forest_admin_agent 1.37.3 → 1.38.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8fdf5c141f3b667c5d637882a071c6775bbf8dd6c814415b53c7cfa1478725d3
-  data.tar.gz: 8e51a39b2ac4461d530d64b9bd24e93dd37463057c68d39a505e6ee63ba7b338
+  metadata.gz: 5455a6164932af84cf535d72cd896814fcb24a83106cae4c6efbf94d3f15f650
+  data.tar.gz: f31a0a6cde3793cd7bc2f5bfc1c2462a0001d4e80e414e7433064f2907dff45d
 SHA512:
-  metadata.gz: cd9a857e7b0c8cd264f998522bca85aef1048253ab7ba30106383fbf91d2744581a4356edad2431d2ea6c392bb67c031390debf5dd0fa496648d2ed454f504a7
-  data.tar.gz: 906a6c9db2e4911fc8b2dea2993c5a274fd2e2fb1b43ce985dfb97e8dbd3563bdbf2592a21d8ac3bac2b580413e871bbacf0f86bf7fc1ec0766e564e16c575fd
+  metadata.gz: 929f4669e1b73c51b615f0259a6b34e6cfa59cb89c7e9dde693c7c47238b4c5b2fe608d5a3eceb73d6ed025fe5d5a83a33759920187c61bb1eddd3b0ab239bf1
+  data.tar.gz: 638dd7596eae9fde1b272e5389d3da042e0aaf3e12080fbdf449866a61a8535a75ae8d46cbf39c5c3eed56792f249c7146d770179a976fe0961b5e6c6b445b02

data/lib/forest_admin_agent/routes/capabilities/collections.rb

@@ -65,6 +65,8 @@ module ForestAdminAgent
               nativeQueryConnections: connections,
               agentCapabilities: {
                 canUseProjectionOnGetOne: true,
+                canUseProjectionViaHeader: true,
+                canUseProjectionViaHeaderOnList: true,
                 canUseMultipleFieldsProjectionOnRelation: true
               }
             },

data/lib/forest_admin_agent/routes/resources/csv.rb

@@ -37,7 +37,7 @@ module ForestAdminAgent
             sort: QueryStringParser.parse_sort(context.collection, args),
             segment: QueryStringParser.parse_segment(context.collection, args)
           )
-          projection = QueryStringParser.parse_projection(context.collection, args)
+          projection = QueryStringParser.parse_projection_from_request(context.collection, args)
           filename = args[:params][:filename] || args[:params]['collection_name']
           filename += '.csv' unless /\.csv$/i.match?(filename)
           header = args[:params][:header]

data/lib/forest_admin_agent/routes/resources/related/associate_related.rb

@@ -50,7 +50,7 @@ module ForestAdminAgent
               condition_tree: ConditionTree::ConditionTreeFactory.intersect(
                 [
                   ConditionTree::Nodes::ConditionTreeLeaf.new(id, 'Equal', value),
-                  context.permissions.get_scope(context.collection)
+                  context.permissions.get_scope(context.child_collection)
                 ]
               )
             )
@@ -67,7 +67,7 @@ module ForestAdminAgent
               condition_tree: ConditionTree::ConditionTreeFactory.intersect(
                 [
                   ConditionTree::Nodes::ConditionTreeLeaf.new(id, 'Equal', value),
-                  context.permissions.get_scope(context.collection)
+                  context.permissions.get_scope(context.child_collection)
                 ]
               )
             )

data/lib/forest_admin_agent/routes/resources/related/csv_related.rb

@@ -32,8 +32,9 @@ module ForestAdminAgent
                 ]
               )
             )
-            projection = ForestAdminAgent::Utils::QueryStringParser.parse_projection_with_pks(context.child_collection,
-                                                                                              args)
+            projection = ForestAdminAgent::Utils::QueryStringParser.parse_projection_from_request(
+              context.child_collection, args
+            )
 
             # Get the parent record primary keys
             primary_key_values = Utils::Id.unpack_id(context.collection, args[:params]['id'], with_key: true)

data/lib/forest_admin_agent/routes/resources/related/dissociate_related.rb

@@ -29,7 +29,7 @@ module ForestAdminAgent
             if is_delete_mode
               context.permissions.can?(:delete, context.child_collection)
             else
-              context.permissions.can?(:edit, context.collection)
+              context.permissions.can?(:edit, context.child_collection)
             end
 
             filter = get_base_foreign_filter(args, context)

data/lib/forest_admin_agent/routes/resources/related/update_related.rb

@@ -22,9 +22,12 @@ module ForestAdminAgent
 
           def handle_request(args = {})
             context = build(args)
-            context.permissions.can?(:edit, context.collection)
 
             relation = context.collection.schema[:fields][args[:params]['relation_name']]
+
+            # Must run before unpack_id: unauthorized callers get a 403, not a validation error
+            context.permissions.can?(:edit, mutated_collection(relation, context))
+
             parent_primary_key_values = Utils::Id.unpack_id(context.collection, args[:params]['id'])
 
             linked_primary_key_values = if (id = args.dig(:params, 'data', 'id'))
@@ -47,13 +50,32 @@ module ForestAdminAgent
 
           private
 
+          def mutated_collection(relation, context)
+            return context.child_collection if ['OneToOne', 'PolymorphicOneToOne'].include?(relation.type)
+
+            context.collection
+          end
+
+          def scoped_fk_owner_filter(parent_primary_key_values, context)
+            fk_owner = ConditionTree::ConditionTreeFactory.match_ids(context.collection, [parent_primary_key_values])
+
+            Filter.new(
+              condition_tree: ConditionTree::ConditionTreeFactory.intersect(
+                [
+                  context.permissions.get_scope(context.collection),
+                  fk_owner
+                ]
+              )
+            )
+          end
+
           def update_many_to_one(relation, parent_primary_key_values, linked_primary_key_values, context)
             foreign_value = if linked_primary_key_values
                               Collection.get_value(context.child_collection, context.caller, linked_primary_key_values,
                                                    relation.foreign_key_target)
                             end
-            fk_owner = ConditionTree::ConditionTreeFactory.match_ids(context.collection, [parent_primary_key_values])
-            context.collection.update(context.caller, Filter.new(condition_tree: fk_owner),
+
+            context.collection.update(context.caller, scoped_fk_owner_filter(parent_primary_key_values, context),
                                       { relation.foreign_key => foreign_value })
           end
 
@@ -68,10 +90,9 @@ module ForestAdminAgent
                             end
 
             polymorphic_type = context.child_collection.name.gsub('__', '::')
-            fk_owner = ConditionTree::ConditionTreeFactory.match_ids(context.collection, [parent_primary_key_values])
             context.collection.update(
               context.caller,
-              Filter.new(condition_tree: fk_owner),
+              scoped_fk_owner_filter(parent_primary_key_values, context),
               {
                 relation.foreign_key => foreign_value,
                 relation.foreign_key_type_field => polymorphic_type
@@ -101,7 +122,7 @@ module ForestAdminAgent
             old_fk_owner_filter = Filter.new(
               condition_tree: ConditionTree::ConditionTreeFactory.intersect(
                 [
-                  context.permissions.get_scope(context.collection),
+                  context.permissions.get_scope(context.child_collection),
                   ConditionTree::Nodes::ConditionTreeBranch.new(
                     'And',
                     [
@@ -150,7 +171,7 @@ module ForestAdminAgent
               Filter.new(
                 condition_tree: ConditionTree::ConditionTreeFactory.intersect(
                   [
-                    context.permissions.get_scope(context.collection), new_fk_owner
+                    context.permissions.get_scope(context.child_collection), new_fk_owner
                   ]
                 )
               ),
@@ -164,7 +185,7 @@ module ForestAdminAgent
             old_fk_owner_filter = Filter.new(
               condition_tree: ConditionTree::ConditionTreeFactory.intersect(
                 [
-                  context.permissions.get_scope(context.collection),
+                  context.permissions.get_scope(context.child_collection),
                   ConditionTree::Nodes::ConditionTreeLeaf.new(
                     relation.origin_key,
                     ConditionTree::Operators::EQUAL,
@@ -198,7 +219,7 @@ module ForestAdminAgent
               context.caller,
               Filter.new(condition_tree: ConditionTree::ConditionTreeFactory.intersect(
                 [
-                  context.permissions.get_scope(context.collection),
+                  context.permissions.get_scope(context.child_collection),
                   new_fk_owner
                 ]
               )),

data/lib/forest_admin_agent/utils/query_string_parser.rb

@@ -47,6 +47,24 @@ module ForestAdminAgent
         raise BadRequestError, "Invalid projection: #{e.message}"
       end
 
+      def self.parse_projection_from_header(collection, args)
+        header = args.dig(:headers, 'HTTP_FOREST_PROJECTION')&.to_s&.strip
+
+        return if header.nil? || header.empty?
+
+        projection_fields = build_header_projection_fields(collection, header.split(',', -1).map(&:strip))
+
+        ForestAdminDatasourceToolkit::Validations::ProjectionValidator.validate?(collection, projection_fields)
+
+        Projection.new(projection_fields)
+      rescue ForestAdminDatasourceToolkit::Exceptions::ForestException => e
+        raise BadRequestError, "Invalid Forest-Projection header: #{e.message}"
+      end
+
+      def self.parse_projection_from_request(collection, args)
+        parse_projection_from_header(collection, args) || parse_projection(collection, args)
+      end
+
       def self.add_polymorphic_type_fields(collection, requested_field_names)
         polymorphic_relations = collection.schema[:fields].select { |_, field| field.type == 'PolymorphicManyToOne' }
 
@@ -83,6 +101,29 @@ module ForestAdminAgent
         end
       end
 
+      def self.build_header_projection_fields(collection, requested_paths)
+        if requested_paths.any? { |path| path.empty? || path.split(':', -1).any?(&:empty?) }
+          raise ForestAdminDatasourceToolkit::Exceptions::ValidationError, 'The projection contains an empty field.'
+        end
+
+        root_field_names = requested_paths.map { |path| path.split(':').first }
+        root_field_names_with_types = root_field_names.dup
+        add_polymorphic_type_fields(collection, root_field_names_with_types)
+
+        projection_fields = requested_paths.map do |path|
+          field_name, nested_path = path.split(':', 2)
+          field = get_field(collection, field_name)
+
+          if field.type == 'PolymorphicManyToOne' && (nested_path.nil? || nested_path == '*')
+            "#{field_name}:*"
+          else
+            path
+          end
+        end
+
+        projection_fields | (root_field_names_with_types - root_field_names)
+      end
+
       def self.get_field(collection, field_name)
         field = collection.schema[:fields][field_name]
         return field unless field.nil?
@@ -93,12 +134,11 @@ module ForestAdminAgent
               "Available fields are: [#{available_fields}]. " \
               'Please check if the field name is correct.'
       end
-      private_class_method :add_polymorphic_type_fields, :build_projection_fields, :get_field
+      private_class_method :add_polymorphic_type_fields, :build_projection_fields,
+                           :build_header_projection_fields, :get_field
 
       def self.parse_projection_with_pks(collection, args)
-        projection = parse_projection(collection, args)
-
-        projection.with_pks(collection)
+        parse_projection_from_request(collection, args).with_pks(collection)
       end
 
       def self.parse_pagination(args)

data/lib/forest_admin_agent/utils/schema/schema_emitter.rb

@@ -6,7 +6,7 @@ module ForestAdminAgent
     module Schema
       class SchemaEmitter
         LIANA_NAME = "agent-ruby"
-        LIANA_VERSION = "1.37.3"
+        LIANA_VERSION = "1.38.0"
 
         def self.generate(datasource)
           datasource.collections

data/lib/forest_admin_agent/version.rb

@@ -1,3 +1,3 @@
 module ForestAdminAgent
-  VERSION = "1.37.3"
+  VERSION = "1.38.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: forest_admin_agent
 version: !ruby/object:Gem::Version
-  version: 1.37.3
+  version: 1.38.0
 platform: ruby
 authors:
 - Matthieu
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-08-11 00:00:00.000000000 Z
+date: 2026-08-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport