admin_suite 0.4.0 → 0.6.1

data/lib/admin_suite/renderer_registry.rb

@@ -65,6 +65,17 @@ module AdminSuite
       def unregister(key)
         @registry.delete(key.to_sym)
       end
+
+      # Test-support only. Removes a single *default* registration.
+      #
+      # Exists solely so a spec that seeds a scratch key into the default
+      # store (e.g. to test host-class-vs-default precedence) can clean up
+      # after itself. AdminSuite's own built-in defaults are registered once
+      # at require time and are never expected to be removed in a running
+      # process -- do not call this outside a test teardown.
+      def unregister_default(key)
+        @defaults.delete(key.to_sym)
+      end
     end
   end
 end

data/lib/admin_suite/ui/dashboard_definition.rb

@@ -48,6 +48,12 @@ module AdminSuite
         panel(:health, title, span: span, **options.merge(status: status, metrics: metrics, block: block))
       end
 
+      # `type:` selects the Chart.js chart type: `:bar` (default), `:line`,
+      # `:area` (a line chart rendered with fill), or `:doughnut`. It flows
+      # through `**options` untouched by this method -- the `_chart.html.erb`
+      # partial is what validates it, falling back to `:bar` with a logged
+      # warning for anything else, so a host typo degrades rather than
+      # breaking the dashboard.
       def chart_panel(title, data: nil, span: nil, **options, &block)
         data_proc = data.is_a?(Proc) ? data : (block_given? ? block : nil)
         panel(:chart, title, span: span, **options.merge(data: data_proc || data))

data/lib/admin_suite/ui/show_value_formatter.rb

@@ -53,9 +53,9 @@ module AdminSuite
           end
         end
 
-        if defined?(ActiveStorage::Attached::One) && value.is_a?(ActiveStorage::Attached::One)
+        if defined?(::ActiveStorage::Attached::One) && value.is_a?(::ActiveStorage::Attached::One)
           return render_attachment_preview(value)
-        elsif defined?(ActiveStorage::Attached::Many) && value.is_a?(ActiveStorage::Attached::Many)
+        elsif defined?(::ActiveStorage::Attached::Many) && value.is_a?(::ActiveStorage::Attached::Many)
           return render_attachments_preview(value)
         end
 

data/lib/admin_suite/version.rb

@@ -2,7 +2,7 @@
 
 module AdminSuite
   module Version
-    VERSION = "0.4.0"
+    VERSION = "0.6.1"
   end
 
   # Backward-compatible constant.

data/lib/admin_suite.rb

@@ -8,9 +8,32 @@ end
 
 require "pagy"
 
+# Hard dependency, declared in the gemspec but not a direct Gemfile entry in
+# any host -- Bundler only auto-requires direct Gemfile dependencies, never a
+# gem's transitive runtime dependencies.
+require "mcp"
+
+# Hard dependency, declared in the gemspec but not a direct Gemfile entry in
+# any host -- Bundler's `Bundler.require` only auto-requires gems declared
+# directly in the Gemfile (or via `gemspec`'s own path entry), not a gem's
+# *transitive* runtime dependencies. Same reasoning as `pagy` above and
+# `redcarpet`/`rouge` in markdown_renderer.rb: required explicitly here so
+# `turbo_frame_tag`/`turbo_stream`/the `:turbo_stream` MIME type are real
+# regardless of what else the host's own Gemfile happens to require.
+require "turbo-rails"
+
 require "admin_suite/version"
 require "admin_suite/deprecation"
 require "admin_suite/configuration"
+require "admin_suite/authorization_context"
+require "admin_suite/query"
+require "admin_suite/mcp/authorization"
+require "admin_suite/mcp/serializer"
+require "admin_suite/mcp/tools/describe_resources"
+require "admin_suite/mcp/tools/list_records"
+require "admin_suite/mcp/tools/get_record"
+require "admin_suite/mcp/tools/aggregate"
+require "admin_suite/mcp"
 require "admin_suite/markdown_renderer"
 require "admin_suite/theme_palette"
 require "admin_suite/portal_registry"
@@ -25,7 +48,6 @@ require "admin_suite/renderers/json_renderer"
 require "admin_suite/renderers/key_value_renderer"
 require "admin_suite/renderers/table_from_renderer"
 require "admin_suite/renderers/code_renderer"
-require "admin_suite/renderers/legacy_gleania"
 require "admin_suite/legacy_custom_renderer_procs"
 require "admin_suite/definition_loader"
 require "admin_suite/host_autoload_policy"
@@ -49,12 +71,6 @@ AdminSuite::RendererRegistry.register_default(:code, AdminSuite::Renderers::Code
 AdminSuite::RendererRegistry.register_default(:json_preview, AdminSuite::Renderers::JsonRenderer)
 AdminSuite::RendererRegistry.register_default(:code_preview, AdminSuite::Renderers::CodeRenderer)
 
-# Deprecated (removed in 0.5.0): the four Gleania-specific LLM chat-transcript
-# renderers. See `AdminSuite::Renderers::LegacyGleania` for details.
-AdminSuite::RendererRegistry.register_default(:prompt_template_preview, AdminSuite::Renderers::LegacyGleania::PromptTemplateRenderer)
-AdminSuite::RendererRegistry.register_default(:messages_preview, AdminSuite::Renderers::LegacyGleania::MessagesPreviewRenderer)
-AdminSuite::RendererRegistry.register_default(:tool_args_preview, AdminSuite::Renderers::LegacyGleania::ToolArgsRenderer)
-AdminSuite::RendererRegistry.register_default(:turn_messages_preview, AdminSuite::Renderers::LegacyGleania::TurnMessagesRenderer)
 
 module AdminSuite
   class << self

data/lib/generators/admin_suite/install/templates/admin_suite.rb

@@ -26,9 +26,12 @@ AdminSuite.configure do |config|
   # provide one (legacy fallback):
   config.current_actor = ->(controller) { controller.respond_to?(:current_user) ? controller.current_user : nil }
 
-  # Authorization hook — called for every resource request:
+  # Authorization hook — called for every resource request.
+  # Signature: ->(actor:, action:, resource:, record:, context:) { true }
   # action is one of :read, :create, :update, :destroy, :execute.
-  # config.authorize = ->(actor:, action:, resource:, record:, controller:) { true }
+  # nil hook: authenticated web requests are allowed; MCP serves no tools/data.
+  # Hook return of false or nil denies the request (no disclose/mutate).
+  # config.authorize = ->(actor:, action:, resource:, record:, context:) { actor&.admin? }
   config.authorize = nil
 
   # Optional sign-out action in the topbar.

data/test/controllers/resources_controller_test.rb

@@ -6,12 +6,7 @@ module AdminSuite
   class ResourcesControllerTest < ActiveSupport::TestCase
     class TestController < ResourcesController
       attr_writer :test_resource_config, :test_params
-      attr_reader :filter_calls, :paginated_scope
-
-      def initialize
-        super
-        @filter_calls = 0
-      end
+      attr_reader :paginated_scope, :pagy_limit
 
       def params
         @test_params ||= {}
@@ -23,18 +18,27 @@ module AdminSuite
         @test_resource_config
       end
 
-      def filtered_collection
-        @filter_calls += 1
-        { total: 37 }
-      end
-
-      def paginate_collection(scope)
+      def pagy(scope, limit:)
         @paginated_scope = scope
+        @pagy_limit = limit
         [ Object.new, :paginated ]
       end
     end
 
+    class StatsModel
+      class << self
+        attr_accessor :all_calls
+
+        def all
+          self.all_calls = all_calls.to_i + 1
+          { total: 37 }
+        end
+      end
+    end
+
     class StatsResource < Admin::Base::Resource
+      model StatsModel
+
       index do
         stats do
           stat :legacy, -> { 11 }
@@ -72,11 +76,13 @@ module AdminSuite
     test "index reuses one filtered unpaginated scope for stats and pagination" do
       controller = TestController.new
       controller.test_resource_config = StatsResource
+      StatsModel.all_calls = 0
 
       controller.index
 
-      assert_equal 1, controller.filter_calls
+      assert_equal 1, StatsModel.all_calls
       assert_equal({ total: 37 }, controller.paginated_scope)
+      assert_equal 25, controller.pagy_limit
       assert_equal 37, controller.instance_variable_get(:@stats).second[:value]
       assert_equal :paginated, controller.instance_variable_get(:@collection)
     end

data/test/integration/association_linking_test.rb

@@ -0,0 +1,292 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+# `LinkingFixtures::Company` (an AR-backed fixture: it genuinely subclasses
+# the `ActiveRecord::Base` stub defined in test_helper.rb) and its
+# registered `Admin::Resources::LinkingCompanyResource` both live in
+# test_helper.rb, not here -- established there because Tasks 4 and 7 reuse
+# them, and test_helper.rb is required by every test file regardless of
+# which single file `rake test TEST=...` runs. Everything below is specific
+# to this task's link-rendering assertions.
+module LinkingFixtures
+  # Same shape as Company, but deliberately never registered as an
+  # Admin::Resources::* class -- exercises the "no resource registered"
+  # degrade path in `auto_admin_suite_path_for`.
+  class UnregisteredVendor < ActiveRecord::Base
+    extend ActiveModel::Naming
+
+    attr_reader :id, :name
+
+    def initialize(id: 3, name: "Ghost Vendor")
+      @id = id
+      @name = name
+    end
+
+    def self.column_names = %w[id name]
+    def self.primary_key = "id"
+    def self.columns_hash = { "id" => Struct.new(:type).new(:integer) }
+    def self.find(_id) = new
+    def to_param = id.to_s
+    def attributes = { "id" => id, "name" => name }
+  end
+
+  # `item_display_title` calls `item.name` unguarded when `respond_to?(:name)`
+  # is true. This record's `#name` raises, simulating a host model whose
+  # display method blows up on bad data -- the point is that a single bad
+  # row must degrade, not 500 the entire page.
+  class RaisingCo < ActiveRecord::Base
+    extend ActiveModel::Naming
+
+    attr_reader :id
+
+    def initialize(id: 9)
+      @id = id
+    end
+
+    def name
+      raise "boom: no display name for you"
+    end
+
+    def self.column_names = %w[id name]
+    def self.primary_key = "id"
+    def self.columns_hash = { "id" => Struct.new(:type).new(:integer) }
+    def self.find(_id) = new
+    def to_param = id.to_s
+    def attributes = { "id" => id }
+  end
+
+  # Simulates an unsaved/unpersisted AR record: real `ActiveRecord::Base#to_param`
+  # returns nil when `persisted?` is false. `auto_admin_suite_path_for`'s
+  # `resource_path(..., id: nil)` call must degrade to no-link, not 500.
+  class UnpersistedVendor < ActiveRecord::Base
+    extend ActiveModel::Naming
+
+    attr_reader :id, :name
+
+    def initialize
+      @id = nil
+      @name = "Draft Vendor"
+    end
+
+    def self.column_names = %w[id name]
+    def self.primary_key = "id"
+    def self.columns_hash = { "id" => Struct.new(:type).new(:integer) }
+    def self.find(_id) = new
+    def to_param = nil
+    def attributes = { "id" => id, "name" => name }
+  end
+
+  # PORO host resource (mirrors the RedirectFixtures/ReadOnlyResourceFixtures
+  # convention). Its index column returns each of the AR values above, and
+  # its show page renders an association table where one column is itself an
+  # AR value -- the two call sites Task 3 unifies (`render_column_value`'s
+  # fallback branch and `format_table_cell`'s AR branch).
+  class Deal
+    extend ActiveModel::Naming
+
+    attr_reader :id, :label, :company
+
+    def initialize(id:, label:, company:)
+      @id = id
+      @label = label
+      @company = company
+    end
+
+    def self.all = ReadOnlyResourceFixtures::Relation.new([
+      new(id: 1, label: "Q3 renewal", company: Company.new),
+      new(id: 2, label: "Raises on display", company: RaisingCo.new),
+      new(id: 3, label: "Unpersisted vendor", company: UnpersistedVendor.new),
+      new(id: 4, label: "No resource registered", company: UnregisteredVendor.new)
+    ])
+    def self.column_names = %w[id label]
+    def self.primary_key = "id"
+    def self.columns_hash = { "id" => Struct.new(:type).new(:integer) }
+    def self.find(id) = all.find { |d| d.to_param == id.to_s }
+    def to_param = id.to_s
+    def attributes = { "id" => id, "label" => label }
+
+    def line_items
+      [
+        LineItem.new(1, "Renewal", Company.new),
+        LineItem.new(2, "Ghost line", UnregisteredVendor.new)
+      ]
+    end
+  end
+
+  LineItem = Struct.new(:id, :label, :company)
+
+  # Five deals, each pointing at a *distinct instance* of the *same*
+  # `LinkingFixtures::Company` class. `auto_admin_suite_path_for`'s registry
+  # lookup is keyed on `item.class`, not identity, so a correct memo
+  # resolves the resource once for this whole page -- pre-memo, each of
+  # the 5 rows independently re-ran the full registry scan.
+  class RepeatedCompanyDeal
+    extend ActiveModel::Naming
+
+    attr_reader :id, :label, :company
+
+    def initialize(id:, label:, company:)
+      @id = id
+      @label = label
+      @company = company
+    end
+
+    ROWS = Array.new(5) { |i| new(id: i + 1, label: "Deal #{i + 1}", company: Company.new(id: 100 + i, name: "Company #{i + 1}")) }
+
+    def self.all = ReadOnlyResourceFixtures::Relation.new(ROWS)
+    def self.column_names = %w[id label]
+    def self.primary_key = "id"
+    def self.columns_hash = { "id" => Struct.new(:type).new(:integer) }
+    def self.find(id) = all.find { |d| d.to_param == id.to_s }
+    def to_param = id.to_s
+    def attributes = { "id" => id, "label" => label }
+  end
+end
+
+module Admin
+  module Resources
+    class LinkingRepeatedCompanyDealResource < Admin::Base::Resource
+      model LinkingFixtures::RepeatedCompanyDeal
+      portal :ops
+      section :observability
+
+      index do
+        columns do
+          column :label
+          column :company
+        end
+      end
+    end
+
+    class LinkingRaisingCoResource < Admin::Base::Resource
+      model LinkingFixtures::RaisingCo
+      portal :ops
+      section :observability
+    end
+
+    class LinkingUnpersistedVendorResource < Admin::Base::Resource
+      model LinkingFixtures::UnpersistedVendor
+      portal :ops
+      section :observability
+    end
+
+    class LinkingDealResource < Admin::Base::Resource
+      model LinkingFixtures::Deal
+      portal :ops
+      section :observability
+
+      index do
+        columns do
+          column :label
+          column :company
+        end
+        # `Deal.all` is a `ReadOnlyResourceFixtures::Relation` -- it has no
+        # `#includes` method at all. This exercises Task 4's "skip
+        # silently, don't raise" path on every request this test file
+        # already makes to `/linking_deals`, not just a dedicated test.
+        includes :company
+      end
+
+      show do
+        section :line_items, association: :line_items, display: :table, columns: [ :label, :company ]
+      end
+    end
+  end
+end
+
+module AdminSuite
+  class AssociationLinkingTest < ActionDispatch::IntegrationTest
+    # ERB auto-escapes `<%= %>` output, so the literal bug string
+    # (`#<Company:0x...>`) never appears as raw `#<` in `response.body` --
+    # it shows up HTML-entity-escaped as `#&lt;LinkingFixtures::Company:0x...&gt;`.
+    # A `refute_includes response.body, "#<"` check would therefore pass
+    # vacuously against the *un*fixed code. Assert on the class-name leak
+    # itself instead, which survives escaping either way.
+    AR_INSPECT_LEAK = "LinkingFixtures::"
+
+    test "an index column returning an AR value links to that record's admin page" do
+      get "/internal/admin_suite/ops/linking_deals"
+      assert_response :success
+
+      refute_includes response.body, AR_INSPECT_LEAK
+      assert_includes response.body, "Acme Corp"
+      assert_match %r{<a[^>]+href="[^"]*linking_companies/7"[^>]*>\s*Acme Corp\s*</a>}, response.body
+    end
+
+    test "an AR value with a raising display title degrades instead of 500ing the page" do
+      get "/internal/admin_suite/ops/linking_deals"
+      assert_response :success
+      refute_includes response.body, AR_INSPECT_LEAK
+    end
+
+    test "an unpersisted AR record (to_param -> nil) renders plain text, not a broken link" do
+      get "/internal/admin_suite/ops/linking_deals"
+      assert_response :success
+      assert_includes response.body, "Draft Vendor"
+      refute_match %r{<a[^>]*>\s*Draft Vendor\s*</a>}, response.body
+    end
+
+    test "an AR value with no registered resource renders plain text, not a broken link" do
+      get "/internal/admin_suite/ops/linking_deals"
+      assert_response :success
+      assert_includes response.body, "Ghost Vendor"
+      refute_match %r{<a[^>]*>\s*Ghost Vendor\s*</a>}, response.body
+    end
+
+    test "an association table cell that is an AR value renders as a link too" do
+      get "/internal/admin_suite/ops/linking_deals/1"
+      assert_response :success
+
+      refute_includes response.body, AR_INSPECT_LEAK
+      assert_match %r{<a[^>]+href="[^"]*linking_companies/7"[^>]*>\s*Acme Corp\s*</a>}, response.body
+      # The second line item's company has no registered resource: plain text.
+      assert_includes response.body, "Ghost Vendor"
+      refute_match %r{<a[^>]*>\s*Ghost Vendor\s*</a>}, response.body
+    end
+
+    # Non-vacuous by construction: it counts actual invocations of
+    # `ensure_admin_resources_loaded_for!` -- called exactly once per
+    # registry *cache miss* inside `admin_suite_resource_for`, and nowhere
+    # else in the gem. (A page-wide spy on
+    # `Admin::Base::Resource.registered_resources` itself was tried first
+    # and rejected: navigation building calls it many more times per
+    # request for unrelated reasons -- e.g. `resources_for_portal` -- so
+    # that count is dominated by noise this task didn't touch.)
+    #
+    # Pre-memo, `auto_admin_suite_path_for` called
+    # `ensure_admin_resources_loaded_for!(item.class)` unconditionally on
+    # every invocation -- 5 rows of the same class meant 5 calls (and 2
+    # full registry scans apiece: the `.any?` inside it, plus the
+    # `registered_resources.find` right after). Memoized, only the first
+    # row's lookup is a cache miss; the other 4 hit
+    # `@admin_suite_resource_for` and never call this method at all -- so
+    # the call count for 5 rows must be 1, not 5. A test that only
+    # asserted "the memo hash is non-empty" would still pass if the memo
+    # were consulted but the scan ran unconditionally anyway; this asserts
+    # the scan was actually skipped.
+    test "auto_admin_suite_path_for memoizes the registry lookup per class, not per row" do
+      call_count = 0
+      helper_module = AdminSuite::BaseHelper
+      original_method = helper_module.instance_method(:ensure_admin_resources_loaded_for!)
+
+      helper_module.send(:define_method, :ensure_admin_resources_loaded_for!) do |model_class|
+        call_count += 1
+        original_method.bind(self).call(model_class)
+      end
+
+      begin
+        get "/internal/admin_suite/ops/linking_repeated_company_deals"
+        assert_response :success
+        assert_includes response.body, "Company 1"
+        assert_includes response.body, "Company 5"
+      ensure
+        helper_module.send(:define_method, :ensure_admin_resources_loaded_for!, original_method)
+      end
+
+      assert_equal 1, call_count,
+        "expected exactly one registry lookup for 5 rows of the same class (LinkingFixtures::Company) " \
+        "-- got #{call_count}, which means the memo isn't preventing a rescan per row"
+    end
+  end
+end

data/test/integration/authentication_test.rb

@@ -43,6 +43,16 @@ module AdminSuite
       end
     end
 
+    test "unknown auth strategy fails closed and lists registered strategies" do
+      with_config(allow_unauthenticated: false, auth_strategy: :typo) do
+        get ROOT
+
+        assert_response :forbidden
+        assert_includes response.body, "Unknown AdminSuite auth strategy :typo"
+        assert_includes response.body, "http_basic"
+      end
+    end
+
     test "legacy authenticate lambda still works" do
       denials = ->(controller) { controller.head :forbidden }
       with_config(allow_unauthenticated: false, auth_strategy: nil, authenticate: denials) do

data/test/integration/authorization_test.rb

@@ -66,13 +66,29 @@ module AdminSuite
       with_authorize(->(**) { false }) do
         get BASE
         assert_response :forbidden
+        refute_includes response.body, "Gadget one"
       end
     end
 
-    test "authorize receives actor, mapped action, resource, record, controller" do
+    test "nil authorize result denies with 403 and does not disclose the record" do
+      with_authorize(->(**) { nil }) do
+        get "#{BASE}/1"
+        assert_response :forbidden
+        refute_includes response.body, "Gadget one"
+      end
+    end
+
+    test "nil authorize result cannot mutate" do
+      with_authorize(->(**) { nil }) do
+        delete "#{BASE}/1"
+        assert_response :forbidden
+      end
+    end
+
+    test "authorize receives actor, mapped action, resource, record, context" do
       captured = nil
-      hook = lambda do |actor:, action:, resource:, record:, controller:|
-        captured = { action: action, resource: resource, record: record }
+      hook = lambda do |actor:, action:, resource:, record:, context:|
+        captured = { action: action, resource: resource, record: record, context: context }
         true
       end
 
@@ -83,6 +99,7 @@ module AdminSuite
       assert_equal :read, captured[:action]
       assert_equal Admin::Resources::AuthzGadgetResource, captured[:resource]
       assert_instance_of AuthzFixtures::Gadget, captured[:record]
+      assert_equal :web, captured[:context].surface
     end
 
     test "destroy maps to :destroy" do