admin_suite 0.5.0 → 0.6.2

data/test/integration/mcp_release_test.rb

@@ -0,0 +1,131 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+module McpReleaseFixtures
+  Record = Struct.new(:id, :state)
+
+  class Relation
+    include Enumerable
+    def initialize(rows) = @rows = rows
+    def each(&block) = @rows.each(&block)
+    def count = @rows.size
+    def offset(n) = self.class.new(@rows.drop(n))
+    def limit(n) = self.class.new(@rows.first(n))
+    def where(conditions)
+      self.class.new(@rows.select { |row| conditions.all? { |key, value| row.public_send(key) == value } })
+    end
+  end
+
+  class Widget
+    extend ActiveModel::Naming
+    def self.all = Relation.new([Record.new(1, "open"), Record.new(2, "closed")])
+    def self.find_by(id:) = all.find { |row| row.id.to_s == id.to_s }
+  end
+end
+
+module Admin
+  module Resources
+    class McpReleaseWidgetResource < Admin::Base::Resource
+      model McpReleaseFixtures::Widget
+      portal :ops
+      section :observability
+      index do
+        paginate 500
+        columns { column :id }
+        filters { filter :state, type: :select }
+      end
+      show { panel :identity, fields: %i[id state] }
+    end
+  end
+end
+
+class McpReleaseTest < ActionDispatch::IntegrationTest
+  setup do
+    @previous_actor = AdminSuite.config.current_actor
+    AdminSuite.config.current_actor = ->(_) { "release-test-operator" }
+  end
+
+  teardown { AdminSuite.config.current_actor = @previous_actor }
+
+  def call_tool(name, **arguments)
+    post "/internal/admin_suite/mcp", params: {
+      jsonrpc: "2.0", id: 1, method: "tools/call", params: { name: name, arguments: arguments }
+    }.to_json, headers: { "CONTENT_TYPE" => "application/json", "HTTP_ACCEPT" => "application/json, text/event-stream" }
+    JSON.parse(response.body)
+  end
+
+  test "JSON filters affect both records and aggregates" do
+    with_authorize(->(**) { true }) do
+      result = call_tool("list_records", resource: "mcp_release_widget", filters: { state: "open" })
+      payload = JSON.parse(result.dig("result", "content", 0, "text"))
+      assert_equal [1], payload.fetch("rows").map { |row| row.fetch("id") }
+      assert_equal 100, payload.fetch("applied_per_page")
+      result = call_tool("aggregate", resource: "mcp_release_widget", filters: { state: "closed" })
+      assert_equal 1, JSON.parse(result.dig("result", "content", 0, "text")).fetch("count")
+    end
+  end
+
+  test "an anonymous MCP request is rejected even in the development escape hatch" do
+    AdminSuite.config.current_actor = nil
+    with_authorize(->(**) { true }) do
+      post "/internal/admin_suite/mcp", params: { jsonrpc: "2.0", id: 1, method: "tools/list" }.to_json,
+        headers: { "CONTENT_TYPE" => "application/json", "HTTP_ACCEPT" => "application/json, text/event-stream" }
+      assert_response :unauthorized
+    end
+  end
+
+  test "get_record checks record policy and passes the HTTP request to authorization" do
+    seen_requests = []
+    policy = ->(record:, context:, **) do
+      seen_requests << context.request
+      record.nil? || record.id != 1
+    end
+    with_authorize(policy) do
+      denied = call_tool("get_record", resource: "mcp_release_widget", id: "1")
+      missing = call_tool("get_record", resource: "mcp_release_widget", id: "999")
+      assert denied.dig("result", "isError")
+      assert_equal missing.dig("result", "content"), denied.dig("result", "content")
+      assert seen_requests.all? { |request| request.is_a?(ActionDispatch::Request) }
+    end
+  end
+
+  test "MCP rejects foreign origins while allowing same-origin and headless clients" do
+    with_authorize(->(**) { true }) do
+      ["https://attacker.example", "null", ""].each do |origin|
+        post "/internal/admin_suite/mcp", params: { jsonrpc: "2.0", id: 1, method: "tools/list" }.to_json,
+          headers: { "CONTENT_TYPE" => "application/json", "HTTP_ACCEPT" => "application/json, text/event-stream", "HTTP_ORIGIN" => origin }
+        assert_response :forbidden
+      end
+      post "/internal/admin_suite/mcp", params: { jsonrpc: "2.0", id: 1, method: "tools/list" }.to_json,
+        headers: { "CONTENT_TYPE" => "application/json", "HTTP_ACCEPT" => "application/json, text/event-stream", "HTTP_ORIGIN" => "http://www.example.com" }
+      assert_response :success
+    end
+  end
+
+  test "the stateless transport accepts notifications and declines GET streams" do
+    with_authorize(->(**) { true }) do
+      post "/internal/admin_suite/mcp", params: { jsonrpc: "2.0", method: "notifications/initialized" }.to_json,
+        headers: { "CONTENT_TYPE" => "application/json", "HTTP_ACCEPT" => "application/json, text/event-stream" }
+      assert_response :accepted
+      assert_empty response.body
+      get "/internal/admin_suite/mcp"
+      assert_response :method_not_allowed
+      delete "/internal/admin_suite/mcp"
+      assert_response :method_not_allowed
+    end
+  end
+
+  test "forgery protection allows the JSON transport but rejects tokenless forms" do
+    previous = AdminSuite::McpController.allow_forgery_protection
+    AdminSuite::McpController.allow_forgery_protection = true
+    with_authorize(->(**) { true }) do
+      call_tool("list_records", resource: "mcp_release_widget")
+      assert_response :success
+      post "/internal/admin_suite/mcp", params: { method: "tools/list" }
+      assert_response :unprocessable_entity
+    end
+  ensure
+    AdminSuite::McpController.allow_forgery_protection = previous
+  end
+end

data/test/integration/read_only_resource_test.rb

@@ -35,6 +35,10 @@ module ReadOnlyResourceFixtures
       new
     end
 
+    def self.where(id:)
+      id.filter_map { |value| find(value) }
+    end
+
     def to_param
       id.to_s
     end
@@ -43,7 +47,16 @@ module ReadOnlyResourceFixtures
       { "id" => id, "name" => name }
     end
 
+    def self.ping_calls
+      @ping_calls || 0
+    end
+
+    def self.ping_calls=(value)
+      @ping_calls = value
+    end
+
     def ping
+      self.class.ping_calls += 1
       true
     end
   end
@@ -65,6 +78,88 @@ module Admin
 
       actions do
         action :ping
+        bulk_action :ping
+      end
+    end
+  end
+end
+
+module WritableResourceFixtures
+  class Widget
+    extend ActiveModel::Naming
+
+    attr_reader :id, :name
+
+    def initialize(id: 1, name: "Writable widget")
+      @id = id
+      @name = name
+    end
+
+    def self.all
+      ReadOnlyResourceFixtures::Relation.new([ new ])
+    end
+
+    def self.column_names
+      %w[id name]
+    end
+
+    def self.primary_key
+      "id"
+    end
+
+    def self.columns_hash
+      { "id" => Struct.new(:type).new(:integer) }
+    end
+
+    def self.find(id)
+      raise ActiveRecord::RecordNotFound unless id.to_s == "1"
+
+      new
+    end
+
+    def self.where(id:)
+      id.filter_map { |value| find(value) }
+    end
+
+    def self.ping_calls
+      @ping_calls || 0
+    end
+
+    def self.ping_calls=(value)
+      @ping_calls = value
+    end
+
+    def to_param
+      id.to_s
+    end
+
+    def attributes
+      { "id" => id, "name" => name }
+    end
+
+    def ping
+      self.class.ping_calls += 1
+      true
+    end
+  end
+end
+
+module Admin
+  module Resources
+    class WritableWidgetResource < Admin::Base::Resource
+      model WritableResourceFixtures::Widget
+      portal :ops
+      section :observability
+
+      index do
+        columns do
+          column :name
+        end
+      end
+
+      actions do
+        action :ping
+        bulk_action :ping
       end
     end
   end
@@ -73,6 +168,12 @@ end
 module AdminSuite
   class ReadOnlyResourceTest < ActionDispatch::IntegrationTest
     BASE_PATH = "/internal/admin_suite/ops/read_only_widgets"
+    WRITABLE_PATH = "/internal/admin_suite/ops/writable_widgets"
+
+    setup do
+      ReadOnlyResourceFixtures::Widget.ping_calls = 0
+      WritableResourceFixtures::Widget.ping_calls = 0
+    end
 
     test "direct built in mutation endpoints are rejected" do
       get "#{BASE_PATH}/new"
@@ -122,9 +223,34 @@ module AdminSuite
       assert_response :not_found
     end
 
-    test "declared member actions remain allowed on read_only resources" do
+    test "declared member actions are rejected on read_only resources" do
       post "#{BASE_PATH}/1/execute_action/ping"
-      refute_equal 404, response.status
+
+      assert_response :not_found
+      assert_equal 0, ReadOnlyResourceFixtures::Widget.ping_calls
+    end
+
+    test "declared bulk actions are rejected on read_only resources" do
+      post "#{BASE_PATH}/bulk_action/ping", params: { ids: [ "1" ] }
+
+      assert_response :not_found
+      assert_equal 0, ReadOnlyResourceFixtures::Widget.ping_calls
+    end
+
+    test "declared member actions still execute on writable resources" do
+      post "#{WRITABLE_PATH}/1/execute_action/ping"
+
+      assert_redirected_to "#{WRITABLE_PATH}/1"
+      assert_equal 1, WritableResourceFixtures::Widget.ping_calls
+    end
+
+    test "declared bulk actions still execute on writable resources" do
+      post "#{WRITABLE_PATH}/bulk_action/ping", params: { ids: [ "1" ] }
+
+      assert_redirected_to WRITABLE_PATH
+      follow_redirect!
+      assert_includes response.body, "Successfully processed 1 records"
+      assert_equal 1, WritableResourceFixtures::Widget.ping_calls
     end
   end
 end

data/test/integration/searchable_select_search_test.rb

@@ -263,10 +263,10 @@ module AdminSuite
       assert_response :forbidden
     end
 
-    test "authorize hook receives action: :read, the resource, a nil record, and the controller" do
+    test "authorize hook receives action: :read, the resource, a nil record, and the context" do
       captured = nil
-      hook = lambda do |actor:, action:, resource:, record:, controller:|
-        captured = { action: action, resource: resource, record: record, controller: controller.class }
+      hook = lambda do |actor:, action:, resource:, record:, context:|
+        captured = { action: action, resource: resource, record: record, context: context }
         true
       end
 
@@ -275,7 +275,8 @@ module AdminSuite
       assert_equal :read, captured[:action]
       assert_equal Admin::Resources::SearchableSelectCompanyResource, captured[:resource]
       assert_nil captured[:record]
-      assert_equal AdminSuite::ResourcesController, captured[:controller]
+      assert_equal :web, captured[:context].surface
+      assert_equal AdminSuite::ResourcesController, captured[:context].controller.class
     end
 
     test "a stray ?id= is never loaded and never reaches authorize's record:" do

data/test/lib/action_executor_test.rb

@@ -2,6 +2,8 @@
 
 require "test_helper"
 require "tmpdir"
+require "open3"
+require "rbconfig"
 
 module Admin
   module Base
@@ -96,16 +98,22 @@ module Admin
       end
 
       test "load_action_handlers_for_admin_suite returns early when AdminSuite is not defined" do
-        # Temporarily undefine AdminSuite to test early return
-        admin_suite_defined = defined?(AdminSuite)
-
-        skip "Cannot test AdminSuite undefined condition when AdminSuite is required" if admin_suite_defined
-
-        resource_class = Struct.new(:resource_name).new("test")
-        executor = ActionExecutor.new(resource_class, :test, nil)
+        # Bundler evaluates the gemspec and defines AdminSuite::VERSION.
+        # Bypass its RUBYOPT preload in this dependency-free subprocess.
+        script = <<~RUBY
+          require_relative "lib/admin/base/action_executor"
+          abort "AdminSuite unexpectedly loaded" if defined?(AdminSuite)
+          executor = Admin::Base::ActionExecutor.new(nil, :test, nil)
+          result = executor.send(:load_action_handlers_for_admin_suite!)
+          abort "Expected early return" unless result.nil?
+          abort "Handlers marked loaded" if Admin::Base::ActionExecutor.handlers_loaded
+        RUBY
+        stdout, stderr, status = Open3.capture3(
+          { "RUBYOPT" => nil }, RbConfig.ruby, "--disable-gems", "-e", script,
+          chdir: File.expand_path("../..", __dir__)
+        )
 
-        # This should return early without error
-        assert_nil executor.send(:load_action_handlers_for_admin_suite!)
+        assert status.success?, "Isolated executor failed:\n#{stdout}#{stderr}"
       end
 
       test "load_action_handlers_for_admin_suite handles empty action_globs gracefully" do

data/test/lib/auth_host_user_test.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class AuthNormalizeActorTest < ActiveSupport::TestCase
+  test "normalizes the authenticated-but-anonymous sentinel to nil" do
+    assert_nil AdminSuite::Auth.normalize_actor(true)
+    assert_nil AdminSuite::Auth.normalize_actor(false)
+    assert_nil AdminSuite::Auth.normalize_actor(nil)
+  end
+
+  test "passes a real actor through untouched" do
+    user = Struct.new(:email).new("ravi@techwright.io")
+    assert_same user, AdminSuite::Auth.normalize_actor(user)
+  end
+end
+
+class AuthHostUserTest < ActiveSupport::TestCase
+  Controller = Struct.new(:performed) do
+    def performed? = !!performed
+    def head(*) = nil
+  end
+
+  test "is registered under :host_user" do
+    assert_equal AdminSuite::Auth::HostUser, AdminSuite::Auth.lookup(:host_user)
+  end
+
+  test "returns the host user the resolver produced" do
+    user = Struct.new(:email).new("ravi@techwright.io")
+    strategy = AdminSuite::Auth::HostUser.new(resolve: ->(_c) { user })
+
+    assert_same user, strategy.authenticate!(Controller.new(false))
+  end
+
+  test "denies when the resolver returns nothing" do
+    strategy = AdminSuite::Auth::HostUser.new(resolve: ->(_c) { nil })
+
+    assert_nil strategy.authenticate!(Controller.new(false))
+  end
+
+  test "denies rather than raising when the resolver blows up" do
+    strategy = AdminSuite::Auth::HostUser.new(resolve: ->(_c) { raise "boom" })
+
+    assert_nil strategy.authenticate!(Controller.new(false))
+  end
+
+  test "denies loudly when no resolver is configured" do
+    strategy = AdminSuite::Auth::HostUser.new({})
+
+    assert_nil strategy.authenticate!(Controller.new(false))
+  end
+end

data/test/lib/auth_http_basic_test.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 raise "unset ADMIN_SUITE_USERNAME in test env" if ENV["ADMIN_SUITE_USERNAME"]
+raise "unset ADMIN_SUITE_PASSWORD in test env" if ENV["ADMIN_SUITE_PASSWORD"]
 
 require "test_helper"
 
@@ -55,6 +56,15 @@ module AdminSuite
       assert_equal :forbidden, controller.rendered_status
     end
 
+    test "denies with 403 when password is blank" do
+      strategy = Auth::HttpBasic.new(username: "ravi", password: nil)
+      controller = ControllerDouble.new(given_username: "ravi", given_password: nil)
+
+      assert_nil strategy.authenticate!(controller)
+      assert_equal :forbidden, controller.rendered_status
+      refute controller.challenged
+    end
+
     test "is registered as :http_basic" do
       assert_equal Auth::HttpBasic, Auth.lookup(:http_basic)
     end

data/test/lib/auth_test.rb

@@ -9,9 +9,11 @@ module AdminSuite
     end
 
     test "register and lookup a strategy by name" do
-      AdminSuite::Auth.register(:fake, FakeStrategy)
-      assert_equal FakeStrategy, AdminSuite::Auth.lookup(:fake)
-      assert_equal FakeStrategy, AdminSuite::Auth.lookup("fake")
+      with_auth_registry_snapshot do
+        AdminSuite::Auth.register(:fake, FakeStrategy)
+        assert_equal FakeStrategy, AdminSuite::Auth.lookup(:fake)
+        assert_equal FakeStrategy, AdminSuite::Auth.lookup("fake")
+      end
     end
 
     test "lookup of unknown strategy raises UnknownStrategyError" do
@@ -20,10 +22,25 @@ module AdminSuite
       end
     end
 
+    test "registered lists registered strategy names" do
+      with_auth_registry_snapshot do
+        AdminSuite::Auth.register(:fake, FakeStrategy)
+
+        assert_includes AdminSuite::Auth.registered, :fake
+        assert_includes AdminSuite::Auth.registered, :http_basic
+      end
+    end
+
     test "base strategy exposes options and requires authenticate!" do
       strategy = AdminSuite::Auth::Strategy.new(username: "u")
       assert_equal({ username: "u" }, strategy.options)
       assert_raises(NotImplementedError) { strategy.authenticate!(nil) }
     end
+
+    test "base strategy symbolizes string-keyed options" do
+      strategy = AdminSuite::Auth::Strategy.new("username" => "u")
+
+      assert_equal({ username: "u" }, strategy.options)
+    end
   end
 end

data/test/lib/authorization_context_test.rb

@@ -0,0 +1,127 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+module AuthorizationContextFixtures
+  # A plain object implementing #call -- exactly the shape a host might write
+  # as an authorize adapter. Has no #parameters of its own; the writer must
+  # fall back to introspecting #call's method object.
+  class CorrectArityCallable
+    def call(actor:, action:, resource:, record:, context:)
+      true
+    end
+  end
+
+  class OldArityCallable
+    def call(actor:, action:, resource:, record:, controller:)
+      true
+    end
+  end
+
+  class SplatCallable
+    def call(**)
+      true
+    end
+  end
+end
+
+class AuthorizationContextTest < ActiveSupport::TestCase
+  test "reports its surface" do
+    web = AdminSuite::AuthorizationContext.new(surface: :web, controller: :ctrl)
+    mcp = AdminSuite::AuthorizationContext.new(surface: :mcp)
+
+    assert_predicate web, :web?
+    refute_predicate web, :mcp?
+    assert_equal :ctrl, web.controller
+    assert_predicate mcp, :mcp?
+    assert_nil mcp.controller
+  end
+
+  test "rejects an unknown surface" do
+    assert_raises(ArgumentError) { AdminSuite::AuthorizationContext.new(surface: :carrier_pigeon) }
+  end
+
+  test "assigning an old-arity authorize hook raises immediately" do
+    error = assert_raises(ArgumentError) do
+      AdminSuite.config.authorize = ->(actor:, action:, resource:, record:, controller:) { true }
+    end
+
+    # Assert on the COMPUTED diagnosis, not the message's fixed footer -- that
+    # footer explains the controller:/context: migration on every failure, so
+    # `assert_match(/controller:/)` alone would pass for any rejection at all.
+    assert_match(/Missing: \[:context\]/, error.message)
+    assert_match(/Unexpected: \[:controller\]/, error.message)
+  ensure
+    AdminSuite.config.authorize = nil
+  end
+
+  test "accepts a correct-arity hook and a nil hook" do
+    AdminSuite.config.authorize = ->(actor:, action:, resource:, record:, context:) { true }
+    assert_respond_to AdminSuite.config.authorize, :call
+    AdminSuite.config.authorize = nil
+    assert_nil AdminSuite.config.authorize
+  end
+
+  test "accepts a hook that takes a keyword splat" do
+    AdminSuite.config.authorize = ->(**) { true }
+    assert_respond_to AdminSuite.config.authorize, :call
+
+    AdminSuite.config.authorize = ->(action:, **) { action == :read }
+    assert_respond_to AdminSuite.config.authorize, :call
+  ensure
+    AdminSuite.config.authorize = nil
+  end
+
+  test "still rejects controller: even behind a splat" do
+    error = assert_raises(ArgumentError) do
+      AdminSuite.config.authorize = ->(controller:, **) { true }
+    end
+
+    # The splat means nothing is missing; `controller:` being named is the
+    # whole defect, so assert exactly that rather than the shared footer.
+    assert_match(/Missing: \[\]/, error.message)
+    assert_match(/Unexpected: \[:controller\]/, error.message)
+  ensure
+    AdminSuite.config.authorize = nil
+  end
+
+  test "accepts a correct-arity callable object without #parameters" do
+    AdminSuite.config.authorize = AuthorizationContextFixtures::CorrectArityCallable.new
+    assert_respond_to AdminSuite.config.authorize, :call
+  ensure
+    AdminSuite.config.authorize = nil
+  end
+
+  test "rejects an old-arity callable object, proving the fallback validates rather than bypasses" do
+    error = assert_raises(ArgumentError) do
+      AdminSuite.config.authorize = AuthorizationContextFixtures::OldArityCallable.new
+    end
+
+    # This test's name claims the fallback VALIDATES rather than bypasses, so
+    # it must assert the guard actually read this object's `#call` signature.
+    # Matching the footer would also pass for a fallback that rejected every
+    # callable outright -- the opposite of validation.
+    assert_match(/Missing: \[:context\]/, error.message)
+    assert_match(/Unexpected: \[:controller\]/, error.message)
+  ensure
+    AdminSuite.config.authorize = nil
+  end
+
+  test "accepts a callable object whose #call takes a keyword splat" do
+    AdminSuite.config.authorize = AuthorizationContextFixtures::SplatCallable.new
+    assert_respond_to AdminSuite.config.authorize, :call
+  ensure
+    AdminSuite.config.authorize = nil
+  end
+
+  test "rejects a non-callable with an ArgumentError naming the problem" do
+    error = assert_raises(ArgumentError) do
+      AdminSuite.config.authorize = "nope"
+    end
+
+    assert_match(/callable/, error.message)
+    assert_match(/String/, error.message)
+  ensure
+    AdminSuite.config.authorize = nil
+  end
+end

data/test/lib/engine_defaults_test.rb

@@ -31,8 +31,7 @@ module AdminSuite
 
     test "dead configuration and DSL members are gone" do
       refute AdminSuite::Configuration.new.respond_to?(:tailwind_cdn)
-      assert Admin::Base::Resource.respond_to?(:exportable),
-        "exportable is a deprecated no-op, not removed -- see ResourceExportableDeprecationTest"
+      refute Admin::Base::Resource.respond_to?(:exportable)
       refute Admin::Base::Resource::ColumnDefinition.members.include?(:render)
     end
   end