activerecord-sort 6.1.0.2 → 7.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5ee5bd719bed4e5e0588390935e7b237f58689dc469eab9a4940ee61117ca567
-  data.tar.gz: f3f6ea7df7d2d07d8f13acf20cc11bddcd6fa992bbb9572b378695ba6c18d628
+  metadata.gz: ec46a72d471b80abc582726404812b56fb9a89176349d5609b9734a6227c4c61
+  data.tar.gz: dd93e9fd01692c8113898c9c34aac125af3288a8b4d92d0be047660f396ace24
 SHA512:
-  metadata.gz: f6e95a89312f348f886a61b723d0f138947520e94cb58248b6eeff25cbfdca65d6bfdb34721ec661c2a9a8c6dfb9cc1e7be1cb1f195d7e57850a2a77d1475e60
-  data.tar.gz: 7ffe6b076093a14bdfd1b75f6863d5ac17e4bcdcaebf60c8233137637d4f100cb8e5dbaabd2176701db10f9262d2f52bcf7e8865f60c01e0e2be057515f85988
+  metadata.gz: 56688dd4bc023b5098de0792f27309452dd85d46bf56f905ae771b9ff3154d5c0ef5c9348a52e363b3a4ed20987805eb7f1e66384faf4eca40429ac126eb15ec
+  data.tar.gz: 8950bc656939f09fb886d5c917fb12a295a3da80d6d79a59ffde629a909c82a335aea17ce3cb5fbaceb4c1e5925261e11e536853321c89e58896dca9c66e2cff

data/CHANGELOG.md

@@ -0,0 +1,28 @@
+## [7.0.0]
+
+The gem's version is now independent of the Rails version it targets.
+
+### Breaking Changes
+
+- Removed the public `random_sort` method. Use `sort(:random)` instead.
+
+### Changed
+
+- Require `activerecord >= 8.0.0, < 9.0`; support for Rails 7.1 and 7.2 has
+  been dropped.
+- Require `arel-extensions >= 9.0.0`.
+- `#sort` called with no arguments now falls back to Ruby's `Enumerable#sort`
+  (loads the records and sorts them by `<=>`) instead of returning the
+  relation. Pass arguments to use the ordering DSL; `sort(nil)` and `sort([])`
+  still return the relation for chaining.
+
+### Internal
+
+- The `sort`, `sort_for_column`, and `sort_for_relation` methods are now
+  defined in an `ActiveRecord::Sort` module prepended onto
+  `ActiveRecord::QueryMethods`, rather than reopening `QueryMethods` directly.
+  Relations still respond to them, but they no longer appear in
+  `ActiveRecord::QueryMethods.public_instance_methods(false)` — which keeps
+  Rails' internal delegation invariants intact.
+
+[7.0.0]: https://github.com/malomalo/activerecord-sort/releases/tag/v7.0.0

data/README.md

@@ -1,11 +1,19 @@
 # ActiveRecord::Sort
 
-`ActiveRecord::Sort` provides and easy way to accept user input and order a query by the input.
+`ActiveRecord::Sort` provides an easy, safe way to accept user input and order a
+query by it. Only recognized columns and associations produce SQL — anything
+else raises `ActiveRecord::StatementInvalid`, so it's safe to pass request
+parameters straight through.
+
+Requirements
+------------
+
+- Rails / ActiveRecord >= 8.0
 
 Installation
 ------------
 
-Add `sunstone` to your Gemfile and run `bundle`:
+Add `activerecord-sort` to your Gemfile and run `bundle`:
 
 ```ruby
 gem 'activerecord-sort', require: 'active_record/sort'
@@ -15,8 +23,10 @@ Or install the gem and require it:
 
 ```sh
 gem install activerecord-sort
-irb
-# => require('active_record/sort')
+```
+
+```ruby
+require 'active_record/sort'
 ```
 
 Examples
@@ -33,14 +43,14 @@ Property.sort(:id, :name).to_sql
 Property.sort(id: :desc).to_sql
 # => "...ORDER BY properties.id DESC"
 
-Property.sort(id: {asc: :nulls_first})
+Property.sort(id: {asc: :nulls_first}).to_sql
 # => "...ORDER BY properties.id ASC NULLS FIRST"
 
-Property.sort(id: {asc: :nulls_last})
+Property.sort(id: {asc: :nulls_last}).to_sql
 # => "...ORDER BY properties.id ASC NULLS LAST"
 ```
 
-It can also sort on relations:
+It can also sort on associations:
 
 ```ruby
 Property.sort(addresses: :id).to_sql
@@ -51,7 +61,29 @@ Property.sort(addresses: {id: :desc}).to_sql
 # => "...INNER JOIN addresses ON addresses.property_id = properties.id
 # => "   ORDER BY addresses.id DESC"
 
-Property.sort(addresses: {id: {asc: :nulls_frist}}).to_sql
+Property.sort(addresses: {id: {asc: :nulls_first}}).to_sql
 # => "...INNER JOIN addresses ON addresses.property_id = properties.id
 # => "   ORDER BY addresses.id ASC NULLS FIRST"
 ```
+
+Order randomly:
+
+```ruby
+Property.sort(:random).to_sql
+# => "...ORDER BY RANDOM()"
+```
+
+Unrecognized columns raise, so unfiltered params can't inject SQL:
+
+```ruby
+Property.sort(:name_or_something_unexpected)
+# => raises ActiveRecord::StatementInvalid
+```
+
+Called with no arguments, `#sort` behaves like Ruby's `Enumerable#sort` —
+it loads the records and sorts them by `<=>` — rather than building a query:
+
+```ruby
+Property.all.sort            # => Array of Property, sorted by <=>
+Property.sort(nil)           # => relation (unchanged), for chaining
+```

data/ext/active_record/base.rb

@@ -0,0 +1,134 @@
+require 'active_record'
+require 'active_record/relation'
+
+module ActiveRecord
+  # Prepended onto ActiveRecord::QueryMethods (see lib/active_record/sort.rb).
+  # Living in a separate module keeps these methods out of
+  # QueryMethods.public_instance_methods(false) — which Rails' own
+  # delegation tests assert against — while relations still respond to them.
+  module Sort
+
+    # ordering:
+    # :id
+    # :name, :id
+    # :id => :desc
+    # :id => {:desc => :nulls_last}
+    # :listings => :id
+    # :listings => {:id => {:asc => :nulls_first}}
+    # :random
+    def sort(*ordering, &block)
+      # With no arguments, fall back to Ruby's Enumerable#sort so code (and
+      # Rails' own test suite) that calls `relation.sort` expecting Ruby
+      # semantics keeps working. The ordering DSL only applies when given
+      # arguments; `sort(nil)`/`sort([])` still return the relation for
+      # chaining.
+      return super(&block) if ordering.empty?
+
+      resource = all
+      ordering.compact!
+      ordering.flatten!
+      return resource if ordering.size == 0
+
+      order_columns = []
+      ordering.each do |order|
+        order = Array(order)
+        order.each do |column_or_relation, options|
+          if column_or_relation.to_sym == :random
+            resource = resource.order(Arel::Nodes::RandomOrdering.new)
+          elsif self.column_names.include?(column_or_relation.to_s)
+            resource = resource.sort_for_column(self.arel_table[column_or_relation.to_s], options)
+          elsif reflect_on_association(column_or_relation.to_sym)
+            resource = resource.sort_for_relation(column_or_relation.to_sym, options, order_columns)
+          else
+            raise ActiveRecord::StatementInvalid.new("Unkown column #{column_or_relation}")
+          end
+        end
+      end
+      
+      if order_columns.present?
+        resource = resource.select(resource.klass.arel_table[Arel::Nodes::SqlLiteral.new('*')], *order_columns)
+      end
+
+      resource
+    end
+
+    # TODO: probably don't need to cast to sym
+    def sort_for_column(column, options)
+      direction = (options.is_a?(Hash) || options.class.name == "ActionController::Parameters" ? options.keys.first.to_sym : options.to_s.downcase.to_sym)
+
+      nulls = (options.is_a?(Hash) ? options.values.first.to_sym : nil)
+      if direction == :desc
+        self.order(Arel::Nodes::Descending.new(column, nulls))
+      elsif direction == :asc || direction == :''
+        self.order(Arel::Nodes::Ascending.new(column, nulls))
+      else
+        raise ActiveRecord::StatementInvalid.new("Unkown ordering #{direction}")
+      end
+    end
+
+    def sort_for_relation(relation, options, order_columns)
+      resource = self
+      relation = reflect_on_association(relation)
+
+      if relation.macro == :has_many
+        options = [options] if !options.is_a?(Array)
+
+        options.each do |order|
+          order = Array(order)
+          order.each do |column, options|
+            column = Arel::Attributes::Relation.new(relation.klass.arel_table[column], relation.name)
+            order_columns.push(column)
+            direction = (options.is_a?(Hash) ? options.keys.first.to_sym : options.to_s.downcase.to_sym)
+
+            nulls = (options.is_a?(Hash) ? options.values.first.to_sym : nil)
+            if direction == :desc
+              # aggregation = Arel::Nodes::Max.new([column], "max_#{relation.name}_#{column.name}")
+              # order = Arel::Nodes::Descending.new(Arel::Nodes::SqlLiteral.new("max_#{relation.name}_#{column.name}"), nulls)
+
+              if relation.options[:through]
+                resource = resource.joins(relation.options[:through] => relation.source_reflection_name)
+              else
+                resource = resource.joins(relation.name)
+              end
+              # resource = resource.select(aggregation)
+              # resource = resource.order(order)
+              resource = resource.order(Arel::Nodes::Descending.new(column, nulls))
+            else
+              # aggregation = Arel::Nodes::Min.new([column], "min_#{relation.name}_#{column.name}")
+              order = Arel::Nodes::Ascending.new(Arel::Nodes::SqlLiteral.new("min_#{relation.name}_#{column.name}"), nulls)
+
+              resource = resource.joins(relation.name)
+              # resource = resource.select(aggregation)
+              # resource = resource.order(order)
+              resource = resource.order(Arel::Nodes::Ascending.new(column, nulls))
+            end
+          end
+        end
+      elsif relation.macro == :belongs_to || relation.macro == :has_one
+        options = [options] if !options.is_a?(Array)
+
+        options.each do |order|
+          order = Array(order)
+          order.each do |column, options|
+            column = relation.klass.arel_table[column]
+            order_columns.push(column)
+            direction = (options.is_a?(Hash) ? options.keys.first.to_sym : options.to_s.downcase.to_sym)
+
+            nulls = (options.is_a?(Hash) ? options.values.first.to_sym : nil)
+            if direction == :asc
+              order = Arel::Nodes::Ascending.new(column, nulls)
+            else
+              order = Arel::Nodes::Descending.new(column, nulls)
+            end
+
+            resource = resource.left_outer_joins(relation.name)
+            resource = resource.order(order)
+          end
+        end
+      end
+
+      resource
+    end
+
+  end
+end

data/lib/active_record/sort/version.rb

@@ -1,5 +1,5 @@
 module ActiveRecord
   module Sort
-    VERSION = '6.1.0.2'
+    VERSION = '7.0.0'
   end
 end

data/lib/active_record/sort.rb

@@ -1,126 +1,7 @@
 require 'active_record'
-require 'active_record/relation'
 require 'arel/extensions'
 
-module ActiveRecord
-  module Sort
-
-    # ordering:
-    # :id
-    # :name, :id
-    # :id => :desc
-    # :id => {:desc => :nulls_last}
-    # :listings => :id
-    # :listings => {:id => {:asc => :nulls_first}}
-    # :random
-    def sort(*ordering)
-      resource = all
-      ordering.compact!
-      ordering.flatten!
-      return resource if ordering.size == 0
-      
-      ordering.each do |order|
-        order = Array(order)
-
-        order.each do |column_or_relation, options|
-          if column_or_relation.to_sym == :random
-            resource = resource.random_sort
-          elsif self.column_names.include?(column_or_relation.to_s)
-            resource = resource.sort_for_column(self.arel_table[column_or_relation.to_s], options)
-          elsif reflect_on_association(column_or_relation.to_sym)
-            resource = resource.select(resource.klass.arel_table[Arel::Nodes::SqlLiteral.new('*')])
-            resource = resource.sort_for_relation(column_or_relation.to_sym, options)
-          else
-            raise ActiveRecord::StatementInvalid.new("Unkown column #{column_or_relation}")
-          end
-        end
-      end
-
-      resource
-    end
-    
-    def random_sort
-      self.order(Arel::Nodes::RandomOrdering.new)
-    end
-
-    # TODO: probably don't need to cast to sym
-    def sort_for_column(column, options)
-      direction = (options.is_a?(Hash) || options.class.name == "ActionController::Parameters" ? options.keys.first.to_sym : options.to_s.downcase.to_sym)
-
-      nulls = (options.is_a?(Hash) ? options.values.first.to_sym : nil)
-      if direction == :desc
-        self.order(Arel::Nodes::Descending.new(column, nulls))
-      elsif direction == :asc || direction == :''
-        self.order(Arel::Nodes::Ascending.new(column, nulls))
-      else
-        raise ActiveRecord::StatementInvalid.new("Unkown ordering #{direction}")
-      end
-    end
-
-    def sort_for_relation(relation, options)
-      resource = self
-      relation = reflect_on_association(relation)
-
-      if relation.macro == :has_many
-        options = [options] if !options.is_a?(Array)
-
-        options.each do |order|
-          order = Array(order)
-          order.each do |column, options|
-            column = Arel::Attributes::Relation.new(relation.klass.arel_table[column], relation.name)
-            direction = (options.is_a?(Hash) ? options.keys.first.to_sym : options.to_s.downcase.to_sym)
-
-            nulls = (options.is_a?(Hash) ? options.values.first.to_sym : nil)
-            if direction == :desc
-              # aggregation = Arel::Nodes::Max.new([column], "max_#{relation.name}_#{column.name}")
-              # order = Arel::Nodes::Descending.new(Arel::Nodes::SqlLiteral.new("max_#{relation.name}_#{column.name}"), nulls)
-
-              if relation.options[:through]
-                resource = resource.joins(relation.options[:through] => relation.source_reflection_name)
-              else
-                resource = resource.joins(relation.name)
-              end
-              # resource = resource.select(aggregation)
-              # resource = resource.order(order)
-              resource = resource.order(Arel::Nodes::Descending.new(column, nulls))
-            else
-              # aggregation = Arel::Nodes::Min.new([column], "min_#{relation.name}_#{column.name}")
-              order = Arel::Nodes::Ascending.new(Arel::Nodes::SqlLiteral.new("min_#{relation.name}_#{column.name}"), nulls)
-
-              resource = resource.joins(relation.name)
-              # resource = resource.select(aggregation)
-              # resource = resource.order(order)
-              resource = resource.order(Arel::Nodes::Ascending.new(column, nulls))
-            end
-          end
-        end
-      elsif relation.macro == :belongs_to || relation.macro == :has_one
-        options = [options] if !options.is_a?(Array)
-
-        options.each do |order|
-          order = Array(order)
-          order.each do |column, options|
-            column = relation.klass.arel_table[column]
-            direction = (options.is_a?(Hash) ? options.keys.first.to_sym : options.to_s.downcase.to_sym)
-
-            nulls = (options.is_a?(Hash) ? options.values.first.to_sym : nil)
-            if direction == :asc
-              order = Arel::Nodes::Ascending.new(column, nulls)
-            else
-              order = Arel::Nodes::Descending.new(column, nulls)
-            end
-
-            resource = resource.left_outer_joins(relation.name)
-            resource = resource.order(order)
-          end
-        end
-      end
-
-      resource
-    end
-
-  end
-end
+require File.expand_path(File.join(__FILE__, '../../../ext/active_record/base'))
 
 ActiveRecord::QueryMethods.prepend(ActiveRecord::Sort)
 ActiveRecord::Querying.delegate :sort, to: :all

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: activerecord-sort
 version: !ruby/object:Gem::Version
-  version: 6.1.0.2
+  version: 7.0.0
 platform: ruby
 authors:
 - Jon Bracy
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-03-23 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activerecord
@@ -16,28 +15,34 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 6.1.0
+        version: 8.0.0
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 6.1.0
+        version: 8.0.0
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9.0'
 - !ruby/object:Gem::Dependency
   name: arel-extensions
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 6.1.0
+        version: 9.0.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 6.1.0
+        version: 9.0.0
 - !ruby/object:Gem::Dependency
   name: pg
   requirement: !ruby/object:Gem::Requirement
@@ -52,20 +57,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-- !ruby/object:Gem::Dependency
-  name: bundler
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -156,14 +147,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 6.1.0.2
+        version: 7.0.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 6.1.0.2
+        version: 7.0.0
 - !ruby/object:Gem::Dependency
   name: webmock
   requirement: !ruby/object:Gem::Requirement
@@ -178,42 +169,43 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-description: A safe way to accept user parameters and order against your ActiveRecord
-  Models
+description: 'Adds a #sort query method to ActiveRecord that turns whitelisted user-supplied
+  parameters into ORDER BY clauses -- ordering by columns or associations, ascending/descending,
+  with NULLS handling and random ordering -- without exposing you to SQL injection.'
 email:
 - jonbracy@gmail.com
 executables: []
 extensions: []
-extra_rdoc_files:
-- README.md
+extra_rdoc_files: []
 files:
+- CHANGELOG.md
 - LICENSE
 - README.md
+- ext/active_record/base.rb
 - lib/active_record/sort.rb
 - lib/active_record/sort/version.rb
 homepage: https://github.com/malomalo/activerecord-sort
 licenses:
 - MIT
-metadata: {}
-post_install_message:
-rdoc_options:
-- "--main"
-- README.md
+metadata:
+  source_code_uri: https://github.com/malomalo/activerecord-sort
+  changelog_uri: https://github.com/malomalo/activerecord-sort/blob/master/CHANGELOG.md
+  rubygems_mfa_required: 'true'
+rdoc_options: []
 require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: '3.3'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.3
-signing_key:
+rubygems_version: 4.0.11
 specification_version: 4
 summary: A safe way to accept user parameters and order against your ActiveRecord
   Models