cafe_car 0.3.0 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8782de0874fe886849232cebef1d036e0cc43680e758a5bfdc2a0b027e26b06c
-  data.tar.gz: 346735b4f4568e3c28a751e8dde44d5e85fa0b5d907c2ce95e0e004ff4277e1e
+  metadata.gz: f60b0fb2f1007109068b603e6b74d167017ae1e025752c86369f0c680a30fdfc
+  data.tar.gz: 9e9d9005160ef6cd09a3c2eda12083d2286d3d4353be85cb904e073d8e21ca89
 SHA512:
-  metadata.gz: 84003696580e71078eced5706bf2a4d33858de2aee2a2b8ac3c2764838f53226d6fa5c1b6015a9bec4ec5f8049ef7cbd3188db462ad6500f29e79c6ff5b9778a
-  data.tar.gz: 4ec99470b492701f531e2977d0fd88cc2f33fa3b4b35327b25a3b5b11f233b75fb91a5b2fdad3ff72a5398975c130cc8b6ffca4db5e159ebc6cfdbcd8c8c036b
+  metadata.gz: baac158f6e2a02c520faea65399352b56d6e54e238092fcee028411ffb4a36fdcae0ac76429dd4e090ecbfb109795dd47b247e5731a51b972e9bd25c87b389ff
+  data.tar.gz: 9f08a42247edd2bc6302e6372b40a1ecefaadb2ddcddedb385b84b918456aca5bf6e4ec922a1750e91e9d455180f178d0dd8b95445ff1db17d8c80226df8543f

data/README.md

@@ -913,6 +913,14 @@ you write one view.** Its existence turns the dashboard on; delete it and there'
 no dashboard at all (a direct hit 404s, no nav link), so a CRUD-only app never
 inherits a blank page.
 
+Authorize the page with an ordinary Pundit policy:
+
+```ruby
+class DashboardPolicy < ApplicationPolicy
+  def show? = user.present?
+end
+```
+
 Write `app/views/cafe_car/dashboard/show.html.haml`:
 
 ```haml
@@ -932,13 +940,14 @@ Three helpers compose the page:
   returns.
 - **`metrics(Model)`** — the tiles a **policy** declares. `Model`'s policy lists
   the scopes to surface in `permitted_metrics` (`:all` = the whole relation), and
-  CafeCar renders a count tile for each — the same policy-is-source-of-truth rule
-  as bulk actions.
+  CafeCar renders a count tile for each over `policy_scope(Model)` — the same
+  policy-is-source-of-truth rule as bulk actions.
 - **`chart "Title", model:, x:, by:`** — the same dependency-free inline-SVG bar
   chart as the index [Chart view](#advanced-usage), bucketing `model`'s records
   over the `x` date column at `by` granularity (`:day`/`:week`/`:month`, default
-  `:month`). The `x` column is validated against the model's date-column allowlist
-  and truncated with portable Arel, so it's never interpolated as raw SQL.
+  `:month`). It reads from `policy_scope(model)`; the `x` column is validated
+  against the model's date-column allowlist and truncated with portable Arel, so
+  it's never interpolated as raw SQL.
 
 ```ruby
 class UserPolicy < ApplicationPolicy

data/app/controllers/cafe_car/dashboards_controller.rb

@@ -3,17 +3,25 @@ module CafeCar
   # template — `app/views/cafe_car/dashboard/show.html.haml` — that composes the
   # `metric`/`chart` helpers (and the policy-driven `metrics` helper). Its existence
   # IS the opt-in: the route always mounts, but with no host template this 404s, so
-  # a CRUD-only host never inherits a blank page. It has no model of its own, so it
-  # skips the CRUD policy/authorization pipeline like the components gallery does.
+  # a CRUD-only host never inherits a blank page. An opted-in dashboard authorizes
+  # the conventional `DashboardPolicy#show?`; its model helpers apply each model's
+  # policy scope independently.
   class DashboardsController < const(:ApplicationController)
     include Controller
     helper CafeCar::Helpers
 
+    rescue_from ::Pundit::NotAuthorizedError, ::Pundit::NotDefinedError, with: :render_unauthorized
+
     before_action :skip_policy_scope
-    before_action :skip_authorization
+    after_action :verify_authorized
 
     def show
-      return head(:not_found) unless dashboard_template?
+      unless dashboard_template?
+        skip_authorization
+        return head(:not_found)
+      end
+
+      authorize :dashboard, :show?
       render "cafe_car/dashboard/show"
     end
 

data/app/views/application/_debug.html.haml

@@ -8,11 +8,4 @@
     = Field label: "Query" do
       = p scope.to_sql, as: :code, lang: :sql
 
-    - if session = current_session
-      = Field label: "Session" do
-        = p session.as_json
-
-    = Field label: "Cookies" do
-      = p cookies.signed.as_json.to_s, as: :code
-
   = yield :debug

data/app/views/application/_has_many_filter.html.haml

@@ -2,6 +2,6 @@
 -# query DSL turns into a where_assoc_exists matching any of the chosen ids.
 = Field do
   = f.label info.method
-  = f.collection_select info.method, info.collection, :id, -> { present(_1).title },
+  = f.collection_select info.method, f.association_collection(info), :id, -> { present(_1).title },
     { selected: f.object.value(info.method, :id) },
     { multiple: true, name: "#{f.field_name(info.method, :id)}[]", **f.searchable_select(info) }

data/lib/cafe_car/controller/association_authorization.rb

@@ -0,0 +1,114 @@
+module CafeCar::Controller::AssociationAuthorization
+  private
+
+  # A parent policy controls whether an association key is editable; the
+  # associated model's policy scope controls WHICH records may be assigned.
+  # Enforce both halves server-side so a crafted foreign key cannot select a
+  # row the association typeahead and initial options correctly hide.
+  def authorize_association_attributes!(record, policy, attributes)
+    checked = {}
+
+    attributes.each_key do |key|
+      info       = CafeCar[:FieldInfo].new(model: record.class, method: key)
+      reflection = info.reflection
+      next unless reflection
+      next if info.attachment?
+
+      if info.type == :nested
+        authorize_nested_associations!(record, reflection, attributes[key])
+      elsif reflection.polymorphic?
+        next if checked[reflection.name]
+        checked[reflection.name] = true
+        authorize_polymorphic_association!(record, policy, reflection, attributes)
+      elsif reflection.macro.in?(%i[belongs_to has_many])
+        authorize_association_ids!(record, policy, reflection, attributes[key])
+      end
+    end
+  end
+
+  def authorize_nested_associations!(record, reflection, value)
+    nested_attributes(reflection, value).each do |attributes|
+      next if destroy_nested_record?(attributes)
+
+      nested = nested_record(record, reflection, attributes)
+      authorize_association_attributes!(nested, policy(nested), attributes)
+    end
+  end
+
+  def authorize_polymorphic_association!(record, policy, reflection, attributes)
+    id   = attributes[reflection.foreign_key]
+    type = attributes[reflection.foreign_type]
+    return if id.blank? && type.blank?
+
+    deny_association!(record, policy, reflection) if id.blank? || type.blank?
+
+    klass = record.class.polymorphic_class_for(type)
+    deny_association!(record, policy, reflection) unless klass <= ActiveRecord::Base
+    authorize_association_ids!(record, policy, reflection, id, klass:)
+  rescue NameError, ArgumentError, Pundit::NotDefinedError
+    deny_association!(record, policy, reflection)
+  end
+
+  def authorize_association_ids!(record, policy, reflection, value, klass: reflection.klass)
+    ids = Array.wrap(value).compact_blank.map(&:to_s).uniq
+    ids -= existing_association_ids(record, reflection, klass, ids)
+    return if ids.empty?
+
+    authorize klass, :index?
+    scope   = policy_scope(klass)
+    primary = klass.primary_key
+    allowed = scope.where(primary => ids).pluck(primary).map(&:to_s)
+    deny_association!(record, policy, reflection) unless (ids - allowed).empty?
+  rescue Pundit::NotDefinedError
+    deny_association!(record, policy, reflection)
+  end
+
+  def existing_association_ids(record, reflection, klass, ids)
+    return [] unless record.persisted?
+
+    if reflection.polymorphic?
+      type = record.public_send(reflection.foreign_type)
+      return [] unless type && record.class.polymorphic_class_for(type) == klass
+    end
+
+    if reflection.belongs_to?
+      [ record.public_send(reflection.foreign_key).to_s ]
+    else
+      primary = klass.primary_key
+      record.association(reflection.name).scope.where(primary => ids).pluck(primary).map(&:to_s)
+    end
+  rescue NameError, ArgumentError
+    []
+  end
+
+  def nested_attributes(reflection, value)
+    values = value.respond_to?(:to_unsafe_h) ? value.to_unsafe_h : value
+    return Array.wrap(values).compact unless reflection.collection?
+
+    values.is_a?(Hash) ? values.values.compact : Array.wrap(values).compact
+  end
+
+  def nested_record(record, reflection, attributes)
+    attributes = attributes.with_indifferent_access
+    id         = attributes[reflection.klass.primary_key]
+    return reflection.klass.new unless id
+
+    association = record.association(reflection.name)
+    if reflection.collection?
+      association.scope.find_by(reflection.klass.primary_key => id)
+    else
+      association.target if association.target&.id.to_s == id.to_s
+    end || reflection.klass.new
+  end
+
+  def destroy_nested_record?(attributes)
+    value = attributes.respond_to?(:[]) && (attributes[:_destroy] || attributes["_destroy"])
+    ActiveModel::Type::Boolean.new.cast(value)
+  end
+
+  def deny_association!(record, policy, reflection)
+    raise Pundit::NotAuthorizedError.new(
+      query: "associate_#{reflection.name}?", record:, policy:
+    )
+  end
+end

data/lib/cafe_car/controller.rb

@@ -4,8 +4,10 @@ module CafeCar
   module Controller
     extend ActiveSupport::Concern
 
+    INDEX_VIEWS = %w[table grid chart].freeze
+
     include Pundit::Authorization
-    include Filtering, Authentication
+    include Filtering, AssociationAuthorization, Authentication
 
     class_methods do
       def model(model)
@@ -311,7 +313,9 @@ module CafeCar
       method = "permitted_attributes" unless policy.respond_to?(method)
       multi  = multiple_attachments(record)
       keys   = policy.public_send(method).map { |k| multi.include?(k) ? { k => [] } : k }
-      pundit_params_for(record).permit(*keys)
+      pundit_params_for(record).permit(*keys).tap do |attributes|
+        authorize_association_attributes!(record, policy, attributes)
+      end
     end
 
     # Names of the record's `has_many_attached` attachments — the fields whose
@@ -399,7 +403,9 @@ module CafeCar
 
     def default_view = self.class.default_view
     def view
-      params.fetch(:view) { default_view }
+      [ params[:view], default_view, "table" ].compact
+        .map(&:to_s)
+        .find { _1.in?(INDEX_VIEWS) }
     end
 
     def _render_with_renderer_json(obj, options)
@@ -410,11 +416,8 @@ module CafeCar
       # permitted_attributes is record-oriented, so ask a record for the column
       # list even when serializing a collection.
       record = obj.is_a?(CafeCar::Model) ? obj : obj.klass.new
-      options[:only] ||= [ :id ] | policy(record).attributes.displayable
-
-      if obj.is_a?(CafeCar::Model)
-        options[:include] ||= policy(obj).displayable_associations
-      end
+      displayable = [ :id ] | policy(record).attributes.displayable
+      options[:only] ||= displayable & record.attribute_names.map(&:to_sym)
 
       super obj, **options
     end

data/lib/cafe_car/field_info.rb

@@ -31,7 +31,7 @@ module CafeCar
     def rich_text?   = reflection&.name =~ /^rich_text_(\w+)$/
     def attachment?  = model.reflect_on_attachment(method)
     def multiple?    = attachment?&.macro == :has_many_attached
-    def collection   = reflection.klass.limit(CafeCar.max_collection_options)
+    def collection(scope = reflection.klass.all) = scope.limit(CafeCar.max_collection_options)
     def reflection
       return if @method.nil?
       # A nested-attributes permit names the key `<assoc>_attributes` (what Rails'

data/lib/cafe_car/form_builder.rb

@@ -18,8 +18,9 @@ module CafeCar
 
       return show(info.input_key) if info.polymorphic? and object.persisted?
       return hidden(*info.polymorphic_methods) if info.polymorphic?
+      return preserved_association(info) unless association_accessible?(info)
 
-      collection ||= with_selected(info)
+      collection ||= with_selected(info, association_collection(info))
       # A multi-select filters by a set (`author_id[]`), so no blank "any" option —
       # an empty selection already means "any". A single select keeps its prompt.
       options[:include_blank] ||= info.prompt unless multiple
@@ -31,6 +32,20 @@ module CafeCar
                         -> { @template.present(_1).title }, options, html)
     end
 
+    # Association choices obey the associated model's Pundit scope. The remote
+    # typeahead endpoint already applies this boundary; using the same boundary
+    # for the initial HTML options keeps the progressive-enhancement path from
+    # leaking rows the user cannot reach through that endpoint.
+    def association_collection(info)
+      klass = info.reflection.klass
+      scope = association_accessible?(info) ? @template.policy_scope(klass) : klass.none
+      info.collection(scope)
+    end
+
+    def association_accessible?(info)
+      @template.policy(info.reflection.klass).index?
+    end
+
     # HTML options that flag an association <select> for Tom Select enhancement
     # (see cafe_car.js). When the associated model exposes an `options` typeahead
     # feed, its URL rides along so keystroke search can reach records past
@@ -53,15 +68,30 @@ module CafeCar
     # The capped option collection, guaranteeing the currently-associated record is
     # among the options even when it sorts past the cap — otherwise editing a record
     # whose association is beyond `max_collection_options` would silently drop the value.
-    def with_selected(info)
-      collection = info.collection
+    def with_selected(info, collection)
       return collection unless info.reflection&.belongs_to?
+      return collection unless association_accessible?(info)
 
       selected = object.try(info.reflection.name)
       return collection unless selected
 
       records = collection.to_a
-      records.include?(selected) ? records : [ selected, *records ]
+      return records if records.include?(selected)
+
+      scope = @template.policy_scope(info.reflection.klass)
+      scope.where(id: selected.id).exists? ? [ selected, *records ] : records
+    end
+
+    # A persisted association can sit outside the viewer's current list boundary
+    # (or listing can be denied wholesale). Keep that foreign key through an
+    # unrelated edit without exposing the associated record as a labelled option.
+    # The controller accepts only this unchanged value; any reassignment still
+    # requires `index?` and membership in the associated policy scope.
+    def preserved_association(info)
+      return @template.safe_join([]) unless object.respond_to?(:persisted?) && object.persisted?
+      return @template.safe_join([]) unless info.reflection.belongs_to?
+
+      hidden(info.input_key)
     end
 
     # An ActiveRecord enum renders as a plain <select> of its declared values,

data/lib/cafe_car/helpers.rb

@@ -146,8 +146,9 @@ module CafeCar
       ids   = Array.wrap(value)
       assoc = filter_association(klass, key)
       return ids.join(", ") unless assoc
+      return ids.join(", ") unless policy(assoc).index?
 
-      titles = assoc.where(id: ids).index_by { _1.id.to_s }
+      titles = policy_scope(assoc).where(id: ids).index_by { _1.id.to_s }
       ids.map { |id| titles[id.to_s]&.then { present(_1).title } || id }.join(", ")
     end
 
@@ -299,9 +300,10 @@ module CafeCar
     # A dashboard chart tile: a title over the dependency-free inline-SVG bar chart,
     # built from `model`'s records bucketed over the `x` date column at `by`
     # granularity. `x` runs through ChartBuilder's date-column allowlist unchanged,
-    # so a column name can never reach SQL raw.
+    # so a column name can never reach SQL raw. The model's policy scope is the
+    # chart's row boundary.
     def chart(title, model:, x:, by: nil)
-      render "cafe_car/dashboard/chart", title:, objects: model.all, x:, by:
+      render "cafe_car/dashboard/chart", title:, objects: policy_scope(model), x:, by:
     end
 
     # The policy-driven metric tiles for `model`: one count tile per name in the
@@ -314,7 +316,8 @@ module CafeCar
     end
 
     def metric_for(model, name)
-      scope = name.to_sym == :all ? model.all : model.public_send(name)
+      scope = policy_scope(model)
+      scope = scope.public_send(name) unless name.to_sym == :all
       metric(metric_label(model, name)) { scope.count }
     end
 
@@ -339,7 +342,7 @@ module CafeCar
       end
     end
 
-    def debug?   = params.key?(:debug)
+    def debug?   = Rails.env.development? && request.local? && params.key?(:debug)
     def console? = params.key?(:console)
 
     def comment(text)

data/lib/cafe_car/version.rb

@@ -1,3 +1,3 @@
 module CafeCar
-  VERSION = "0.3.0"
+  VERSION = "0.3.1"
 end

data/skills/cafe_car/references/navigation.md

@@ -43,7 +43,16 @@ Override the partials like any other ([views.md](views.md)):
 ## The dashboard — opt in by writing one view
 
 No template, no dashboard: the route always exists, but it 404s and shows no nav
-link until the host writes `app/views/cafe_car/dashboard/show.html.haml`:
+link until the host writes `app/views/cafe_car/dashboard/show.html.haml`. The page
+uses ordinary Pundit authorization:
+
+```ruby
+class DashboardPolicy < ApplicationPolicy
+  def show? = user.present?
+end
+```
+
+Then write the view:
 
 ```haml
 - title "Dashboard"
@@ -57,11 +66,13 @@ link until the host writes `app/views/cafe_car/dashboard/show.html.haml`:
 ```
 
 - `metrics(Model)` — one count tile per scope named in the model policy's
-  `permitted_metrics` (`:all` = whole relation). Policy-driven; the default choice.
+  `permitted_metrics` (`:all` = the whole policy scope). Policy-driven; the default
+  choice.
 - `metric("Label") { … }` — one tile with whatever the block returns.
 - `chart "Title", model:, x:, by:` — the inline-SVG bar chart, bucketing over the
   `x` date column at `:day`/`:week`/`:month`. Column names are validated against
-  the policy's date columns — never raw SQL.
+  the policy's date columns, and rows come from `policy_scope(model)` — never raw
+  SQL or unscoped data.
 
 It's a plain view: add headings, your own partials, anything between tiles. Once
 the file exists a Dashboard link appears at the top of the sidebar.

data/skills/cafe_car/references/policies.md

@@ -59,6 +59,12 @@ end
 def permitted_attributes_for_create = %i[name email owner_id]  # per-action variant
 ```
 
+For associations, the parent policy decides whether the foreign key is editable,
+and the associated model's `index?` permission plus policy scope decide which
+records may be selected. CafeCar applies that boundary to the initial select, the
+remote typeahead, and submitted ids (including nested and polymorphic ids); a
+crafted id outside it is denied server-side.
+
 Nested records permit `<assoc>_attributes` the Rails way (with `:id` + `:_destroy`
 for `allow_destroy`):
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cafe_car
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.3.1
 platform: ruby
 authors:
 - Jeff Peterson
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-11 00:00:00.000000000 Z
+date: 2026-07-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -388,6 +388,7 @@ files:
 - lib/cafe_car/component.rb
 - lib/cafe_car/context.rb
 - lib/cafe_car/controller.rb
+- lib/cafe_car/controller/association_authorization.rb
 - lib/cafe_car/controller/filtering.rb
 - lib/cafe_car/core_ext.rb
 - lib/cafe_car/core_ext/array.rb