admin_suite 0.3.1 → 0.5.0

data/test/integration/searchable_select_search_test.rb

@@ -0,0 +1,368 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+# Fixtures for the gem-provided searchable_select search endpoint
+# (ResourcesController#search). Self-contained per the pattern established in
+# authorization_test.rb/pagination_and_stats_test.rb: `rake test
+# TEST=test/integration/searchable_select_search_test.rb` must work with no
+# other test file's fixtures loaded.
+module SearchableSelectFixtures
+  class Company
+    extend ActiveModel::Naming
+
+    attr_reader :id, :name, :secret
+
+    def initialize(id:, name:, secret: nil)
+      @id = id
+      @name = name
+      @secret = secret
+    end
+
+    def self.records
+      @records ||= (1..30).map { |n| new(id: n, name: "Widget #{n}") } +
+        [ new(id: 1000, name: "Acme Corp", secret: "unicorn-marker") ]
+    end
+
+    def self.all = ReadOnlyResourceFixtures::Relation.new(records)
+    def self.column_names = %w[id name secret]
+    def self.primary_key = "id"
+    def self.columns_hash = { "id" => Struct.new(:type).new(:integer) }
+
+    def self.find(id)
+      records.find { |r| r.id.to_s == id.to_s } || raise(ActiveRecord::RecordNotFound)
+    end
+
+    # Fakes AR's `where(sql, binds)` well enough to exercise the real
+    # production predicate (`Admin::Base::FilterBuilder.search_predicate`)
+    # end to end in this database-free dummy app: parses the field name(s)
+    # out of the "<field> ILIKE :search" text the predicate builds -- which
+    # only ever contains names from the resource's declared `searchable`
+    # whitelist -- and substring-matches only *those* fields. A term that
+    # only appears in a non-searchable field (`secret`, below) can therefore
+    # never match, mirroring real ILIKE restricted to real whitelisted
+    # columns.
+    def self.where(conditions, binds = {})
+      term = binds[:search].to_s.delete_prefix("%").delete_suffix("%").downcase
+      fields = conditions.scan(/(\w+) ILIKE :search/).flatten
+      matches = records.select { |r| fields.any? { |f| r.public_send(f).to_s.downcase.include?(term) } }
+      ReadOnlyResourceFixtures::Relation.new(matches)
+    end
+
+    def to_param = id.to_s
+    def attributes = { "id" => id, "name" => name, "secret" => secret }
+  end
+
+  # Declares an index (so it's a real, otherwise-normal resource) but never
+  # calls `searchable`, leaving `searchable_fields` empty -- one of the
+  # hostile-input shapes the task brief calls out explicitly. `where` raises
+  # so any test that reaches it proves the guard in
+  # `ResourcesController#search_results` failed to short-circuit before
+  # querying.
+  class NoSearchWidget
+    extend ActiveModel::Naming
+
+    attr_reader :id, :name
+
+    def initialize(id:, name:)
+      @id = id
+      @name = name
+    end
+
+    def self.all = ReadOnlyResourceFixtures::Relation.new([ new(id: 1, name: "Solo widget") ])
+    def self.column_names = %w[id name]
+    def self.primary_key = "id"
+    def self.columns_hash = { "id" => Struct.new(:type).new(:integer) }
+    def self.find(_id) = new(id: 1, name: "Solo widget")
+
+    def self.where(*)
+      raise "must not query a resource with no searchable fields declared"
+    end
+
+    def to_param = id.to_s
+    def attributes = { "id" => id, "name" => name }
+  end
+
+  # No `index` block at all -- `index_config` itself is nil, a stricter
+  # version of the "no searchable fields" case above.
+  class NoIndexWidget
+    extend ActiveModel::Naming
+
+    attr_reader :id, :name
+
+    def initialize(id:, name:)
+      @id = id
+      @name = name
+    end
+
+    def self.all = ReadOnlyResourceFixtures::Relation.new([ new(id: 1, name: "Bare widget") ])
+    def self.column_names = %w[id name]
+    def self.primary_key = "id"
+    def self.columns_hash = { "id" => Struct.new(:type).new(:integer) }
+    def self.find(_id) = new(id: 1, name: "Bare widget")
+
+    def self.where(*)
+      raise "must not query a resource with no index config at all"
+    end
+
+    def to_param = id.to_s
+    def attributes = { "id" => id, "name" => name }
+  end
+
+  # Exercises `render_searchable_select`'s URL resolution: one field left to
+  # resolve its search URL automatically via `resource:`, one overridden
+  # with an explicit String `collection:` (must still win -- unchanged host
+  # behavior).
+  class Deal
+    extend ActiveModel::Naming
+
+    attr_accessor :id, :company_id, :vendor_id
+
+    def initialize(id: nil, company_id: nil, vendor_id: nil)
+      @id = id
+      @company_id = company_id
+      @vendor_id = vendor_id
+    end
+
+    def self.column_names = %w[id company_id vendor_id]
+    def persisted? = !id.nil?
+    def new_record? = !persisted?
+
+    # render_form_field unconditionally calls `resource.errors[field.name]`
+    # for every field; no test here exercises a validation error, so a Hash
+    # defaulting to `[]` is sufficient (same rationale as
+    # layout_assets_test.rb's MarkdownWidget).
+    def errors
+      Hash.new([])
+    end
+  end
+end
+
+module Admin
+  module Resources
+    class SearchableSelectCompanyResource < Admin::Base::Resource
+      model SearchableSelectFixtures::Company
+      portal :ops
+      section :observability
+
+      index do
+        searchable :name
+        columns { column :name }
+      end
+    end
+
+    class SearchableSelectNoSearchWidgetResource < Admin::Base::Resource
+      model SearchableSelectFixtures::NoSearchWidget
+      portal :ops
+      section :observability
+
+      index do
+        columns { column :name }
+      end
+    end
+
+    class SearchableSelectNoIndexWidgetResource < Admin::Base::Resource
+      model SearchableSelectFixtures::NoIndexWidget
+      portal :ops
+      section :observability
+    end
+
+    class SearchableSelectDealResource < Admin::Base::Resource
+      model SearchableSelectFixtures::Deal
+      portal :ops
+      section :observability
+
+      form do
+        field :company_id, type: :searchable_select, resource: :searchable_select_companies
+        field :vendor_id, type: :searchable_select, collection: "/custom/vendor/search"
+      end
+    end
+  end
+end
+
+module AdminSuite
+  class SearchableSelectSearchTest < ActionDispatch::IntegrationTest
+    COMPANIES_SEARCH = "/internal/admin_suite/ops/searchable_select_companies/search"
+    NO_SEARCH = "/internal/admin_suite/ops/searchable_select_no_search_widgets/search"
+    NO_INDEX = "/internal/admin_suite/ops/searchable_select_no_index_widgets/search"
+
+    def with_authorize(hook)
+      saved = AdminSuite.config.authorize
+      AdminSuite.config.authorize = hook
+      yield
+    ensure
+      AdminSuite.config.authorize = saved
+    end
+
+    test "returns matching records as a bare JSON array with id and name" do
+      get COMPANIES_SEARCH, params: { q: "Acme" }
+      assert_response :success
+
+      body = JSON.parse(response.body)
+      assert_instance_of Array, body
+      assert_equal [ { "id" => 1000, "name" => "Acme Corp" } ], body
+    end
+
+    test "the response is a bare array, never {results: [...]}" do
+      get COMPANIES_SEARCH, params: { q: "Widget" }
+      assert_response :success
+      assert_kind_of Array, JSON.parse(response.body)
+    end
+
+    test "caps results at 25 even when more records match" do
+      get COMPANIES_SEARCH, params: { q: "Widget" }
+      assert_response :success
+      assert_equal 25, JSON.parse(response.body).size
+    end
+
+    test "empty q returns an empty array, not the whole table" do
+      get COMPANIES_SEARCH, params: { q: "" }
+      assert_response :success
+      assert_equal [], JSON.parse(response.body)
+    end
+
+    test "a missing q param returns an empty array" do
+      get COMPANIES_SEARCH
+      assert_response :success
+      assert_equal [], JSON.parse(response.body)
+    end
+
+    test "only searches the resource's declared searchable fields, never an arbitrary column" do
+      get COMPANIES_SEARCH, params: { q: "unicorn-marker" }
+      assert_response :success
+      assert_equal [], JSON.parse(response.body),
+        "a term that only exists in a non-searchable column must never match"
+    end
+
+    test "a resource with no searchable fields declared returns empty results without querying the model" do
+      get NO_SEARCH, params: { q: "widget" }
+      assert_response :success
+      assert_equal [], JSON.parse(response.body)
+    end
+
+    test "a resource with no index config at all returns empty results without querying the model" do
+      get NO_INDEX, params: { q: "widget" }
+      assert_response :success
+      assert_equal [], JSON.parse(response.body)
+    end
+
+    test "unknown resource name 404s" do
+      get "/internal/admin_suite/ops/totally_unregistered_things/search", params: { q: "x" }
+      assert_response :not_found
+    end
+
+    test "a resource name with path traversal characters 404s rather than erroring" do
+      get "/internal/admin_suite/ops/#{ERB::Util.url_encode('../../etc/passwd')}/search", params: { q: "x" }
+      assert_response :not_found
+    end
+
+    test "denies with 403 when config.authorize denies" do
+      with_authorize(->(**) { false }) do
+        get COMPANIES_SEARCH, params: { q: "Acme" }
+      end
+      assert_response :forbidden
+    end
+
+    test "authorize hook receives action: :read, the resource, a nil record, and the controller" do
+      captured = nil
+      hook = lambda do |actor:, action:, resource:, record:, controller:|
+        captured = { action: action, resource: resource, record: record, controller: controller.class }
+        true
+      end
+
+      with_authorize(hook) { get COMPANIES_SEARCH, params: { q: "Acme" } }
+
+      assert_equal :read, captured[:action]
+      assert_equal Admin::Resources::SearchableSelectCompanyResource, captured[:resource]
+      assert_nil captured[:record]
+      assert_equal AdminSuite::ResourcesController, captured[:controller]
+    end
+
+    test "a stray ?id= is never loaded and never reaches authorize's record:" do
+      captured_record = :not_set
+      hook = lambda do |record:, **|
+        captured_record = record
+        true
+      end
+
+      # Company id 1000 ("Acme Corp") genuinely exists in this fixture --
+      # this must not load it, unlike show/edit/update/destroy, where an
+      # `:id` is expected and meaningful.
+      with_authorize(hook) { get COMPANIES_SEARCH, params: { q: "Acme", id: "1000" } }
+
+      assert_response :success
+      assert_nil captured_record,
+        "search must never load a record from a stray ?id= -- doing so hands an " \
+        "attacker-chosen record to config.authorize and creates a 404-vs-403 " \
+        "existence oracle over find_friendly_resource!'s slug/uuid/token lookups"
+    end
+
+    test "a stray ?id= for a nonexistent record does not 404 before authorize runs" do
+      # Before excluding `search` from `set_resource`, an unmatched id here
+      # raised ActiveRecord::RecordNotFound (404) *before* authorize_admin_suite!
+      # ever ran -- letting a denied actor distinguish "no such id" from
+      # "denied" by id, on a resource they have no read access to.
+      hook_called = false
+      with_authorize(->(**) { hook_called = true; false }) do
+        get COMPANIES_SEARCH, params: { q: "Acme", id: "999999" }
+      end
+
+      assert_response :forbidden
+      assert hook_called, "authorize must run even with a nonexistent stray ?id="
+    end
+
+    test "unregistered resource name 404s before the authorize hook ever runs" do
+      hook_called = false
+      with_authorize(->(**) { hook_called = true; false }) do
+        get "/internal/admin_suite/ops/totally_unregistered_things/search", params: { q: "x" }
+      end
+      refute hook_called, "authorize hook must not run for an unregistered resource name"
+    end
+
+    test "a very long q does not crash and does not leak the table" do
+      get COMPANIES_SEARCH, params: { q: "a" * 10_000 }
+      assert_response :success
+      assert_equal [], JSON.parse(response.body)
+    end
+
+    test "SQL metacharacters in q do not crash and are treated as a literal search term" do
+      get COMPANIES_SEARCH, params: { q: "'; DROP TABLE companies; --" }
+      assert_response :success
+      assert_equal [], JSON.parse(response.body)
+    end
+
+    test "render_searchable_select resolves field resource: to the gem's search endpoint" do
+      get "/internal/admin_suite/ops/searchable_select_deals/new"
+      assert_response :success
+      assert_includes response.body, "/internal/admin_suite/ops/searchable_select_companies/search"
+    end
+
+    test "a String collection: still overrides the default resource: URL, unchanged" do
+      get "/internal/admin_suite/ops/searchable_select_deals/new"
+      assert_response :success
+      assert_includes response.body, "/custom/vendor/search"
+    end
+
+    # Pins requirement #1 (authentication) with an actual test, not trace
+    # only -- this controller relies on ApplicationController's
+    # `admin_suite_authenticate!` before_action, and nothing here re-proves
+    # that for this specific action. Mirrors
+    # authentication_test.rb's "unconfigured auth fails closed with 403".
+    test "unconfigured auth fails closed with 403 on /search" do
+      saved_allow = AdminSuite.config.allow_unauthenticated
+      saved_strategy = AdminSuite.config.auth_strategy
+      saved_authenticate = AdminSuite.config.authenticate
+
+      AdminSuite.config.allow_unauthenticated = false
+      AdminSuite.config.auth_strategy = nil
+      AdminSuite.config.authenticate = nil
+
+      get COMPANIES_SEARCH, params: { q: "Acme" }
+      assert_response :forbidden
+    ensure
+      AdminSuite.config.allow_unauthenticated = saved_allow
+      AdminSuite.config.auth_strategy = saved_strategy
+      AdminSuite.config.authenticate = saved_authenticate
+    end
+  end
+end

data/test/integration/show_hide_blank_test.rb

@@ -0,0 +1,195 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+# Exercises `hide_blank:` on `panel`/`section` `fields:` rows. Mirrors the
+# `ReadOnlyResourceFixtures::Widget` shape (test/integration/read_only_resource_test.rb)
+# so the show route resolves through the ordinary numeric-id `klass.find` path,
+# not the slug/uuid/token fallback.
+module HideBlankFixtures
+  class Widget
+    extend ActiveModel::Naming
+
+    attr_reader :id
+
+    def initialize(id: 1)
+      @id = id
+    end
+
+    def self.all
+      [ new ]
+    end
+
+    def self.column_names
+      %w[id]
+    end
+
+    def self.primary_key
+      "id"
+    end
+
+    def self.columns_hash
+      { "id" => Struct.new(:type).new(:integer) }
+    end
+
+    def self.find(id)
+      raise ActiveRecord::RecordNotFound unless id.to_s == "1"
+
+      new
+    end
+
+    def to_param
+      id.to_s
+    end
+
+    def attributes
+      { "id" => id }
+    end
+
+    # Non-blank control value -- always kept, hide_blank or not.
+    def title
+      "Widget One"
+    end
+
+    def blank_string
+      ""
+    end
+
+    def whitespace_string
+      "   "
+    end
+
+    def nil_field
+      nil
+    end
+
+    def empty_array
+      []
+    end
+
+    def empty_hash
+      {}
+    end
+
+    def false_flag
+      false
+    end
+
+    def zero_count
+      0
+    end
+
+    def zero_float
+      0.0
+    end
+  end
+end
+
+module Admin
+  module Resources
+    class HideBlankWidgetResource < Admin::Base::Resource
+      model HideBlankFixtures::Widget
+      portal :ops
+      section :observability
+
+      FIELDS = %i[
+        title blank_string whitespace_string nil_field
+        empty_array empty_hash false_flag zero_count zero_float
+      ].freeze
+
+      show do
+        sidebar do
+          panel :sidebar_hidden, title: "Sidebar hidden", fields: FIELDS, hide_blank: true
+          panel :sidebar_default, title: "Sidebar default", fields: FIELDS
+        end
+
+        section :main_hidden, title: "Main hidden", fields: FIELDS, hide_blank: true
+        section :main_default, title: "Main default", fields: FIELDS
+      end
+    end
+  end
+end
+
+module AdminSuite
+  class ShowHideBlankTest < ActionDispatch::IntegrationTest
+    PATH = "/internal/admin_suite/ops/hide_blank_widgets/1"
+
+    test "hide_blank: true hides nil, empty string, empty array, and empty hash" do
+      get PATH
+      assert_response :success
+
+      hidden_section = response.body[/Main hidden.*?(?=Main default)/m]
+      refute_nil hidden_section, "expected to find the 'Main hidden' panel before 'Main default' in the body"
+
+      refute_includes hidden_section, "Nil field"
+      refute_includes hidden_section, "Blank string"
+      refute_includes hidden_section, "Empty array"
+      refute_includes hidden_section, "Empty hash"
+    end
+
+    test "hide_blank: true keeps false, 0, 0.0, and whitespace-only strings" do
+      get PATH
+      assert_response :success
+
+      hidden_section = response.body[/Main hidden.*?(?=Main default)/m]
+      refute_nil hidden_section
+
+      assert_includes hidden_section, "False flag"
+      assert_includes hidden_section, "Zero count"
+      assert_includes hidden_section, "Zero float"
+      assert_includes hidden_section, "Whitespace string"
+      # And the boolean must still render as the meaningful "No" state, not
+      # silently vanish.
+      assert_includes hidden_section, "No"
+    end
+
+    test "hide_blank: true keeps genuinely non-blank fields" do
+      get PATH
+      assert_response :success
+
+      hidden_section = response.body[/Main hidden.*?(?=Main default)/m]
+      assert_includes hidden_section, "Title"
+      assert_includes hidden_section, "Widget One"
+    end
+
+    test "default (no hide_blank option) hides nothing -- every label row still renders" do
+      get PATH
+      assert_response :success
+
+      default_section = response.body[/Main default.*?(?=<\/html>)/m]
+      refute_nil default_section
+
+      %w[Title Blank\ string Whitespace\ string Nil\ field Empty\ array Empty\ hash False\ flag Zero\ count Zero\ float].each do |label|
+        assert_includes default_section, label, "expected label '#{label}' to render in the default (no hide_blank) panel"
+      end
+    end
+
+    test "hide_blank: true on a sidebar panel hides the same blank fields as main" do
+      get PATH
+      assert_response :success
+
+      sidebar_hidden = response.body[/Sidebar hidden.*?(?=Sidebar default)/m]
+      refute_nil sidebar_hidden
+
+      refute_includes sidebar_hidden, "Nil field"
+      refute_includes sidebar_hidden, "Blank string"
+      refute_includes sidebar_hidden, "Empty array"
+      refute_includes sidebar_hidden, "Empty hash"
+      assert_includes sidebar_hidden, "False flag"
+      assert_includes sidebar_hidden, "Zero count"
+      assert_includes sidebar_hidden, "Zero float"
+    end
+
+    test "default sidebar panel (no hide_blank) hides nothing" do
+      get PATH
+      assert_response :success
+
+      sidebar_default = response.body[/Sidebar default.*?(?=<div class="bg-white)/m] || response.body[/Sidebar default.*\z/m]
+      refute_nil sidebar_default
+
+      %w[Nil\ field Blank\ string Empty\ array Empty\ hash].each do |label|
+        assert_includes sidebar_default, label
+      end
+    end
+  end
+end

data/test/integration/toggle_test.rb

@@ -0,0 +1,106 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+# Final review Finding 3: the gem hard-depends on turbo-rails (`turbo_stream`
+# in `ResourcesController#toggle`, `turbo_frame_tag` throughout the resource
+# views) but never declared it in the gemspec. Before that dependency is
+# declared, this test exercises the exact path the review flagged as broken
+# in a turbo-less host: `format.turbo_stream` inside `respond_to` raises the
+# moment it's evaluated, because the `:turbo_stream` MIME type is unregistered
+# without turbo-rails loaded. See `test/test_helper.rb`'s (now removed)
+# `TurboFrameTestHelper`, which only ever patched `turbo_frame_tag` -- it
+# never made `turbo_stream`/the MIME type real, so this branch was untestable
+# until the real dependency was declared.
+module ToggleFixtures
+  class Widget
+    extend ActiveModel::Naming
+
+    attr_reader :id
+    attr_accessor :active
+
+    def initialize(id: 1, active: false)
+      @id = id
+      @active = active
+    end
+
+    def self.all
+      ReadOnlyResourceFixtures::Relation.new([ new ])
+    end
+
+    def self.column_names
+      %w[id active]
+    end
+
+    def self.primary_key
+      "id"
+    end
+
+    def self.columns_hash
+      { "id" => Struct.new(:type).new(:integer) }
+    end
+
+    def self.find(id)
+      return new(id: 1, active: false) if id.to_s == "1"
+
+      raise ActiveRecord::RecordNotFound
+    end
+
+    def to_param
+      id.to_s
+    end
+
+    # `dom_id` (via `ActionView::RecordIdentifier#record_key_for_dom_id`)
+    # calls `to_key` on the record -- `extend ActiveModel::Naming` alone
+    # only supplies `model_name`, not `to_key`.
+    def to_key
+      [ id ]
+    end
+
+    def update!(attrs)
+      attrs.each { |key, value| public_send("#{key}=", value) }
+      true
+    end
+  end
+end
+
+module Admin
+  module Resources
+    class ToggleWidgetResource < Admin::Base::Resource
+      model ToggleFixtures::Widget
+      portal :ops
+      section :observability
+
+      index do
+        columns do
+          column :active, type: :toggle
+        end
+      end
+    end
+  end
+end
+
+module AdminSuite
+  class ToggleTest < ActionDispatch::IntegrationTest
+    include ActionView::RecordIdentifier
+
+    BASE_PATH = "/internal/admin_suite/ops/toggle_widgets"
+
+    test "toggle's turbo_stream branch replaces the toggle cell with the flipped state" do
+      post "#{BASE_PATH}/1/toggle",
+        params: { field: "active" },
+        headers: { "Accept" => "text/vnd.turbo-stream.html" }
+
+      assert_response :success
+      assert_equal "text/vnd.turbo-stream.html", response.media_type
+
+      target = dom_id(ToggleFixtures::Widget.new(id: 1), "active_toggle")
+      assert_includes response.body, "<turbo-stream"
+      assert_includes response.body, %(action="replace")
+      assert_includes response.body, %(target="#{target}")
+      # The record started with `active: false`; the toggle flips it to
+      # `true` before rendering, so the replaced cell must reflect "on".
+      assert_includes response.body, "is-on"
+    end
+  end
+end