admin_suite 0.4.0 → 0.5.0

data/test/integration/index_table_test.rb

@@ -0,0 +1,289 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+# Self-contained fixtures, following the pattern established in
+# association_linking_test.rb/pagination_and_stats_test.rb: this file must
+# work in isolation under `rake test TEST=test/integration/index_table_test.rb`,
+# so it defines everything it needs rather than depending on fixtures that
+# live only in a sibling test file. `LinkingFixtures::Company` is the one
+# exception -- it lives in test_helper.rb (loaded for every run) precisely
+# so tasks like this one can reuse it (see test_helper.rb's comment above
+# it).
+module IndexTableFixtures
+  # Two rows: one fully populated (including a present `belongs_to`-shaped
+  # association), one deliberately sparse (nil scalar, nil association) --
+  # covers item 5 (nil -> em dash) and Task 3's non-regression (a present
+  # association still renders as a link) in the same fixture.
+  class Widget
+    extend ActiveModel::Naming
+
+    attr_reader :id, :name, :count, :status, :company
+
+    def initialize(id:, name:, count:, status:, company:)
+      @id = id
+      @name = name
+      @count = count
+      @status = status
+      @company = company
+    end
+
+    ROWS = [
+      new(id: 1, name: "Alpha", count: 5, status: "ok", company: LinkingFixtures::Company.new),
+      new(id: 2, name: "Beta", count: nil, status: nil, company: nil)
+    ]
+
+    def self.all = ReadOnlyResourceFixtures::Relation.new(ROWS)
+    def self.column_names = %w[id name count status]
+    def self.primary_key = "id"
+    def self.columns_hash = { "id" => Struct.new(:type).new(:integer) }
+    def self.find(id) = ROWS.find { |w| w.to_param == id.to_s }
+    def to_param = id.to_s
+    def attributes = { "id" => id, "name" => name, "count" => count, "status" => status }
+  end
+
+  # A real slicing relation (unlike `ReadOnlyResourceFixtures::Relation`,
+  # whose `#offset`/`#limit` are no-ops returning self -- see
+  # test-harness fact #8). `Pagy::Backend#pagy_get_items` calls
+  # `collection.offset(pagy.offset).limit(pagy.limit)`, so this must
+  # actually slice for the per-page tests to prove anything.
+  class SlicingRelation
+    include Enumerable
+
+    def initialize(records, offset: 0)
+      @records = records
+      @offset = offset
+    end
+
+    def each(&block) = @records.each(&block)
+    def count(*) = @records.length
+    def offset(n) = SlicingRelation.new(@records, offset: n)
+    def limit(n) = @records[@offset, n] || []
+  end
+
+  class PagedWidget
+    extend ActiveModel::Naming
+
+    attr_reader :id
+
+    def initialize(id:) = @id = id
+
+    ALL_ROWS = (1..150).map { |n| new(id: n) }
+
+    def self.all = SlicingRelation.new(ALL_ROWS)
+    def self.column_names = %w[id]
+    def self.primary_key = "id"
+    def self.columns_hash = { "id" => Struct.new(:type).new(:integer) }
+    def self.find(id) = ALL_ROWS.find { |w| w.to_param == id.to_s }
+    def to_param = id.to_s
+    def attributes = { "id" => id }
+  end
+end
+
+module Admin
+  module Resources
+    class IndexTableWidgetResource < Admin::Base::Resource
+      model IndexTableFixtures::Widget
+      portal :ops
+      section :observability
+
+      index do
+        # A filter is required for the sidebar (and thus the per-page
+        # selector, which lives inside that same form) to render at all --
+        # see `index.html.erb`'s `if index_config&.filters_list&.any? || ...`
+        # guard.
+        filters { filter :name, type: :text }
+        columns do
+          column :name, class: "font-mono"
+          column :count, align: :right
+          column :status, align: :diagonal
+          column :company
+        end
+        paginate 10
+      end
+    end
+
+    class IndexTablePagedWidgetResource < Admin::Base::Resource
+      model IndexTableFixtures::PagedWidget
+      portal :ops
+      section :observability
+
+      index do
+        columns { column :id }
+        # Deliberately distinct from the hardcoded 25 default and from any
+        # of the per_page values under test (10, 50, 100), so a test that
+        # asserts "10 rows" can only be passing because the DSL fallback
+        # kicked in, not by coincidence with some other default.
+        paginate 10
+      end
+    end
+  end
+end
+
+module AdminSuite
+  class IndexTableTest < ActionDispatch::IntegrationTest
+    # Item 1: sticky header.
+    test "the index thead carries the sticky header classes" do
+      get "/internal/admin_suite/ops/index_table_widgets"
+      assert_response :success
+      assert_match %r{<thead[^>]*\bsticky\b[^>]*\btop-0\b[^>]*\bz-10\b[^>]*>}, response.body
+    end
+
+    # `sticky top-0` only actually pins the header if its nearest scroll
+    # container ancestor genuinely scrolls internally. `overflow-x: auto`
+    # alone forces the browser to compute `overflow-y` as `auto` too (per
+    # the CSS Overflow spec's "visible becomes auto when the other axis
+    # isn't visible" rule), making the wrapper div a sticky containing
+    # block -- but with no bounded height, that div never scrolls, so the
+    # header has nothing to stick against and just scrolls away with the
+    # page. This asserts the wrapper is *also* given a bounded height and
+    # `overflow-y-auto`, so a future edit that drops the height silently
+    # re-breaks sticky (a class-presence-only test on `<thead>` would stay
+    # green even if the header stopped sticking) and fails here instead.
+    test "the table's scroll wrapper is bounded so the sticky header has something to stick against" do
+      get "/internal/admin_suite/ops/index_table_widgets"
+      assert_response :success
+      assert_match(
+        %r{<div class="[^"]*overflow-x-auto[^"]*overflow-y-auto[^"]*max-h-\[70vh\][^"]*"},
+        response.body
+      )
+    end
+
+    # Item 2: row click wiring, via the already-existing ClickActionsController.
+    test "each row wires the click-actions controller to its own show path" do
+      get "/internal/admin_suite/ops/index_table_widgets"
+      assert_response :success
+
+      assert_match(/<tr[^>]*data-controller="admin-suite--click-actions"[^>]*>/, response.body)
+      # ERB HTML-escapes the `>` in the Stimulus action descriptor, so the
+      # attribute renders as `click-&gt;...`, not a literal `->`.
+      assert_match(/<tr[^>]*data-action="click-&gt;admin-suite--click-actions#navigate"[^>]*>/, response.body)
+      assert_match(
+        %r{<tr[^>]*data-admin-suite--click-actions-url-value="[^"]*index_table_widgets/1"[^>]*>},
+        response.body
+      )
+    end
+
+    # Item 3: per-page selector + server-side clamp.
+    test "the filter form offers a 25/50/100 per_page selector" do
+      get "/internal/admin_suite/ops/index_table_widgets"
+      assert_response :success
+      assert_match(/<select[^>]*name="per_page"[^>]*>/, response.body)
+      assert_match(/<option[^>]*value="25"/, response.body)
+      assert_match(/<option[^>]*value="50"/, response.body)
+      assert_match(/<option[^>]*value="100"/, response.body)
+    end
+
+    # Counts `<tr>` inside `<tbody>` only, deliberately independent of item
+    # 2's row-click markup (which lands in the same `<tr>` tags) -- so a
+    # per_page test failure can never be secretly caused by row-click not
+    # being wired yet.
+    def row_count(body)
+      tbody = body[%r{<tbody.*?</tbody>}m]
+      tbody ? tbody.scan(/<tr[ >]/).size : 0
+    end
+
+    test "no per_page param falls back to the DSL's paginate(n) value" do
+      get "/internal/admin_suite/ops/index_table_paged_widgets"
+      assert_response :success
+      assert_equal 10, row_count(response.body)
+    end
+
+    test "a valid per_page renders that many rows" do
+      get "/internal/admin_suite/ops/index_table_paged_widgets", params: { per_page: 50 }
+      assert_response :success
+      assert_equal 50, row_count(response.body)
+    end
+
+    test "per_page above the max clamps to 100, not the requested amount" do
+      get "/internal/admin_suite/ops/index_table_paged_widgets", params: { per_page: 999_999 }
+      assert_response :success
+      assert_equal 100, row_count(response.body)
+    end
+
+    test "per_page=0 falls back to the DSL value instead of an empty/unbounded page" do
+      get "/internal/admin_suite/ops/index_table_paged_widgets", params: { per_page: 0 }
+      assert_response :success
+      assert_equal 10, row_count(response.body)
+    end
+
+    test "a negative per_page falls back to the DSL value" do
+      get "/internal/admin_suite/ops/index_table_paged_widgets", params: { per_page: -1 }
+      assert_response :success
+      assert_equal 10, row_count(response.body)
+    end
+
+    test "a non-numeric per_page falls back to the DSL value" do
+      get "/internal/admin_suite/ops/index_table_paged_widgets", params: { per_page: "abc" }
+      assert_response :success
+      assert_equal 10, row_count(response.body)
+    end
+
+    test "an array-shaped per_page (per_page[]=1) falls back to the DSL value" do
+      get "/internal/admin_suite/ops/index_table_paged_widgets", params: { per_page: [ "1" ] }
+      assert_response :success
+      assert_equal 10, row_count(response.body)
+    end
+
+    # Item 4: column alignment + css_class.
+    test "align: :right emits text-right on the td" do
+      get "/internal/admin_suite/ops/index_table_widgets"
+      assert_response :success
+      assert_match(%r{<td class="[^"]*\btext-right\b[^"]*">\s*5\s*</td>}, response.body)
+    end
+
+    test "column.css_class (the class: option) reaches the td" do
+      get "/internal/admin_suite/ops/index_table_widgets"
+      assert_response :success
+      assert_match(%r{<td class="[^"]*\bfont-mono\b[^"]*">}, response.body)
+    end
+
+    test "an unknown align value renders successfully with no fabricated text-<value> class" do
+      get "/internal/admin_suite/ops/index_table_widgets"
+      assert_response :success
+      refute_includes response.body, "text-diagonal"
+    end
+
+    # Isolates a single fixture row's `<tr>...</tr>` markup by a distinctive
+    # cell value, so nil-cell assertions can target Beta's row specifically
+    # instead of matching the first empty-looking `<td>` anywhere on the
+    # page (there are several: Alpha's row has none, but a loose regex
+    # would not tell the two rows apart).
+    def widget_row(body, marker)
+      tbody = body[%r{<tbody.*?</tbody>}m]
+      tbody.scan(%r{<tr.*?</tr>}m).find { |r| r.include?(marker) }
+    end
+
+    # Item 5: nil cells render an em dash, and Task 3's association links
+    # are not regressed by that change.
+    test "a nil scalar column renders an em dash, not a blank cell" do
+      get "/internal/admin_suite/ops/index_table_widgets"
+      assert_response :success
+      beta_row = widget_row(response.body, "Beta")
+      refute_nil beta_row, "expected to find Beta's row"
+      # Beta's `count` is nil -- the fallback branch must turn that into an
+      # em dash instead of the empty string it renders today.
+      assert_match(%r{<td[^>]*>\s*—\s*</td>}, beta_row)
+    end
+
+    test "a nil association column renders an em dash, not a blank cell" do
+      get "/internal/admin_suite/ops/index_table_widgets"
+      assert_response :success
+      beta_row = widget_row(response.body, "Beta")
+      refute_nil beta_row, "expected to find Beta's row"
+      # Beta's `company` is nil (Task 3 deliberately left nil association
+      # handling to this task). Count how many dash-only cells the row has:
+      # count and status are also nil, so there must be at least 3 (not 2),
+      # proving company's cell got the dash too rather than staying blank.
+      dash_cells = beta_row.scan(%r{<td[^>]*>\s*—\s*</td>}).size
+      assert_equal 3, dash_cells,
+        "expected 3 dash cells (count, status, company all nil) in Beta's row, got #{dash_cells}"
+    end
+
+    test "a present association still renders as a link (Task 3 non-regression)" do
+      get "/internal/admin_suite/ops/index_table_widgets"
+      assert_response :success
+      assert_match %r{<a[^>]+href="[^"]*linking_companies/7"[^>]*>\s*Acme Corp\s*</a>}, response.body
+    end
+  end
+end

data/test/integration/navigation_sections_test.rb

@@ -37,5 +37,26 @@ module AdminSuite
       assert_response :success
       assert_includes response.body, "Observability" # from ReadOnlyWidgetResource's `section :observability`
     end
+
+    # `:zzz_last` (declared in `setup` above) has no resources registered
+    # under it anywhere in the suite, unlike `:observability`. Before this
+    # fix, `_sidebar.html.erb` rendered a bare section label with nothing
+    # underneath for a section like this; `portals/show.html.erb` already
+    # showed "No resources in this section yet." for the same case, so the
+    # sidebar was the odd one out.
+    test "the sidebar shows the no-resources message for a declared but empty section" do
+      get "/internal/admin_suite/ops"
+      assert_response :success
+
+      # Scoped to the sidebar itself: `portals/show.html.erb`'s own fallback
+      # section list also renders "No resources in this section yet." for
+      # the same empty section, so an unscoped `assert_includes` on the full
+      # body wouldn't actually prove the *sidebar* (as opposed to the main
+      # content) says it.
+      sidebar = Nokogiri::HTML(response.body).at_css(".admin-suite-sidebar")
+      assert sidebar, "expected to find the sidebar"
+      assert_includes sidebar.text, "Aaa Displayed First"
+      assert_includes sidebar.text, "No resources in this section yet."
+    end
   end
 end

data/test/integration/searchable_select_search_test.rb

@@ -0,0 +1,368 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+# Fixtures for the gem-provided searchable_select search endpoint
+# (ResourcesController#search). Self-contained per the pattern established in
+# authorization_test.rb/pagination_and_stats_test.rb: `rake test
+# TEST=test/integration/searchable_select_search_test.rb` must work with no
+# other test file's fixtures loaded.
+module SearchableSelectFixtures
+  class Company
+    extend ActiveModel::Naming
+
+    attr_reader :id, :name, :secret
+
+    def initialize(id:, name:, secret: nil)
+      @id = id
+      @name = name
+      @secret = secret
+    end
+
+    def self.records
+      @records ||= (1..30).map { |n| new(id: n, name: "Widget #{n}") } +
+        [ new(id: 1000, name: "Acme Corp", secret: "unicorn-marker") ]
+    end
+
+    def self.all = ReadOnlyResourceFixtures::Relation.new(records)
+    def self.column_names = %w[id name secret]
+    def self.primary_key = "id"
+    def self.columns_hash = { "id" => Struct.new(:type).new(:integer) }
+
+    def self.find(id)
+      records.find { |r| r.id.to_s == id.to_s } || raise(ActiveRecord::RecordNotFound)
+    end
+
+    # Fakes AR's `where(sql, binds)` well enough to exercise the real
+    # production predicate (`Admin::Base::FilterBuilder.search_predicate`)
+    # end to end in this database-free dummy app: parses the field name(s)
+    # out of the "<field> ILIKE :search" text the predicate builds -- which
+    # only ever contains names from the resource's declared `searchable`
+    # whitelist -- and substring-matches only *those* fields. A term that
+    # only appears in a non-searchable field (`secret`, below) can therefore
+    # never match, mirroring real ILIKE restricted to real whitelisted
+    # columns.
+    def self.where(conditions, binds = {})
+      term = binds[:search].to_s.delete_prefix("%").delete_suffix("%").downcase
+      fields = conditions.scan(/(\w+) ILIKE :search/).flatten
+      matches = records.select { |r| fields.any? { |f| r.public_send(f).to_s.downcase.include?(term) } }
+      ReadOnlyResourceFixtures::Relation.new(matches)
+    end
+
+    def to_param = id.to_s
+    def attributes = { "id" => id, "name" => name, "secret" => secret }
+  end
+
+  # Declares an index (so it's a real, otherwise-normal resource) but never
+  # calls `searchable`, leaving `searchable_fields` empty -- one of the
+  # hostile-input shapes the task brief calls out explicitly. `where` raises
+  # so any test that reaches it proves the guard in
+  # `ResourcesController#search_results` failed to short-circuit before
+  # querying.
+  class NoSearchWidget
+    extend ActiveModel::Naming
+
+    attr_reader :id, :name
+
+    def initialize(id:, name:)
+      @id = id
+      @name = name
+    end
+
+    def self.all = ReadOnlyResourceFixtures::Relation.new([ new(id: 1, name: "Solo widget") ])
+    def self.column_names = %w[id name]
+    def self.primary_key = "id"
+    def self.columns_hash = { "id" => Struct.new(:type).new(:integer) }
+    def self.find(_id) = new(id: 1, name: "Solo widget")
+
+    def self.where(*)
+      raise "must not query a resource with no searchable fields declared"
+    end
+
+    def to_param = id.to_s
+    def attributes = { "id" => id, "name" => name }
+  end
+
+  # No `index` block at all -- `index_config` itself is nil, a stricter
+  # version of the "no searchable fields" case above.
+  class NoIndexWidget
+    extend ActiveModel::Naming
+
+    attr_reader :id, :name
+
+    def initialize(id:, name:)
+      @id = id
+      @name = name
+    end
+
+    def self.all = ReadOnlyResourceFixtures::Relation.new([ new(id: 1, name: "Bare widget") ])
+    def self.column_names = %w[id name]
+    def self.primary_key = "id"
+    def self.columns_hash = { "id" => Struct.new(:type).new(:integer) }
+    def self.find(_id) = new(id: 1, name: "Bare widget")
+
+    def self.where(*)
+      raise "must not query a resource with no index config at all"
+    end
+
+    def to_param = id.to_s
+    def attributes = { "id" => id, "name" => name }
+  end
+
+  # Exercises `render_searchable_select`'s URL resolution: one field left to
+  # resolve its search URL automatically via `resource:`, one overridden
+  # with an explicit String `collection:` (must still win -- unchanged host
+  # behavior).
+  class Deal
+    extend ActiveModel::Naming
+
+    attr_accessor :id, :company_id, :vendor_id
+
+    def initialize(id: nil, company_id: nil, vendor_id: nil)
+      @id = id
+      @company_id = company_id
+      @vendor_id = vendor_id
+    end
+
+    def self.column_names = %w[id company_id vendor_id]
+    def persisted? = !id.nil?
+    def new_record? = !persisted?
+
+    # render_form_field unconditionally calls `resource.errors[field.name]`
+    # for every field; no test here exercises a validation error, so a Hash
+    # defaulting to `[]` is sufficient (same rationale as
+    # layout_assets_test.rb's MarkdownWidget).
+    def errors
+      Hash.new([])
+    end
+  end
+end
+
+module Admin
+  module Resources
+    class SearchableSelectCompanyResource < Admin::Base::Resource
+      model SearchableSelectFixtures::Company
+      portal :ops
+      section :observability
+
+      index do
+        searchable :name
+        columns { column :name }
+      end
+    end
+
+    class SearchableSelectNoSearchWidgetResource < Admin::Base::Resource
+      model SearchableSelectFixtures::NoSearchWidget
+      portal :ops
+      section :observability
+
+      index do
+        columns { column :name }
+      end
+    end
+
+    class SearchableSelectNoIndexWidgetResource < Admin::Base::Resource
+      model SearchableSelectFixtures::NoIndexWidget
+      portal :ops
+      section :observability
+    end
+
+    class SearchableSelectDealResource < Admin::Base::Resource
+      model SearchableSelectFixtures::Deal
+      portal :ops
+      section :observability
+
+      form do
+        field :company_id, type: :searchable_select, resource: :searchable_select_companies
+        field :vendor_id, type: :searchable_select, collection: "/custom/vendor/search"
+      end
+    end
+  end
+end
+
+module AdminSuite
+  class SearchableSelectSearchTest < ActionDispatch::IntegrationTest
+    COMPANIES_SEARCH = "/internal/admin_suite/ops/searchable_select_companies/search"
+    NO_SEARCH = "/internal/admin_suite/ops/searchable_select_no_search_widgets/search"
+    NO_INDEX = "/internal/admin_suite/ops/searchable_select_no_index_widgets/search"
+
+    def with_authorize(hook)
+      saved = AdminSuite.config.authorize
+      AdminSuite.config.authorize = hook
+      yield
+    ensure
+      AdminSuite.config.authorize = saved
+    end
+
+    test "returns matching records as a bare JSON array with id and name" do
+      get COMPANIES_SEARCH, params: { q: "Acme" }
+      assert_response :success
+
+      body = JSON.parse(response.body)
+      assert_instance_of Array, body
+      assert_equal [ { "id" => 1000, "name" => "Acme Corp" } ], body
+    end
+
+    test "the response is a bare array, never {results: [...]}" do
+      get COMPANIES_SEARCH, params: { q: "Widget" }
+      assert_response :success
+      assert_kind_of Array, JSON.parse(response.body)
+    end
+
+    test "caps results at 25 even when more records match" do
+      get COMPANIES_SEARCH, params: { q: "Widget" }
+      assert_response :success
+      assert_equal 25, JSON.parse(response.body).size
+    end
+
+    test "empty q returns an empty array, not the whole table" do
+      get COMPANIES_SEARCH, params: { q: "" }
+      assert_response :success
+      assert_equal [], JSON.parse(response.body)
+    end
+
+    test "a missing q param returns an empty array" do
+      get COMPANIES_SEARCH
+      assert_response :success
+      assert_equal [], JSON.parse(response.body)
+    end
+
+    test "only searches the resource's declared searchable fields, never an arbitrary column" do
+      get COMPANIES_SEARCH, params: { q: "unicorn-marker" }
+      assert_response :success
+      assert_equal [], JSON.parse(response.body),
+        "a term that only exists in a non-searchable column must never match"
+    end
+
+    test "a resource with no searchable fields declared returns empty results without querying the model" do
+      get NO_SEARCH, params: { q: "widget" }
+      assert_response :success
+      assert_equal [], JSON.parse(response.body)
+    end
+
+    test "a resource with no index config at all returns empty results without querying the model" do
+      get NO_INDEX, params: { q: "widget" }
+      assert_response :success
+      assert_equal [], JSON.parse(response.body)
+    end
+
+    test "unknown resource name 404s" do
+      get "/internal/admin_suite/ops/totally_unregistered_things/search", params: { q: "x" }
+      assert_response :not_found
+    end
+
+    test "a resource name with path traversal characters 404s rather than erroring" do
+      get "/internal/admin_suite/ops/#{ERB::Util.url_encode('../../etc/passwd')}/search", params: { q: "x" }
+      assert_response :not_found
+    end
+
+    test "denies with 403 when config.authorize denies" do
+      with_authorize(->(**) { false }) do
+        get COMPANIES_SEARCH, params: { q: "Acme" }
+      end
+      assert_response :forbidden
+    end
+
+    test "authorize hook receives action: :read, the resource, a nil record, and the controller" do
+      captured = nil
+      hook = lambda do |actor:, action:, resource:, record:, controller:|
+        captured = { action: action, resource: resource, record: record, controller: controller.class }
+        true
+      end
+
+      with_authorize(hook) { get COMPANIES_SEARCH, params: { q: "Acme" } }
+
+      assert_equal :read, captured[:action]
+      assert_equal Admin::Resources::SearchableSelectCompanyResource, captured[:resource]
+      assert_nil captured[:record]
+      assert_equal AdminSuite::ResourcesController, captured[:controller]
+    end
+
+    test "a stray ?id= is never loaded and never reaches authorize's record:" do
+      captured_record = :not_set
+      hook = lambda do |record:, **|
+        captured_record = record
+        true
+      end
+
+      # Company id 1000 ("Acme Corp") genuinely exists in this fixture --
+      # this must not load it, unlike show/edit/update/destroy, where an
+      # `:id` is expected and meaningful.
+      with_authorize(hook) { get COMPANIES_SEARCH, params: { q: "Acme", id: "1000" } }
+
+      assert_response :success
+      assert_nil captured_record,
+        "search must never load a record from a stray ?id= -- doing so hands an " \
+        "attacker-chosen record to config.authorize and creates a 404-vs-403 " \
+        "existence oracle over find_friendly_resource!'s slug/uuid/token lookups"
+    end
+
+    test "a stray ?id= for a nonexistent record does not 404 before authorize runs" do
+      # Before excluding `search` from `set_resource`, an unmatched id here
+      # raised ActiveRecord::RecordNotFound (404) *before* authorize_admin_suite!
+      # ever ran -- letting a denied actor distinguish "no such id" from
+      # "denied" by id, on a resource they have no read access to.
+      hook_called = false
+      with_authorize(->(**) { hook_called = true; false }) do
+        get COMPANIES_SEARCH, params: { q: "Acme", id: "999999" }
+      end
+
+      assert_response :forbidden
+      assert hook_called, "authorize must run even with a nonexistent stray ?id="
+    end
+
+    test "unregistered resource name 404s before the authorize hook ever runs" do
+      hook_called = false
+      with_authorize(->(**) { hook_called = true; false }) do
+        get "/internal/admin_suite/ops/totally_unregistered_things/search", params: { q: "x" }
+      end
+      refute hook_called, "authorize hook must not run for an unregistered resource name"
+    end
+
+    test "a very long q does not crash and does not leak the table" do
+      get COMPANIES_SEARCH, params: { q: "a" * 10_000 }
+      assert_response :success
+      assert_equal [], JSON.parse(response.body)
+    end
+
+    test "SQL metacharacters in q do not crash and are treated as a literal search term" do
+      get COMPANIES_SEARCH, params: { q: "'; DROP TABLE companies; --" }
+      assert_response :success
+      assert_equal [], JSON.parse(response.body)
+    end
+
+    test "render_searchable_select resolves field resource: to the gem's search endpoint" do
+      get "/internal/admin_suite/ops/searchable_select_deals/new"
+      assert_response :success
+      assert_includes response.body, "/internal/admin_suite/ops/searchable_select_companies/search"
+    end
+
+    test "a String collection: still overrides the default resource: URL, unchanged" do
+      get "/internal/admin_suite/ops/searchable_select_deals/new"
+      assert_response :success
+      assert_includes response.body, "/custom/vendor/search"
+    end
+
+    # Pins requirement #1 (authentication) with an actual test, not trace
+    # only -- this controller relies on ApplicationController's
+    # `admin_suite_authenticate!` before_action, and nothing here re-proves
+    # that for this specific action. Mirrors
+    # authentication_test.rb's "unconfigured auth fails closed with 403".
+    test "unconfigured auth fails closed with 403 on /search" do
+      saved_allow = AdminSuite.config.allow_unauthenticated
+      saved_strategy = AdminSuite.config.auth_strategy
+      saved_authenticate = AdminSuite.config.authenticate
+
+      AdminSuite.config.allow_unauthenticated = false
+      AdminSuite.config.auth_strategy = nil
+      AdminSuite.config.authenticate = nil
+
+      get COMPANIES_SEARCH, params: { q: "Acme" }
+      assert_response :forbidden
+    ensure
+      AdminSuite.config.allow_unauthenticated = saved_allow
+      AdminSuite.config.auth_strategy = saved_strategy
+      AdminSuite.config.authenticate = saved_authenticate
+    end
+  end
+end