avo 4.3.8 → 4.3.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 79364fd16b4d55af4c2ee6676ec4942ad7d7ad289bcf3fd300c47172acbb30ce
-  data.tar.gz: f462864fcc13f206b4706a5454656f5aa278a48a5c3d839845c668e268a54029
+  metadata.gz: 2ca7f212d5e09898e6ec5b8aae81bdb7ccae9df016a6d9f48c162a45fae79426
+  data.tar.gz: 205fdca72016899639b593c92a3ce7f96a4822e62e178f8f0110db45f1175389
 SHA512:
-  metadata.gz: 8008df30eb61a88c04529145fe63cbb678f00958c465b3726b8677f706f08a45dfb93cfcab3b2c9efe7948d108e376ca627463d2e73d7ff0ece74b8e7ef8c25b
-  data.tar.gz: dab18f64782d3c6bffcac3927d4b1010c8a8ce42e95db1e6b12e3edf37b1394204f8d4af6638f013d20379ca2c52d1f7dd9f89f73aceca02afdad17e116b3b23
+  metadata.gz: 1f91977716121ccdb087fb910520f5d3a68de0f0f0625c8760014cbe31ab3f6852b26d54b106186209afd605b4ecf95172b5eb5f9ab87970837c3b4614adb7b0
+  data.tar.gz: f59463967527115900a1a1e751539ec68227bef01aef4230d03e362d9c0641faa3a51e3a16c3ccf97e980be416f234153fadf6c506a218163c60c5ab9e97af67

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    avo (4.3.8)
+    avo (4.3.9)
       actionview (>= 6.1)
       active_link_to
       activerecord (>= 6.1)

data/app/controllers/avo/actions_controller.rb

@@ -71,7 +71,7 @@ module Avo
     def set_query
       # If the user selected all records, use the decrypted index query
       # Otherwise, find the records from the resource ids
-      @query = if action_params[:fields]&.dig(:avo_selected_all) == "true"
+      @query = if selected_all?
         decrypted_index_query
       else
         find_records_from_resource_ids
@@ -252,8 +252,23 @@ module Avo
       end
     end
 
+    def selected_all?
+      action_params[:fields]&.dig(:avo_selected_all) == "true"
+    end
+
     def verify_authorization
-      raise Avo::NotAuthorizedError.new unless @action.authorized?
+      raise Avo::NotAuthorizedError.new unless @action.authorized? && act_on_authorized?
+    end
+
+    # The Actions button asks `act_on?`, so the run asks it too, of every record it names: the one in
+    # the URL and the selected ids. With none, the model class stands in, as on the index. A select-all
+    # run is the index query the button already allowed, and is not loaded here to ask it row by row.
+    def act_on_authorized?
+      records = [@record, *(@query unless selected_all?)].compact
+
+      (records.presence || [@resource.model_class]).all? do |record|
+        @resource.authorization.authorize_action(:act_on, record:, raise_exception: false)
+      end
     end
   end
 end

data/app/controllers/avo/base_application_controller.rb

@@ -245,16 +245,21 @@ module Avo
       Avo.configuration.locale = locale if locale
     end
 
+    # With nowhere to go back to, the refusal renders here: redirecting to the root loops when the
+    # home page is the one refused.
     def render_unauthorized(exception)
-      flash[:notice] = t "avo.not_authorized"
-
-      redirect_url = if request.referrer.blank? || (request.referrer == request.url)
-        root_url
-      else
-        request.referrer
+      if request.referrer.present? && request.referrer != request.url
+        flash[:notice] = t "avo.not_authorized"
+        return redirect_to(request.referrer)
       end
 
-      redirect_to(redirect_url)
+      respond_to do |format|
+        format.html do
+          Avo.error_manager.add t("avo.not_authorized")
+          render html: "", layout: "avo/application", status: :forbidden
+        end
+        format.any { head :forbidden }
+      end
     end
 
     def set_authorization

data/lib/avo/skills/avo-actions/SKILL.md

@@ -260,7 +260,7 @@ When an index spans multiple pages, checking "Select all" offers to select **eve
 
 - **`query` is always an array.** Even a single-record action gets `[record]`. Use `query.first` for the one-record case; don't call record methods on `query` directly. `records` is an alias.
 - **Records deleted after selection are omitted.** Another user may delete a checked record before the action request arrives. Avo drops that missing record and still passes every surviving selection to `handle`; action authors do not need to rescue `ActiveRecord::RecordNotFound` for this race. `query` can therefore come back **empty** when every selected record is gone — guard with `return error "No record selected" if query.blank?` if that matters.
-- **"My action doesn't show up" is usually the policy.** With Pundit, `act_on?` in the resource's policy gates action visibility (and `authorize` on the action gates it further). Check the policy first. See the **`avo-authorization`** skill.
+- **"My action doesn't show up", or is refused, is usually the policy.** With Pundit, `act_on?` in the resource's policy gates the Actions dropdown and every run: Avo asks it of the record in the URL and of each selected record (of the model class when there are none, and for a "Select all" run), and one refusal refuses the whole run. An action started from an association panel shows under the parent's `act_on_<assoc>?`, but still runs only on children whose own `act_on?` allows it. `authorize` on the action gates it further. Check the policy first. See the **`avo-authorization`** skill.
 - **`view` is the view the action was started from.** In `authorize`, `visible`, the modal text blocks, `fields`, and `handle`, `view` (and `resource.view`) is `index`, `show`, or `edit` — the page the user opened the action from — both while the modal renders and while the action runs. It is never `new`; the modal is not a view. It arrives with the request and is checked against the route (`show` and `edit` need a record in the URL), so use it to adapt behavior (`reload_records if view.index?`), never as the only gate on who may run the action: gate people on `current_user`, and single-versus-bulk on `query.size` or `record`.
 - **Every field in `fields` renders in the modal.** `hide_on`/`show_on` marks are for resource views and are ignored here. A field with a form component (text, select, hidden...) renders as an input; a display-only field (badge, key/value) renders read-only, as on Show. The one mark that counts: a badge declared with `show_on: :forms` renders as a select. The modal focuses its first input; a field with `autofocus: true` takes the focus instead (avo-fields lists the fields that support it). Use it to show context next to the inputs.
 - **The modal is a NEW request.** Params from the Index/Show page that opened it are **not** available in `fields`/`handle`. To prefill from the triggering page, parse `request.referer`:

data/lib/avo/version.rb

@@ -1,3 +1,3 @@
 module Avo
-  VERSION = "4.3.8" unless const_defined?(:VERSION)
+  VERSION = "4.3.9" unless const_defined?(:VERSION)
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: avo
 version: !ruby/object:Gem::Version
-  version: 4.3.8
+  version: 4.3.9
 platform: ruby
 authors:
 - Adrian Marin