avo 1.9.0 → 1.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 219e6a5235aed0e22ffacfd3f18f7844735aa38ec3bf894b5d0f4f9b38c3c625
-  data.tar.gz: 13f60c9fcbbb74c861832532630d2f22a8a711cb5b0feec3cb66bc210506204f
+  metadata.gz: 5162ebb15a5e800bfba0e8562395b2fa0c95f368fa22e52a66c276bed0b0e2a2
+  data.tar.gz: 67a79ac90458f4a5ade56121f48fedc402fa23642725b27f8f06882fbb19f948
 SHA512:
-  metadata.gz: 1466e8390b54d6def5ba74f1cafceb4e10ecb13b2c580083b42089dc548bb4e89d6e256f9384645a4ae7c10da0508da33a2620256c9e34525ead03043ef8908a
-  data.tar.gz: cfef9e4787ad8caf2e81282bbc35c1a646aaeb907738f05b812454bc23dd174c71d3e02e6571ee1b20ada1530c0255d4ce5f8a19648f964a82dc47500d6ecee1
+  metadata.gz: 2ee41b521694c320cc77d8f534fc6ca1b1c1b13362a3bab671b5f24ffaf7053fb7492b29dab3a832f50577dfb5abcb60011c1eae3a96a8d76689577448eee6a9
+  data.tar.gz: fc53575ea78e71116ca5664ec73adc8069ee289f163f75234fd45ceb725828f29c84396862434a4bb4f661863108d257df8bef35e3be2cb8514f6863853c6f4e

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    avo (1.9.0)
+    avo (1.11.0)
       active_link_to
       addressable
       breadcrumbs_on_rails
@@ -14,7 +14,6 @@ PATH
       pagy
       pundit
       rails (>= 6.0)
-      ransack
       view_component
       zeitwerk
 
@@ -213,7 +212,7 @@ GEM
     nokogiri (1.11.7-x86_64-linux)
       racc (~> 1.4)
     orm_adapter (0.5.0)
-    pagy (4.8.1)
+    pagy (4.10.0)
     parallel (1.20.1)
     parser (3.0.0.0)
       ast (~> 2.4.1)

data/app/components/avo/fields/has_one_field/show_component.html.erb

@@ -5,7 +5,7 @@
 <% else %>
   <%= render Avo::PanelComponent.new(title: @field.id.capitalize) do |c| %>
     <% c.tools do %>
-      <% unless @field.readonly %>
+      <% if !@field.readonly && can_attach? %>
         <%= a_link helpers.resource_attach_path(@resource.model.model_name.route_key, @resource.model.id, @field.id), color: 'indigo', 'data-turbo-frame': 'attach_modal' do %>
           <%= svg 'view-grid-add' %> <%= t('avo.attach_item', item: @field.id).capitalize %>
         <% end %>

data/app/components/avo/fields/has_one_field/show_component.rb

@@ -2,4 +2,19 @@
 
 class Avo::Fields::HasOneField::ShowComponent < Avo::Fields::ShowComponent
   include Avo::ApplicationHelper
+
+  def can_attach?
+    attach_policy = true
+    if @field.present?
+      reflection_resource = @field.target_resource
+      if reflection_resource.present? && @resource.present?
+        method_name = ('attach_' + reflection_resource.model_class.model_name.singular_route_key.underscore + '?').to_sym
+        defined_policy_methods = @resource.authorization.defined_methods(@resource.model_class, raise_exception: false)
+        if defined_policy_methods.present? && defined_policy_methods.include?(method_name)
+          attach_policy = @resource.authorization.authorize_action(method_name, raise_exception: false)
+        end
+      end
+    end
+    attach_policy
+  end
 end

data/app/components/avo/index/resource_controls_component.html.erb

@@ -2,7 +2,7 @@
   <% if can_view? %>
     <%= link_to helpers.svg('eye', class: 'text-gray-400 h-6 hover:text-gray-600'),
       show_path,
-      title: t('avo.view_item',  item: @resource.model.model_name.name.downcase ).capitalize,
+      title: t('avo.view_item',  item: singular_resource_name).capitalize,
       data: {
         control: :show,
         'tippy': 'tooltip',
@@ -13,7 +13,7 @@
   <% if can_edit? %>
     <%= link_to helpers.svg('edit', class: 'text-gray-400 h-6 hover:text-gray-600'),
       edit_path,
-      title: t('avo.edit_item', item: @resource.model.model_name.name.downcase ).capitalize,
+      title: t('avo.edit_item', item: singular_resource_name).capitalize,
       data: {
         control: :edit,
         'resource-id': @resource.model.id,
@@ -27,10 +27,10 @@
         'data-turbo-frame': params[:turbo_frame]
       } do |form| %>
       <%= form.button helpers.svg('trash-sm', class: 'text-gray-400 h-6 hover:text-gray-600'),
-        title: t('avo.detach_item', item: @resource.model.model_name.name.downcase).capitalize,
+        title: t('avo.detach_item', item: singular_resource_name).capitalize,
         type: :submit,
         data: {
-          confirm: t('avo.are_you_sure_detach_item', item: @resource.model.model_name.name.downcase),
+          confirm: t('avo.are_you_sure_detach_item', item: singular_resource_name),
           control: :detach,
           'resource-id': @resource.model.id,
           'tippy': 'tooltip',
@@ -46,10 +46,10 @@
         'data-turbo-frame': params[:turbo_frame]
       } do |form| %>
       <%= form.button helpers.svg('trash', class: 'text-gray-400 h-6 hover:text-gray-600'),
-        title: t('avo.delete_item',  item: @resource.model.model_name.name.downcase ).capitalize,
+        title: t('avo.delete_item',  item: singular_resource_name).capitalize,
         type: :submit,
         data: {
-          confirm: t('avo.are_you_sure',  item: @resource.model.model_name.name.downcase ),
+          confirm: t('avo.are_you_sure',  item: singular_resource_name),
           control: :destroy,
           'resource-id': @resource.model.id,
           'tippy': 'tooltip',

data/app/components/avo/index/resource_controls_component.rb

@@ -10,7 +10,8 @@ class Avo::Index::ResourceControlsComponent < Avo::ResourceComponent
   def can_detach?
     @reflection.present? &&
       @resource.model.present? &&
-      (@reflection.is_a?(::ActiveRecord::Reflection::HasManyReflection) || @reflection.is_a?(::ActiveRecord::Reflection::ThroughReflection))
+      (@reflection.is_a?(::ActiveRecord::Reflection::HasManyReflection) || @reflection.is_a?(::ActiveRecord::Reflection::ThroughReflection)) &&
+      authorize_association_for('detach')
   end
 
   def can_edit?
@@ -36,4 +37,12 @@ class Avo::Index::ResourceControlsComponent < Avo::ResourceComponent
       helpers.edit_resource_path(@resource.model)
     end
   end
+
+  def singular_resource_name
+    if @reflection.present?
+      @reflection.name.to_s.downcase.singularize
+    else
+      @resource.singular_name.present? ? @resource.singular_name : @resource.model_class.model_name.name.downcase
+    end
+  end
 end

data/app/components/avo/resource_component.rb

@@ -7,6 +7,22 @@ class Avo::ResourceComponent < ViewComponent::Base
     @resource.authorization.authorize_action(:destroy, raise_exception: false)
   end
 
+  def authorize_association_for(policy_method)
+    association_policy = true
+    if @reflection.present?
+      reflection_resource = ::Avo::App.get_resource_by_model_name(@reflection.active_record.name)
+      if reflection_resource.present?
+        method_name = ("#{policy_method}_#{@reflection.name.to_s.underscore}?").to_sym
+        defined_policy_methods = reflection_resource.authorization.defined_methods(reflection_resource.model_class, raise_exception: false)
+        if defined_policy_methods.present? && defined_policy_methods.include?(method_name)
+          association_policy = reflection_resource.authorization.authorize_action(method_name, raise_exception: false)
+        end
+      end
+    end
+
+    association_policy
+  end
+
   private
 
   def simple_relation?

data/app/components/avo/views/resource_index_component.html.erb

@@ -11,13 +11,13 @@
 
       <% if can_detach? %>
         <%= a_link detach_path, color: 'indigo', method: :delete, data: { confirm: "Are you sure you want to detach this #{@resource.singular_name}." } do %>
-          <%= svg 'trash' %> <%= t('avo.detach_item', item: @resource.singular_name).capitalize %>
+          <%= svg 'trash' %> <%= t('avo.detach_item', item: singular_resource_name).capitalize %>
         <% end %>
       <% end %>
 
       <% if can_attach? %>
         <%= a_link attach_path, color: 'indigo', 'data-turbo-frame': 'attach_modal' do %>
-          <%= svg 'view-grid-add' %> <%= t('avo.attach_item', item: @resource.singular_name).capitalize %>
+          <%= svg 'view-grid-add' %> <%= t('avo.attach_item', item: singular_resource_name).capitalize %>
         <% end %>
       <% end %>
     <% end %>

data/app/components/avo/views/resource_index_component.rb

@@ -52,11 +52,11 @@ class Avo::Views::ResourceIndexComponent < Avo::ResourceComponent
     klass = @reflection
     klass = @reflection.through_reflection if klass.is_a? ::ActiveRecord::Reflection::ThroughReflection
 
-    @reflection.present? && klass.is_a?(::ActiveRecord::Reflection::HasManyReflection) && !has_reflection_and_is_read_only
+    @reflection.present? && klass.is_a?(::ActiveRecord::Reflection::HasManyReflection) && !has_reflection_and_is_read_only && authorize_association_for('attach')
   end
 
   def can_detach?
-    @reflection.present? && @reflection.is_a?(::ActiveRecord::Reflection::HasOneReflection) && @models.present? && !has_reflection_and_is_read_only
+    @reflection.present? && @reflection.is_a?(::ActiveRecord::Reflection::HasOneReflection) && @models.present? && !has_reflection_and_is_read_only && authorize_association_for('detach')
   end
 
   def has_reflection_and_is_read_only
@@ -67,7 +67,7 @@ class Avo::Views::ResourceIndexComponent < Avo::ResourceComponent
       return false
     end
 
-    if filtered_fields
+    if filtered_fields.present?
       is_field_read_only = filtered_fields.filter{ |f| f.id == @reflection.name}[0].readonly
     else
       is_field_read_only = false
@@ -101,6 +101,14 @@ class Avo::Views::ResourceIndexComponent < Avo::ResourceComponent
     helpers.resource_detach_path(via_resource_name, via_resource_id, via_relation_param, @models.first.id)
   end
 
+  def singular_resource_name
+    if @reflection.present?
+      @reflection.name.to_s.downcase.singularize
+    else
+      @resource.singular_name.present? ? @resource.singular_name : @resource.model_class.model_name.name.downcase
+    end
+  end
+
   private
 
   def simple_relation?

data/app/components/avo/views/resource_show_component.html.erb

@@ -8,9 +8,12 @@
         <% if resource_panel[:name] == @resource.default_panel_name %>
           <%= render 'actions' %>
 
+
           <% if @reflection.present? && @resource.model.present? %>
-            <%= a_link detach_path, color: 'indigo', method: :delete, data: { confirm: "Are you sure you want to detach this #{@resource.singular_name}." } do %>
-              <%= svg 'trash' %> <%= t('avo.detach_item', item: @resource.singular_name).capitalize %>
+            <% if can_detach? %>
+              <%= a_link detach_path, color: 'indigo', method: :delete, data: { confirm: "Are you sure you want to detach this #{@reflection.name.to_s}." } do %>
+                <%= svg 'trash' %> <%= t('avo.detach_item', item: @reflection.name.to_s).capitalize %>
+              <% end %>
             <% end %>
           <% else %>
             <%= a_link back_path do %>

data/app/components/avo/views/resource_show_component.rb

@@ -30,13 +30,17 @@ class Avo::Views::ResourceShowComponent < Avo::ResourceComponent
   end
 
   def detach_path
-    helpers.resource_detach_path(params[:resource_name], params[:id], @resource.model_class.model_name.route_key, @resource.model.id)
+    helpers.resource_detach_path(params[:resource_name], params[:id], @reflection.name.to_s, @resource.model.id)
   end
 
   def destroy_path
     helpers.resource_path(@resource.model)
   end
 
+  def can_detach?
+    authorize_association_for('detach')
+  end
+
   private
 
   def via_resource?

data/app/controllers/avo/actions_controller.rb

@@ -11,14 +11,20 @@ module Avo
     end
 
     def handle
-      resource_ids = action_params[:fields][:resource_ids].split(",").map(&:to_i)
+      resource_ids = action_params[:fields][:resource_ids].split(",")
       models = @resource.class.find_scope.find resource_ids
 
       fields = action_params[:fields].select do |key, value|
         key != "resource_ids"
       end
 
-      performed_action = @action.handle_action(models: models, fields: fields)
+      args = {
+        fields: fields
+      }
+
+      args[:models] = models unless @action.standalone
+
+      performed_action = @action.handle_action(**args)
 
       respond performed_action.response
     end

data/app/controllers/avo/relations_controller.rb

@@ -10,7 +10,7 @@ module Avo
     before_action :set_attachment_class
     before_action :set_attachment_resource
     before_action :set_attachment_model, only: [:create, :destroy]
-    before_action :set_reflection, only: [:index]
+    before_action :set_reflection, only: [:index, :show]
 
     def index
       @parent_resource = @resource.dup
@@ -23,7 +23,6 @@ module Avo
     end
 
     def show
-      @reflection = params[:related_name]
       @resource, @model = @related_resource, @related_model
 
       super

data/app/packs/js/controllers/actions_picker_controller.js

@@ -2,6 +2,8 @@ import { AttributeObserver } from '@stimulus/mutation-observers'
 import { Controller } from 'stimulus'
 
 export default class extends Controller {
+  static targets = ['resourceAction', 'standaloneAction']
+
   target = {}
 
   enableTarget() {

data/app/packs/js/controllers/item_selector_controller.js

@@ -22,9 +22,9 @@ export default class extends Controller {
 
     if (this.actionsPanelPresent) {
       if (value.length > 0) {
-        this.enableActionsPanel()
+        this.enableResourceActions()
       } else {
-        this.disableActionsPanel()
+        this.disableResourceActions()
       }
     }
   }
@@ -58,11 +58,23 @@ export default class extends Controller {
     }
   }
 
-  enableActionsPanel() {
-    this.actionsButtonElement.disabled = false
+  enableResourceActions() {
+    (document.querySelectorAll('.js-actions-dropdown a[data-actions-picker-target="resourceAction"]'))
+      .forEach((link) => {
+        link.classList.add('text-gray-700')
+        link.classList.remove('text-gray-500')
+        link.setAttribute('data-href', link.getAttribute('href'))
+        link.dataset.disabled = false
+      })
   }
 
-  disableActionsPanel() {
-    this.actionsButtonElement.disabled = true
+  disableResourceActions() {
+    (document.querySelectorAll('.js-actions-dropdown a[data-actions-picker-target="resourceAction"]'))
+      .forEach((link) => {
+        link.classList.remove('text-gray-700')
+        link.classList.add('text-gray-500')
+        link.setAttribute('href', link.getAttribute('data-href'))
+        link.dataset.disabled = true
+      })
   }
 }

data/app/views/avo/base/_actions.html.erb

@@ -1,10 +1,9 @@
 <% if @actions.count > 0 %>
-  <div class="relative z-30" data-controller="toggle-panel actions-picker">
+  <div class="relative z-30 js-actions-dropdown" data-controller="toggle-panel actions-picker">
     <%= a_button class: "focus:outline-none",
       color: 'light-blue',
       'data-action': "click->toggle-panel#togglePanel",
-      'data-actions-dropdown-button': @resource.plural_name.downcase,
-      disabled: action_name != 'show' do
+      'data-actions-dropdown-button': @resource.plural_name.downcase do
     %>
       <%= svg 'arrow-left', class: 'h-4 mr-1 transform -rotate-90' %> <%= t 'avo.actions' %>
     <% end %>
@@ -17,11 +16,18 @@
           path = action_name == 'show' ?
             "#{avo.root_path}resources/#{@resource.model_class.model_name.route_key}/#{@model.id}/actions/#{action.param_id}" :
             "#{avo.root_path}resources/#{@resource.model_class.model_name.route_key}/actions/#{action.param_id}"
+          if action_name == 'show' || action.standalone
+            disabled = false
+          else
+            disabled = true
+          end
       %>
         <%= link_to path,
           'data-turbo-frame': 'actions_show',
           'data-action': 'click->actions-picker#visitAction',
-          class: 'flex items-center w-full py-2 px-4 font-bold text-gray-700 hover:text-white hover:bg-blue-500' do %>
+          'data-actions-picker-target': action.standalone ? 'standaloneAction' : 'resourceAction',
+          class: "flex items-center w-full py-2 px-4 font-bold text-gray-700 hover:text-white hover:bg-blue-500 #{disabled ? 'text-gray-500' : 'text-gray-700'}",
+          'data-disabled': disabled do %>
           <%= svg 'play', class: 'h-5 mr-1 inline' %> <%= action.action_name %>
         <% end %>
       <% end %>

data/avo.gemspec

@@ -45,5 +45,4 @@ Gem::Specification.new do |spec|
   spec.add_dependency "meta-tags"
   spec.add_dependency "breadcrumbs_on_rails"
   spec.add_dependency "manifester"
-  spec.add_dependency "ransack"
 end

data/lib/avo/base_action.rb

@@ -13,6 +13,7 @@ module Avo
     class_attribute :user
     class_attribute :resource
     class_attribute :fields
+    class_attribute :standalone, default: false
 
     attr_accessor :response
     attr_accessor :model
@@ -68,7 +69,8 @@ module Avo
         .to_h
     end
 
-    def handle_action(models:, fields:)
+    def handle_action(**args)
+      models, fields = args.values_at(:models, :fields)
       avo_fields = get_fields.map { |field| [field.id, field] }.to_h
 
       if fields.present?
@@ -81,7 +83,13 @@ module Avo
         processed_fields = {}
       end
 
-      handle models: models, fields: processed_fields
+      args = {
+        fields: processed_fields
+      }
+
+      args[:models] = models unless standalone
+
+      handle(**args)
 
       self
     end

data/lib/avo/base_resource.rb

@@ -274,7 +274,7 @@ module Avo
     end
 
     def authorization
-      Avo::Services::AuthorizationService.new(user, model)
+      Avo::Services::AuthorizationService.new(user, model || model_class)
     end
 
     def file_hash

data/lib/avo/services/authorization_service.rb

@@ -33,6 +33,10 @@ module Avo
         self.class.apply_policy(user, model)
       end
 
+      def defined_methods(model, **args)
+        self.class.defined_methods(user, model, **args)
+      end
+
       class << self
         def authorize(user, record, action, **args)
           return true if skip_authorization
@@ -56,7 +60,7 @@ module Avo
         end
 
         def authorize_action(user, record, action, **args)
-          action = Avo.configuration.authorization_methods.stringify_keys[action.to_s]
+          action = Avo.configuration.authorization_methods.stringify_keys[action.to_s] || action
 
           return true if action.nil?
 
@@ -87,6 +91,18 @@ module Avo
         def get_policy(user, record)
           Pundit.policy user, record
         end
+
+        def defined_methods(user, record, **args)
+          begin
+            Pundit.policy!(user, record).methods
+          rescue => error
+            if args[:raise_exception] == false
+              false
+            else
+              raise error
+            end
+          end
+        end
       end
     end
   end