admin_suite 0.2.8 → 0.3.0

data/lib/generators/admin_suite/install/templates/admin_suite.rb

@@ -2,16 +2,33 @@
 
 # AdminSuite configuration (host app adapter layer).
 AdminSuite.configure do |config|
-  # Hook called as a before_action inside the engine.
-  # config.authenticate = ->(controller) { ... }
-  config.authenticate = nil
+  # --- Authentication (REQUIRED — AdminSuite fails closed) ---
+  #
+  # Built-in HTTP Basic (reads ADMIN_SUITE_USERNAME / ADMIN_SUITE_PASSWORD):
+  config.auth_strategy = :http_basic
+  # config.auth_options = { username: ENV["ADMIN_SUITE_USERNAME"], password: ENV["ADMIN_SUITE_PASSWORD"] }
+  #
+  # Or a custom strategy (e.g. your SSO). Subclass AdminSuite::Auth::Strategy,
+  # return an actor from #authenticate!(controller), and register it:
+  #   AdminSuite::Auth.register(:my_sso, MySsoStrategy)
+  #   config.auth_strategy = :my_sso
+  #
+  # Or the legacy lambda (still supported):
+  # config.authenticate = ->(controller) { ... render/redirect to deny ... }
+  #
+  # Development/test only — run without authentication (ignored in production):
+  # config.allow_unauthenticated = true
+
+  # Host before_actions the engine skips (it authenticates itself):
+  # config.skip_host_before_actions = [ :require_authentication ]
 
-  # Actor used for actions/auditing/authorization.
-  # config.current_actor = ->(controller) { ... }
+  # Actor used for actions/auditing/authorization when your strategy does not
+  # provide one (legacy fallback):
   config.current_actor = ->(controller) { controller.respond_to?(:current_user) ? controller.current_user : nil }
 
-  # Optional authorization hook (Pundit/CanCan/ActionPolicy/custom).
-  # config.authorize = ->(actor, action:, subject:, resource:, controller:) { true }
+  # Authorization hook — called for every resource request:
+  # action is one of :read, :create, :update, :destroy, :execute.
+  # config.authorize = ->(actor:, action:, resource:, record:, controller:) { true }
   config.authorize = nil
 
   # Optional sign-out action in the topbar.

data/test/controllers/resources_controller_test.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+module AdminSuite
+  class ResourcesControllerTest < ActiveSupport::TestCase
+    class TestController < ResourcesController
+      attr_writer :test_resource_config
+      attr_reader :filter_calls, :paginated_scope
+
+      def initialize
+        super
+        @filter_calls = 0
+      end
+
+      private
+
+      def resource_config
+        @test_resource_config
+      end
+
+      def filtered_collection
+        @filter_calls += 1
+        { total: 37 }
+      end
+
+      def paginate_collection(scope)
+        @paginated_scope = scope
+        [ Object.new, :paginated ]
+      end
+    end
+
+    class StatsResource < Admin::Base::Resource
+      index do
+        stats do
+          stat :legacy, -> { 11 }
+          stat :filtered, ->(scope) { scope.fetch(:total) }
+        end
+      end
+    end
+
+    class BrokenStatsResource < Admin::Base::Resource
+      index do
+        stats do
+          stat :broken, ->(_scope) { raise "boom" }
+        end
+      end
+    end
+
+    test "stats preserve zero arity calculators and pass the filtered scope to one arity calculators" do
+      controller = TestController.new
+      controller.test_resource_config = StatsResource
+      scope = { total: 37 }
+
+      stats = controller.send(:calculate_stats, scope)
+
+      assert_equal 11, stats.first[:value]
+      assert_equal 37, stats.second[:value]
+    end
+
+    test "stats preserve the existing calculator rescue behavior" do
+      controller = TestController.new
+      controller.test_resource_config = BrokenStatsResource
+
+      assert_equal "N/A", controller.send(:calculate_stats, Object.new).first[:value]
+    end
+
+    test "index reuses one filtered unpaginated scope for stats and pagination" do
+      controller = TestController.new
+      controller.test_resource_config = StatsResource
+
+      controller.index
+
+      assert_equal 1, controller.filter_calls
+      assert_equal({ total: 37 }, controller.paginated_scope)
+      assert_equal 37, controller.instance_variable_get(:@stats).second[:value]
+      assert_equal :paginated, controller.instance_variable_get(:@collection)
+    end
+  end
+end

data/test/dummy/config/initializers/admin_suite_auth.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+# The dummy app's pre-auth integration tests exercise pages without
+# authentication. Fail-closed is covered explicitly in
+# test/integration/authentication_test.rb by flipping this off.
+AdminSuite.configure do |config|
+  config.allow_unauthenticated = true
+end

data/test/integration/authentication_test.rb

@@ -0,0 +1,99 @@
+# frozen_string_literal: true
+
+require "test_helper"
+require "minitest/mock"
+
+module AdminSuite
+  class AuthenticationTest < ActionDispatch::IntegrationTest
+    ROOT = "/internal/admin_suite"
+
+    def with_config(**overrides)
+      saved = overrides.keys.index_with { |k| AdminSuite.config.public_send(k) }
+      overrides.each { |k, v| AdminSuite.config.public_send("#{k}=", v) }
+      yield
+    ensure
+      saved.each { |k, v| AdminSuite.config.public_send("#{k}=", v) }
+    end
+
+    test "unconfigured auth fails closed with 403" do
+      with_config(allow_unauthenticated: false, auth_strategy: nil, authenticate: nil) do
+        get ROOT
+        assert_response :forbidden
+        assert_includes response.body, "no authentication is configured"
+      end
+    end
+
+    test "allow_unauthenticated opens access outside production" do
+      with_config(allow_unauthenticated: true, auth_strategy: nil, authenticate: nil) do
+        get ROOT
+        assert_response :success
+      end
+    end
+
+    test "http_basic strategy denies without credentials and allows with them" do
+      with_config(allow_unauthenticated: false, auth_strategy: :http_basic,
+                  auth_options: { username: "ravi", password: "s3cret" }) do
+        get ROOT
+        assert_response :unauthorized # Basic challenge
+
+        get ROOT, headers: {
+          "Authorization" => ActionController::HttpAuthentication::Basic.encode_credentials("ravi", "s3cret")
+        }
+        assert_response :success
+      end
+    end
+
+    test "legacy authenticate lambda still works" do
+      denials = ->(controller) { controller.head :forbidden }
+      with_config(allow_unauthenticated: false, auth_strategy: nil, authenticate: denials) do
+        get ROOT
+        assert_response :forbidden
+      end
+    end
+
+    test "allow_unauthenticated is ignored in production" do
+      with_config(allow_unauthenticated: true, auth_strategy: nil, authenticate: nil) do
+        Rails.stub(:env, ActiveSupport::StringInquirer.new("production")) do
+          get ROOT
+          assert_response :forbidden
+          assert_includes response.body, "no authentication is configured"
+        end
+      end
+    end
+
+    test "current_actor is consulted at most once per request on the legacy path" do
+      calls = 0
+      passes = ->(_controller) {}
+      counting_actor = lambda { |_controller|
+        calls += 1
+        nil
+      }
+
+      with_config(allow_unauthenticated: false, auth_strategy: nil, authenticate: passes,
+                  current_actor: counting_actor) do
+        get ROOT
+        assert_response :success
+        assert_equal 1, calls
+      end
+    end
+
+    test "legacy authenticate lambda passes but a raising current_actor lambda is rescued to nil" do
+      passes = ->(_controller) {}
+      raising_actor = ->(_controller) { raise "boom" }
+
+      with_config(allow_unauthenticated: false, auth_strategy: nil, authenticate: passes,
+                  current_actor: raising_actor) do
+        get ROOT
+        assert_response :success
+      end
+    end
+
+    test "host filter skip list is config-driven with require_authentication default" do
+      assert_equal [ :require_authentication ], AdminSuite.config.skip_host_before_actions
+      # The controller must consume config rather than hardcode the name:
+      source = AdminSuite::Engine.root.join("app/controllers/admin_suite/application_controller.rb").read
+      assert_includes source, "skip_host_before_actions"
+      refute_match(/skip_before_action :require_authentication\b/, source)
+    end
+  end
+end

data/test/integration/authorization_test.rb

@@ -0,0 +1,131 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+# Reuses the in-memory fixture pattern from read_only_resource_test.rb.
+module AuthzFixtures
+  class Gadget
+    extend ActiveModel::Naming
+
+    attr_reader :id, :name
+
+    def initialize(id: 1, name: "Gadget one")
+      @id = id
+      @name = name
+    end
+
+    def self.all = ReadOnlyResourceFixtures::Relation.new([ new ])
+    def self.column_names = %w[id name]
+    def self.primary_key = "id"
+    def self.columns_hash = { "id" => Struct.new(:type).new(:integer) }
+
+    def self.find(id)
+      raise ActiveRecord::RecordNotFound unless id.to_s == "1"
+      new
+    end
+
+    def to_param = id.to_s
+    def attributes = { "id" => id, "name" => name }
+  end
+end
+
+module Admin
+  module Resources
+    class AuthzGadgetResource < Admin::Base::Resource
+      model AuthzFixtures::Gadget
+      portal :ops
+      section :observability
+
+      index do
+        columns { column :name }
+      end
+    end
+  end
+end
+
+module AdminSuite
+  class AuthorizationTest < ActionDispatch::IntegrationTest
+    BASE = "/internal/admin_suite/ops/authz_gadgets"
+
+    def with_authorize(hook)
+      saved = AdminSuite.config.authorize
+      AdminSuite.config.authorize = hook
+      yield
+    ensure
+      AdminSuite.config.authorize = saved
+    end
+
+    test "nil authorize hook allows requests" do
+      with_authorize(nil) do
+        get BASE
+        assert_response :success
+      end
+    end
+
+    test "falsy authorize denies with 403" do
+      with_authorize(->(**) { false }) do
+        get BASE
+        assert_response :forbidden
+      end
+    end
+
+    test "authorize receives actor, mapped action, resource, record, controller" do
+      captured = nil
+      hook = lambda do |actor:, action:, resource:, record:, controller:|
+        captured = { action: action, resource: resource, record: record }
+        true
+      end
+
+      with_authorize(hook) do
+        get "#{BASE}/1"
+      end
+
+      assert_equal :read, captured[:action]
+      assert_equal Admin::Resources::AuthzGadgetResource, captured[:resource]
+      assert_instance_of AuthzFixtures::Gadget, captured[:record]
+    end
+
+    test "destroy maps to :destroy" do
+      captured_action = nil
+      with_authorize(->(action:, **) { captured_action = action; false }) do
+        delete "#{BASE}/1"
+      end
+      assert_equal :destroy, captured_action
+    end
+
+    test "execute_action reaches the authorize hook with :execute before the action-name 404" do
+      captured_action = nil
+      with_authorize(->(action:, **) { captured_action = action; false }) do
+        post "#{BASE}/1/execute_action/anything"
+      end
+      assert_equal :execute, captured_action
+    end
+
+    test "bulk_action reaches the authorize hook with :execute before the action-name 404" do
+      captured_action = nil
+      with_authorize(->(action:, **) { captured_action = action; false }) do
+        post "#{BASE}/bulk_action/anything", params: { ids: [ "1" ] }
+      end
+      assert_equal :execute, captured_action
+    end
+
+    test "unregistered resource name 404s instead of constantizing a host model" do
+      get "/internal/admin_suite/ops/strings"
+      assert_response :not_found
+    end
+
+    test "unregistered resource name 404s on mutating verbs instead of reaching the model" do
+      delete "/internal/admin_suite/ops/strings/1"
+      assert_response :not_found
+    end
+
+    test "unregistered resource name 404s before the authorize hook ever runs" do
+      hook_called = false
+      with_authorize(->(**) { hook_called = true; false }) do
+        get "/internal/admin_suite/ops/strings"
+        assert_response :not_found
+      end
+      refute hook_called, "authorize hook must not run for an unregistered resource name"
+    end
+  end
+end

data/test/integration/read_only_resource_test.rb

@@ -0,0 +1,130 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+module ReadOnlyResourceFixtures
+  class Widget
+    extend ActiveModel::Naming
+
+    attr_reader :id, :name
+
+    def initialize(id: 1, name: "Observed widget")
+      @id = id
+      @name = name
+    end
+
+    def self.all
+      Relation.new([ new ])
+    end
+
+    def self.column_names
+      %w[id name]
+    end
+
+    def self.primary_key
+      "id"
+    end
+
+    def self.columns_hash
+      { "id" => Struct.new(:type).new(:integer) }
+    end
+
+    def self.find(id)
+      raise ActiveRecord::RecordNotFound unless id.to_s == "1"
+
+      new
+    end
+
+    def to_param
+      id.to_s
+    end
+
+    def attributes
+      { "id" => id, "name" => name }
+    end
+
+    def ping
+      true
+    end
+  end
+end
+
+module Admin
+  module Resources
+    class ReadOnlyWidgetResource < Admin::Base::Resource
+      model ReadOnlyResourceFixtures::Widget
+      portal :ops
+      section :observability
+      read_only
+
+      index do
+        columns do
+          column :name
+        end
+      end
+
+      actions do
+        action :ping
+      end
+    end
+  end
+end
+
+module AdminSuite
+  class ReadOnlyResourceTest < ActionDispatch::IntegrationTest
+    BASE_PATH = "/internal/admin_suite/ops/read_only_widgets"
+
+    test "direct built in mutation endpoints are rejected" do
+      get "#{BASE_PATH}/new"
+      assert_response :not_found
+
+      post BASE_PATH, params: { read_only_resource_fixtures_widget: { name: "changed" } }
+      assert_response :not_found
+
+      get "#{BASE_PATH}/1/edit"
+      assert_response :not_found
+
+      patch "#{BASE_PATH}/1", params: { read_only_resource_fixtures_widget: { name: "changed" } }
+      assert_response :not_found
+
+      delete "#{BASE_PATH}/1"
+      assert_response :not_found
+    end
+
+    test "index hides create and edit controls" do
+      get BASE_PATH
+
+      assert_response :success
+      assert_includes response.body, "Observed widget"
+      refute_includes response.body, "New Widget"
+      refute_match(/>\s*Edit\s*</, response.body)
+    end
+
+    test "show mutation controls are conditional on write access" do
+      template = AdminSuite::Engine.root.join("app/views/admin_suite/resources/show.html.erb").read
+
+      assert_includes template, "has_edit_route = !resource_config.read_only?"
+      assert_includes template, "has_destroy_route = !resource_config.read_only?"
+    end
+
+    test "toggle endpoint is rejected on read_only resources" do
+      post "#{BASE_PATH}/1/toggle", params: { field: "name" }
+      assert_response :not_found
+    end
+
+    test "undeclared execute_action names respond 404" do
+      post "#{BASE_PATH}/1/execute_action/nonexistent_action"
+      assert_response :not_found
+    end
+
+    test "undeclared bulk_action names respond 404" do
+      post "#{BASE_PATH}/bulk_action/nonexistent_bulk", params: { ids: ["1"] }
+      assert_response :not_found
+    end
+
+    test "declared member actions remain allowed on read_only resources" do
+      post "#{BASE_PATH}/1/execute_action/ping"
+      refute_equal 404, response.status
+    end
+  end
+end

data/test/lib/auth_http_basic_test.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+raise "unset ADMIN_SUITE_USERNAME in test env" if ENV["ADMIN_SUITE_USERNAME"]
+
+require "test_helper"
+
+module AdminSuite
+  class AuthHttpBasicTest < ActiveSupport::TestCase
+    # Minimal stand-in for the parts of ActionController the strategy touches.
+    class ControllerDouble
+      attr_reader :rendered_status, :challenged
+
+      def initialize(given_username: nil, given_password: nil)
+        @given_username = given_username
+        @given_password = given_password
+      end
+
+      def authenticate_with_http_basic
+        return false if @given_username.nil?
+        yield(@given_username, @given_password)
+      end
+
+      def render(plain:, status:)
+        @rendered_status = status
+      end
+
+      def request_http_basic_authentication(_realm)
+        @challenged = true
+      end
+    end
+
+    test "returns an actor for correct credentials" do
+      strategy = Auth::HttpBasic.new(username: "ravi", password: "s3cret")
+      controller = ControllerDouble.new(given_username: "ravi", given_password: "s3cret")
+
+      actor = strategy.authenticate!(controller)
+
+      assert_equal "ravi", actor.username
+      assert_equal "http-basic:ravi", actor.to_s
+    end
+
+    test "challenges on wrong credentials and returns nil" do
+      strategy = Auth::HttpBasic.new(username: "ravi", password: "s3cret")
+      controller = ControllerDouble.new(given_username: "ravi", given_password: "wrong")
+
+      assert_nil strategy.authenticate!(controller)
+      assert controller.challenged
+    end
+
+    test "denies with 403 when credentials are not configured" do
+      strategy = Auth::HttpBasic.new(username: nil, password: nil)
+      controller = ControllerDouble.new(given_username: "any", given_password: "any")
+
+      assert_nil strategy.authenticate!(controller)
+      assert_equal :forbidden, controller.rendered_status
+    end
+
+    test "is registered as :http_basic" do
+      assert_equal Auth::HttpBasic, Auth.lookup(:http_basic)
+    end
+  end
+end

data/test/lib/auth_resolution_test.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+module AdminSuite
+  class AuthResolutionTest < ActiveSupport::TestCase
+    class PerformableDouble
+      def initialize(performed:) = @performed = performed
+      def performed? = @performed
+    end
+
+    setup do
+      @saved = {
+        auth_strategy: AdminSuite.config.auth_strategy,
+        auth_options: AdminSuite.config.auth_options,
+        authenticate: AdminSuite.config.authenticate,
+        current_actor: AdminSuite.config.current_actor
+      }
+    end
+
+    teardown do
+      @saved.each { |k, v| AdminSuite.config.public_send("#{k}=", v) }
+    end
+
+    test "config defaults are fail-closed friendly" do
+      fresh = AdminSuite::Configuration.new
+      assert_nil fresh.auth_strategy
+      assert_equal({}, fresh.auth_options)
+      assert_equal false, fresh.allow_unauthenticated
+      assert_equal [ :require_authentication ], fresh.skip_host_before_actions
+    end
+
+    test "resolves a symbol strategy through the registry with options" do
+      AdminSuite.config.auth_strategy = :http_basic
+      AdminSuite.config.auth_options = { username: "u", password: "p" }
+
+      strategy = AdminSuite.resolved_auth_strategy
+
+      assert_instance_of Auth::HttpBasic, strategy
+      assert_equal "u", strategy.options[:username]
+    end
+
+    test "resolves a class strategy directly" do
+      klass = Class.new(Auth::Strategy)
+      AdminSuite.config.auth_strategy = klass
+      assert_instance_of klass, AdminSuite.resolved_auth_strategy
+    end
+
+    test "wraps legacy authenticate lambda when no strategy is set" do
+      AdminSuite.config.auth_strategy = nil
+      AdminSuite.config.authenticate = ->(_controller) { :called }
+      AdminSuite.config.current_actor = ->(_controller) { :legacy_actor }
+
+      strategy = AdminSuite.resolved_auth_strategy
+      assert_instance_of Auth::HostHook, strategy
+
+      actor = strategy.authenticate!(PerformableDouble.new(performed: false))
+      assert_equal :legacy_actor, actor
+    end
+
+    test "legacy lambda that halts (renders/redirects) denies" do
+      AdminSuite.config.auth_strategy = nil
+      AdminSuite.config.authenticate = ->(_controller) { :redirected_inside }
+
+      strategy = AdminSuite.resolved_auth_strategy
+      assert_nil strategy.authenticate!(PerformableDouble.new(performed: true))
+    end
+
+    test "returns nil when nothing configured" do
+      AdminSuite.config.auth_strategy = nil
+      AdminSuite.config.authenticate = nil
+      assert_nil AdminSuite.resolved_auth_strategy
+    end
+  end
+end

data/test/lib/auth_test.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+module AdminSuite
+  class AuthTest < ActiveSupport::TestCase
+    class FakeStrategy < AdminSuite::Auth::Strategy
+      def authenticate!(_controller) = :fake_actor
+    end
+
+    test "register and lookup a strategy by name" do
+      AdminSuite::Auth.register(:fake, FakeStrategy)
+      assert_equal FakeStrategy, AdminSuite::Auth.lookup(:fake)
+      assert_equal FakeStrategy, AdminSuite::Auth.lookup("fake")
+    end
+
+    test "lookup of unknown strategy raises UnknownStrategyError" do
+      assert_raises(AdminSuite::Auth::UnknownStrategyError) do
+        AdminSuite::Auth.lookup(:nope)
+      end
+    end
+
+    test "base strategy exposes options and requires authenticate!" do
+      strategy = AdminSuite::Auth::Strategy.new(username: "u")
+      assert_equal({ username: "u" }, strategy.options)
+      assert_raises(NotImplementedError) { strategy.authenticate!(nil) }
+    end
+  end
+end