admin_suite 0.5.0 → 0.6.2

data/test/lib/mcp_serializer_test.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class McpSerializerTest < ActiveSupport::TestCase
+  Column = Data.define(:name)
+  Index = Data.define(:columns_list)
+  Config = Data.define(:index_config)
+
+  test "emits only the resource's declared columns" do
+    record = Struct.new(:id, :name, :secret_token).new(1, "Widget", "sh-hh")
+    config = Config.new(Index.new([Column.new(:id), Column.new(:name)]))
+
+    row = AdminSuite::Mcp::Serializer.index_row(record, config)
+
+    assert_equal %w[id name], row.keys.map(&:to_s).sort
+    refute_includes row.keys.map(&:to_s), "secret_token"
+  end
+
+  test "a raising accessor degrades that cell, not the row" do
+    record = Object.new
+    def record.id = 1
+    def record.name = raise("boom")
+    config = Config.new(Index.new([Column.new(:id), Column.new(:name)]))
+
+    row = AdminSuite::Mcp::Serializer.index_row(record, config)
+
+    assert_equal 1, row[:id]
+    assert_nil row[:name]
+  end
+
+  test "association panels return bounded rows containing only declared columns" do
+    show = Admin::Base::Resource::ShowConfig.new
+    show.panel :children, association: :children, columns: [:name], limit: 500
+    config = Struct.new(:show_config).new(show)
+    child = Struct.new(:name, :secret_token).new("Visible", "private")
+    record = Struct.new(:children).new(Array.new(150, child))
+
+    payload = AdminSuite::Mcp::Serializer.associations_payload(record, config, max_rows: 100)
+    assert_equal 100, payload.fetch(:children).fetch(:rows).size
+    assert_equal({ name: "Visible" }, payload.fetch(:children).fetch(:rows).first)
+    assert_equal 100, payload.fetch(:children).fetch(:applied_limit)
+    refute_includes JSON.generate(payload), "private"
+  end
+
+  test "association panels without declared columns do not serialize model attributes" do
+    show = Admin::Base::Resource::ShowConfig.new
+    show.panel :children, association: :children
+    config = Struct.new(:show_config).new(show)
+    record = Object.new
+    def record.children = raise("must not load an undeclared field set")
+
+    assert_empty AdminSuite::Mcp::Serializer.associations_payload(record, config, max_rows: 100)
+  end
+
+  test "a content lambda serializes the proc result, not a missing attribute" do
+    record = Struct.new(:id).new(1)
+    column = Admin::Base::Resource::ColumnDefinition.new(name: :listings_count, content: ->(_r) { 42 })
+    config = Config.new(Index.new([column]))
+
+    assert_equal 42, AdminSuite::Mcp::Serializer.index_row(record, config)[:listings_count]
+  end
+
+  test "a label lambda serializes the proc result" do
+    record = Struct.new(:id).new(1)
+    column = Admin::Base::Resource::ColumnDefinition.new(name: :status, content: ->(_r) { "active" }, type: :label)
+    config = Config.new(Index.new([column]))
+
+    assert_equal "active", AdminSuite::Mcp::Serializer.index_row(record, config)[:status]
+  end
+
+  test "declared times and associations serialize as parseable primitives, not heap dumps" do
+    created_at = Time.utc(2026, 9, 10, 12, 0, 0)
+    application = SerializerApplication.new(id: 7, name: "Acme")
+    record = Struct.new(:created_at, :application, :blob).new(created_at, application, SerializerOpaque.new)
+    config = Config.new(Index.new([Column.new(:created_at), Column.new(:application), Column.new(:blob)]))
+
+    row = AdminSuite::Mcp::Serializer.index_row(record, config)
+    text = AdminSuite::Mcp::Serializer.dump(row)
+
+    assert_equal "2026-09-10T12:00:00Z", row[:created_at]
+    assert_equal created_at, Time.iso8601(row[:created_at])
+    assert_equal "Acme", row[:application]
+    refute_match(/#<|0x[0-9a-f]+/i, text)
+  end
+
+  test "a missing association panel degrades that panel instead of raising" do
+    show = Admin::Base::Resource::ShowConfig.new
+    show.panel :children, association: :missing_kids, columns: [:name]
+    config = Struct.new(:show_config).new(show)
+
+    payload = AdminSuite::Mcp::Serializer.associations_payload(Object.new, config, max_rows: 100)
+
+    assert_equal [], payload.fetch(:children).fetch(:rows)
+  end
+
+  class SerializerApplication < ActiveRecord::Base
+    attr_reader :id, :name
+
+    def initialize(id:, name:)
+      @id = id
+      @name = name
+    end
+  end
+
+  class SerializerOpaque; end
+end

data/test/lib/query_test.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class QueryTest < ActiveSupport::TestCase
+  Config = Struct.new(:model_class, :index_config)
+  IndexConfig = Struct.new(
+    :per_page,
+    :includes_list,
+    :searchable_fields,
+    :filters_list,
+    :default_sort,
+    :sortable_fields,
+    :default_sort_direction
+  )
+
+  class RaisingIncludesRelation < ReadOnlyResourceFixtures::Relation
+    def includes(*)
+      raise ArgumentError, "bad association"
+    end
+  end
+
+  class Model
+    class << self
+      attr_accessor :relation
+
+      def all = relation
+    end
+  end
+
+  test "per_page falls back to the DSL value when no param is given" do
+    query = AdminSuite::Query.new(resource_config: config_with(per_page: 30), params: {})
+
+    assert_equal 30, query.per_page
+  end
+
+  test "per_page honours the param" do
+    query = AdminSuite::Query.new(resource_config: config_with(per_page: 30), params: { per_page: "50" })
+
+    assert_equal 50, query.per_page
+  end
+
+  test "per_page clamps to MAX_PAGE_SIZE" do
+    query = AdminSuite::Query.new(resource_config: config_with(per_page: 30), params: { per_page: "999999" })
+
+    assert_equal AdminSuite::Query::MAX_PAGE_SIZE, query.per_page
+  end
+
+  test "per_page falls back for junk and non-positive values" do
+    ["abc", "0", "-5", nil, "", [], true].each do |value|
+      query = AdminSuite::Query.new(resource_config: config_with(per_page: 30), params: { per_page: value })
+
+      assert_equal 30, query.per_page, "per_page: #{value.inspect} must fall back to the DSL value"
+    end
+  end
+
+  test "the cap applies to DSL defaults as well as explicit page sizes" do
+    [nil, "", "bad", 0, -1, [], true, 5000].each do |value|
+      query = AdminSuite::Query.new(resource_config: config_with(per_page: 500),
+        params: { per_page: value }, max_page_size: 40)
+      assert_equal 40, query.per_page, "per_page=#{value.inspect}"
+    end
+  end
+
+  test "per_page remains a positive integer when max_page_size is below 1" do
+    [0, -5, nil].each do |cap|
+      query = AdminSuite::Query.new(
+        resource_config: config_with(per_page: 30),
+        params: { per_page: "10" },
+        max_page_size: cap
+      )
+
+      assert_kind_of Integer, query.per_page, "max_page_size=#{cap.inspect}"
+      assert_operator query.per_page, :>, 0, "max_page_size=#{cap.inspect}"
+    end
+  end
+
+  test "a raising includes degrades to the unoptimized scope instead of raising" do
+    relation = RaisingIncludesRelation.new([])
+    Model.relation = relation
+    query = AdminSuite::Query.new(resource_config: config_with(per_page: 25, includes: [:nope]), params: {})
+
+    assert_same relation, query.scope
+  end
+
+  private
+
+  def config_with(per_page:, includes: [])
+    Config.new(Model, IndexConfig.new(per_page, includes, [], [], nil, [], :asc))
+  end
+end

data/test/lib/removed_deprecations_test.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class RemovedDeprecationsTest < ActiveSupport::TestCase
+  test "the gem has no legacy Gleania renderer implementations or defaults" do
+    refute defined?(AdminSuite::Renderers::LegacyGleania)
+    %i[prompt_template_preview messages_preview tool_args_preview turn_messages_preview].each do |key|
+      assert_nil AdminSuite::RendererRegistry.lookup_default(key)
+    end
+  end
+
+  test "exportable is no longer a resource DSL method" do
+    refute Admin::Base::Resource.respond_to?(:exportable)
+  end
+end

data/test/publish_workflow_test.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+require "minitest/autorun"
+require "yaml"
+
+class PublishWorkflowTest < Minitest::Test
+  WORKFLOW_PATH = File.expand_path("../.github/workflows/publish.yml", __dir__)
+
+  def setup
+    @source = File.read(WORKFLOW_PATH)
+    @workflow = YAML.load_file(WORKFLOW_PATH)
+    @job = @workflow.fetch("jobs").fetch("publish")
+    @steps = @job.fetch("steps")
+  end
+
+  def test_publishing_uses_the_release_environment_and_job_scoped_oidc
+    assert_equal "release", @job["environment"]
+    assert_equal "write", @job.fetch("permissions")["id-token"]
+    assert_equal "write", @job.fetch("permissions")["contents"]
+    refute @workflow.fetch("permissions", {}).key?("id-token")
+  end
+
+  def test_automatic_publishing_requires_successful_main_push_ci
+    condition = @job.fetch("if")
+    assert_includes condition, "github.repository == 'techwright-lab/admin_suite'"
+    assert_includes condition, "github.event_name == 'workflow_run'"
+    assert_includes condition, "github.event.workflow_run.conclusion == 'success'"
+    assert_includes condition, "github.event.workflow_run.event == 'push'"
+    assert_includes condition, "github.event.workflow_run.head_branch == 'main'"
+    assert_includes condition, "github.event.workflow_run.head_repository.full_name == github.repository"
+    assert_includes condition, "github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main'"
+  end
+
+  def test_credentials_are_pinned_conditional_and_before_the_push
+    credentials_index = @steps.index { |step| step["name"] == "Configure RubyGems trusted publishing" }
+    refute_nil credentials_index
+    credentials = @steps.fetch(credentials_index)
+    push_index = @steps.index { |step| step["name"] == "Publish to RubyGems" }
+    push = @steps.fetch(push_index)
+
+    assert_equal "rubygems/configure-rubygems-credentials@dc5a8d8553e6ee01fc26761a49e99e733d17954a", credentials["uses"]
+    assert_equal "steps.version_check.outputs.should_publish == 'true'", credentials["if"]
+    assert_equal credentials["if"], push["if"]
+    assert_operator credentials_index, :<, push_index
+    refute_includes @source, "secrets.RUBYGEMS_API_KEY"
+    refute_includes @source, "GEM_HOST_API_KEY:"
+    refute_includes @source, "~/.gem/credentials"
+    assert_includes push.fetch("run"), "gem push"
+    assert_includes push.fetch("run"), "--host https://rubygems.org"
+  end
+
+  def test_releases_preserve_tested_sha_and_serialization
+    checkout = @steps.find { |step| step.fetch("uses", "").start_with?("actions/checkout@") }
+    assert_equal "${{ github.event.workflow_run.head_sha || github.sha }}", checkout.fetch("with")["ref"]
+    assert_equal false, @workflow.fetch("concurrency")["cancel-in-progress"]
+    assert_includes @source, "different contents. Bump the gem version before publishing."
+    push_index = @steps.index { |step| step["name"] == "Publish to RubyGems" }
+    tag_index = @steps.index { |step| step["name"] == "Create Git tag" }
+    release_index = @steps.index { |step| step["name"] == "Create GitHub Release" }
+    assert_operator push_index, :<, tag_index
+    assert_operator tag_index, :<, release_index
+  end
+end

data/test/test_helper.rb

@@ -16,6 +16,15 @@ if ENV["COVERAGE"]
 end
 
 require_relative "dummy/config/environment"
+
+# Auth strategies are process-global. Tests that register temporary strategies
+# can restore a snapshot with this helper to avoid cross-file registry leakage.
+def with_auth_registry_snapshot
+  registry = AdminSuite::Auth.instance_variable_get(:@registry).dup
+  yield
+ensure
+  AdminSuite::Auth.instance_variable_set(:@registry, registry)
+end
 require "minitest/autorun"
 require "active_support/test_case"
 require "action_dispatch/testing/integration"
@@ -23,6 +32,14 @@ require "action_dispatch/testing/integration"
 # Ensure the engine is loaded (and its initializers run).
 require "admin_suite"
 
+def with_authorize(hook)
+  previous = AdminSuite.config.authorize
+  AdminSuite.config.authorize = hook
+  yield
+ensure
+  AdminSuite.config.authorize = previous
+end
+
 # The dummy app is intentionally database-free, while the generic controller
 # supports Active Record hosts. Supply only the exception type its lookup path
 # rescues so show-page behavior can be exercised with an in-memory fixture.
@@ -181,3 +198,12 @@ module Admin
     end
   end
 end
+
+# MCP never permits anonymous callers, including in the development escape hatch.
+class McpIntegrationTest < ActionDispatch::IntegrationTest
+  setup do
+    @previous_mcp_actor_resolver = AdminSuite.config.current_actor
+    AdminSuite.config.current_actor = ->(_) { "test-operator" }
+  end
+  teardown { AdminSuite.config.current_actor = @previous_mcp_actor_resolver }
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: admin_suite
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.6.2
 platform: ruby
 authors:
 - TechWright Labs
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-01 00:00:00.000000000 Z
+date: 2026-10-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -50,6 +50,20 @@ dependencies:
     - - "<"
       - !ruby/object:Gem::Version
         version: '10'
+- !ruby/object:Gem::Dependency
+  name: mcp
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.1'
 - !ruby/object:Gem::Dependency
   name: turbo-rails
   requirement: !ruby/object:Gem::Requirement
@@ -152,6 +166,7 @@ files:
 - app/controllers/admin_suite/application_controller.rb
 - app/controllers/admin_suite/dashboard_controller.rb
 - app/controllers/admin_suite/docs_controller.rb
+- app/controllers/admin_suite/mcp_controller.rb
 - app/controllers/admin_suite/portals_controller.rb
 - app/controllers/admin_suite/resources_controller.rb
 - app/helpers/admin_suite/base_helper.rb
@@ -205,8 +220,10 @@ files:
 - lib/admin_suite.rb
 - lib/admin_suite/auth.rb
 - lib/admin_suite/auth/host_hook.rb
+- lib/admin_suite/auth/host_user.rb
 - lib/admin_suite/auth/http_basic.rb
 - lib/admin_suite/auth/strategy.rb
+- lib/admin_suite/authorization_context.rb
 - lib/admin_suite/configuration.rb
 - lib/admin_suite/definition_loader.rb
 - lib/admin_suite/deprecation.rb
@@ -214,14 +231,21 @@ files:
 - lib/admin_suite/host_autoload_policy.rb
 - lib/admin_suite/legacy_custom_renderer_procs.rb
 - lib/admin_suite/markdown_renderer.rb
+- lib/admin_suite/mcp.rb
+- lib/admin_suite/mcp/authorization.rb
+- lib/admin_suite/mcp/serializer.rb
+- lib/admin_suite/mcp/tools/aggregate.rb
+- lib/admin_suite/mcp/tools/describe_resources.rb
+- lib/admin_suite/mcp/tools/get_record.rb
+- lib/admin_suite/mcp/tools/list_records.rb
 - lib/admin_suite/portal_definition.rb
 - lib/admin_suite/portal_registry.rb
+- lib/admin_suite/query.rb
 - lib/admin_suite/renderer.rb
 - lib/admin_suite/renderer_registry.rb
 - lib/admin_suite/renderers/code_renderer.rb
 - lib/admin_suite/renderers/json_renderer.rb
 - lib/admin_suite/renderers/key_value_renderer.rb
-- lib/admin_suite/renderers/legacy_gleania.rb
 - lib/admin_suite/renderers/table_from_renderer.rb
 - lib/admin_suite/section_definition.rb
 - lib/admin_suite/theme_palette.rb
@@ -238,6 +262,7 @@ files:
 - lib/generators/admin_suite/scaffold/scaffold_generator.rb
 - lib/tasks/admin_suite_tailwind.rake
 - lib/tasks/admin_suite_test.rake
+- test/archspec/enforcement_test.rb
 - test/controllers/resources_controller_test.rb
 - test/dummy/Gemfile
 - test/dummy/README.md
@@ -281,6 +306,7 @@ files:
 - test/dummy/public/icon.svg
 - test/dummy/public/robots.txt
 - test/dummy/test/test_helper.rb
+- test/dummy_boot_test.rb
 - test/fixtures/docs/progress/PROGRESS_REPORT.md
 - test/integration/association_linking_test.rb
 - test/integration/authentication_test.rb
@@ -288,8 +314,17 @@ files:
 - test/integration/chart_panel_test.rb
 - test/integration/dashboard_test.rb
 - test/integration/docs_test.rb
+- test/integration/index_query_characterization_test.rb
 - test/integration/index_table_test.rb
 - test/integration/layout_assets_test.rb
+- test/integration/mcp_aggregate_test.rb
+- test/integration/mcp_authorization_test.rb
+- test/integration/mcp_endpoint_test.rb
+- test/integration/mcp_get_record_test.rb
+- test/integration/mcp_instrumentation_test.rb
+- test/integration/mcp_list_records_test.rb
+- test/integration/mcp_parity_test.rb
+- test/integration/mcp_release_test.rb
 - test/integration/navigation_sections_test.rb
 - test/integration/pagination_and_stats_test.rb
 - test/integration/read_only_resource_test.rb
@@ -299,23 +334,27 @@ files:
 - test/integration/toggle_test.rb
 - test/lib/action_executor_redirect_test.rb
 - test/lib/action_executor_test.rb
+- test/lib/auth_host_user_test.rb
 - test/lib/auth_http_basic_test.rb
 - test/lib/auth_resolution_test.rb
 - test/lib/auth_test.rb
+- test/lib/authorization_context_test.rb
 - test/lib/builtin_renderers_test.rb
 - test/lib/definition_loader_test.rb
 - test/lib/engine_defaults_test.rb
 - test/lib/form_field_renderer_test.rb
 - test/lib/format_table_cell_test.rb
 - test/lib/index_includes_test.rb
-- test/lib/legacy_renderer_deprecation_test.rb
 - test/lib/markdown_renderer_test.rb
+- test/lib/mcp_serializer_test.rb
+- test/lib/query_test.rb
+- test/lib/removed_deprecations_test.rb
 - test/lib/renderer_test.rb
-- test/lib/resource_exportable_deprecation_test.rb
 - test/lib/resource_observability_extensions_test.rb
 - test/lib/show_value_formatter_test.rb
 - test/lib/theme_palette_test.rb
 - test/lib/zeitwerk_integration_test.rb
+- test/publish_workflow_test.rb
 - test/test_helper.rb
 homepage: https://github.com/techwright-lab/admin_suite
 licenses: