cancancan 3.6.0 → 3.6.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ec627804781c87a834f313dfd9447e83d8769449dab9a484f7069cb201a7450a
-  data.tar.gz: d6e99d78e6f075d1870f02c491090d3526e1167770ed886fbd00c1933be78f2d
+  metadata.gz: f110f791b83ea1cc157fae66dd576a3dae94f60b983d654e8be252cb6c4e8939
+  data.tar.gz: cbf9e6c8e6fadca715eeff37cfce3b289550d538e84a5996b4e95aa00632d7fd
 SHA512:
-  metadata.gz: 98a14c9573781aad22fe329853e516e9149d977b4f02ee0f274a79651bd29ec6444b15397cff695f2ec8ac94a0a0207b060c11dbe20ab0d65471a18023b0b4e1
-  data.tar.gz: 8e6ac6e2b51fb9ca95c7f59d961d1da0a35d9fa3bae5e8b0fa967c9a2f4c18e44577b8048fa33612919eb03bb010335ccd57c9cffb0497175a906bfc66e4c212
+  metadata.gz: 8102b54914e87e65dbd15b27991e33462d5083d37c6f57aaf09a2dfeaff92826420e27863bd88e17a8c1f18939281ec36ed2abb70e2e012df16661997af5f98a
+  data.tar.gz: 6b1defbddb0262274e8ad349fb6b267fa45b4024ca790ba3ba93f67d741cc38055e37e485d57f7ff17b59244a5c235d42e956b9049b603d2d8aa28898a4dd768

data/lib/cancan/ability/strong_parameter_support.rb

@@ -31,7 +31,7 @@ module CanCan
         klass = subject_class?(subject) ? subject : subject.class
         # empty attributes is an 'all'
         if rule.attributes.empty? && klass < ActiveRecord::Base
-          klass.column_names.map(&:to_sym) - Array(klass.primary_key)
+          klass.attribute_names.map(&:to_sym) - Array(klass.primary_key)
         else
           rule.attributes
         end

data/lib/cancan/controller_additions.rb

@@ -171,6 +171,11 @@ module CanCan
       # [:+instance_name+]
       #   The name of the instance variable for this resource.
       #
+      # [:+id_param+]
+      #   Find using a param key other than :id. For example:
+      #
+      #     load_resource :id_param => :url # will use find(params[:url])
+      #
       # [:+through+]
       #   Authorize conditions on this parent resource when instance isn't available.
       #
@@ -208,7 +213,7 @@ module CanCan
       def skip_load_resource(*args)
         options = args.extract_options!
         name = args.first
-        cancan_skipper[:load][name] = options
+        add_cancan_skip(:load, name, options)
       end
 
       # Skip the authorization behavior of CanCan. This is useful when using +load_and_authorize_resource+ but want to
@@ -224,7 +229,7 @@ module CanCan
       def skip_authorize_resource(*args)
         options = args.extract_options!
         name = args.first
-        cancan_skipper[:authorize][name] = options
+        add_cancan_skip(:authorize, name, options)
       end
 
       # Add this to a controller to ensure it performs authorization through +authorize+! or +authorize_resource+ call.
@@ -290,6 +295,15 @@ module CanCan
       def cancan_skipper
         self._cancan_skipper ||= { authorize: {}, load: {} }
       end
+
+      private
+
+      # _cancan_skipper is a class_attribute: a subclass shares the hash of its superclass until it assigns
+      # its own. Assign a copy, so a skip in a subclass does not change the superclass or sibling classes.
+      def add_cancan_skip(behavior, name, options)
+        skipper = cancan_skipper
+        self._cancan_skipper = skipper.merge(behavior => skipper[behavior].merge(name => options))
+      end
     end
 
     def self.included(base)

data/lib/cancan/model_adapters/active_record_5_adapter.rb

@@ -49,11 +49,22 @@ module CanCan
       def visit_nodes(node)
         # Rails 5.2 adds a BindParam node that prevents the visitor method from properly compiling the SQL query
         if self.class.version_greater_or_equal?('5.2.0')
-          connection = @model_class.send(:connection)
+          connection = model_connection
           collector = Arel::Collectors::SubstituteBinds.new(connection, Arel::Collectors::SQLString.new)
           connection.visitor.accept(node, collector).value
         else
-          @model_class.send(:connection).visitor.compile(node)
+          model_connection.visitor.compile(node)
+        end
+      end
+
+      # Rails 7.2 soft-deprecated ActiveRecord::Base.connection in favour of
+      # lease_connection, which better describes its lifecycle. Fall back to
+      # connection for Rails < 7.2 where lease_connection is not defined.
+      def model_connection
+        if @model_class.respond_to?(:lease_connection)
+          @model_class.lease_connection
+        else
+          @model_class.send(:connection)
         end
       end
     end

data/lib/cancan/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module CanCan
-  VERSION = '3.6.0'.freeze
+  VERSION = '3.6.2'.freeze
 end

metadata

@@ -1,17 +1,16 @@
 --- !ruby/object:Gem::Specification
 name: cancancan
 version: !ruby/object:Gem::Version
-  version: 3.6.0
+  version: 3.6.2
 platform: ruby
 authors:
 - Alessandro Rodi (Renuo AG)
 - Bryan Rite
 - Ryan Bates
 - Richard Wilson
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-05-23 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: appraisal
@@ -157,7 +156,6 @@ licenses:
 - MIT
 metadata:
   funding_uri: https://github.com/sponsors/coorasse
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -172,8 +170,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.3
-signing_key:
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Simple authorization solution for Rails.
 test_files: []