forest_admin_agent 1.37.2 → 1.37.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 803b07951c6391fe8053f31ae3e61f9e5ca4554d566dbdb632e58ed1af347023
-  data.tar.gz: dbcaeb6b707a998e2611aed5b48f70ac837cb7108bccdada00c18c32352f07cb
+  metadata.gz: e658e8812d89132182a96392c58221793cf5991bd95b4c0d3170dff0676a693c
+  data.tar.gz: b7cf6705ebdda5d3785e78290f1b1f4b762b1eac7b157c999bbbde4b6206b8f3
 SHA512:
-  metadata.gz: 5f5be7f213857e22442935adae33a72e67161349f1ffc8fc54226eee9564ab732a9e69e5ff546b3f4d47abd3284609e7ba563bb9bc18a21f7bfc727da99a4fec
-  data.tar.gz: 399f1c35b9568d590844a70aae5d01a00ed67eb6e4edade4371b05813b2ccf7ae9393477bd80565e3f65edfb7eb5870eee1aa06d5fdd775a1426996417806ba7
+  metadata.gz: 2feb766efd70870058a92d79ebde8cc3a41cc83452767a7478f6d5a4e66aa72346c0b1208364696fe67c5b4d4378439797240cf387d4462ea198a4f5df521152
+  data.tar.gz: d49ef0aca2acdb55a4c6b8d5ac58861165017f424958787064635322ff2fe961ecaa6e206ecc80c4fc495a5986434615f1aa5b9b599d62ce390733b0a4bb89e8

data/lib/forest_admin_agent/routes/capabilities/collections.rb

@@ -2,7 +2,7 @@ require 'json'
 module ForestAdminAgent
   module Routes
     module Capabilities
-      class Collections < AbstractRoute
+      class Collections < AbstractAuthenticatedRoute
         include ForestAdminDatasourceToolkit::Schema
         include ForestAdminDatasourceToolkit::Schema::Relations
 
@@ -16,7 +16,8 @@ module ForestAdminAgent
         end
 
         def handle_request(args = {})
-          datasource = ForestAdminAgent::Facades::Container.datasource
+          context = build(args)
+          datasource = context.datasource
           collections = args[:params]['collectionNames'] || []
 
           connections = datasource.live_query_connections.keys.map { |connection_name| { name: connection_name } }

data/lib/forest_admin_agent/routes/charts/api_chart_datasource.rb

@@ -37,14 +37,13 @@ module ForestAdminAgent
         end
 
         def handle_api_chart(args = {})
-          caller = Utils::QueryStringParser.parse_caller(args)
+          context = build(args)
           parameters = Utils::QueryStringParser.parse_chart_parameters(args)
-          datasource = ForestAdminAgent::Facades::Container.datasource
 
           {
             content: Serializer::ForestChartSerializer.serialize(
-              datasource.render_chart(
-                caller,
+              context.datasource.render_chart(
+                context.caller,
                 @chart_name,
                 parameters
               )
@@ -53,13 +52,12 @@ module ForestAdminAgent
         end
 
         def handle_smart_chart(args = {})
-          caller = Utils::QueryStringParser.parse_caller(args)
+          context = build(args)
           parameters = Utils::QueryStringParser.parse_chart_parameters(args)
-          datasource = ForestAdminAgent::Facades::Container.datasource
 
           {
-            content: datasource.render_chart(
-              caller,
+            content: context.datasource.render_chart(
+              context.caller,
               @chart_name,
               parameters
             )

data/lib/forest_admin_agent/routes/resources/related/associate_related.rb

@@ -50,7 +50,7 @@ module ForestAdminAgent
               condition_tree: ConditionTree::ConditionTreeFactory.intersect(
                 [
                   ConditionTree::Nodes::ConditionTreeLeaf.new(id, 'Equal', value),
-                  context.permissions.get_scope(context.collection)
+                  context.permissions.get_scope(context.child_collection)
                 ]
               )
             )
@@ -67,7 +67,7 @@ module ForestAdminAgent
               condition_tree: ConditionTree::ConditionTreeFactory.intersect(
                 [
                   ConditionTree::Nodes::ConditionTreeLeaf.new(id, 'Equal', value),
-                  context.permissions.get_scope(context.collection)
+                  context.permissions.get_scope(context.child_collection)
                 ]
               )
             )

data/lib/forest_admin_agent/routes/resources/related/dissociate_related.rb

@@ -29,7 +29,7 @@ module ForestAdminAgent
             if is_delete_mode
               context.permissions.can?(:delete, context.child_collection)
             else
-              context.permissions.can?(:edit, context.collection)
+              context.permissions.can?(:edit, context.child_collection)
             end
 
             filter = get_base_foreign_filter(args, context)

data/lib/forest_admin_agent/routes/resources/related/update_related.rb

@@ -22,9 +22,12 @@ module ForestAdminAgent
 
           def handle_request(args = {})
             context = build(args)
-            context.permissions.can?(:edit, context.collection)
 
             relation = context.collection.schema[:fields][args[:params]['relation_name']]
+
+            # Must run before unpack_id: unauthorized callers get a 403, not a validation error
+            context.permissions.can?(:edit, mutated_collection(relation, context))
+
             parent_primary_key_values = Utils::Id.unpack_id(context.collection, args[:params]['id'])
 
             linked_primary_key_values = if (id = args.dig(:params, 'data', 'id'))
@@ -47,13 +50,32 @@ module ForestAdminAgent
 
           private
 
+          def mutated_collection(relation, context)
+            return context.child_collection if ['OneToOne', 'PolymorphicOneToOne'].include?(relation.type)
+
+            context.collection
+          end
+
+          def scoped_fk_owner_filter(parent_primary_key_values, context)
+            fk_owner = ConditionTree::ConditionTreeFactory.match_ids(context.collection, [parent_primary_key_values])
+
+            Filter.new(
+              condition_tree: ConditionTree::ConditionTreeFactory.intersect(
+                [
+                  context.permissions.get_scope(context.collection),
+                  fk_owner
+                ]
+              )
+            )
+          end
+
           def update_many_to_one(relation, parent_primary_key_values, linked_primary_key_values, context)
             foreign_value = if linked_primary_key_values
                               Collection.get_value(context.child_collection, context.caller, linked_primary_key_values,
                                                    relation.foreign_key_target)
                             end
-            fk_owner = ConditionTree::ConditionTreeFactory.match_ids(context.collection, [parent_primary_key_values])
-            context.collection.update(context.caller, Filter.new(condition_tree: fk_owner),
+
+            context.collection.update(context.caller, scoped_fk_owner_filter(parent_primary_key_values, context),
                                       { relation.foreign_key => foreign_value })
           end
 
@@ -68,10 +90,9 @@ module ForestAdminAgent
                             end
 
             polymorphic_type = context.child_collection.name.gsub('__', '::')
-            fk_owner = ConditionTree::ConditionTreeFactory.match_ids(context.collection, [parent_primary_key_values])
             context.collection.update(
               context.caller,
-              Filter.new(condition_tree: fk_owner),
+              scoped_fk_owner_filter(parent_primary_key_values, context),
               {
                 relation.foreign_key => foreign_value,
                 relation.foreign_key_type_field => polymorphic_type
@@ -101,7 +122,7 @@ module ForestAdminAgent
             old_fk_owner_filter = Filter.new(
               condition_tree: ConditionTree::ConditionTreeFactory.intersect(
                 [
-                  context.permissions.get_scope(context.collection),
+                  context.permissions.get_scope(context.child_collection),
                   ConditionTree::Nodes::ConditionTreeBranch.new(
                     'And',
                     [
@@ -150,7 +171,7 @@ module ForestAdminAgent
               Filter.new(
                 condition_tree: ConditionTree::ConditionTreeFactory.intersect(
                   [
-                    context.permissions.get_scope(context.collection), new_fk_owner
+                    context.permissions.get_scope(context.child_collection), new_fk_owner
                   ]
                 )
               ),
@@ -164,7 +185,7 @@ module ForestAdminAgent
             old_fk_owner_filter = Filter.new(
               condition_tree: ConditionTree::ConditionTreeFactory.intersect(
                 [
-                  context.permissions.get_scope(context.collection),
+                  context.permissions.get_scope(context.child_collection),
                   ConditionTree::Nodes::ConditionTreeLeaf.new(
                     relation.origin_key,
                     ConditionTree::Operators::EQUAL,
@@ -198,7 +219,7 @@ module ForestAdminAgent
               context.caller,
               Filter.new(condition_tree: ConditionTree::ConditionTreeFactory.intersect(
                 [
-                  context.permissions.get_scope(context.collection),
+                  context.permissions.get_scope(context.child_collection),
                   new_fk_owner
                 ]
               )),

data/lib/forest_admin_agent/routes/security/scope_invalidation.rb

@@ -1,7 +1,7 @@
 module ForestAdminAgent
   module Routes
     module Security
-      class ScopeInvalidation < AbstractRoute
+      class ScopeInvalidation < AbstractAuthenticatedRoute
         include ForestAdminAgent::Builder
         include ForestAdminAgent::Services
 
@@ -17,8 +17,7 @@ module ForestAdminAgent
         end
 
         def handle_request(args)
-          # Check if user is logged
-          Utils::QueryStringParser.parse_caller(args)
+          build(args)
           Permissions.invalidate_cache('forest.rendering')
 
           { content: nil, status: 204 }

data/lib/forest_admin_agent/utils/caller_parser.rb

@@ -51,6 +51,8 @@ module ForestAdminAgent
           true,
           { algorithm: 'HS256' }
         )[0].tap { |data| data.delete('exp') }
+      rescue JWT::DecodeError
+        raise Http::Exceptions::UnauthorizedError, 'Invalid or expired authentication token.'
       end
 
       def extract_forest_context

data/lib/forest_admin_agent/utils/schema/schema_emitter.rb

@@ -6,7 +6,7 @@ module ForestAdminAgent
     module Schema
       class SchemaEmitter
         LIANA_NAME = "agent-ruby"
-        LIANA_VERSION = "1.37.2"
+        LIANA_VERSION = "1.37.4"
 
         def self.generate(datasource)
           datasource.collections

data/lib/forest_admin_agent/version.rb

@@ -1,3 +1,3 @@
 module ForestAdminAgent
-  VERSION = "1.37.2"
+  VERSION = "1.37.4"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: forest_admin_agent
 version: !ruby/object:Gem::Version
-  version: 1.37.2
+  version: 1.37.4
 platform: ruby
 authors:
 - Matthieu
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-08-10 00:00:00.000000000 Z
+date: 2026-08-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport