locked packages, 27 outdated, total lag 17.94 years, average 0.145 years per package, 6 packages one major behind (arbre, inherited_resources, json, marcel, diff-lcs, rubocop-capybara). Coverage floor in config/polyrun_coverage.yml is 85 percent line. No upgrade spike was run this pass.
-
-No person-facing surface in this pass.
-
 ## Findings
 
 Tier hot path direct. Kind security. Severity high. Confidence high. Package graphql 2.6.7. Why it matters: Marshal.load of unauthenticated parser cache files is RCE when parse_file runs. Evidence kind observed (bundle-audit, GHSA text, repo grep with no parse_file). Sources: GHSA-rmxg-5p3r-j6hh, ruby-advisory-db. Smallest fix: lock 2.6.10 and gemspec >= 2.6.9. Deeper fix: none. Status: CI graphs affected; this library execute path not_affected. Disposition: upgrade. Next: apply when confirmed.
@@ -52,6 +40,18 @@ Tier dev/test. Kind freshness. Severity low. Confidence high. json 2.21.2 vs 3.0
 
 Tier automation. Kind automation gap. Severity low. Confidence high. Why it matters: Dependabot bundler directory / does not refresh gemfiles/*.gemfile.lock. scorecard.yml still pins actions/checkout 9c091bb (v7.0.0) while test.yml uses 3d3c42e5 (v7.0.1). ossf/scorecard-action 4eaacf05 is v2.4.3; v2.4.4 exists. mschilde/auto-label-merge-conflicts is commented as master. Makefile has no audit target. Evidence kind observed (workflow files, dependabot.yml). Smallest fix: optional action SHA refresh via Dependabot; keep appraisal locks in the on-demand audit. Do not put advisory scanners back on test.yml.
 
+## Effects
+
+ruby-advisory-db update: 1245 advisories, last updated 2026-09-16 10:35:37 -0400, commit 44784c295391577f25d198a9205eae4ba73ec4da.
+
+bundle-audit check failed on all four lockfiles with GHSA-rmxg-5p3r-j6hh (graphql 2.6.7, solution >= 2.6.9). No other scanner matches.
+
+bundle outdated --strict on the root Gemfile listed 16 outdated specs. graphql 2.6.7 vs 2.6.10 is the only outdated hot-path direct runtime gem.
+
+Libyears from Gemfile.lock vs RubyGems stable (compact-graph band: about 10 low, about 100 medium): 124 locked packages, 27 outdated, total lag 17.94 years, average 0.145 years per package, 6 packages one major behind (arbre, inherited_resources, json, marcel, diff-lcs, rubocop-capybara). Coverage floor in config/polyrun_coverage.yml is 85 percent line. No upgrade spike was run this pass.
+
+No person-facing surface in this pass.
+
 ## Next
 
 Wait for a Rails release that includes rails/rails#58601. Then drop the development json < 3 pin and bundle update json. Leave marcel 2 and diff-lcs 2 alone until those parents move.

data/docs/issues/20260921115500_file-length-metrics.md

@@ -2,7 +2,7 @@
 
 ## Participants
 
-Andrei Makarov
+Andrei Makarov (@amkisko)
 
 ## Decisions
 

data/docs/issues/20261010111159_rails-composite-primary-keys-alignment.md

@@ -2,7 +2,7 @@
 
 ## Participants
 
-Andrei Makarov
+Andrei Makarov (@amkisko)
 
 ## Decisions
 
@@ -16,28 +16,28 @@ after shipping inferred id columns and RFC 0007 identity DSL.
 
 ## Effects
 
-Compared gem behavior to the guide’s model, query, form, and parameter rules.
+Compared gem behavior to the guide's model, query, form, and parameter rules.
 
 ActiveRecord composite primary key (self.primary_key = array):
 
-- Aligns: model declares composite key the same way as the guide’s
+- Aligns: model declares composite key the same way as the guide's
   `self.primary_key = [:store_id, :sku]` style. Dummy `LibraryEdition` uses
   `[:book_code, :seq]`.
 - Aligns: internal batch and find paths convert that string id into an ordered
   value list and use Rails tuple/`Relation#find` style lookups
   (`ActiveAdmin::PrimaryKey.dataloader_tuple`, `ResourceQueryProxy` composite
-  branch). That matches the guide’s `Product.find([3, "XYZ12345"])` and
+  branch). That matches the guide's `Product.find([3, "XYZ12345"])` and
   `where(primary_key => [[...], [...]])` idea at the Ruby API layer.
 - Diverges: GraphQL and the published docs encode composite `id` as a JSON
-  object string (`{"book_code":"CPK","seq":7}`), not as the guide’s form/URL
+  object string (`{"book_code":"CPK","seq":7}`), not as the guide's form/URL
   underscore packing (`/books/2_25` with `params.extract_value(:id)`). JSON
   keeps column names explicit and avoids ambiguity when a key value contains
   `_`. Underscore packing is not accepted as GraphQL `id` today.
 - Diverges: GraphQL also accepts per-key arguments and `WhereInput` fields for
-  composite models. The guide’s controller example extracts one `:id` param
+  composite models. The guide's controller example extracts one `:id` param
   into an array; we keep named keys as a GraphQL-friendly alternate.
 - Aligns with guide caution: `where(id: ...)` / `find_by(id:)` on composite
-  models can mean an `:id` attribute, not the full primary key. The gem’s
+  models can mean an `:id` attribute, not the full primary key. The gem's
   GraphQL `id` field is the ActiveAdminResource identity string, not
   necessarily an ActiveRecord `:id` column. Member lookup uses primary-key
   columns (or configured identity), not a bare `where(id: graphql_id)` on
@@ -45,15 +45,15 @@ ActiveRecord composite primary key (self.primary_key = array):
 
 Keyless views and RFC 0007 `graphql { identity ... }`:
 
-- Outside the guide’s scope. The guide assumes a declared composite primary
+- Outside the guide's scope. The guide assumes a declared composite primary
   key on the table/model. AlertEvent-style views with `primary_key = nil` and
   a virtual Ruby `id` are not Rails composite primary keys.
 - `identity :a, :b, :c, separator: ":"` is an application-level encoding so
   GraphQL can share the same string as a hand-rolled `def id; [...].join(":")`.
-  That separator form is closer in spirit to Rails’ delimited URL id than our
+  That separator form is closer in spirit to Rails' delimited URL id than our
   JSON composite encoding, but the delimiter and segment rules are app-chosen,
-  not `extract_value`’s underscore default.
-- Without `separator`, configured multi-column identity reuses the gem’s JSON
+  not `extract_value`'s underscore default.
+- Without `separator`, configured multi-column identity reuses the gem's JSON
   object string so keyless and AR-composite GraphQL ids stay one family.
 
 Stock ActiveAdmin HTML member routes still need a composite-aware
@@ -64,8 +64,8 @@ make Rails form URLs use JSON.
 
 Leave GraphQL composite `id` as JSON for AR composite primary keys unless a
 later RFC deliberately adds underscore (or `extract_value`-compatible) accept
-and emit. Document that choice next to the Rails guide, not as “the same
-format Rails uses for casting composite ids” without qualification.
+and emit. Document that choice next to the Rails guide, not as "the same
+format Rails uses for casting composite ids" without qualification.
 
 No change required for RFC 0007 separator identity; it is the escape hatch
 when the model is not a Rails composite primary key.

data/docs/issues/20261010111300_partitions-and-shards-support.md

@@ -2,7 +2,7 @@
 
 ## Participants
 
-Andrei Makarov
+Andrei Makarov (@amkisko)
 
 ## Decisions
 
@@ -23,7 +23,7 @@ as a product feature and untested in this gem.
 Searched lib, docs, rfcs, and spec for partition, shard, connects_to,
 multiple database, tenant routing, writing_role, and reading_role.
 
-Product code has no shard or partition API. Hits for “shard” and “partition”
+Product code has no shard or partition API. Hits for "shard" and "partition"
 are Polyrun/CI test parallelism and agent IO-fault vocabulary, not databases.
 
 Dummy app uses one SQLite database (`spec/dummy/config/database.yml`). No
@@ -41,7 +41,7 @@ the Rails/ActiveAdmin request boundary (middleware, `connected_to`, custom
 finder). Do not invent gem DSL until a concrete host failure and RFC name the
 contract (shard key in GraphQL args, role switching, cross-shard batch limits).
 
-Optional later: document “unsupported / inherited only” next to identity in
+Optional later: document "unsupported / inherited only" next to identity in
 `docs/graphql-api.md` when a reader asks again.
 
 ## Source

data/docs/issues/20261010111500_graphql-federation-support.md

@@ -2,7 +2,7 @@
 
 ## Participants
 
-Andrei Makarov
+Andrei Makarov (@amkisko)
 
 ## Decisions
 
@@ -34,8 +34,8 @@ tested here.
 ## Next
 
 Keep federation out of scope until a host names a concrete subgraph contract
-and an RFC. Prefer documenting “single-schema admin API; federation
-unsupported” if readers keep asking.
+and an RFC. Prefer documenting "single-schema admin API; federation
+unsupported" if readers keep asking.
 
 ## Source
 

data/docs/issues/20261012200000_host-customization-gaps.md

@@ -0,0 +1,30 @@
+# Host customization gaps
+
+## Participants
+
+Andrei Makarov (@amkisko)
+
+## Decisions
+
+The gem owns mechanics: when a field is visible, null, or omitted; dry-run
+argument wiring; filter-key policy hooks; default member-action capability;
+confirm/dry_run injection on custom fields. Hosts own product grants, domain
+preview bodies, and audit storage.
+
+Capabilities remain grant names in context[:capabilities]. Named visibility
+profiles stay incompatible with graphql_capabilities.
+
+## Effects
+
+RFCs 0009-0013 specify the contract. Implementation landed on the feature
+branch with request coverage for each hook.
+
+## Next
+
+Publish a release. Hosts migrate off local prepends in the order: capability
+null mode and dry-run DSL, then collection policy, then field_visible and
+capability defaults, then confirm helpers.
+
+## Source
+
+RFCs 0009-0013. docs/changelogs/20261012200000_host-customization-hooks.md.

data/docs/issues/20261103145000_engineering-prose-release-audit.md

@@ -0,0 +1,39 @@
+# Engineering, prose, and release audit
+
+## Participants
+
+Andrei Makarov (@amkisko)
+
+## Decisions
+
+- Keep version 0.4.1. Fold audit fixes into the unpublished cut and date the product changelog 2026-11-03.
+- Treat member and registered_resource instance-read denials as missing (null), and update/destroy instance denials as not found, so clients cannot enumerate ids from the error message.
+- Wrap resolve_create hooks in a nested transaction and run instance create authorization before commit.
+- Keep release confirmation EOF as rejection, require a CHANGELOG version heading, and run tests on pull requests to main.
+- Leave policy run-action over-reporting, composite find_members N+1, RecordSource unscoped load, and default-open collection filter policy as follow-up work (medium severity, not cut into 0.4.1).
+
+## Effects
+
+Pipeline: GraphQL HTTP ingress -> schema -> resolve -> auth/policy -> ActiveRecord -> JSON egress. Queue, worker, learned-system, and physical plant modes skipped (absent). Resource and identification: gem execute log keeps namespace, operation name, and error count only.
+
+Ranked fixes applied:
+
+1. Member and registered_resource instance-read deny returns null (high, observed).
+2. Update and destroy instance deny returns not found (high, observed).
+3. resolve_create hook deny rolls back nested transaction (high, observed).
+4. Release changelog heading specs and EOF confirmation coverage (medium, observed).
+5. ASCII punctuation in README, CHANGELOG, and graphql-api guide (house prose).
+6. Docs timestamp trees: Participants handle, Source after Later pass sections.
+
+Checks: rubocop clean on touched files; rspec 197 examples, 0 failures; gem 0.4.1 builds and verifies.
+
+## Next
+
+- Commit the worktree, then run make release for tag and gem push.
+- Follow-up: filter PolicyAdapter run-action lists by per-action authorized?; batch composite find_members; scope RecordSource loads; optional default collection query policy.
+
+## Source
+
+docs/reviews/20261103145000_engineering-prose-release-audit.md
+CHANGELOG.md section 0.4.1 (2026-11-03)
+docs/reviews/20261028_engineering-audit-release-preparation.md

data/docs/plan/20260817201500_rfc-starter.md

@@ -2,7 +2,7 @@
 
 ## Participants
 
-Andrei Makarov
+Andrei Makarov (@amkisko)
 
 ## Decisions
 

data/docs/reviews/20261028_engineering-audit-release-preparation.md

@@ -0,0 +1,24 @@
+# Engineering audit and release preparation
+
+## Participants
+
+Andrei Makarov (@amkisko)
+
+## Decisions
+
+- Treat end-of-input at the release confirmation prompt as rejection.
+- Run tests for pull requests targeting `main`.
+
+## Effects
+
+- `make test`, RBS validation, RuboCop, and the sharded suite pass.
+- The 0.4.1 gem builds and passes `Gem::Package#verify`.
+- A local Rails and ActiveAdmin host cold load used 1.063 CPU seconds and 92,422,144 bytes peak RSS. These are single-machine observations, not release budgets.
+
+## Next
+
+- Review the worktree, commit it, and let the release workflow create the tag and publish the gem.
+
+## Source
+
+Iterative engineering audit on 2026-10-28.

data/docs/reviews/20261103145000_engineering-prose-release-audit.md

@@ -0,0 +1,38 @@
+# Engineering and prose audit before 0.4.1 publish
+
+## Participants
+
+Andrei Makarov (@amkisko)
+
+## Decisions
+
+Re-audit main for the unpublished 0.4.1 cut. Include member auth oracle shape, resolve_create transaction order, release confirmation and changelog gates, pull_request CI, and ASCII docs punctuation. Leave tag and RubyGems publish to make release after commit.
+
+## Effects
+
+Pipeline: POST graphql -> GraphqlController#execute -> schema_for -> resolve -> AuthContext / ResourceQueryProxy -> ActiveRecord -> JSON. Boundary mode covered class vs instance authorization messages. Resource and identification modes: no new person identifiers in gem logs. Queue, worker, learned-system, and physical plant modes skipped (absent).
+
+Ranked fixes applied:
+
+1. Null for denied member and registered_resource reads (high confidence, observed).
+2. not found for denied update and destroy (high confidence, observed).
+3. Nested transaction around resolve_create with instance authorize before commit (high confidence, observed).
+4. Changelog heading and confirmation specs; CHANGELOG dated 2026-11-03.
+5. ASCII punctuation pass on README, CHANGELOG, and docs/graphql-api.md.
+
+Deferred (documented in the issue): PolicyAdapter run-action over-report, composite find_members N+1, RecordSource unscoped PK load, default-open collection q policy.
+
+Checks observed in this session:
+
+- bundle exec rubocop on touched Ruby files: 9 files, no offenses.
+- bundle exec rspec: 197 examples, 0 failures (includes release_version_check and new auth examples).
+- gem build activeadmin-graphql.gemspec and Gem::Package#verify for 0.4.1: ok.
+
+## Next
+
+Commit, then make release.
+
+## Source
+
+- docs/issues/20261103145000_engineering-prose-release-audit.md
+- CHANGELOG.md section 0.4.1 (2026-11-03)

data/lib/active_admin/graphql/capability_definition_dsl.rb

@@ -2,7 +2,7 @@
 
 module ActiveAdmin
   module GraphQL
-    # Block body for +capability :name do ... end+ (RFC 0008).
+    # Block body for +capability :name do ... end+ (RFC 0008, RFC 0009).
     class CapabilityDefinitionDSL
       QUERY_ALIASES = {
         index: :collection,
@@ -14,13 +14,18 @@ module ActiveAdmin
         delete: :destroy
       }.freeze
 
-      def initialize(config, capability_name)
+      def initialize(config, capability_name, mode: nil)
         @config = config
         @capability_name = capability_name.to_sym
+        @mode = mode
       end
 
-      def fields(*names)
-        @config.assign_field_capabilities!(@capability_name, names)
+      def fields(*names, mode: nil)
+        @config.assign_field_capabilities!(
+          @capability_name,
+          names,
+          mode: mode.nil? ? @mode : mode
+        )
       end
 
       def queries(*names)

data/lib/active_admin/graphql/collection_query_policy.rb

@@ -0,0 +1,103 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    # Built-in helpers for +graphql_collection_query_policy+ (RFC 0011).
+    module CollectionQueryPolicy
+      module_function
+
+      def require_visible_fields!(
+        context:,
+        aa_resource:,
+        q: nil,
+        order: nil,
+        allow_q_keys: [],
+        field_grants: {},
+        infer_field_grants: true
+      )
+        allow = Array(allow_q_keys).map(&:to_s)
+        grants = merge_field_grants(aa_resource, field_grants, infer: infer_field_grants)
+
+        normalize_q(q).each_key do |raw_key|
+          key = raw_key.to_s
+          next if allow.include?(key)
+
+          field_name = field_from_predicate_key(key)
+          unless field_name
+            raise ::GraphQL::ExecutionError, "unsupported collection filter key #{key.inspect}"
+          end
+
+          assert_field_filterable!(context, aa_resource, field_name, grants)
+        end
+
+        assert_order_filterable!(context, aa_resource, order, grants) if order.present?
+      end
+
+      def merge_field_grants(aa_resource, field_grants, infer: true)
+        explicit = field_grants.to_h.transform_keys(&:to_s).transform_values(&:to_sym)
+        return explicit unless infer
+
+        inferred = aa_resource.graphql_config.field_capabilities.to_h do |name, capability|
+          [name.to_s, capability.to_sym]
+        end
+        inferred.merge(explicit)
+      end
+
+      def normalize_q(q)
+        return {} if q.nil?
+        return q.to_unsafe_h if q.respond_to?(:to_unsafe_h)
+
+        q.respond_to?(:to_h) ? q.to_h : {}
+      end
+
+      def field_from_predicate_key(key)
+        predicates = ransack_predicate_names
+        predicates.sort_by(&:length).reverse_each do |predicate|
+          suffix = "_#{predicate}"
+          return key[0...-suffix.length] if key.end_with?(suffix) && key.length > suffix.length
+        end
+        nil
+      end
+
+      def ransack_predicate_names
+        if defined?(Ransack) && Ransack.respond_to?(:predicates)
+          Ransack.predicates.keys.map(&:to_s)
+        else
+          %w[eq cont start end gt lt gteq lteq in not_in null present blank matches does_not_match]
+        end
+      end
+
+      def assert_order_filterable!(context, aa_resource, order, grants)
+        column = order.to_s.sub(/_(asc|desc|ascs|descs)\z/i, "")
+        return if column.blank?
+
+        assert_field_filterable!(context, aa_resource, column, grants)
+      end
+
+      def assert_field_filterable!(context, aa_resource, field_name, grants)
+        unless field_schema_visible?(context, aa_resource, field_name)
+          raise ::GraphQL::ExecutionError, "not authorized to filter on #{field_name}"
+        end
+
+        capability = grants[field_name.to_s]
+        return if capability.nil?
+        return if Capability.granted?(context, capability)
+
+        raise ::GraphQL::ExecutionError, "not authorized to filter on #{field_name}"
+      end
+
+      def field_schema_visible?(context, aa_resource, field_name)
+        type_name = graphql_type_name_for(aa_resource)
+        type = context.schema.get_type(type_name, context)
+        return false unless type
+
+        !context.schema.get_field(type, field_name.to_s, context).nil?
+      end
+
+      def graphql_type_name_for(aa_resource)
+        aa_resource.graphql_config.graphql_type_name.presence ||
+          aa_resource.resource_class.name.delete_prefix("::").gsub("::", "__")
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/integration.rb

@@ -26,6 +26,12 @@ module ActiveAdmin
 
       def register_namespace_settings!
         ns = ActiveAdmin::NamespaceSettings
+        register_surface_namespace_settings!(ns)
+        register_capability_namespace_settings!(ns)
+        register_limit_namespace_settings!(ns)
+      end
+
+      def register_surface_namespace_settings!(ns)
         ns.register :graphql, false
         # true preserves 0.3.x: every ActiveRecord resource is in the schema once the namespace endpoint is on.
         # Set false for opt-in per resource (empty graphql block or enable!).
@@ -45,8 +51,26 @@ module ActiveAdmin
         ns.register :graphql_visibility, nil
         ns.register :graphql_visibility_profile, nil
         ns.register :graphql_schema_visible, nil
+      end
+
+      def register_capability_namespace_settings!(ns)
         # Optional Proc +(context_hash) -> Enumerable+ of capability names (RFC 0008).
         ns.register :graphql_capabilities, nil
+        # RFC 0009: default field capability mode (:omit or :null).
+        ns.register :graphql_field_capability_mode_default, :omit
+        # RFC 0009: optional Proc +(context, meta) -> Boolean+ to omit object/root fields.
+        ns.register :graphql_field_visible, nil
+        # RFC 0010: optional Proc +(context, meta) -> void+ after run-action outcomes.
+        ns.register :graphql_run_action_audit, nil
+        # RFC 0011: optional Proc +(context, meta) -> void+ at collection resolve start.
+        ns.register :graphql_collection_query_policy, nil
+        # RFC 0012: optional default capabilities for run-action mutation fields.
+        ns.register :graphql_member_action_capability_default, nil
+        ns.register :graphql_batch_action_capability_default, nil
+        ns.register :graphql_collection_action_capability_default, nil
+      end
+
+      def register_limit_namespace_settings!(ns)
         ns.register :graphql_max_complexity, 300
         ns.register :graphql_max_depth, 18
         ns.register :graphql_batch_action_max_ids, 5000

data/lib/active_admin/graphql/member_action_capability.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    # Compatibility wrapper around {RunActionCapability} for member actions (RFC 0012).
+    module MemberActionCapability
+      module_function
+
+      def resolve(namespace, aa_res, action_name = nil)
+        RunActionCapability.resolve(namespace, aa_res, :member, action_name)
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/member_action_dry_run.rb

@@ -0,0 +1,121 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    # Preview context and resolve helpers for +member_action_mutation dry_run:+ (RFC 0010).
+    class MemberActionDryRun
+      PreviewContext = RunActionPreview
+
+      def self.resolve(
+        aa_res,
+        proxy:,
+        context:,
+        action:,
+        id:,
+        params_h:,
+        extras:,
+        per:,
+        dry_run:
+      )
+        new(aa_res, proxy:, context:, action:, id:, params_h:, extras:, per:, dry_run:).call
+      end
+
+      def initialize(aa_res, proxy:, context:, action:, id:, params_h:, extras:, per:, dry_run:)
+        @aa_res = aa_res
+        @proxy = proxy
+        @context = context
+        @action = action
+        @id = id
+        @params_h = params_h
+        @extras = extras
+        @per = per
+        @dry_run = dry_run
+      end
+
+      def call
+        record = @proxy.find_member(@id)
+        preview_result = run_preview(record)
+
+        if @dry_run
+          result = preview_result || default_dry_run_result(record)
+          audit!(result, dry_run: true)
+          return result
+        end
+
+        if preview_result && !preview_result.ok
+          audit!(preview_result, dry_run: false)
+          return preview_result
+        end
+
+        result = run_action
+        audit!(result, dry_run: false)
+        result
+      end
+
+      private
+
+      def run_preview(record)
+        return nil unless @per.preview_proc
+
+        PreviewContext.new.instance_exec(
+          record,
+          proxy: @proxy,
+          context: @context,
+          aa_resource: @aa_res,
+          auth: @context[:auth],
+          action: @action,
+          id: @id,
+          params: @params_h,
+          **@extras,
+          &@per.preview_proc
+        )
+      end
+
+      def default_dry_run_result(record)
+        body = if record
+          "would_run:#{@action}:#{record.id}"
+        else
+          "would_run:#{@action}"
+        end
+        RunActionPayload::Result.new(ok: true, status: 200, location: nil, body: body)
+      end
+
+      def run_action
+        resolve = @per.resolve_proc || @aa_res.graphql_config.member_run_action.resolve_proc
+        if resolve
+          resolve.call(
+            proxy: @proxy,
+            context: @context,
+            aa_resource: @aa_res,
+            auth: @context[:auth],
+            action: @action,
+            id: @id,
+            params: @params_h,
+            **@extras
+          )
+        else
+          @proxy.run_member_action(@action, @id, extra_params: @params_h)
+        end
+      end
+
+      def audit!(result, dry_run:)
+        hook = @context[:namespace]&.graphql_run_action_audit
+        return if hook.nil?
+
+        hook.call(
+          @context,
+          {
+            action: @action,
+            id: @id,
+            status: result.respond_to?(:status) ? result.status : nil,
+            dry_run: dry_run,
+            ok: result.respond_to?(:ok) ? result.ok : nil,
+            reason: result.respond_to?(:body) ? result.body : nil
+          }
+        )
+      rescue
+        nil
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/resource_capability_dsl.rb

@@ -4,7 +4,7 @@ require_relative "capability_definition_dsl"
 
 module ActiveAdmin
   module GraphQL
-    # +capability+ entry on {ResourceDefinitionDSL} (RFC 0008).
+    # +capability+ entry on {ResourceDefinitionDSL} (RFC 0008, RFC 0009).
     module ResourceCapabilityDSL
       def capability(
         name,
@@ -14,10 +14,11 @@ module ActiveAdmin
         member_actions: nil,
         batch_actions: nil,
         collection_actions: nil,
+        mode: nil,
         &block
       )
-        body = CapabilityDefinitionDSL.new(@config, name)
-        body.fields(*fields) if fields
+        body = CapabilityDefinitionDSL.new(@config, name, mode: mode)
+        body.fields(*fields, mode: mode) if fields
         body.queries(*queries) if queries
         body.mutations(*mutations) if mutations
         body.member_actions(*member_actions) if member_actions