admin_suite 0.4.0 → 0.6.1

data/test/integration/show_hide_blank_test.rb

@@ -0,0 +1,195 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+# Exercises `hide_blank:` on `panel`/`section` `fields:` rows. Mirrors the
+# `ReadOnlyResourceFixtures::Widget` shape (test/integration/read_only_resource_test.rb)
+# so the show route resolves through the ordinary numeric-id `klass.find` path,
+# not the slug/uuid/token fallback.
+module HideBlankFixtures
+  class Widget
+    extend ActiveModel::Naming
+
+    attr_reader :id
+
+    def initialize(id: 1)
+      @id = id
+    end
+
+    def self.all
+      [ new ]
+    end
+
+    def self.column_names
+      %w[id]
+    end
+
+    def self.primary_key
+      "id"
+    end
+
+    def self.columns_hash
+      { "id" => Struct.new(:type).new(:integer) }
+    end
+
+    def self.find(id)
+      raise ActiveRecord::RecordNotFound unless id.to_s == "1"
+
+      new
+    end
+
+    def to_param
+      id.to_s
+    end
+
+    def attributes
+      { "id" => id }
+    end
+
+    # Non-blank control value -- always kept, hide_blank or not.
+    def title
+      "Widget One"
+    end
+
+    def blank_string
+      ""
+    end
+
+    def whitespace_string
+      "   "
+    end
+
+    def nil_field
+      nil
+    end
+
+    def empty_array
+      []
+    end
+
+    def empty_hash
+      {}
+    end
+
+    def false_flag
+      false
+    end
+
+    def zero_count
+      0
+    end
+
+    def zero_float
+      0.0
+    end
+  end
+end
+
+module Admin
+  module Resources
+    class HideBlankWidgetResource < Admin::Base::Resource
+      model HideBlankFixtures::Widget
+      portal :ops
+      section :observability
+
+      FIELDS = %i[
+        title blank_string whitespace_string nil_field
+        empty_array empty_hash false_flag zero_count zero_float
+      ].freeze
+
+      show do
+        sidebar do
+          panel :sidebar_hidden, title: "Sidebar hidden", fields: FIELDS, hide_blank: true
+          panel :sidebar_default, title: "Sidebar default", fields: FIELDS
+        end
+
+        section :main_hidden, title: "Main hidden", fields: FIELDS, hide_blank: true
+        section :main_default, title: "Main default", fields: FIELDS
+      end
+    end
+  end
+end
+
+module AdminSuite
+  class ShowHideBlankTest < ActionDispatch::IntegrationTest
+    PATH = "/internal/admin_suite/ops/hide_blank_widgets/1"
+
+    test "hide_blank: true hides nil, empty string, empty array, and empty hash" do
+      get PATH
+      assert_response :success
+
+      hidden_section = response.body[/Main hidden.*?(?=Main default)/m]
+      refute_nil hidden_section, "expected to find the 'Main hidden' panel before 'Main default' in the body"
+
+      refute_includes hidden_section, "Nil field"
+      refute_includes hidden_section, "Blank string"
+      refute_includes hidden_section, "Empty array"
+      refute_includes hidden_section, "Empty hash"
+    end
+
+    test "hide_blank: true keeps false, 0, 0.0, and whitespace-only strings" do
+      get PATH
+      assert_response :success
+
+      hidden_section = response.body[/Main hidden.*?(?=Main default)/m]
+      refute_nil hidden_section
+
+      assert_includes hidden_section, "False flag"
+      assert_includes hidden_section, "Zero count"
+      assert_includes hidden_section, "Zero float"
+      assert_includes hidden_section, "Whitespace string"
+      # And the boolean must still render as the meaningful "No" state, not
+      # silently vanish.
+      assert_includes hidden_section, "No"
+    end
+
+    test "hide_blank: true keeps genuinely non-blank fields" do
+      get PATH
+      assert_response :success
+
+      hidden_section = response.body[/Main hidden.*?(?=Main default)/m]
+      assert_includes hidden_section, "Title"
+      assert_includes hidden_section, "Widget One"
+    end
+
+    test "default (no hide_blank option) hides nothing -- every label row still renders" do
+      get PATH
+      assert_response :success
+
+      default_section = response.body[/Main default.*?(?=<\/html>)/m]
+      refute_nil default_section
+
+      %w[Title Blank\ string Whitespace\ string Nil\ field Empty\ array Empty\ hash False\ flag Zero\ count Zero\ float].each do |label|
+        assert_includes default_section, label, "expected label '#{label}' to render in the default (no hide_blank) panel"
+      end
+    end
+
+    test "hide_blank: true on a sidebar panel hides the same blank fields as main" do
+      get PATH
+      assert_response :success
+
+      sidebar_hidden = response.body[/Sidebar hidden.*?(?=Sidebar default)/m]
+      refute_nil sidebar_hidden
+
+      refute_includes sidebar_hidden, "Nil field"
+      refute_includes sidebar_hidden, "Blank string"
+      refute_includes sidebar_hidden, "Empty array"
+      refute_includes sidebar_hidden, "Empty hash"
+      assert_includes sidebar_hidden, "False flag"
+      assert_includes sidebar_hidden, "Zero count"
+      assert_includes sidebar_hidden, "Zero float"
+    end
+
+    test "default sidebar panel (no hide_blank) hides nothing" do
+      get PATH
+      assert_response :success
+
+      sidebar_default = response.body[/Sidebar default.*?(?=<div class="bg-white)/m] || response.body[/Sidebar default.*\z/m]
+      refute_nil sidebar_default
+
+      %w[Nil\ field Blank\ string Empty\ array Empty\ hash].each do |label|
+        assert_includes sidebar_default, label
+      end
+    end
+  end
+end

data/test/integration/toggle_test.rb

@@ -0,0 +1,106 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+# Final review Finding 3: the gem hard-depends on turbo-rails (`turbo_stream`
+# in `ResourcesController#toggle`, `turbo_frame_tag` throughout the resource
+# views) but never declared it in the gemspec. Before that dependency is
+# declared, this test exercises the exact path the review flagged as broken
+# in a turbo-less host: `format.turbo_stream` inside `respond_to` raises the
+# moment it's evaluated, because the `:turbo_stream` MIME type is unregistered
+# without turbo-rails loaded. See `test/test_helper.rb`'s (now removed)
+# `TurboFrameTestHelper`, which only ever patched `turbo_frame_tag` -- it
+# never made `turbo_stream`/the MIME type real, so this branch was untestable
+# until the real dependency was declared.
+module ToggleFixtures
+  class Widget
+    extend ActiveModel::Naming
+
+    attr_reader :id
+    attr_accessor :active
+
+    def initialize(id: 1, active: false)
+      @id = id
+      @active = active
+    end
+
+    def self.all
+      ReadOnlyResourceFixtures::Relation.new([ new ])
+    end
+
+    def self.column_names
+      %w[id active]
+    end
+
+    def self.primary_key
+      "id"
+    end
+
+    def self.columns_hash
+      { "id" => Struct.new(:type).new(:integer) }
+    end
+
+    def self.find(id)
+      return new(id: 1, active: false) if id.to_s == "1"
+
+      raise ActiveRecord::RecordNotFound
+    end
+
+    def to_param
+      id.to_s
+    end
+
+    # `dom_id` (via `ActionView::RecordIdentifier#record_key_for_dom_id`)
+    # calls `to_key` on the record -- `extend ActiveModel::Naming` alone
+    # only supplies `model_name`, not `to_key`.
+    def to_key
+      [ id ]
+    end
+
+    def update!(attrs)
+      attrs.each { |key, value| public_send("#{key}=", value) }
+      true
+    end
+  end
+end
+
+module Admin
+  module Resources
+    class ToggleWidgetResource < Admin::Base::Resource
+      model ToggleFixtures::Widget
+      portal :ops
+      section :observability
+
+      index do
+        columns do
+          column :active, type: :toggle
+        end
+      end
+    end
+  end
+end
+
+module AdminSuite
+  class ToggleTest < ActionDispatch::IntegrationTest
+    include ActionView::RecordIdentifier
+
+    BASE_PATH = "/internal/admin_suite/ops/toggle_widgets"
+
+    test "toggle's turbo_stream branch replaces the toggle cell with the flipped state" do
+      post "#{BASE_PATH}/1/toggle",
+        params: { field: "active" },
+        headers: { "Accept" => "text/vnd.turbo-stream.html" }
+
+      assert_response :success
+      assert_equal "text/vnd.turbo-stream.html", response.media_type
+
+      target = dom_id(ToggleFixtures::Widget.new(id: 1), "active_toggle")
+      assert_includes response.body, "<turbo-stream"
+      assert_includes response.body, %(action="replace")
+      assert_includes response.body, %(target="#{target}")
+      # The record started with `active: false`; the toggle flips it to
+      # `true` before rendering, so the replaced cell must reflect "on".
+      assert_includes response.body, "is-on"
+    end
+  end
+end

data/test/lib/auth_host_user_test.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class AuthNormalizeActorTest < ActiveSupport::TestCase
+  test "normalizes the authenticated-but-anonymous sentinel to nil" do
+    assert_nil AdminSuite::Auth.normalize_actor(true)
+    assert_nil AdminSuite::Auth.normalize_actor(false)
+    assert_nil AdminSuite::Auth.normalize_actor(nil)
+  end
+
+  test "passes a real actor through untouched" do
+    user = Struct.new(:email).new("ravi@techwright.io")
+    assert_same user, AdminSuite::Auth.normalize_actor(user)
+  end
+end
+
+class AuthHostUserTest < ActiveSupport::TestCase
+  Controller = Struct.new(:performed) do
+    def performed? = !!performed
+    def head(*) = nil
+  end
+
+  test "is registered under :host_user" do
+    assert_equal AdminSuite::Auth::HostUser, AdminSuite::Auth.lookup(:host_user)
+  end
+
+  test "returns the host user the resolver produced" do
+    user = Struct.new(:email).new("ravi@techwright.io")
+    strategy = AdminSuite::Auth::HostUser.new(resolve: ->(_c) { user })
+
+    assert_same user, strategy.authenticate!(Controller.new(false))
+  end
+
+  test "denies when the resolver returns nothing" do
+    strategy = AdminSuite::Auth::HostUser.new(resolve: ->(_c) { nil })
+
+    assert_nil strategy.authenticate!(Controller.new(false))
+  end
+
+  test "denies rather than raising when the resolver blows up" do
+    strategy = AdminSuite::Auth::HostUser.new(resolve: ->(_c) { raise "boom" })
+
+    assert_nil strategy.authenticate!(Controller.new(false))
+  end
+
+  test "denies loudly when no resolver is configured" do
+    strategy = AdminSuite::Auth::HostUser.new({})
+
+    assert_nil strategy.authenticate!(Controller.new(false))
+  end
+end

data/test/lib/auth_http_basic_test.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 raise "unset ADMIN_SUITE_USERNAME in test env" if ENV["ADMIN_SUITE_USERNAME"]
+raise "unset ADMIN_SUITE_PASSWORD in test env" if ENV["ADMIN_SUITE_PASSWORD"]
 
 require "test_helper"
 
@@ -55,6 +56,15 @@ module AdminSuite
       assert_equal :forbidden, controller.rendered_status
     end
 
+    test "denies with 403 when password is blank" do
+      strategy = Auth::HttpBasic.new(username: "ravi", password: nil)
+      controller = ControllerDouble.new(given_username: "ravi", given_password: nil)
+
+      assert_nil strategy.authenticate!(controller)
+      assert_equal :forbidden, controller.rendered_status
+      refute controller.challenged
+    end
+
     test "is registered as :http_basic" do
       assert_equal Auth::HttpBasic, Auth.lookup(:http_basic)
     end

data/test/lib/auth_test.rb

@@ -9,9 +9,11 @@ module AdminSuite
     end
 
     test "register and lookup a strategy by name" do
-      AdminSuite::Auth.register(:fake, FakeStrategy)
-      assert_equal FakeStrategy, AdminSuite::Auth.lookup(:fake)
-      assert_equal FakeStrategy, AdminSuite::Auth.lookup("fake")
+      with_auth_registry_snapshot do
+        AdminSuite::Auth.register(:fake, FakeStrategy)
+        assert_equal FakeStrategy, AdminSuite::Auth.lookup(:fake)
+        assert_equal FakeStrategy, AdminSuite::Auth.lookup("fake")
+      end
     end
 
     test "lookup of unknown strategy raises UnknownStrategyError" do
@@ -20,10 +22,25 @@ module AdminSuite
       end
     end
 
+    test "registered lists registered strategy names" do
+      with_auth_registry_snapshot do
+        AdminSuite::Auth.register(:fake, FakeStrategy)
+
+        assert_includes AdminSuite::Auth.registered, :fake
+        assert_includes AdminSuite::Auth.registered, :http_basic
+      end
+    end
+
     test "base strategy exposes options and requires authenticate!" do
       strategy = AdminSuite::Auth::Strategy.new(username: "u")
       assert_equal({ username: "u" }, strategy.options)
       assert_raises(NotImplementedError) { strategy.authenticate!(nil) }
     end
+
+    test "base strategy symbolizes string-keyed options" do
+      strategy = AdminSuite::Auth::Strategy.new("username" => "u")
+
+      assert_equal({ username: "u" }, strategy.options)
+    end
   end
 end

data/test/lib/authorization_context_test.rb

@@ -0,0 +1,127 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+module AuthorizationContextFixtures
+  # A plain object implementing #call -- exactly the shape a host might write
+  # as an authorize adapter. Has no #parameters of its own; the writer must
+  # fall back to introspecting #call's method object.
+  class CorrectArityCallable
+    def call(actor:, action:, resource:, record:, context:)
+      true
+    end
+  end
+
+  class OldArityCallable
+    def call(actor:, action:, resource:, record:, controller:)
+      true
+    end
+  end
+
+  class SplatCallable
+    def call(**)
+      true
+    end
+  end
+end
+
+class AuthorizationContextTest < ActiveSupport::TestCase
+  test "reports its surface" do
+    web = AdminSuite::AuthorizationContext.new(surface: :web, controller: :ctrl)
+    mcp = AdminSuite::AuthorizationContext.new(surface: :mcp)
+
+    assert_predicate web, :web?
+    refute_predicate web, :mcp?
+    assert_equal :ctrl, web.controller
+    assert_predicate mcp, :mcp?
+    assert_nil mcp.controller
+  end
+
+  test "rejects an unknown surface" do
+    assert_raises(ArgumentError) { AdminSuite::AuthorizationContext.new(surface: :carrier_pigeon) }
+  end
+
+  test "assigning an old-arity authorize hook raises immediately" do
+    error = assert_raises(ArgumentError) do
+      AdminSuite.config.authorize = ->(actor:, action:, resource:, record:, controller:) { true }
+    end
+
+    # Assert on the COMPUTED diagnosis, not the message's fixed footer -- that
+    # footer explains the controller:/context: migration on every failure, so
+    # `assert_match(/controller:/)` alone would pass for any rejection at all.
+    assert_match(/Missing: \[:context\]/, error.message)
+    assert_match(/Unexpected: \[:controller\]/, error.message)
+  ensure
+    AdminSuite.config.authorize = nil
+  end
+
+  test "accepts a correct-arity hook and a nil hook" do
+    AdminSuite.config.authorize = ->(actor:, action:, resource:, record:, context:) { true }
+    assert_respond_to AdminSuite.config.authorize, :call
+    AdminSuite.config.authorize = nil
+    assert_nil AdminSuite.config.authorize
+  end
+
+  test "accepts a hook that takes a keyword splat" do
+    AdminSuite.config.authorize = ->(**) { true }
+    assert_respond_to AdminSuite.config.authorize, :call
+
+    AdminSuite.config.authorize = ->(action:, **) { action == :read }
+    assert_respond_to AdminSuite.config.authorize, :call
+  ensure
+    AdminSuite.config.authorize = nil
+  end
+
+  test "still rejects controller: even behind a splat" do
+    error = assert_raises(ArgumentError) do
+      AdminSuite.config.authorize = ->(controller:, **) { true }
+    end
+
+    # The splat means nothing is missing; `controller:` being named is the
+    # whole defect, so assert exactly that rather than the shared footer.
+    assert_match(/Missing: \[\]/, error.message)
+    assert_match(/Unexpected: \[:controller\]/, error.message)
+  ensure
+    AdminSuite.config.authorize = nil
+  end
+
+  test "accepts a correct-arity callable object without #parameters" do
+    AdminSuite.config.authorize = AuthorizationContextFixtures::CorrectArityCallable.new
+    assert_respond_to AdminSuite.config.authorize, :call
+  ensure
+    AdminSuite.config.authorize = nil
+  end
+
+  test "rejects an old-arity callable object, proving the fallback validates rather than bypasses" do
+    error = assert_raises(ArgumentError) do
+      AdminSuite.config.authorize = AuthorizationContextFixtures::OldArityCallable.new
+    end
+
+    # This test's name claims the fallback VALIDATES rather than bypasses, so
+    # it must assert the guard actually read this object's `#call` signature.
+    # Matching the footer would also pass for a fallback that rejected every
+    # callable outright -- the opposite of validation.
+    assert_match(/Missing: \[:context\]/, error.message)
+    assert_match(/Unexpected: \[:controller\]/, error.message)
+  ensure
+    AdminSuite.config.authorize = nil
+  end
+
+  test "accepts a callable object whose #call takes a keyword splat" do
+    AdminSuite.config.authorize = AuthorizationContextFixtures::SplatCallable.new
+    assert_respond_to AdminSuite.config.authorize, :call
+  ensure
+    AdminSuite.config.authorize = nil
+  end
+
+  test "rejects a non-callable with an ArgumentError naming the problem" do
+    error = assert_raises(ArgumentError) do
+      AdminSuite.config.authorize = "nope"
+    end
+
+    assert_match(/callable/, error.message)
+    assert_match(/String/, error.message)
+  ensure
+    AdminSuite.config.authorize = nil
+  end
+end

data/test/lib/definition_loader_test.rb

@@ -41,6 +41,18 @@ module AdminSuite
           before.each_value { |definition| AdminSuite::PortalRegistry.register(definition) }
         end
       else
+        # :dashboards/:actions have no accumulating registry to snapshot --
+        # unlike :resources/:portals (which pick up real fixtures registered
+        # by *other* test files at load time), reset! for these two kinds
+        # only clears a single flag/definition object
+        # (`root_dashboard_loaded`/`root_dashboard_definition`,
+        # `handlers_loaded`) that is entirely local to whichever test set it,
+        # via its own `with_globs`/`with_dashboard`-style ensure block. So
+        # there is nothing cross-test left to preserve, and "restore" here
+        # deliberately degrades to a second `reset!` call rather than a real
+        # snapshot+restore -- do not read this branch as returning a
+        # value-preserving restore the way the :resources/:portals branches
+        # above do.
         -> { AdminSuite::DefinitionLoader.reset!(kind) }
       end
     end

data/test/lib/engine_defaults_test.rb

@@ -31,8 +31,7 @@ module AdminSuite
 
     test "dead configuration and DSL members are gone" do
       refute AdminSuite::Configuration.new.respond_to?(:tailwind_cdn)
-      assert Admin::Base::Resource.respond_to?(:exportable),
-        "exportable is a deprecated no-op, not removed -- see ResourceExportableDeprecationTest"
+      refute Admin::Base::Resource.respond_to?(:exportable)
       refute Admin::Base::Resource::ColumnDefinition.members.include?(:render)
     end
   end