activeadmin-graphql 0.4.0 → 0.4.1

data/docs/issues/20261010111159_rails-composite-primary-keys-alignment.md

@@ -2,7 +2,7 @@
 
 ## Participants
 
-Andrei Makarov
+Andrei Makarov (@amkisko)
 
 ## Decisions
 
@@ -16,28 +16,28 @@ after shipping inferred id columns and RFC 0007 identity DSL.
 
 ## Effects
 
-Compared gem behavior to the guide’s model, query, form, and parameter rules.
+Compared gem behavior to the guide's model, query, form, and parameter rules.
 
 ActiveRecord composite primary key (self.primary_key = array):
 
-- Aligns: model declares composite key the same way as the guide’s
+- Aligns: model declares composite key the same way as the guide's
   `self.primary_key = [:store_id, :sku]` style. Dummy `LibraryEdition` uses
   `[:book_code, :seq]`.
 - Aligns: internal batch and find paths convert that string id into an ordered
   value list and use Rails tuple/`Relation#find` style lookups
   (`ActiveAdmin::PrimaryKey.dataloader_tuple`, `ResourceQueryProxy` composite
-  branch). That matches the guide’s `Product.find([3, "XYZ12345"])` and
+  branch). That matches the guide's `Product.find([3, "XYZ12345"])` and
   `where(primary_key => [[...], [...]])` idea at the Ruby API layer.
 - Diverges: GraphQL and the published docs encode composite `id` as a JSON
-  object string (`{"book_code":"CPK","seq":7}`), not as the guide’s form/URL
+  object string (`{"book_code":"CPK","seq":7}`), not as the guide's form/URL
   underscore packing (`/books/2_25` with `params.extract_value(:id)`). JSON
   keeps column names explicit and avoids ambiguity when a key value contains
   `_`. Underscore packing is not accepted as GraphQL `id` today.
 - Diverges: GraphQL also accepts per-key arguments and `WhereInput` fields for
-  composite models. The guide’s controller example extracts one `:id` param
+  composite models. The guide's controller example extracts one `:id` param
   into an array; we keep named keys as a GraphQL-friendly alternate.
 - Aligns with guide caution: `where(id: ...)` / `find_by(id:)` on composite
-  models can mean an `:id` attribute, not the full primary key. The gem’s
+  models can mean an `:id` attribute, not the full primary key. The gem's
   GraphQL `id` field is the ActiveAdminResource identity string, not
   necessarily an ActiveRecord `:id` column. Member lookup uses primary-key
   columns (or configured identity), not a bare `where(id: graphql_id)` on
@@ -45,15 +45,15 @@ ActiveRecord composite primary key (self.primary_key = array):
 
 Keyless views and RFC 0007 `graphql { identity ... }`:
 
-- Outside the guide’s scope. The guide assumes a declared composite primary
+- Outside the guide's scope. The guide assumes a declared composite primary
   key on the table/model. AlertEvent-style views with `primary_key = nil` and
   a virtual Ruby `id` are not Rails composite primary keys.
 - `identity :a, :b, :c, separator: ":"` is an application-level encoding so
   GraphQL can share the same string as a hand-rolled `def id; [...].join(":")`.
-  That separator form is closer in spirit to Rails’ delimited URL id than our
+  That separator form is closer in spirit to Rails' delimited URL id than our
   JSON composite encoding, but the delimiter and segment rules are app-chosen,
-  not `extract_value`’s underscore default.
-- Without `separator`, configured multi-column identity reuses the gem’s JSON
+  not `extract_value`'s underscore default.
+- Without `separator`, configured multi-column identity reuses the gem's JSON
   object string so keyless and AR-composite GraphQL ids stay one family.
 
 Stock ActiveAdmin HTML member routes still need a composite-aware
@@ -64,8 +64,8 @@ make Rails form URLs use JSON.
 
 Leave GraphQL composite `id` as JSON for AR composite primary keys unless a
 later RFC deliberately adds underscore (or `extract_value`-compatible) accept
-and emit. Document that choice next to the Rails guide, not as “the same
-format Rails uses for casting composite ids” without qualification.
+and emit. Document that choice next to the Rails guide, not as "the same
+format Rails uses for casting composite ids" without qualification.
 
 No change required for RFC 0007 separator identity; it is the escape hatch
 when the model is not a Rails composite primary key.

data/docs/issues/20261010111300_partitions-and-shards-support.md

@@ -2,7 +2,7 @@
 
 ## Participants
 
-Andrei Makarov
+Andrei Makarov (@amkisko)
 
 ## Decisions
 
@@ -23,7 +23,7 @@ as a product feature and untested in this gem.
 Searched lib, docs, rfcs, and spec for partition, shard, connects_to,
 multiple database, tenant routing, writing_role, and reading_role.
 
-Product code has no shard or partition API. Hits for “shard” and “partition”
+Product code has no shard or partition API. Hits for "shard" and "partition"
 are Polyrun/CI test parallelism and agent IO-fault vocabulary, not databases.
 
 Dummy app uses one SQLite database (`spec/dummy/config/database.yml`). No
@@ -41,7 +41,7 @@ the Rails/ActiveAdmin request boundary (middleware, `connected_to`, custom
 finder). Do not invent gem DSL until a concrete host failure and RFC name the
 contract (shard key in GraphQL args, role switching, cross-shard batch limits).
 
-Optional later: document “unsupported / inherited only” next to identity in
+Optional later: document "unsupported / inherited only" next to identity in
 `docs/graphql-api.md` when a reader asks again.
 
 ## Source

data/docs/issues/20261010111500_graphql-federation-support.md

@@ -2,7 +2,7 @@
 
 ## Participants
 
-Andrei Makarov
+Andrei Makarov (@amkisko)
 
 ## Decisions
 
@@ -34,8 +34,8 @@ tested here.
 ## Next
 
 Keep federation out of scope until a host names a concrete subgraph contract
-and an RFC. Prefer documenting “single-schema admin API; federation
-unsupported” if readers keep asking.
+and an RFC. Prefer documenting "single-schema admin API; federation
+unsupported" if readers keep asking.
 
 ## Source
 

data/docs/issues/20261012200000_host-customization-gaps.md

@@ -1,5 +1,9 @@
 # Host customization gaps
 
+## Participants
+
+Andrei Makarov (@amkisko)
+
 ## Decisions
 
 The gem owns mechanics: when a field is visible, null, or omitted; dry-run
@@ -12,7 +16,7 @@ profiles stay incompatible with graphql_capabilities.
 
 ## Effects
 
-RFCs 0009–0013 specify the contract. Implementation landed on the feature
+RFCs 0009-0013 specify the contract. Implementation landed on the feature
 branch with request coverage for each hook.
 
 ## Next
@@ -23,4 +27,4 @@ capability defaults, then confirm helpers.
 
 ## Source
 
-RFCs 0009–0013. docs/changelogs/20261012200000_host-customization-hooks.md.
+RFCs 0009-0013. docs/changelogs/20261012200000_host-customization-hooks.md.

data/docs/issues/20261103145000_engineering-prose-release-audit.md

@@ -0,0 +1,39 @@
+# Engineering, prose, and release audit
+
+## Participants
+
+Andrei Makarov (@amkisko)
+
+## Decisions
+
+- Keep version 0.4.1. Fold audit fixes into the unpublished cut and date the product changelog 2026-11-03.
+- Treat member and registered_resource instance-read denials as missing (null), and update/destroy instance denials as not found, so clients cannot enumerate ids from the error message.
+- Wrap resolve_create hooks in a nested transaction and run instance create authorization before commit.
+- Keep release confirmation EOF as rejection, require a CHANGELOG version heading, and run tests on pull requests to main.
+- Leave policy run-action over-reporting, composite find_members N+1, RecordSource unscoped load, and default-open collection filter policy as follow-up work (medium severity, not cut into 0.4.1).
+
+## Effects
+
+Pipeline: GraphQL HTTP ingress -> schema -> resolve -> auth/policy -> ActiveRecord -> JSON egress. Queue, worker, learned-system, and physical plant modes skipped (absent). Resource and identification: gem execute log keeps namespace, operation name, and error count only.
+
+Ranked fixes applied:
+
+1. Member and registered_resource instance-read deny returns null (high, observed).
+2. Update and destroy instance deny returns not found (high, observed).
+3. resolve_create hook deny rolls back nested transaction (high, observed).
+4. Release changelog heading specs and EOF confirmation coverage (medium, observed).
+5. ASCII punctuation in README, CHANGELOG, and graphql-api guide (house prose).
+6. Docs timestamp trees: Participants handle, Source after Later pass sections.
+
+Checks: rubocop clean on touched files; rspec 197 examples, 0 failures; gem 0.4.1 builds and verifies.
+
+## Next
+
+- Commit the worktree, then run make release for tag and gem push.
+- Follow-up: filter PolicyAdapter run-action lists by per-action authorized?; batch composite find_members; scope RecordSource loads; optional default collection query policy.
+
+## Source
+
+docs/reviews/20261103145000_engineering-prose-release-audit.md
+CHANGELOG.md section 0.4.1 (2026-11-03)
+docs/reviews/20261028_engineering-audit-release-preparation.md

data/docs/plan/20260817201500_rfc-starter.md

@@ -2,7 +2,7 @@
 
 ## Participants
 
-Andrei Makarov
+Andrei Makarov (@amkisko)
 
 ## Decisions
 

data/docs/reviews/20261028_engineering-audit-release-preparation.md

@@ -0,0 +1,24 @@
+# Engineering audit and release preparation
+
+## Participants
+
+Andrei Makarov (@amkisko)
+
+## Decisions
+
+- Treat end-of-input at the release confirmation prompt as rejection.
+- Run tests for pull requests targeting `main`.
+
+## Effects
+
+- `make test`, RBS validation, RuboCop, and the sharded suite pass.
+- The 0.4.1 gem builds and passes `Gem::Package#verify`.
+- A local Rails and ActiveAdmin host cold load used 1.063 CPU seconds and 92,422,144 bytes peak RSS. These are single-machine observations, not release budgets.
+
+## Next
+
+- Review the worktree, commit it, and let the release workflow create the tag and publish the gem.
+
+## Source
+
+Iterative engineering audit on 2026-10-28.

data/docs/reviews/20261103145000_engineering-prose-release-audit.md

@@ -0,0 +1,38 @@
+# Engineering and prose audit before 0.4.1 publish
+
+## Participants
+
+Andrei Makarov (@amkisko)
+
+## Decisions
+
+Re-audit main for the unpublished 0.4.1 cut. Include member auth oracle shape, resolve_create transaction order, release confirmation and changelog gates, pull_request CI, and ASCII docs punctuation. Leave tag and RubyGems publish to make release after commit.
+
+## Effects
+
+Pipeline: POST graphql -> GraphqlController#execute -> schema_for -> resolve -> AuthContext / ResourceQueryProxy -> ActiveRecord -> JSON. Boundary mode covered class vs instance authorization messages. Resource and identification modes: no new person identifiers in gem logs. Queue, worker, learned-system, and physical plant modes skipped (absent).
+
+Ranked fixes applied:
+
+1. Null for denied member and registered_resource reads (high confidence, observed).
+2. not found for denied update and destroy (high confidence, observed).
+3. Nested transaction around resolve_create with instance authorize before commit (high confidence, observed).
+4. Changelog heading and confirmation specs; CHANGELOG dated 2026-11-03.
+5. ASCII punctuation pass on README, CHANGELOG, and docs/graphql-api.md.
+
+Deferred (documented in the issue): PolicyAdapter run-action over-report, composite find_members N+1, RecordSource unscoped PK load, default-open collection q policy.
+
+Checks observed in this session:
+
+- bundle exec rubocop on touched Ruby files: 9 files, no offenses.
+- bundle exec rspec: 197 examples, 0 failures (includes release_version_check and new auth examples).
+- gem build activeadmin-graphql.gemspec and Gem::Package#verify for 0.4.1: ok.
+
+## Next
+
+Commit, then make release.
+
+## Source
+
+- docs/issues/20261103145000_engineering-prose-release-audit.md
+- CHANGELOG.md section 0.4.1 (2026-11-03)

data/lib/active_admin/graphql/schema_builder/mutation_create.rb

@@ -35,32 +35,32 @@ module ActiveAdmin
                 input,
                 attribute_names: aa_res.graphql_create_attribute_names
               )
-              record = if (hook = aa_res.graphql_config.resolve_create_proc)
-                hook.call(
-                  proxy: proxy,
-                  input: input,
-                  attributes: attrs,
-                  context: context,
-                  auth: auth,
-                  aa_resource: aa_res
-                )
+              if (hook = aa_res.graphql_config.resolve_create_proc)
+                ActiveRecord::Base.transaction(requires_new: true) do
+                  record = hook.call(
+                    proxy: proxy,
+                    input: input,
+                    attributes: attrs,
+                    context: context,
+                    auth: auth,
+                    aa_resource: aa_res
+                  )
+                  unless auth.authorized?(aa_res, ActiveAdmin::Authorization::CREATE, record)
+                    raise ::GraphQL::ExecutionError, "not authorized to create this record"
+                  end
+                  record
+                end
               else
-                r = proxy.build_new(attrs)
-                unless auth.authorized?(aa_res, ActiveAdmin::Authorization::CREATE, r)
+                record = proxy.build_new(attrs)
+                unless auth.authorized?(aa_res, ActiveAdmin::Authorization::CREATE, record)
                   raise ::GraphQL::ExecutionError, "not authorized to create this record"
                 end
 
-                unless r.save
-                  raise MutationExecutionError.validation(r)
+                unless record.save
+                  raise MutationExecutionError.validation(record)
                 end
-                r
-              end
-
-              unless auth.authorized?(aa_res, ActiveAdmin::Authorization::CREATE, record)
-                raise ::GraphQL::ExecutionError, "not authorized to create this record"
+                record
               end
-
-              record
             end
           end
         end

data/lib/active_admin/graphql/schema_builder/mutation_update_destroy.rb

@@ -38,9 +38,8 @@ module ActiveAdmin
               )
               record = proxy.find_member(rid)
               raise ::GraphQL::ExecutionError, "not found" unless record
-
               unless auth.authorized?(aa_res, ActiveAdmin::Authorization::UPDATE, record)
-                raise ::GraphQL::ExecutionError, "not authorized to update this record"
+                raise ::GraphQL::ExecutionError, "not found"
               end
 
               attrs = sb.assignable_slice_from_input(
@@ -105,9 +104,8 @@ module ActiveAdmin
               )
               record = proxy.find_member(rid)
               raise ::GraphQL::ExecutionError, "not found" unless record
-
               unless auth.authorized?(aa_res, ActiveAdmin::Authorization::DESTROY, record)
-                raise ::GraphQL::ExecutionError, "not authorized to destroy this record"
+                raise ::GraphQL::ExecutionError, "not found"
               end
 
               if (hook = aa_res.graphql_config.resolve_destroy_proc)

data/lib/active_admin/graphql/schema_builder/query_type_member.rb

@@ -79,10 +79,7 @@ module ActiveAdmin
                 id_argument: id
               )
               return nil unless record
-
-              unless auth.authorized?(aa_res, ActiveAdmin::Authorization::READ, record)
-                raise ::GraphQL::ExecutionError, "not authorized to read this record"
-              end
+              return nil unless auth.authorized?(aa_res, ActiveAdmin::Authorization::READ, record)
 
               record
             end

data/lib/active_admin/graphql/schema_builder/query_type_registered.rb

@@ -42,10 +42,7 @@ module ActiveAdmin
                 graph_params: graph_params
               )
               return nil unless record
-
-              unless auth.authorized?(aa_res, ActiveAdmin::Authorization::READ, record)
-                raise ::GraphQL::ExecutionError, "not authorized to read this record"
-              end
+              return nil unless auth.authorized?(aa_res, ActiveAdmin::Authorization::READ, record)
 
               record
             end

data/lib/active_admin/graphql/version.rb

@@ -2,6 +2,6 @@
 
 module ActiveAdmin
   module GraphQL
-    VERSION = "0.4.0"
+    VERSION = "0.4.1"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: activeadmin-graphql
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.4.1
 platform: ruby
 authors:
 - Andrei Makarov
@@ -384,6 +384,7 @@ files:
 - docs/changelogs/20261012113500_release-0-3-3.md
 - docs/changelogs/20261012200000_host-customization-hooks.md
 - docs/changelogs/20261013080000_release-0-4-0.md
+- docs/changelogs/20261103145000_release-0-4-1.md
 - docs/dependencies/20260907141000_json-cve-2026-71847.md
 - docs/dependencies/20260907141000_sqlite3-ghsa-mwm8-39rw-8826.md
 - docs/dependencies/20260921114000_rails-json-parse-kwargs.md
@@ -400,7 +401,10 @@ files:
 - docs/issues/20261010111300_partitions-and-shards-support.md
 - docs/issues/20261010111500_graphql-federation-support.md
 - docs/issues/20261012200000_host-customization-gaps.md
+- docs/issues/20261103145000_engineering-prose-release-audit.md
 - docs/plan/20260817201500_rfc-starter.md
+- docs/reviews/20261028_engineering-audit-release-preparation.md
+- docs/reviews/20261103145000_engineering-prose-release-audit.md
 - lib/active_admin/graphql.rb
 - lib/active_admin/graphql/auth_context.rb
 - lib/active_admin/graphql/capability.rb