activeadmin-graphql 0.3.3 → 0.4.1

data/lib/active_admin/graphql/resource_capability_maps.rb

@@ -2,12 +2,16 @@
 
 module ActiveAdmin
   module GraphQL
-    # Capability → member maps on {ResourceConfig} (RFC 0008).
+    # Capability → member maps on {ResourceConfig} (RFC 0008, RFC 0009).
     module ResourceCapabilityMaps
       def field_capabilities
         @field_capabilities ||= {}
       end
 
+      def field_capability_modes
+        @field_capability_modes ||= {}
+      end
+
       def query_capabilities
         @query_capabilities ||= {}
       end
@@ -20,6 +24,10 @@ module ActiveAdmin
         field_capabilities[name.to_sym]
       end
 
+      def capability_mode_for_field(name)
+        field_capability_modes[name.to_sym]
+      end
+
       def capability_for_query(kind)
         query_capabilities[kind.to_sym]
       end
@@ -28,8 +36,18 @@ module ActiveAdmin
         mutation_capabilities[kind.to_sym]
       end
 
-      def assign_field_capabilities!(capability_name, names)
+      def assign_field_capabilities!(capability_name, names, mode: nil)
         assign_capabilities!(field_capabilities, capability_name, names, label: "field")
+        return if mode.nil?
+
+        resolved = mode.to_sym
+        unless %i[omit null].include?(resolved)
+          raise ArgumentError, "capability mode must be :omit or :null, got #{mode.inspect}"
+        end
+
+        names.flatten.each do |name|
+          field_capability_modes[name.to_sym] = resolved
+        end
       end
 
       def assign_query_capabilities!(capability_name, names)

data/lib/active_admin/graphql/resource_definition_dsl.rb

@@ -103,21 +103,32 @@ module ActiveAdmin
       end
 
       # Pair +type+ and +resolve+ for +posts_batch_action+ (graphql-ruby-style block).
-      def batch_action_mutation(&block)
-        RunActionMutationDSL.new(@config.batch_run_action).instance_exec(&block)
+      # +capability:+ overrides the resource map / namespace default for the aggregate field (RFC 0012).
+      def batch_action_mutation(capability: nil, &block)
+        cfg = @config.batch_run_action
+        cfg.capability = capability.to_sym if capability
+        RunActionMutationDSL.new(cfg).instance_exec(&block) if block
+        cfg
       end
 
       # With no name: configures the aggregate +posts_member_action(action: …)+ field.
       # With a symbol/string: configures +posts_member_<action>+ (one field per +member_action+), so each
       # action can use its own +type+, +resolve+, +arguments+, and GraphQL inputs.
-      def member_action_mutation(name = nil, &block)
+      # +dry_run:+ / +capability:+ apply to named per-action fields (RFC 0010, RFC 0012).
+      def member_action_mutation(name = nil, dry_run: false, capability: nil, &block)
         cfg = name.nil? ? @config.member_run_action : @config.member_action_mutation_for(name)
-        RunActionMutationDSL.new(cfg).instance_exec(&block)
+        cfg.dry_run = true if dry_run
+        cfg.capability = capability.to_sym if capability
+        RunActionMutationDSL.new(cfg).instance_exec(&block) if block
+        cfg
       end
 
-      def collection_action_mutation(name = nil, &block)
+      def collection_action_mutation(name = nil, dry_run: false, capability: nil, &block)
         cfg = name.nil? ? @config.collection_run_action : @config.collection_action_mutation_for(name)
-        RunActionMutationDSL.new(cfg).instance_exec(&block)
+        cfg.dry_run = true if dry_run
+        cfg.capability = capability.to_sym if capability
+        RunActionMutationDSL.new(cfg).instance_exec(&block) if block
+        cfg
       end
 
       # Default return type for all run-action fields unless a kind-specific +type+ is set inside

data/lib/active_admin/graphql/run_action_capability.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    # Resolves the capability for batch / member / collection run-action fields (RFC 0012).
+    module RunActionCapability
+      KINDS = %i[batch member collection].freeze
+
+      module_function
+
+      # @param kind [Symbol] +:batch+, +:member+, or +:collection+
+      # @param action_name [String, Symbol, nil] per-action name; +nil+ for the aggregate field
+      def resolve(namespace, aa_res, kind, action_name = nil)
+        kind = kind.to_sym
+        unless KINDS.include?(kind)
+          raise ArgumentError, "run-action kind must be one of #{KINDS.inspect}, got #{kind.inspect}"
+        end
+
+        if action_name
+          per_capability = per_action_config_capability(aa_res, kind, action_name)
+          return per_capability if per_capability
+
+          mapped = aa_res.graphql_config.capability_for_mutation(
+            :"#{kind}_#{action_name.to_s.tr("-", "_")}"
+          )
+        else
+          aggregate_capability = aggregate_config_capability(aa_res, kind)
+          return aggregate_capability if aggregate_capability
+
+          mapped = aa_res.graphql_config.capability_for_mutation(:"#{kind}_action")
+        end
+        return mapped if mapped
+
+        namespace.public_send(:"graphql_#{kind}_action_capability_default")&.to_sym
+      end
+
+      def per_action_config_capability(aa_res, kind, action_name)
+        map =
+          case kind
+          when :member then aa_res.graphql_config.member_action_mutations
+          when :collection then aa_res.graphql_config.collection_action_mutations
+          when :batch then nil
+          end
+        return nil unless map
+
+        map[action_name.to_s]&.capability
+      end
+      module_function :per_action_config_capability
+
+      def aggregate_config_capability(aa_res, kind)
+        cfg =
+          case kind
+          when :member then aa_res.graphql_config.member_run_action
+          when :batch then aa_res.graphql_config.batch_run_action
+          when :collection then aa_res.graphql_config.collection_run_action
+          end
+        cfg&.capability
+      end
+      module_function :aggregate_config_capability
+    end
+  end
+end

data/lib/active_admin/graphql/run_action_control_extension.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    # Confirm gate and optional preview short-circuit for custom run-action fields (RFC 0013).
+    class RunActionControlExtension < ::GraphQL::Schema::FieldExtension
+      def resolve(arguments:, context:, object: nil, objects: nil)
+        if options[:confirm] && !arguments[:dry_run] && !arguments[:confirm]
+          result = RunActionPayload::Result.new(
+            ok: false, status: 422, location: nil, body: "confirm_required"
+          )
+          audit!(context, result, dry_run: false)
+          return result
+        end
+
+        preview_proc = options[:preview]
+        if preview_proc
+          preview_result = run_preview(preview_proc, arguments, context)
+
+          if arguments[:dry_run]
+            result = preview_result || default_dry_run_result
+            audit!(context, result, dry_run: true)
+            return result
+          end
+
+          if preview_result&.respond_to?(:ok) && !preview_result.ok
+            audit!(context, preview_result, dry_run: false)
+            return preview_result
+          end
+        end
+
+        yield(object.nil? ? objects : object, arguments, nil)
+      end
+
+      private
+
+      def run_preview(preview_proc, arguments, context)
+        kwargs = arguments.respond_to?(:to_h) ? arguments.to_h : arguments
+        kwargs = kwargs.merge(context: context)
+        RunActionPreview.call(preview_proc, **kwargs.transform_keys(&:to_sym))
+      end
+
+      def default_dry_run_result
+        RunActionPayload::Result.new(
+          ok: true,
+          status: 200,
+          location: nil,
+          body: "would_run:#{field.graphql_name}"
+        )
+      end
+
+      def audit!(context, result, dry_run:)
+        hook = context[:namespace]&.graphql_run_action_audit
+        return if hook.nil?
+
+        hook.call(
+          context,
+          {
+            action: field.graphql_name,
+            id: nil,
+            status: result.respond_to?(:status) ? result.status : nil,
+            dry_run: dry_run,
+            ok: result.respond_to?(:ok) ? result.ok : nil,
+            reason: result.respond_to?(:body) ? result.body : nil
+          }
+        )
+      rescue
+        nil
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/run_action_field.rb

@@ -0,0 +1,103 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    # DSL sugar for custom run-action mutation fields (RFC 0013).
+    #
+    #   ActiveAdmin::GraphQL::RunActionField.define(schema.mutation, :create_batch,
+    #     dry_run: true, confirm: true, capability: :support_act) do
+    #     argument :q, GraphQL::Types::JSON, required: true, camelize: false
+    #     preview { |**| ok("would_run:create_batch") }
+    #     resolve { |q:, **| HostService.call(q: q) }
+    #   end
+    module RunActionField
+      module_function
+
+      def define(
+        owner,
+        name,
+        type: RunActionPayload,
+        null: false,
+        camelize: false,
+        dry_run: false,
+        confirm: false,
+        capability: nil,
+        authorize: false,
+        visibility: nil,
+        **kwargs,
+        &block
+      )
+        definition = Definition.new
+        definition.instance_exec(&block) if block
+        unless definition.resolve_proc
+          raise ArgumentError, "run_action_field #{name.inspect} requires a resolve block"
+        end
+
+        owner.field(
+          name,
+          type,
+          null: null,
+          camelize: camelize,
+          dry_run: dry_run,
+          confirm: confirm,
+          preview: definition.preview_proc,
+          capability: capability,
+          authorize: authorize,
+          visibility: visibility,
+          **kwargs,
+          &definition.field_configuration_block
+        )
+
+        resolve_proc = definition.resolve_proc
+        owner.define_method(name) do |**args|
+          resolve_proc.call(**args)
+        end
+      end
+
+      # Block body for {RunActionField.define}.
+      class Definition
+        attr_reader :preview_proc, :resolve_proc
+
+        def initialize
+          @argument_calls = []
+          @arguments_proc = nil
+        end
+
+        def argument(*args, **kwargs)
+          @argument_calls << [args, kwargs]
+        end
+
+        def arguments(&block)
+          @arguments_proc = block
+        end
+
+        def preview(&block)
+          @preview_proc = block
+        end
+
+        def resolve(&block)
+          @resolve_proc = block
+        end
+
+        def ok(body, status: 200)
+          RunActionPreview.new.ok(body, status: status)
+        end
+
+        def refuse(body, status: 422)
+          RunActionPreview.new.refuse(body, status: status)
+        end
+
+        def field_configuration_block
+          argument_calls = @argument_calls
+          arguments_proc = @arguments_proc
+          proc do
+            instance_exec(&arguments_proc) if arguments_proc
+            argument_calls.each do |args, kwargs|
+              argument(*args, **kwargs)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/run_action_mutation_config.rb

@@ -14,6 +14,14 @@ module ActiveAdmin
       attr_accessor :arguments_proc
       # Optional authorization toggle for this mutation configuration. +nil+ means namespace default.
       attr_accessor :authorize
+      # When true, inject +dry_run+ and honor +preview+ (RFC 0010).
+      attr_accessor :dry_run
+      # @return [Proc, nil] preview block for dry-run / refuse-before-run
+      attr_accessor :preview_proc
+      # @return [Array<String>, nil] allowlisted extra GraphQL kwargs forwarded into AA params
+      attr_accessor :extra_param_keys
+      # Optional capability override for this action field (RFC 0012).
+      attr_accessor :capability
 
       def self.ensure_graphql_object_subclass!(type)
         unless type.is_a?(Class) && type < ::GraphQL::Schema::Object

data/lib/active_admin/graphql/run_action_mutation_dsl.rb

@@ -31,6 +31,24 @@ module ActiveAdmin
       def authorize(value = true)
         @mutation_config.authorize = !!value
       end
+
+      # Preview before run / dry-run short-circuit (RFC 0010). Block receives the member record.
+      def preview(&block)
+        @mutation_config.preview_proc = block
+      end
+
+      # Allowlisted GraphQL kwargs forwarded into the ActiveAdmin request (never +id+).
+      def extra_params(*names)
+        @mutation_config.extra_param_keys = names.flatten.map(&:to_s)
+      end
+
+      def ok(body, status: 200)
+        RunActionPreview.new.ok(body, status: status)
+      end
+
+      def refuse(body, status: 422)
+        RunActionPreview.new.refuse(body, status: status)
+      end
     end
   end
 end

data/lib/active_admin/graphql/run_action_preview.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    # Shared +ok+ / +refuse+ helpers for run-action preview blocks (RFC 0010, RFC 0013).
+    class RunActionPreview
+      def ok(body, status: 200)
+        RunActionPayload::Result.new(ok: true, status: status, location: nil, body: body.to_s)
+      end
+
+      def refuse(body, status: 422)
+        RunActionPayload::Result.new(ok: false, status: status, location: nil, body: body.to_s)
+      end
+
+      def self.call(preview_proc, **kwargs)
+        new.instance_exec(**kwargs, &preview_proc)
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/schema_builder/mutation_batch.rb

@@ -15,7 +15,7 @@ module ActiveAdmin
           proc do
             field fname.to_sym, batch_payload_t, null: false, camelize: false,
               visibility: {kind: :mutation_batch_action, graphql_type_name: sb.send(:graphql_type_name_for, aa_res), resource: aa_res, field_name: fname},
-              capability: aa_res.graphql_config.capability_for_mutation(:batch_action),
+              capability: RunActionCapability.resolve(ns, aa_res, :batch),
               description: "Run a batch action registered on #{aa_res.resource_name} (+batch_action+ DSL), " \
                     "same as the index batch UI (+collection_selection+ / +batch_action_inputs+)." do
               argument :batch_action, ::GraphQL::Types::String, required: true, camelize: false
@@ -42,7 +42,7 @@ module ActiveAdmin
               end
               unless Capability.granted?(
                 context,
-                aa_res.graphql_config.capability_for_mutation(:"batch_#{ba.tr("-", "_")}")
+                RunActionCapability.resolve(ns, aa_res, :batch, ba)
               )
                 raise ::GraphQL::ExecutionError, "not authorized for batch action #{ba}"
               end

data/lib/active_admin/graphql/schema_builder/mutation_collection.rb

@@ -21,7 +21,7 @@ module ActiveAdmin
           proc do
             field fname.to_sym, collection_payload_t, null: false, camelize: false,
               visibility: {kind: :mutation_collection_action, graphql_type_name: sb.send(:graphql_type_name_for, aa_res), resource: aa_res, field_name: fname, aggregate: true},
-              capability: aa_res.graphql_config.capability_for_mutation(:collection_action),
+              capability: RunActionCapability.resolve(ns, aa_res, :collection),
               description: "Invoke a +collection_action+ on #{aa_res.resource_name} by name (same scoping as REST +index+). Prefer per-action fields +#{plural}_collection_<action>+ for distinct inputs or return types." do
               argument :action, ::GraphQL::Types::String, required: true, camelize: false
               argument :params, [KeyValuePairInput], required: false, camelize: false,
@@ -46,7 +46,7 @@ module ActiveAdmin
               end
               unless Capability.granted?(
                 context,
-                aa_res.graphql_config.capability_for_mutation(:"collection_#{act.tr("-", "_")}")
+                RunActionCapability.resolve(ns, aa_res, :collection, act)
               )
                 raise ::GraphQL::ExecutionError, "not authorized for collection action #{act}"
               end
@@ -76,6 +76,7 @@ module ActiveAdmin
           fname = field_name.to_sym
           per_cfg = aa_res.graphql_config.collection_action_mutations[action_name]
           collection_payload_t = collection_action_return_type(aa_res, action_name)
+          capability = RunActionCapability.resolve(ns, aa_res, :collection, action_name)
 
           proc do
             field fname, collection_payload_t, null: false, camelize: false,
@@ -86,7 +87,7 @@ module ActiveAdmin
                 field_name: field_name,
                 collection_action: action_name
               },
-              capability: aa_res.graphql_config.capability_for_mutation(:"collection_#{action_name.tr("-", "_")}"),
+              capability: capability,
               description: "Invoke +collection_action+ #{action_name} on #{aa_res.resource_name} (same scoping as REST +index+)." do
               argument :params, [KeyValuePairInput], required: false, camelize: false,
                 description: "Extra request params as flat key/value pairs."

data/lib/active_admin/graphql/schema_builder/mutation_create.rb

@@ -35,32 +35,32 @@ module ActiveAdmin
                 input,
                 attribute_names: aa_res.graphql_create_attribute_names
               )
-              record = if (hook = aa_res.graphql_config.resolve_create_proc)
-                hook.call(
-                  proxy: proxy,
-                  input: input,
-                  attributes: attrs,
-                  context: context,
-                  auth: auth,
-                  aa_resource: aa_res
-                )
+              if (hook = aa_res.graphql_config.resolve_create_proc)
+                ActiveRecord::Base.transaction(requires_new: true) do
+                  record = hook.call(
+                    proxy: proxy,
+                    input: input,
+                    attributes: attrs,
+                    context: context,
+                    auth: auth,
+                    aa_resource: aa_res
+                  )
+                  unless auth.authorized?(aa_res, ActiveAdmin::Authorization::CREATE, record)
+                    raise ::GraphQL::ExecutionError, "not authorized to create this record"
+                  end
+                  record
+                end
               else
-                r = proxy.build_new(attrs)
-                unless auth.authorized?(aa_res, ActiveAdmin::Authorization::CREATE, r)
+                record = proxy.build_new(attrs)
+                unless auth.authorized?(aa_res, ActiveAdmin::Authorization::CREATE, record)
                   raise ::GraphQL::ExecutionError, "not authorized to create this record"
                 end
 
-                unless r.save
-                  raise MutationExecutionError.validation(r)
+                unless record.save
+                  raise MutationExecutionError.validation(record)
                 end
-                r
-              end
-
-              unless auth.authorized?(aa_res, ActiveAdmin::Authorization::CREATE, record)
-                raise ::GraphQL::ExecutionError, "not authorized to create this record"
+                record
               end
-
-              record
             end
           end
         end

data/lib/active_admin/graphql/schema_builder/mutation_member.rb

@@ -21,7 +21,7 @@ module ActiveAdmin
           proc do
             field fname.to_sym, member_payload_t, null: false, camelize: false,
               visibility: {kind: :mutation_member_action, graphql_type_name: sb.send(:graphql_type_name_for, aa_res), resource: aa_res, field_name: fname, aggregate: true},
-              capability: aa_res.graphql_config.capability_for_mutation(:member_action),
+              capability: MemberActionCapability.resolve(ns, aa_res),
               description: "Invoke a +member_action+ on #{aa_res.resource_name} by name (same scoping as REST +show+). Prefer per-action fields +#{plural}_member_<action>+ for distinct inputs or return types." do
               argument :action, ::GraphQL::Types::String, required: true, camelize: false
               argument :id, ::GraphQL::Types::ID, required: true, camelize: false
@@ -47,7 +47,7 @@ module ActiveAdmin
               end
               unless Capability.granted?(
                 context,
-                aa_res.graphql_config.capability_for_mutation(:"member_#{act.tr("-", "_")}")
+                MemberActionCapability.resolve(ns, aa_res, act)
               )
                 raise ::GraphQL::ExecutionError, "not authorized for member action #{act}"
               end
@@ -78,6 +78,7 @@ module ActiveAdmin
           fname = field_name.to_sym
           per_cfg = aa_res.graphql_config.member_action_mutations[action_name]
           member_payload_t = member_action_return_type(aa_res, action_name)
+          capability = MemberActionCapability.resolve(ns, aa_res, action_name)
 
           proc do
             field fname, member_payload_t, null: false, camelize: false,
@@ -88,11 +89,15 @@ module ActiveAdmin
                 field_name: field_name,
                 member_action: action_name
               },
-              capability: aa_res.graphql_config.capability_for_mutation(:"member_#{action_name.tr("-", "_")}"),
+              capability: capability,
               description: "Invoke +member_action+ #{action_name} on #{aa_res.resource_name} (same scoping as REST +show+)." do
               argument :id, ::GraphQL::Types::ID, required: true, camelize: false
               argument :params, [KeyValuePairInput], required: false, camelize: false,
                 description: "Extra request params as flat key/value pairs."
+              if per_cfg&.dry_run
+                argument :dry_run, ::GraphQL::Types::Boolean, required: false, default_value: false, camelize: false,
+                  description: "When true, preview without performing the member action."
+              end
               if (btc = aa_res.belongs_to_config)
                 argument btc.to_param.to_sym, ::GraphQL::Types::ID, required: btc.required?, camelize: false
               end

data/lib/active_admin/graphql/schema_builder/mutation_update_destroy.rb

@@ -38,9 +38,8 @@ module ActiveAdmin
               )
               record = proxy.find_member(rid)
               raise ::GraphQL::ExecutionError, "not found" unless record
-
               unless auth.authorized?(aa_res, ActiveAdmin::Authorization::UPDATE, record)
-                raise ::GraphQL::ExecutionError, "not authorized to update this record"
+                raise ::GraphQL::ExecutionError, "not found"
               end
 
               attrs = sb.assignable_slice_from_input(
@@ -105,9 +104,8 @@ module ActiveAdmin
               )
               record = proxy.find_member(rid)
               raise ::GraphQL::ExecutionError, "not found" unless record
-
               unless auth.authorized?(aa_res, ActiveAdmin::Authorization::DESTROY, record)
-                raise ::GraphQL::ExecutionError, "not authorized to destroy this record"
+                raise ::GraphQL::ExecutionError, "not found"
               end
 
               if (hook = aa_res.graphql_config.resolve_destroy_proc)

data/lib/active_admin/graphql/schema_builder/query_type_member.rb

@@ -79,10 +79,7 @@ module ActiveAdmin
                 id_argument: id
               )
               return nil unless record
-
-              unless auth.authorized?(aa_res, ActiveAdmin::Authorization::READ, record)
-                raise ::GraphQL::ExecutionError, "not authorized to read this record"
-              end
+              return nil unless auth.authorized?(aa_res, ActiveAdmin::Authorization::READ, record)
 
               record
             end

data/lib/active_admin/graphql/schema_builder/query_type_registered.rb

@@ -42,10 +42,7 @@ module ActiveAdmin
                 graph_params: graph_params
               )
               return nil unless record
-
-              unless auth.authorized?(aa_res, ActiveAdmin::Authorization::READ, record)
-                raise ::GraphQL::ExecutionError, "not authorized to read this record"
-              end
+              return nil unless auth.authorized?(aa_res, ActiveAdmin::Authorization::READ, record)
 
               record
             end