cancancan 3.6.2 → 3.7.0

data/lib/cancan/model_adapters/conditions_extractor.rb

@@ -1,74 +1,130 @@
 # frozen_string_literal: true
 
 # this class is responsible of converting the hash of conditions
-# in "where conditions" to generate the sql query
-# it consists of a names_cache that helps calculating the next name given to the association
-# it tries to reflect the behavior of ActiveRecord when generating aliases for tables.
+# in "where conditions" to generate the sql query.
+# Every association is given the table alias that ActiveRecord gives it when joining the associations,
+# so it walks the joins in the same order and registers every joined table, through tables included.
 module CanCan
   module ModelAdapters
     class ConditionsExtractor
-      def initialize(model_class)
-        @names_cache = { model_class.table_name => [] }.with_indifferent_access
+      # Pass the associations given to `joins` and then to `left_joins`, as they are joined by ActiveRecord.
+      def initialize(model_class, *joins)
         @root_model_class = model_class
+        @aliases = Hash.new(0)
+        @aliases[model_class.table_name] = 1
+        @table_aliases = {}
+        @joined_tables = {}
+        @model_classes = {}
+        joins.each { |associations| register_joins(model_class, joins_tree(associations), []) }
       end
 
-      def tableize_conditions(conditions, model_class = @root_model_class, path_to_key = 0)
+      def tableize_conditions(conditions, model_class = @root_model_class, path = [])
         return conditions unless conditions.is_a? Hash
 
         conditions.each_with_object({}) do |(key, value), result_hash|
           if value.is_a? Hash
-            result_hash.merge!(calculate_result_hash(key, model_class, path_to_key, result_hash, value))
+            tableize_association(model_class, path + [key.to_sym], value, result_hash)
           else
             result_hash[key] = value
           end
-          result_hash
         end
       end
 
+      # The model class of a table alias returned by tableize_conditions.
+      def model_class_for(table_alias)
+        @model_classes[table_alias.to_s]
+      end
+
       private
 
-      def calculate_result_hash(key, model_class, path_to_key, result_hash, value)
-        reflection = model_class.reflect_on_association(key)
-        nested_resulted = calculate_nested(model_class, result_hash, key, value.dup, path_to_key)
-        association_class = reflection.klass.name.constantize
-        tableize_conditions(nested_resulted, association_class, "#{path_to_key}_#{key}")
+      def tableize_association(model_class, path, conditions, result_hash)
+        reflection = model_class.reflect_on_association(path.last)
+        table_alias = @table_aliases[path] || register_association(model_class, reflection, path)
+        nested, values = conditions.partition { |_key, value| value.is_a? Hash }.map(&:to_h)
+        result_hash[table_alias.to_sym] = values unless values.empty?
+        result_hash.merge!(tableize_conditions(nested, reflection.klass, path))
       end
 
-      def calculate_nested(model_class, result_hash, relation_name, value, path_to_key)
-        value.each_with_object({}) do |(k, v), nested|
-          if v.is_a? Hash
-            value.delete(k)
-            nested[k] = v
-          else
-            table_alias = generate_table_alias(model_class, relation_name, path_to_key)
-            result_hash[table_alias] = value
-          end
-          nested
+      def joins_tree(joins)
+        case joins
+        when Hash then joins.to_h { |name, nested| [name.to_sym, joins_tree(nested)] }
+        when Array then joins.each_with_object({}) { |nested, tree| tree.deep_merge!(joins_tree(nested)) }
+        when nil then {}
+        else { joins.to_sym => {} }
         end
       end
 
-      def generate_table_alias(model_class, relation_name, path_to_key)
-        table_alias = model_class.reflect_on_association(relation_name).table_name.to_sym
+      # Mirrors ActiveRecord::Associations::JoinDependency#walk: the associations already joined come first.
+      def register_joins(model_class, tree, path)
+        joined, missing = tree.partition { |name, _nested| @table_aliases.key?(path + [name]) }
+        (joined + missing).each do |name, nested|
+          reflection = model_class.reflect_on_association(name)
+          next if reflection.nil? || reflection.polymorphic?
+
+          register_association(model_class, reflection, path + [name]) unless @table_aliases.key?(path + [name])
+          register_joins(reflection.klass, nested, path + [name])
+        end
+      end
 
-        if already_used?(table_alias, relation_name, path_to_key)
-          table_alias = "#{relation_name.to_s.pluralize}_#{model_class.table_name}".to_sym
+      def register_association(parent_class, reflection, path)
+        chain = reflection.chain
+        table_alias = nil
+        chain.each_index do |index|
+          table, reused = join_table(parent_class, chain, index)
+          table_alias ||= table
+          break if reused
+        end
+        @model_classes[table_alias] = reflection.klass
+        @table_aliases[path] = table_alias
+      end
 
-          index = 1
-          while already_used?(table_alias, relation_name, path_to_key)
-            table_alias = "#{table_alias}_#{index += 1}".to_sym
-          end
+      # Mirrors ActiveRecord::Associations::JoinDependency#make_constraints
+      def join_table(parent_class, chain, index)
+        root = index.zero?
+        remaining_chain = chain[index..]
+        table, terminated = @joined_tables[remaining_chain]
+        return reuse_joined_table(remaining_chain, table, root) if reuse_joined_table?(table, root, terminated)
+
+        table = aliased_table_for(chain[index].klass.table_name) do
+          name = chain[index].alias_candidate(parent_class.table_name)
+          root ? name : "#{name}_join"
+        end
+        @joined_tables[remaining_chain] ||= [table, root]
+        [table, false]
+      end
+
+      def reuse_joined_table(remaining_chain, table, root)
+        @joined_tables[remaining_chain] = [table, root] if root
+        [table, true]
+      end
+
+      # ActiveRecord reuses the through tables of the associations already joined since version 6.1
+      def reuse_joined_table?(table, root, terminated)
+        table && (!root || !terminated) && ActiveRecordAdapter.version_greater_or_equal?('6.1.0')
+      end
+
+      # Mirrors ActiveRecord::Associations::AliasTracker#aliased_table_for
+      def aliased_table_for(table_name)
+        if @aliases[table_name].zero?
+          @aliases[table_name] = 1
+          return table_name
         end
-        add_to_cache(table_alias, relation_name, path_to_key)
+
+        aliased_name = yield[0...table_alias_length].tr('.', '_')
+        count = @aliases[aliased_name] += 1
+        count > 1 ? "#{aliased_name[0, table_alias_length - 2]}_#{count}" : aliased_name
       end
 
-      def already_used?(table_alias, relation_name, path_to_key)
-        @names_cache[table_alias].try(:exclude?, "#{path_to_key}_#{relation_name}")
+      def table_alias_length
+        @table_alias_length ||= connection.table_alias_length
       end
 
-      def add_to_cache(table_alias, relation_name, path_to_key)
-        @names_cache[table_alias] ||= []
-        @names_cache[table_alias] << "#{path_to_key}_#{relation_name}"
-        table_alias
+      def connection
+        if @root_model_class.respond_to?(:lease_connection)
+          @root_model_class.lease_connection
+        else
+          @root_model_class.connection
+        end
       end
     end
   end

data/lib/cancan/model_adapters/conditions_normalizer.rb

@@ -41,7 +41,15 @@ module CanCan
         end
 
         def normalizable_association?(reflection)
-          reflection.options[:through].present? && !reflection.options[:source_type].present?
+          reflection.options[:through].present? &&
+            !reflection.options[:source_type].present? &&
+            !joinable_with_scope?(reflection)
+        end
+
+        # A through association with its own scope is not exploded, because its parts do not keep
+        # that scope. Active Record joins it with the scope, unless the scope takes the record as argument.
+        def joinable_with_scope?(reflection)
+          reflection.scope.present? && reflection.scope.arity.zero?
         end
       end
     end

data/lib/cancan/model_adapters/sti_normalizer.rb

@@ -7,25 +7,18 @@ module CanCan
     class StiNormalizer
       class << self
         def normalize(rules)
-          rules_cache = []
           return unless defined?(ActiveRecord::Base)
 
-          rules.delete_if do |rule|
-            subjects = rule.subjects.select do |subject|
-              update_rule(subject, rule, rules_cache)
-            end
-            subjects.length == rule.subjects.length
-          end
-          rules_cache.each { |rule| rules.push(rule) }
+          rules.replace(rules.flat_map { |rule| normalized_rules(rule) })
         end
 
         private
 
-        def update_rule(subject, rule, rules_cache)
-          return false unless StiDetector.sti_class?(subject)
-
-          rules_cache.push(build_rule_for_subclass(rule, subject))
-          true
+        # The rules for the subclasses take the place of the original rule, so their precedence is kept.
+        def normalized_rules(rule)
+          sti_subjects = rule.subjects.select { |subject| StiDetector.sti_class?(subject) }
+          subclass_rules = sti_subjects.map { |subject| build_rule_for_subclass(rule, subject) }
+          sti_subjects.length == rule.subjects.length ? subclass_rules : [rule, *subclass_rules]
         end
 
         # create a new rule for the subclasses that links on the inheritance_column

data/lib/cancan/model_adapters/strategies/joined_alias_each_rule_as_exists_subquery.rb

@@ -25,9 +25,9 @@ module CanCan
         end
 
         def sub_query_for_rule(rule)
-          conditions_extractor = ConditionsExtractor.new(model_class)
-          rule_where_conditions = extract_multiple_conditions(conditions_extractor, [rule])
           joins_hash, left_joins_hash = extract_joins_from_rule(rule)
+          conditions_extractor = ConditionsExtractor.new(model_class, joins_hash, left_joins_hash)
+          rule_where_conditions = extract_multiple_conditions(conditions_extractor, [rule])
           sub_query_for_rules_and_join_hashes(rule_where_conditions, joins_hash, left_joins_hash)
         end
 

data/lib/cancan/relevant.rb

@@ -8,6 +8,10 @@ module CanCan
       @match_all || (matches_action?(action) && matches_subject?(subject))
     end
 
+    def only_for_subclasses_of?(klass)
+      !@subjects.empty? && @subjects.all? { |subject| subject.is_a?(Class) && subject < klass }
+    end
+
     private
 
     def matches_action?(action)

data/lib/cancan/rule.rb

@@ -28,7 +28,7 @@ module CanCan
       raise Error, "Subject is required for #{action}" if action && subject.nil?
 
       @base_behavior = base_behavior
-      @actions = wrap(action)
+      @actions = wrap(action).map(&:to_sym)
       @subjects = wrap(subject)
       @attributes = wrap(attributes)
       @conditions = extra_args || {}
@@ -58,7 +58,8 @@ module CanCan
 
     def catch_all?
       (with_scope? && @conditions.where_values_hash.empty?) ||
-        (!with_scope? && [nil, false, [], {}, '', ' '].include?(@conditions))
+        ((@subjects.all? { |subject| !StiDetector.sti_class?(subject) || subject.base_class == subject }) &&
+          (!with_scope? && [nil, false, [], {}, '', ' '].include?(@conditions)))
     end
 
     def only_block?

data/lib/cancan/rules_compressor.rb

@@ -31,9 +31,10 @@ module CanCan
     def simplify(rules)
       seen = Set.new
       rules.reverse_each.filter_map do |rule|
-        next if seen.include?(rule.conditions)
+        subjects_and_conditions = [rule.subjects, rule.conditions]
+        next if seen.include?(subjects_and_conditions)
 
-        seen.add(rule.conditions)
+        seen.add(subjects_and_conditions)
         rule
       end.reverse
     end

data/lib/cancan/sti_detector.rb

@@ -4,7 +4,7 @@ class StiDetector
   def self.sti_class?(subject)
     return false unless defined?(ActiveRecord::Base)
     return false unless subject.respond_to?(:descends_from_active_record?)
-    return false if subject == :all || subject.descends_from_active_record?
+    return false if subject.descends_from_active_record?
     return false unless subject < ActiveRecord::Base
 
     true

data/lib/cancan/unauthorized_message_resolver.rb

@@ -3,6 +3,7 @@
 module CanCan
   module UnauthorizedMessageResolver
     def unauthorized_message(action, subject)
+      action = action.to_sym if action.is_a?(String)
       subject = subject.values.last if subject.is_a?(Hash)
       keys = unauthorized_message_keys(action, subject)
       variables = {}

data/lib/cancan/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module CanCan
-  VERSION = '3.6.2'.freeze
+  VERSION = '3.7.0'.freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cancancan
 version: !ruby/object:Gem::Version
-  version: 3.6.2
+  version: 3.7.0
 platform: ruby
 authors:
 - Alessandro Rodi (Renuo AG)
@@ -50,22 +50,16 @@ dependencies:
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '10.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 10.1.1
+        version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '10.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 10.1.1
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
@@ -119,11 +113,6 @@ files:
 - lib/cancan/config.rb
 - lib/cancan/controller_additions.rb
 - lib/cancan/controller_resource.rb
-- lib/cancan/controller_resource_builder.rb
-- lib/cancan/controller_resource_finder.rb
-- lib/cancan/controller_resource_loader.rb
-- lib/cancan/controller_resource_name_finder.rb
-- lib/cancan/controller_resource_sanitizer.rb
 - lib/cancan/exceptions.rb
 - lib/cancan/matchers.rb
 - lib/cancan/model_adapters/abstract_adapter.rb
@@ -155,6 +144,7 @@ homepage: https://github.com/CanCanCommunity/cancancan
 licenses:
 - MIT
 metadata:
+  changelog_uri: https://github.com/CanCanCommunity/cancancan/blob/develop/CHANGELOG.md
   funding_uri: https://github.com/sponsors/coorasse
 rdoc_options: []
 require_paths:

data/lib/cancan/controller_resource_builder.rb

@@ -1,26 +0,0 @@
-# frozen_string_literal: true
-
-module CanCan
-  module ControllerResourceBuilder
-    protected
-
-    def build_resource
-      resource = resource_base.new(resource_params || {})
-      assign_attributes(resource)
-    end
-
-    def assign_attributes(resource)
-      resource.send("#{parent_name}=", parent_resource) if @options[:singleton] && parent_resource
-      initial_attributes.each do |attr_name, value|
-        resource.send("#{attr_name}=", value)
-      end
-      resource
-    end
-
-    def initial_attributes
-      current_ability.attributes_for(@params[:action].to_sym, resource_class).delete_if do |key, _value|
-        resource_params && resource_params.include?(key)
-      end
-    end
-  end
-end

data/lib/cancan/controller_resource_finder.rb

@@ -1,42 +0,0 @@
-# frozen_string_literal: true
-
-module CanCan
-  module ControllerResourceFinder
-    protected
-
-    def find_resource
-      if @options[:singleton] && parent_resource.respond_to?(name)
-        parent_resource.send(name)
-      elsif @options[:find_by]
-        find_resource_using_find_by
-      else
-        adapter.find(resource_base, id_param)
-      end
-    end
-
-    def find_resource_using_find_by
-      find_by_dynamic_finder || find_by_find_by_finder || resource_base.send(@options[:find_by], id_param)
-    end
-
-    def find_by_dynamic_finder
-      method_name = "find_by_#{@options[:find_by]}!"
-      resource_base.send(method_name, id_param) if resource_base.respond_to? method_name
-    end
-
-    def find_by_find_by_finder
-      resource_base.find_by(@options[:find_by].to_sym => id_param) if resource_base.respond_to? :find_by
-    end
-
-    def id_param
-      @params[id_param_key].to_s if @params[id_param_key].present?
-    end
-
-    def id_param_key
-      if @options[:id_param]
-        @options[:id_param]
-      else
-        parent? ? :"#{name}_id" : :id
-      end
-    end
-  end
-end

data/lib/cancan/controller_resource_loader.rb

@@ -1,120 +0,0 @@
-# frozen_string_literal: true
-
-require_relative 'controller_resource_finder.rb'
-require_relative 'controller_resource_name_finder.rb'
-require_relative 'controller_resource_builder.rb'
-require_relative 'controller_resource_sanitizer.rb'
-module CanCan
-  module ControllerResourceLoader
-    include CanCan::ControllerResourceNameFinder
-    include CanCan::ControllerResourceFinder
-    include CanCan::ControllerResourceBuilder
-    include CanCan::ControllerResourceSanitizer
-
-    def load_resource
-      return if skip?(:load)
-
-      if load_instance?
-        self.resource_instance ||= load_resource_instance
-      elsif load_collection?
-        self.collection_instance ||= load_collection
-      end
-    end
-
-    protected
-
-    def new_actions
-      %i[new create] + Array(@options[:new])
-    end
-
-    def resource_params_by_key(key)
-      return unless @options[key] && @params.key?(extract_key(@options[key]))
-
-      @params[extract_key(@options[key])]
-    end
-
-    def resource_params_by_namespaced_name
-      resource_params_by_key(:instance_name) || resource_params_by_key(:class) || (
-      params = @params[extract_key(namespaced_name)]
-      params.respond_to?(:to_h) ? params : nil)
-    end
-
-    def resource_params
-      if parameters_require_sanitizing? && params_method.present?
-        sanitize_parameters
-      else
-        resource_params_by_namespaced_name
-      end
-    end
-
-    def fetch_parent(name)
-      if @controller.instance_variable_defined? "@#{name}"
-        @controller.instance_variable_get("@#{name}")
-      elsif @controller.respond_to?(name, true)
-        @controller.send(name)
-      end
-    end
-
-    # The object to load this resource through.
-    def parent_resource
-      parent_name && fetch_parent(parent_name)
-    end
-
-    def parent_name
-      @options[:through] && [@options[:through]].flatten.detect { |i| fetch_parent(i) }
-    end
-
-    def resource_base_through_parent_resource
-      if @options[:singleton]
-        resource_class
-      else
-        parent_resource.send(@options[:through_association] || name.to_s.pluralize)
-      end
-    end
-
-    def resource_base_through
-      if parent_resource
-        resource_base_through_parent_resource
-      elsif @options[:shallow]
-        resource_class
-      else
-        # maybe this should be a record not found error instead?
-        raise AccessDenied.new(nil, authorization_action, resource_class)
-      end
-    end
-
-    # The object that methods (such as "find", "new" or "build") are called on.
-    # If the :through option is passed it will go through an association on that instance.
-    # If the :shallow option is passed it will use the resource_class if there's no parent
-    # If the :singleton option is passed it won't use the association because it needs to be handled later.
-    def resource_base
-      @options[:through] ? resource_base_through : resource_class
-    end
-
-    def parent_authorization_action
-      @options[:parent_action] || :show
-    end
-
-    def authorization_action
-      parent? ? parent_authorization_action : @params[:action].to_sym
-    end
-
-    def load_collection
-      resource_base.accessible_by(current_ability, authorization_action)
-    end
-
-    def load_resource_instance
-      if !parent? && new_actions.include?(@params[:action].to_sym)
-        build_resource
-      elsif id_param || @options[:singleton]
-        find_resource
-      end
-    end
-
-    private
-
-    def extract_key(value)
-      value.to_s.underscore.tr('/', '_')
-    end
-  end
-end

data/lib/cancan/controller_resource_name_finder.rb

@@ -1,23 +0,0 @@
-# frozen_string_literal: true
-
-module CanCan
-  module ControllerResourceNameFinder
-    protected
-
-    def name_from_controller
-      @params[:controller].split('/').last.singularize
-    end
-
-    def namespaced_name
-      [namespace, name].join('/').singularize.camelize.safe_constantize || name
-    end
-
-    def name
-      @name || name_from_controller
-    end
-
-    def namespace
-      @params[:controller].split('/')[0..-2]
-    end
-  end
-end

data/lib/cancan/controller_resource_sanitizer.rb

@@ -1,32 +0,0 @@
-# frozen_string_literal: true
-
-module CanCan
-  module ControllerResourceSanitizer
-    protected
-
-    def sanitize_parameters
-      case params_method
-      when Symbol
-        @controller.send(params_method)
-      when String
-        @controller.instance_eval(params_method)
-      when Proc
-        params_method.call(@controller)
-      end
-    end
-
-    def params_methods
-      methods = ["#{@params[:action]}_params".to_sym, "#{name}_params".to_sym, :resource_params]
-      methods.unshift(@options[:param_method]) if @options[:param_method].present?
-      methods
-    end
-
-    def params_method
-      params_methods.each do |method|
-        return method if (method.is_a?(Symbol) && @controller.respond_to?(method, true)) ||
-                         method.is_a?(String) || method.is_a?(Proc)
-      end
-      nil
-    end
-  end
-end