forest_admin_agent 1.41.0 → 1.42.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e206afe12d8b554e97e214bc27441b51ddf5252d3e4b1ee5800645bd27baa228
-  data.tar.gz: cb1e6a7aa74f086fb70ebc7f30808db2b984660f6e375a49a5ee3467ebf0dbd2
+  metadata.gz: 2efec0ce2de78876bbab2962c838ee712dc576c6133e6b705f6f4c9d62ea998b
+  data.tar.gz: 557af82363e33d90b02952742832f4cdd3e2283610a4850ce3252eef12f6f3ca
 SHA512:
-  metadata.gz: 681910cfb585cef1e368db4e0f464b8866d35615cd1b2daaee1f02a45da613a52ec0a5063620ea36d2b1f47061486922227cc67cfa2d314b38f97a47c06fb7c8
-  data.tar.gz: 16763d62485a9bf7be6d253fb68352e8da2edc2d7679b606b4b535fce67d2e301e39f236c649d4cb27930fb6b3b9a7daec5643ca9a51fb30e9e34bf14095e20a
+  metadata.gz: 0dcfa322e26c5fb8c0e65865abf8d5f5ab4cd9a7f3c5e5abe6d86c5b8ffc6149f16ea609417fb3c9ce421b46f81157cb408078e18aced4b6336cb474d0a70a05
+  data.tar.gz: 350b111bf50db137f596d884d4fceab32fbab20ee9858846d0342b360b731d157a37a9ecd59878483672f9c1411a683302ccac3cf76428714786e2bede72b319

data/lib/forest_admin_agent/services/permissions.rb

@@ -330,11 +330,16 @@ module ForestAdminAgent
       end
 
       def collect_search_usages(collection, search, search_extended, usages)
-        return if search.nil? || !collection.respond_to?(:searched_fields)
+        # The stack discards a blank search instead of running it, so there is nothing to authorize.
+        return if search.nil? || search.strip.empty?
 
-        searched = collection.searched_fields(search, search_extended)
+        searched = collection.searched_fields(search, search_extended) if collection.respond_to?(:searched_fields)
 
-        return if searched.nil?
+        if searched.nil?
+          assert_extended_search_checkable(collection, search_extended)
+
+          return
+        end
 
         published = collection.datasource.collections
 
@@ -344,6 +349,25 @@ module ForestAdminAgent
         end
       end
 
+      # Only a callable `replace_search` is a footprint this stack could have described and did not; a
+      # native child search, or no search decorator at all, builds no condition here. A plain search is
+      # served in either case — the extended flag is the caller's own, so the exemption stops there.
+      def assert_extended_search_checkable(collection, search_extended)
+        return unless search_extended
+        return unless describes_own_search?(collection)
+        return unless permission_system?
+
+        raise ForbiddenError,
+              "You cannot run an extended search on the '#{collection.name}' collection: the fields " \
+              'it reaches cannot be determined, so they cannot be checked against your permissions.'
+      end
+
+      # Reaches the search decorator only through `CollectionDecorator#search_handler?`: drop that
+      # delegation and this answers false for every collection.
+      def describes_own_search?(collection)
+        collection.respond_to?(:search_handler?) && collection.search_handler?
+      end
+
       # `searched_fields` answers below the publication layer — deliberately, so a field hidden by
       # renaming above it is still checked — so it can name a collection `remove_collection` took out
       # of the API. An extended search does reach through to it: the condition is built below

data/lib/forest_admin_agent/utils/query_string_parser.rb

@@ -10,6 +10,7 @@ module ForestAdminAgent
       DEFAULT_ITEMS_PER_PAGE = '15'.freeze
       DEFAULT_PAGE_TO_SKIP = '1'.freeze
       POLYMORPHIC_TARGET_WILDCARD = '*'.freeze
+      FALSY_SEARCH_EXTENDED = [nil, false, 0, '0', 'false', ''].freeze
 
       def self.parse_condition_tree(collection, args)
         filters = begin
@@ -230,21 +231,43 @@ module ForestAdminAgent
         Page.new(offset: 0, limit: limit&.to_i)
       end
 
+      # Presence, not truth: with +||+ a +false+ in the select-all body would silently lose to the
+      # query string. An explicit +null+ or +''+ there is read as absent rather than as "no search",
+      # so neither can widen a result set by discarding the term the URL carried.
+      def self.subset_or_query(args, key)
+        subset = begin
+          args.dig(:params, :data, :attributes, :all_records_subset_query)
+        rescue StandardError
+          nil
+        end
+
+        return subset[key] if subset.is_a?(Hash) && !subset[key].nil? && subset[key] != ''
+
+        begin
+          args.dig(:params, key)
+        rescue StandardError
+          nil
+        end
+      end
+
       def self.parse_search(collection, args)
-        search = args.dig(:params, :data, :attributes, :all_records_subset_query, :search) || args.dig(:params, :search)
+        search = subset_or_query(args, :search)
+
+        return nil if search.nil?
 
-        raise BadRequestError, 'Collection is not searchable' if search && !collection.is_searchable?
+        raise BadRequestError, 'Collection is not searchable' unless collection.is_searchable?
 
-        search
+        unless search.is_a?(String) || search.is_a?(Numeric)
+          raise BadRequestError, 'Search must be a string or a number'
+        end
+
+        search.to_s
       end
 
       def self.parse_search_extended(args)
-        extended = args.dig(:params, :data, :attributes, :all_records_subset_query,
-                            :searchExtended) || args.dig(:params, :searchExtended)
-
-        return false if extended.nil?
+        extended = subset_or_query(args, :searchExtended)
 
-        extended != '0'
+        !FALSY_SEARCH_EXTENDED.include?(extended.is_a?(String) ? extended.downcase : extended)
       end
 
       def self.parse_sort(collection, args)

data/lib/forest_admin_agent/utils/schema/schema_emitter.rb

@@ -6,7 +6,7 @@ module ForestAdminAgent
     module Schema
       class SchemaEmitter
         LIANA_NAME = "agent-ruby"
-        LIANA_VERSION = "1.41.0"
+        LIANA_VERSION = "1.42.0"
 
         def self.generate(datasource)
           datasource.collections

data/lib/forest_admin_agent/version.rb

@@ -1,3 +1,3 @@
 module ForestAdminAgent
-  VERSION = "1.41.0"
+  VERSION = "1.42.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: forest_admin_agent
 version: !ruby/object:Gem::Version
-  version: 1.41.0
+  version: 1.42.0
 platform: ruby
 authors:
 - Matthieu
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-09-01 00:00:00.000000000 Z
+date: 2026-09-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport