activeadmin-graphql 0.3.3 → 0.4.1

data/lib/active_admin/graphql/schema_builder/resolvers.rb

@@ -4,22 +4,29 @@ module ActiveAdmin
   module GraphQL
     class SchemaBuilder
       module Resolvers
-        def mutation_extra_keyword_params(aa_res, kw)
+        def mutation_extra_keyword_params(aa_res, kw, allowlist: nil)
           skip =
             if (btc = aa_res.belongs_to_config)
               [btc.to_param.to_s]
             else
               []
             end
+          skip << "id"
+          skip << "dry_run"
+          allow = allowlist&.map(&:to_s)
+
           kw.each_with_object({}) do |(key, val), h|
             ks = key.to_s
             next if skip.include?(ks)
+            next if allow && !allow.include?(ks)
 
             h[ks] = val
           end
         end
 
         def graphql_resolve_index(aa_res, proxy:, context:, graph_params:, **field_kwargs)
+          invoke_collection_query_policy!(aa_res, context, field_kwargs)
+
           proc_ = aa_res.graphql_config.resolve_index_proc
           base_kwargs = {graph_params: graph_params}.merge(field_kwargs)
           if proc_
@@ -57,9 +64,26 @@ module ActiveAdmin
         end
 
         def graphql_resolve_member_action(aa_res, proxy:, context:, action:, id:, params: nil, **kw)
-          extras = mutation_extra_keyword_params(aa_res, kw)
-          params_h = coerce_action_param_map(params).merge(extras.transform_keys(&:to_s))
           per = aa_res.graphql_config.member_action_mutations[action.to_s]
+          dry_run = !!kw[:dry_run]
+          extras = mutation_extra_keyword_params(aa_res, kw, allowlist: per&.extra_param_keys)
+          params_h = coerce_action_param_map(params).merge(extras.transform_keys(&:to_s))
+          params_h.delete("id")
+
+          if per&.dry_run
+            return MemberActionDryRun.resolve(
+              aa_res,
+              proxy: proxy,
+              context: context,
+              action: action,
+              id: id,
+              params_h: params_h,
+              extras: extras.transform_keys(&:to_sym),
+              per: per,
+              dry_run: dry_run
+            )
+          end
+
           resolve = per&.resolve_proc || aa_res.graphql_config.member_run_action.resolve_proc
           if resolve
             resolve.call(
@@ -70,7 +94,7 @@ module ActiveAdmin
               action: action,
               id: id,
               params: params_h,
-              **extras
+              **extras.transform_keys(&:to_sym)
             )
           else
             proxy.run_member_action(action, id, extra_params: params_h)
@@ -78,9 +102,10 @@ module ActiveAdmin
         end
 
         def graphql_resolve_collection_action(aa_res, proxy:, context:, action:, params: nil, **kw)
-          extras = mutation_extra_keyword_params(aa_res, kw)
-          params_h = coerce_action_param_map(params).merge(extras.transform_keys(&:to_s))
           per = aa_res.graphql_config.collection_action_mutations[action.to_s]
+          extras = mutation_extra_keyword_params(aa_res, kw, allowlist: per&.extra_param_keys)
+          params_h = coerce_action_param_map(params).merge(extras.transform_keys(&:to_s))
+          params_h.delete("id")
           resolve = per&.resolve_proc || aa_res.graphql_config.collection_run_action.resolve_proc
           if resolve
             resolve.call(
@@ -90,7 +115,7 @@ module ActiveAdmin
               auth: context[:auth],
               action: action,
               params: params_h,
-              **extras
+              **extras.transform_keys(&:to_sym)
             )
           else
             proxy.run_collection_action(action, extra_params: params_h)
@@ -105,6 +130,20 @@ module ActiveAdmin
           h.stringify_keys
         end
 
+        def invoke_collection_query_policy!(aa_res, context, field_kwargs)
+          hook = context[:namespace]&.graphql_collection_query_policy
+          return if hook.nil?
+
+          meta = field_kwargs.merge(
+            aa_resource: aa_res,
+            q: field_kwargs[:q],
+            scope: field_kwargs[:scope],
+            order: field_kwargs[:order],
+            filter: field_kwargs[:filter]
+          )
+          hook.call(context, meta)
+        end
+
         public :graphql_resolve_index,
           :graphql_resolve_show,
           :graphql_resolve_batch_action,

data/lib/active_admin/graphql/schema_builder/types_object.rb

@@ -119,7 +119,8 @@ module ActiveAdmin
               null: true,
               camelize: false,
               authorize: false,
-              capability: aa_res.graphql_config.capability_for_field(name)
+              capability: aa_res.graphql_config.capability_for_field(name),
+              capability_mode: aa_res.graphql_config.capability_mode_for_field(name)
             )
 
             type_class.define_method(name.to_sym) { object.public_send(name) }

data/lib/active_admin/graphql/schema_builder/wire.rb

@@ -22,7 +22,8 @@ module ActiveAdmin
 
               type_class.field field_name, @object_types[target], null: true, camelize: false,
                 authorize: false,
-                capability: aa_res.graphql_config.capability_for_field(field_name)
+                capability: aa_res.graphql_config.capability_for_field(field_name),
+                capability_mode: aa_res.graphql_config.capability_mode_for_field(field_name)
 
               type_class.define_method(field_name) do
                 fk_val = object.public_send(fk)

data/lib/active_admin/graphql/schema_field.rb

@@ -2,17 +2,36 @@
 
 module ActiveAdmin
   module GraphQL
-    # Subclass of {::GraphQL::Schema::Field} for namespace +Query+ / +Mutation+ fields.
+    # Subclass of {::GraphQL::Schema::Field} for namespace +Query+ / +Mutation+ fields
+    # and resource object fields.
     #
     # The +visibility:+ keyword accepts an optional Hash of metadata forwarded to
     # +graphql_schema_visible+ (second argument) when {GraphQL::Schema::Visibility} is enabled.
-    # That hook runs from {#visible?}; it does not replace graphql-ruby's visibility system—it
-    # composes with +super+ like any custom +Field+ class.
     #
-    # +capability:+ (RFC 0008) gates +visible?+ and +authorized?+ via +context[:capabilities]+.
+    # +capability:+ (RFC 0008) and +capability_mode:+ (RFC 0009) gate +visible?+ /
+    # +authorized?+ via +context[:capabilities]+. +graphql_field_visible+ may omit fields.
+    # +dry_run:+ / +confirm:+ / +preview:+ (RFC 0013) control custom run-action fields.
     class SchemaField < ::GraphQL::Schema::Field
-      def initialize(visibility: nil, authorize: nil, authorize_action: nil, capability: nil, **kwargs, &block)
+      CAPABILITY_MODES = %i[omit null].freeze
+
+      def initialize(
+        visibility: nil,
+        authorize: nil,
+        authorize_action: nil,
+        capability: nil,
+        capability_mode: nil,
+        dry_run: false,
+        confirm: false,
+        preview: nil,
+        extensions: ::GraphQL::EmptyObjects::EMPTY_ARRAY,
+        **kwargs,
+        &block
+      )
         @capability = capability&.to_sym
+        @capability_mode = normalize_capability_mode(capability_mode)
+        @inject_dry_run = dry_run
+        @inject_confirm = confirm
+        @preview_proc = preview
         @visibility =
           if @capability && visibility.is_a?(Hash) && !visibility.key?(:capability)
             visibility.merge(capability: @capability)
@@ -21,16 +40,30 @@ module ActiveAdmin
           end
         @authorize = authorize
         @authorize_action = authorize_action
-        super(**kwargs, &block)
+        field_extensions = Array(extensions)
+        if @inject_confirm || @preview_proc
+          field_extensions += [{
+            RunActionControlExtension => {confirm: @inject_confirm, preview: @preview_proc}
+          }]
+        end
+        if @inject_dry_run || @inject_confirm || @preview_proc || block
+          super(extensions: field_extensions, **kwargs) do
+            inject_run_action_control_arguments!
+            instance_exec(&block) if block
+          end
+        else
+          super(extensions: field_extensions, **kwargs)
+        end
       end
 
       def visible?(ctx)
         return false unless super
+        return false unless field_visible_by_hook?(ctx)
 
-        # Gate introspection only when Schema::Visibility is enabled; otherwise
-        # capability is enforced in +authorized?+ so hosts without the plugin
-        # do not trip graphql-ruby's legacy Warden +visible?+ path.
-        if ctx[:namespace]&.graphql_visibility && !Capability.granted?(ctx, @capability)
+        if ctx[:namespace]&.graphql_visibility &&
+            @capability &&
+            !Capability.granted?(ctx, @capability) &&
+            capability_mode_for(ctx) == :omit
           return false
         end
 
@@ -60,6 +93,48 @@ module ActiveAdmin
         action = @authorize_action || ActiveAdmin::Authorization::READ
         !!ctx[:auth]&.authorized?(aa_resource, action, object)
       end
+
+      private
+
+      def inject_run_action_control_arguments!
+        if @inject_dry_run
+          argument :dry_run, ::GraphQL::Types::Boolean, required: false, default_value: false, camelize: false,
+            description: "When true, preview without performing the side-effecting action."
+        end
+        if @inject_confirm
+          argument :confirm, ::GraphQL::Types::Boolean, required: false, default_value: false, camelize: false,
+            description: "When false and dry_run is false, refuse with body confirm_required."
+        end
+      end
+
+      def normalize_capability_mode(mode)
+        return nil if mode.nil?
+
+        sym = mode.to_sym
+        unless CAPABILITY_MODES.include?(sym)
+          raise ArgumentError, "capability_mode must be :omit or :null, got #{mode.inspect}"
+        end
+        sym
+      end
+
+      def capability_mode_for(ctx)
+        mode = @capability_mode || ctx[:namespace]&.graphql_field_capability_mode_default || :omit
+        mode.to_sym
+      end
+
+      def field_visible_by_hook?(ctx)
+        hook = ctx[:namespace]&.graphql_field_visible
+        return true if hook.nil?
+
+        owner = self.owner
+        meta = {
+          graphql_type_name: owner.respond_to?(:graphql_name) ? owner.graphql_name : nil,
+          field_name: graphql_name,
+          resource: owner.respond_to?(:activeadmin_graphql_resource) ? owner.activeadmin_graphql_resource : nil
+        }
+        meta = meta.merge(@visibility) if @visibility.is_a?(Hash)
+        !!hook.call(ctx, meta)
+      end
     end
   end
 end

data/lib/active_admin/graphql/version.rb

@@ -2,6 +2,6 @@
 
 module ActiveAdmin
   module GraphQL
-    VERSION = "0.3.3"
+    VERSION = "0.4.1"
   end
 end

data/lib/active_admin/graphql.rb

@@ -69,6 +69,8 @@ module ActiveAdmin
         %w[
           graphql/resource_interface
           graphql/capability
+          graphql/run_action_preview
+          graphql/run_action_control_extension
           graphql/schema_field
           graphql/auth_context
           graphql/record_source
@@ -77,6 +79,11 @@ module ActiveAdmin
           graphql/run_action_payload
           graphql/run_action_mutation_config
           graphql/run_action_mutation_dsl
+          graphql/run_action_field
+          graphql/member_action_dry_run
+          graphql/run_action_capability
+          graphql/member_action_capability
+          graphql/collection_query_policy
           graphql/key_value_pair_input
           graphql/policy_adapter
           graphql/policy_set_cache

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: activeadmin-graphql
 version: !ruby/object:Gem::Version
-  version: 0.3.3
+  version: 0.4.1
 platform: ruby
 authors:
 - Andrei Makarov
@@ -382,6 +382,9 @@ files:
 - docs/changelogs/20261012050051_graphql-surface-toggles.md
 - docs/changelogs/20261012064500_graphql-capabilities.md
 - docs/changelogs/20261012113500_release-0-3-3.md
+- docs/changelogs/20261012200000_host-customization-hooks.md
+- docs/changelogs/20261013080000_release-0-4-0.md
+- docs/changelogs/20261103145000_release-0-4-1.md
 - docs/dependencies/20260907141000_json-cve-2026-71847.md
 - docs/dependencies/20260907141000_sqlite3-ghsa-mwm8-39rw-8826.md
 - docs/dependencies/20260921114000_rails-json-parse-kwargs.md
@@ -397,14 +400,21 @@ files:
 - docs/issues/20261010111159_rails-composite-primary-keys-alignment.md
 - docs/issues/20261010111300_partitions-and-shards-support.md
 - docs/issues/20261010111500_graphql-federation-support.md
+- docs/issues/20261012200000_host-customization-gaps.md
+- docs/issues/20261103145000_engineering-prose-release-audit.md
 - docs/plan/20260817201500_rfc-starter.md
+- docs/reviews/20261028_engineering-audit-release-preparation.md
+- docs/reviews/20261103145000_engineering-prose-release-audit.md
 - lib/active_admin/graphql.rb
 - lib/active_admin/graphql/auth_context.rb
 - lib/active_admin/graphql/capability.rb
 - lib/active_admin/graphql/capability_definition_dsl.rb
+- lib/active_admin/graphql/collection_query_policy.rb
 - lib/active_admin/graphql/engine.rb
 - lib/active_admin/graphql/integration.rb
 - lib/active_admin/graphql/key_value_pair_input.rb
+- lib/active_admin/graphql/member_action_capability.rb
+- lib/active_admin/graphql/member_action_dry_run.rb
 - lib/active_admin/graphql/mutation_execution_error.rb
 - lib/active_admin/graphql/mutation_input_config.rb
 - lib/active_admin/graphql/mutation_input_definition_dsl.rb
@@ -423,9 +433,13 @@ files:
 - lib/active_admin/graphql/resource_query_proxy/controller.rb
 - lib/active_admin/graphql/resource_query_proxy/identity.rb
 - lib/active_admin/graphql/resource_surface_dsl.rb
+- lib/active_admin/graphql/run_action_capability.rb
+- lib/active_admin/graphql/run_action_control_extension.rb
+- lib/active_admin/graphql/run_action_field.rb
 - lib/active_admin/graphql/run_action_mutation_config.rb
 - lib/active_admin/graphql/run_action_mutation_dsl.rb
 - lib/active_admin/graphql/run_action_payload.rb
+- lib/active_admin/graphql/run_action_preview.rb
 - lib/active_admin/graphql/schema_builder.rb
 - lib/active_admin/graphql/schema_builder/build.rb
 - lib/active_admin/graphql/schema_builder/graph_params.rb