admin_suite 0.5.0 → 0.6.1

data/lib/admin_suite.rb

@@ -8,6 +8,11 @@ end
 
 require "pagy"
 
+# Hard dependency, declared in the gemspec but not a direct Gemfile entry in
+# any host -- Bundler only auto-requires direct Gemfile dependencies, never a
+# gem's transitive runtime dependencies.
+require "mcp"
+
 # Hard dependency, declared in the gemspec but not a direct Gemfile entry in
 # any host -- Bundler's `Bundler.require` only auto-requires gems declared
 # directly in the Gemfile (or via `gemspec`'s own path entry), not a gem's
@@ -20,6 +25,15 @@ require "turbo-rails"
 require "admin_suite/version"
 require "admin_suite/deprecation"
 require "admin_suite/configuration"
+require "admin_suite/authorization_context"
+require "admin_suite/query"
+require "admin_suite/mcp/authorization"
+require "admin_suite/mcp/serializer"
+require "admin_suite/mcp/tools/describe_resources"
+require "admin_suite/mcp/tools/list_records"
+require "admin_suite/mcp/tools/get_record"
+require "admin_suite/mcp/tools/aggregate"
+require "admin_suite/mcp"
 require "admin_suite/markdown_renderer"
 require "admin_suite/theme_palette"
 require "admin_suite/portal_registry"
@@ -34,7 +48,6 @@ require "admin_suite/renderers/json_renderer"
 require "admin_suite/renderers/key_value_renderer"
 require "admin_suite/renderers/table_from_renderer"
 require "admin_suite/renderers/code_renderer"
-require "admin_suite/renderers/legacy_gleania"
 require "admin_suite/legacy_custom_renderer_procs"
 require "admin_suite/definition_loader"
 require "admin_suite/host_autoload_policy"
@@ -58,14 +71,6 @@ AdminSuite::RendererRegistry.register_default(:code, AdminSuite::Renderers::Code
 AdminSuite::RendererRegistry.register_default(:json_preview, AdminSuite::Renderers::JsonRenderer)
 AdminSuite::RendererRegistry.register_default(:code_preview, AdminSuite::Renderers::CodeRenderer)
 
-# Deprecated (removal targeted at 0.6.0, moved from the originally-planned
-# 0.5.0 -- both host migrations, gleania and trust_growth, are in flight):
-# the four Gleania-specific LLM chat-transcript renderers. See
-# `AdminSuite::Renderers::LegacyGleania` for details.
-AdminSuite::RendererRegistry.register_default(:prompt_template_preview, AdminSuite::Renderers::LegacyGleania::PromptTemplateRenderer)
-AdminSuite::RendererRegistry.register_default(:messages_preview, AdminSuite::Renderers::LegacyGleania::MessagesPreviewRenderer)
-AdminSuite::RendererRegistry.register_default(:tool_args_preview, AdminSuite::Renderers::LegacyGleania::ToolArgsRenderer)
-AdminSuite::RendererRegistry.register_default(:turn_messages_preview, AdminSuite::Renderers::LegacyGleania::TurnMessagesRenderer)
 
 module AdminSuite
   class << self

data/lib/generators/admin_suite/install/templates/admin_suite.rb

@@ -26,9 +26,12 @@ AdminSuite.configure do |config|
   # provide one (legacy fallback):
   config.current_actor = ->(controller) { controller.respond_to?(:current_user) ? controller.current_user : nil }
 
-  # Authorization hook — called for every resource request:
+  # Authorization hook — called for every resource request.
+  # Signature: ->(actor:, action:, resource:, record:, context:) { true }
   # action is one of :read, :create, :update, :destroy, :execute.
-  # config.authorize = ->(actor:, action:, resource:, record:, controller:) { true }
+  # nil hook: authenticated web requests are allowed; MCP serves no tools/data.
+  # Hook return of false or nil denies the request (no disclose/mutate).
+  # config.authorize = ->(actor:, action:, resource:, record:, context:) { actor&.admin? }
   config.authorize = nil
 
   # Optional sign-out action in the topbar.

data/test/controllers/resources_controller_test.rb

@@ -6,12 +6,7 @@ module AdminSuite
   class ResourcesControllerTest < ActiveSupport::TestCase
     class TestController < ResourcesController
       attr_writer :test_resource_config, :test_params
-      attr_reader :filter_calls, :paginated_scope
-
-      def initialize
-        super
-        @filter_calls = 0
-      end
+      attr_reader :paginated_scope, :pagy_limit
 
       def params
         @test_params ||= {}
@@ -23,18 +18,27 @@ module AdminSuite
         @test_resource_config
       end
 
-      def filtered_collection
-        @filter_calls += 1
-        { total: 37 }
-      end
-
-      def paginate_collection(scope)
+      def pagy(scope, limit:)
         @paginated_scope = scope
+        @pagy_limit = limit
         [ Object.new, :paginated ]
       end
     end
 
+    class StatsModel
+      class << self
+        attr_accessor :all_calls
+
+        def all
+          self.all_calls = all_calls.to_i + 1
+          { total: 37 }
+        end
+      end
+    end
+
     class StatsResource < Admin::Base::Resource
+      model StatsModel
+
       index do
         stats do
           stat :legacy, -> { 11 }
@@ -72,11 +76,13 @@ module AdminSuite
     test "index reuses one filtered unpaginated scope for stats and pagination" do
       controller = TestController.new
       controller.test_resource_config = StatsResource
+      StatsModel.all_calls = 0
 
       controller.index
 
-      assert_equal 1, controller.filter_calls
+      assert_equal 1, StatsModel.all_calls
       assert_equal({ total: 37 }, controller.paginated_scope)
+      assert_equal 25, controller.pagy_limit
       assert_equal 37, controller.instance_variable_get(:@stats).second[:value]
       assert_equal :paginated, controller.instance_variable_get(:@collection)
     end

data/test/integration/authentication_test.rb

@@ -43,6 +43,16 @@ module AdminSuite
       end
     end
 
+    test "unknown auth strategy fails closed and lists registered strategies" do
+      with_config(allow_unauthenticated: false, auth_strategy: :typo) do
+        get ROOT
+
+        assert_response :forbidden
+        assert_includes response.body, "Unknown AdminSuite auth strategy :typo"
+        assert_includes response.body, "http_basic"
+      end
+    end
+
     test "legacy authenticate lambda still works" do
       denials = ->(controller) { controller.head :forbidden }
       with_config(allow_unauthenticated: false, auth_strategy: nil, authenticate: denials) do

data/test/integration/authorization_test.rb

@@ -66,13 +66,29 @@ module AdminSuite
       with_authorize(->(**) { false }) do
         get BASE
         assert_response :forbidden
+        refute_includes response.body, "Gadget one"
       end
     end
 
-    test "authorize receives actor, mapped action, resource, record, controller" do
+    test "nil authorize result denies with 403 and does not disclose the record" do
+      with_authorize(->(**) { nil }) do
+        get "#{BASE}/1"
+        assert_response :forbidden
+        refute_includes response.body, "Gadget one"
+      end
+    end
+
+    test "nil authorize result cannot mutate" do
+      with_authorize(->(**) { nil }) do
+        delete "#{BASE}/1"
+        assert_response :forbidden
+      end
+    end
+
+    test "authorize receives actor, mapped action, resource, record, context" do
       captured = nil
-      hook = lambda do |actor:, action:, resource:, record:, controller:|
-        captured = { action: action, resource: resource, record: record }
+      hook = lambda do |actor:, action:, resource:, record:, context:|
+        captured = { action: action, resource: resource, record: record, context: context }
         true
       end
 
@@ -83,6 +99,7 @@ module AdminSuite
       assert_equal :read, captured[:action]
       assert_equal Admin::Resources::AuthzGadgetResource, captured[:resource]
       assert_instance_of AuthzFixtures::Gadget, captured[:record]
+      assert_equal :web, captured[:context].surface
     end
 
     test "destroy maps to :destroy" do

data/test/integration/index_query_characterization_test.rb

@@ -0,0 +1,229 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+# Pins the index query path as it behaves at v0.5.0, before
+# AdminSuite::Query is extracted. These assertions intentionally exercise
+# routed requests and rendered rows rather than controller internals.
+module IndexQueryCharacterizationFixtures
+  class Relation
+    include Enumerable
+
+    attr_reader :includes_calls
+
+    def initialize(records, offset: 0, includes_calls: [])
+      @records = records
+      @offset = offset
+      @includes_calls = includes_calls
+    end
+
+    def each(&block) = @records.each(&block)
+    def count(*) = @records.length
+    def offset(value) = self.class.new(@records, offset: value, includes_calls: includes_calls)
+    def limit(value) = @records[@offset, value] || []
+
+    def where(condition = nil, *values, **bindings)
+      condition = bindings if condition.nil?
+      selected =
+        if condition.is_a?(Hash)
+          @records.select { |record| condition.all? { |field, value| record.public_send(field).to_s == value.to_s } }
+        else
+          term = (bindings[:search] || values.first).to_s.delete("%").downcase
+          fields = condition.scan(/(\w+) ILIKE/).flatten
+          @records.select { |record| fields.any? { |field| record.public_send(field).to_s.downcase.include?(term) } }
+        end
+      self.class.new(selected, includes_calls: includes_calls)
+    end
+
+    def order(ordering)
+      field, direction = ordering.first
+      sorted = @records.sort_by { |record| record.public_send(field).to_s }
+      sorted.reverse! if direction.to_sym == :desc
+      self.class.new(sorted, includes_calls: includes_calls)
+    end
+
+    def includes(*associations)
+      includes_calls << associations
+      self
+    end
+  end
+
+  class BadIncludesRelation < Relation
+    def includes(*) = raise(ArgumentError, "unknown association")
+  end
+
+  class Widget
+    extend ActiveModel::Naming
+
+    attr_reader :id, :name, :secret, :status
+
+    def initialize(id:, name:, secret:, status:)
+      @id = id
+      @name = name
+      @secret = secret
+      @status = status
+    end
+
+    ROWS = [
+      new(id: 1, name: "Zulu", secret: "hidden alpha", status: "open"),
+      new(id: 2, name: "Alpha", secret: "hidden zulu", status: "closed"),
+      new(id: 3, name: "Bravo", secret: "private", status: "open")
+    ].freeze
+    INCLUDES_CALLS = []
+
+    def self.all = Relation.new(ROWS, includes_calls: INCLUDES_CALLS)
+    def self.column_names = %w[id name secret status]
+    def self.primary_key = "id"
+    def self.columns_hash = { "id" => Struct.new(:type).new(:integer) }
+    def self.find(id) = ROWS.find { |row| row.to_param == id.to_s }
+    def to_param = id.to_s
+    def attributes = { "id" => id, "name" => name, "secret" => secret, "status" => status }
+  end
+
+  class BadIncludesWidget < Widget
+    def self.all = BadIncludesRelation.new(ROWS)
+  end
+
+  class PagedWidget
+    extend ActiveModel::Naming
+
+    attr_reader :id
+
+    def initialize(id:) = @id = id
+
+    ROWS = (1..150).map { |id| new(id: id) }.freeze
+
+    def self.all = Relation.new(ROWS)
+    def self.column_names = %w[id]
+    def self.primary_key = "id"
+    def self.columns_hash = { "id" => Struct.new(:type).new(:integer) }
+    def self.find(id) = ROWS.find { |row| row.to_param == id.to_s }
+    def to_param = id.to_s
+    def attributes = { "id" => id }
+  end
+end
+
+module Admin
+  module Resources
+    class IndexQueryCharacterizationWidgetResource < Admin::Base::Resource
+      model IndexQueryCharacterizationFixtures::Widget
+      portal :ops
+      section :observability
+
+      index do
+        searchable :name
+        sortable :name, default: :name, direction: :desc
+        filters { filter :status, type: :select, options: %w[open closed] }
+        columns do
+          column :name, sortable: true
+          column :status
+        end
+        includes :owner
+      end
+    end
+
+    class IndexQueryCharacterizationBadIncludesWidgetResource < Admin::Base::Resource
+      model IndexQueryCharacterizationFixtures::BadIncludesWidget
+      portal :ops
+      section :observability
+      index do
+        columns { column :name }
+        includes :missing
+      end
+    end
+
+    class IndexQueryCharacterizationPagedWidgetResource < Admin::Base::Resource
+      model IndexQueryCharacterizationFixtures::PagedWidget
+      portal :ops
+      section :observability
+      index do
+        columns { column :id }
+        paginate 30
+      end
+    end
+  end
+end
+
+class IndexQueryCharacterizationTest < ActionDispatch::IntegrationTest
+  WIDGETS_PATH = "/internal/admin_suite/ops/index_query_characterization_widgets"
+  PAGED_PATH = "/internal/admin_suite/ops/index_query_characterization_paged_widgets"
+
+  def rendered_names
+    css_select("tbody tr td:first-child").map { |cell| cell.text.strip }
+  end
+
+  def rendered_row_count = css_select("tbody tr").size
+
+  test "default sort applies when no sort param is given" do
+    get WIDGETS_PATH
+    assert_equal %w[Zulu Bravo Alpha], rendered_names
+  end
+
+  test "explicit sort and direction override the default" do
+    get WIDGETS_PATH, params: { sort: "name", direction: "asc" }
+    assert_equal %w[Alpha Bravo Zulu], rendered_names
+  end
+
+  test "a sort param naming an undeclared field is ignored" do
+    get WIDGETS_PATH, params: { sort: "secret", direction: "asc" }
+    assert_equal %w[Alpha Bravo Zulu], rendered_names
+  end
+
+  test "search examines only declared searchable fields" do
+    get WIDGETS_PATH, params: { search: "alpha" }
+    assert_equal [ "Alpha" ], rendered_names
+  end
+
+  test "a blank search returns the unfiltered scope" do
+    get WIDGETS_PATH, params: { search: " " }
+    assert_equal %w[Zulu Bravo Alpha], rendered_names
+  end
+
+  test "a declared filter narrows while an undeclared filter is ignored" do
+    get WIDGETS_PATH, params: { status: "open", secret: "hidden zulu" }
+    assert_equal %w[Zulu Bravo], rendered_names
+  end
+
+  test "declared includes are applied" do
+    IndexQueryCharacterizationFixtures::Widget::INCLUDES_CALLS.clear
+    get WIDGETS_PATH
+    assert_equal [ [ :owner ] ], IndexQueryCharacterizationFixtures::Widget::INCLUDES_CALLS
+  end
+
+  test "a bad includes association logs and still renders" do
+    logged = []
+    Rails.logger.stub(:warn, ->(message) { logged << message }) do
+      get "/internal/admin_suite/ops/index_query_characterization_bad_includes_widgets"
+    end
+    assert_response :success
+    assert_includes response.body, "Zulu"
+    assert_equal 1, logged.size
+  end
+
+  test "paginate 30 yields 30 rows per page" do
+    get PAGED_PATH
+    assert_equal 30, rendered_row_count
+  end
+
+  test "per_page 50 overrides the DSL value" do
+    get PAGED_PATH, params: { per_page: "50" }
+    assert_equal 50, rendered_row_count
+  end
+
+  test "an excessive per_page clamps to 100" do
+    get PAGED_PATH, params: { per_page: "999999" }
+    assert_equal 100, rendered_row_count
+  end
+
+  test "invalid and zero per_page values fall back to the DSL value" do
+    [ "abc", "0" ].each do |value|
+      get PAGED_PATH, params: { per_page: value }
+      assert_equal 30, rendered_row_count
+    end
+  end
+
+  test "a leading-zero per_page parses with Integer octal semantics" do
+    get PAGED_PATH, params: { per_page: "010" }
+    assert_equal 8, rendered_row_count
+  end
+end

data/test/integration/mcp_aggregate_test.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+module McpAggregateFixtures
+  class Widget
+    extend ActiveModel::Naming
+
+    def self.all = ReadOnlyResourceFixtures::Relation.new([new, new])
+  end
+end
+
+module Admin
+  module Resources
+    class McpAggregateWidgetResource < Admin::Base::Resource
+      model McpAggregateFixtures::Widget
+      portal :ops
+      section :observability
+      index do
+        stats { stat :total, ->(scope) { scope.count } }
+      end
+    end
+  end
+end
+
+class McpAggregateTest < McpIntegrationTest
+  def call_tool(arguments)
+    post "/internal/admin_suite/mcp",
+      params: { jsonrpc: "2.0", id: 1, method: "tools/call", params: { name: "aggregate", arguments: arguments } }.to_json,
+      headers: { "CONTENT_TYPE" => "application/json", "HTTP_ACCEPT" => "application/json, text/event-stream" }
+    JSON.parse(response.body)
+  end
+
+  test "returns a count and declared stats without records" do
+    result = with_authorize(->(**) { true }) do
+      call_tool(resource: "mcp_aggregate_widget")
+    end
+
+    payload = JSON.parse(result.dig("result", "content", 0, "text"))
+    assert_equal 2, payload.fetch("count")
+    assert_equal 2, payload.dig("stats", "total")
+    refute payload.key?("rows"), "aggregate must never return records"
+  end
+end

data/test/integration/mcp_authorization_test.rb

@@ -0,0 +1,102 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+module McpAuthorizationFixtures
+  class Widget
+    extend ActiveModel::Naming
+
+    def self.all = ReadOnlyResourceFixtures::Relation.new([])
+    def self.find_by(id:) = new
+  end
+end
+
+module Admin
+  module Resources
+    class McpAuthorizationWidgetResource < Admin::Base::Resource
+      model McpAuthorizationFixtures::Widget
+      portal :ops
+      section :observability
+      index { columns { column :name } }
+    end
+
+    class McpAuthorizationDisabledResource < Admin::Base::Resource
+      model McpAuthorizationFixtures::Widget
+      portal :ops
+      section :observability
+      mcp false
+    end
+  end
+end
+
+class McpAuthorizationTest < McpIntegrationTest
+  def rpc(method, params = {})
+    post "/internal/admin_suite/mcp",
+      params: { jsonrpc: "2.0", id: 1, method: method, params: params }.to_json,
+      headers: { "CONTENT_TYPE" => "application/json", "HTTP_ACCEPT" => "application/json, text/event-stream" }
+    JSON.parse(response.body)
+  end
+
+  def call_tool(name, arguments = {})
+    rpc("tools/call", { name: name, arguments: arguments })
+  end
+
+  test "a nil authorize hook advertises no tools" do
+    with_authorize(nil) do
+      assert_empty rpc("tools/list").dig("result", "tools")
+    end
+  end
+
+  test "a nil authorize hook denies a direct call to every tool" do
+    ctx = { actor: "x" }
+
+    with_authorize(nil) do
+      [
+        AdminSuite::Mcp::Tools::DescribeResources.call(server_context: ctx),
+        AdminSuite::Mcp::Tools::ListRecords.call(resource: "mcp_authorization_widget", server_context: ctx),
+        AdminSuite::Mcp::Tools::GetRecord.call(resource: "mcp_authorization_widget", id: "1", server_context: ctx),
+        AdminSuite::Mcp::Tools::Aggregate.call(resource: "mcp_authorization_widget", server_context: ctx)
+      ].each do |response|
+        assert response.error?, response.inspect
+        assert_equal AdminSuite::Mcp::Authorization::DENIED_MESSAGE, response.content.first[:text]
+      end
+    end
+  end
+
+  test "the authorize hook receives an mcp surface and a read action" do
+    seen = []
+    hook = lambda do |action:, record:, context:, **|
+      seen << [action, context.surface, record]
+      true
+    end
+
+    with_authorize(hook) do
+      call_tool("list_records", { resource: "mcp_authorization_widget" })
+    end
+
+    assert_includes seen, [:read, :mcp, nil]
+  end
+
+  test "describe_resources omits resources the hook denies" do
+    hook = ->(resource:, **) { resource.resource_name != "mcp_authorization_widget" }
+
+    with_authorize(hook) do
+      refute_match(/mcp_authorization_widget/, call_tool("describe_resources").to_s)
+    end
+  end
+
+  test "an mcp-disabled resource is invisible and unreachable" do
+    with_authorize(->(**) { true }) do
+      refute_match(/mcp_authorization_disabled/, call_tool("describe_resources").to_s)
+      assert call_tool("list_records", { resource: "mcp_authorization_disabled" }).dig("result", "isError")
+    end
+  end
+
+  test "a raising authorize hook denies instead of returning a server error" do
+    with_authorize(->(**) { raise "boom" }) do
+      result = call_tool("list_records", { resource: "mcp_authorization_widget" })
+
+      assert result.dig("result", "isError"), result.inspect
+    end
+  end
+end

data/test/integration/mcp_endpoint_test.rb

@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+module McpEndpointFixtures
+  class Widget
+    extend ActiveModel::Naming
+  end
+end
+
+module Admin
+  module Resources
+    class McpEndpointWidgetResource < Admin::Base::Resource
+      model McpEndpointFixtures::Widget
+      portal :ops
+      section :observability
+      index do
+        columns { column :name }
+      end
+      actions do
+        action :approve
+        bulk_action :archive
+      end
+    end
+  end
+end
+
+class McpEndpointTest < McpIntegrationTest
+  def rpc(method, params = {}, id: 1)
+    post "/internal/admin_suite/mcp",
+      params: { jsonrpc: "2.0", id: id, method: method, params: params }.to_json,
+      headers: { "CONTENT_TYPE" => "application/json", "HTTP_ACCEPT" => "application/json, text/event-stream" }
+    JSON.parse(response.body)
+  end
+
+  test "tools/list advertises the read tools when an authorize hook permits" do
+    with_authorize(->(**) { true }) do
+      names = rpc("tools/list").dig("result", "tools").map { |tool| tool["name"] }
+
+      assert_includes names, "describe_resources"
+    end
+  end
+
+  test "describe_resources returns declared resources and their fields" do
+    with_authorize(->(**) { true }) do
+      result = rpc("tools/call", { name: "describe_resources", arguments: {} })
+
+      refute result.dig("result", "isError"), result.inspect
+      assert_match(/mcp_endpoint_widget/, result.to_s)
+      assert_match(/name/, result.to_s)
+    end
+  end
+
+  test "describe_resources includes portal, section, and declared actions" do
+    with_authorize(->(**) { true }) do
+      result = rpc("tools/call", { name: "describe_resources", arguments: {} })
+      payload = JSON.parse(result.dig("result", "content", 0, "text"))
+      widget = payload.find { |resource| resource["name"] == "mcp_endpoint_widget" }
+
+      assert_equal "ops", widget.fetch("portal")
+      assert_equal "observability", widget.fetch("section")
+      assert_includes widget.fetch("actions"), { "name" => "approve", "kind" => "member" }
+      assert_includes widget.fetch("actions"), { "name" => "archive", "kind" => "bulk" }
+    end
+  end
+
+  test "describe_resources returns a generic error without the raised message" do
+    with_authorize(->(**) { true }) do
+      AdminSuite::Mcp::Tools::DescribeResources.stub(:describe, proc { raise "SECRET-/db/password-detail" }) do
+        result = rpc("tools/call", { name: "describe_resources", arguments: {} })
+
+        refute result["error"], result.inspect
+        assert result.dig("result", "isError")
+        body = result.to_s
+        assert_match(/describe_resources failed/, body)
+        refute_match(/SECRET-\/db\/password-detail/, body)
+      end
+    end
+  end
+
+  test "a nil authorize hook advertises no tools and denies direct calls" do
+    with_authorize(nil) do
+      assert_empty rpc("tools/list").dig("result", "tools")
+
+      result = rpc("tools/call", { name: "describe_resources", arguments: {} })
+      assert result["error"], result.inspect
+    end
+  end
+end