forest_admin_agent 1.42.0 → 1.43.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2efec0ce2de78876bbab2962c838ee712dc576c6133e6b705f6f4c9d62ea998b
-  data.tar.gz: 557af82363e33d90b02952742832f4cdd3e2283610a4850ce3252eef12f6f3ca
+  metadata.gz: 2646404b27c4b7c45446b93b09ea1b9f488e26b66760599122950fae26982027
+  data.tar.gz: a61f1f277ddaf461a4629727fb0958f0bd6290eb1e83cd62658d23ceb65de08c
 SHA512:
-  metadata.gz: 0dcfa322e26c5fb8c0e65865abf8d5f5ab4cd9a7f3c5e5abe6d86c5b8ffc6149f16ea609417fb3c9ce421b46f81157cb408078e18aced4b6336cb474d0a70a05
-  data.tar.gz: 350b111bf50db137f596d884d4fceab32fbab20ee9858846d0342b360b731d157a37a9ecd59878483672f9c1411a683302ccac3cf76428714786e2bede72b319
+  metadata.gz: 8b357902be6f9a8cfdd0ce5b74695911dd6d31cb7613c3e4bc93658a17691a6c8c7d02744271b15ecebf576e72bdb04c25836eef5ef45d9c234da4df97316d5c
+  data.tar.gz: d129a77b8b1b9fd9e2b96c1bcdb87b45f295062b3cdcab28be6b3975629ad5c3597fcdf4626bae67c2563d8975469129e01512460245900700131e2f05c6fbc0

data/lib/forest_admin_agent/builder/agent_factory.rb

@@ -27,6 +27,7 @@ module ForestAdminAgent
         build_container
         build_cache
         build_logger
+        warn_relation_read_permissions_skipped
       end
 
       def add_datasource(datasource, options = {})
@@ -341,6 +342,19 @@ module ForestAdminAgent
         Facades::Container.cache(:skip_schema_update) == true
       end
 
+      # An auditor reading the boot log should see the weakened posture without reading the config.
+      # Read from the options `setup` was handed: `Facades::Container` resolves against
+      # `AgentFactory.instance`, which a host subclassing this factory has not populated.
+      def warn_relation_read_permissions_skipped
+        return unless @options.to_h[:skip_relation_read_permissions] == true
+
+        @logger.log(
+          'Warn',
+          '[ForestAdmin] skip_relation_read_permissions is true: columns of collections the caller ' \
+          'has no read permission on are served when a relation path reaches them'
+        )
+      end
+
       def log_schema_skip
         @logger.log('Warn', '[ForestAdmin] Schema update skipped (skip_schema_update flag is true)')
         environment = Facades::Container.cache(:is_production) ? 'production' : 'development'

data/lib/forest_admin_agent/routes/capabilities/collections.rb

@@ -68,7 +68,8 @@ module ForestAdminAgent
                 canUseProjectionViaHeader: true,
                 canUseProjectionViaHeaderOnList: true,
                 canUseMultipleFieldsProjectionOnRelation: true,
-                canUseAuditTrail: audit_trail_enabled?
+                canUseAuditTrail: audit_trail_enabled?,
+                checksRelationReadPermissions: !skip_relation_read_permissions?
               }
             },
             status: 200
@@ -83,6 +84,10 @@ module ForestAdminAgent
         def audit_trail_enabled?
           !::ForestAdminAgent::AuditTrail.store.nil?
         end
+
+        def skip_relation_read_permissions?
+          ForestAdminAgent::Facades::Container.config_from_cache[:skip_relation_read_permissions] == true
+        end
       end
     end
   end

data/lib/forest_admin_agent/routes/charts/charts.rb

@@ -55,6 +55,10 @@ module ForestAdminAgent
           field.nil? || field.to_s.empty? ? nil : field
         end
 
+        def skip_relation_read_permissions?
+          ForestAdminAgent::Facades::Container.config_from_cache[:skip_relation_read_permissions] == true
+        end
+
         def validate_and_get_type(type)
           chart_types = %w[Value Objective Pie Line Leaderboard]
           unless chart_types.include?(type)
@@ -202,8 +206,9 @@ module ForestAdminAgent
             )
 
             # A count exposes the cardinality of the relation, which `/relationships/<name>/count`
-            # puts behind `browse`. No path names it, so nothing above sees it.
-            if aggregation.field.nil?
+            # puts behind `browse`. No path names it, so nothing above sees it. It arrived with the
+            # related-read checks, so it goes away with them.
+            if aggregation.field.nil? && !skip_relation_read_permissions?
               context.permissions.can?(:browse, context.datasource.get_collection(field.foreign_collection))
             end
 

data/lib/forest_admin_agent/services/permissions.rb

@@ -66,7 +66,10 @@ module ForestAdminAgent
 
         # An absent permission system is not a denial: `can?` allows everything there, and answering
         # anything else would redact every relation on a deployment that granted nothing to check.
-        return allowed.merge(to_check.to_h { |name| [name, true] }) unless permission_system?
+        # `skip_relation_read_permissions` is the operator asking for that same answer on purpose.
+        if skip_relation_read_permissions? || !permission_system?
+          return allowed.merge(to_check.to_h { |name| [name, true] })
+        end
 
         @read_permissions ||= {}
         missing = to_check - @read_permissions.keys
@@ -273,6 +276,10 @@ module ForestAdminAgent
         names.any? && names.all? { |name| allowed[name] }
       end
 
+      def skip_relation_read_permissions?
+        Facades::Container.config_from_cache[:skip_relation_read_permissions] == true
+      end
+
       def leaf_label(names)
         names.empty? ? 'an unresolved polymorphic relation' : "the '#{names.join("' or '")}' collection"
       end
@@ -356,6 +363,8 @@ module ForestAdminAgent
         return unless search_extended
         return unless describes_own_search?(collection)
         return unless permission_system?
+        # Refused ahead of `read_permissions`, so the skip has to be read here as well.
+        return if skip_relation_read_permissions?
 
         raise ForbiddenError,
               "You cannot run an extended search on the '#{collection.name}' collection: the fields " \

data/lib/forest_admin_agent/utils/schema/schema_emitter.rb

@@ -6,7 +6,7 @@ module ForestAdminAgent
     module Schema
       class SchemaEmitter
         LIANA_NAME = "agent-ruby"
-        LIANA_VERSION = "1.42.0"
+        LIANA_VERSION = "1.43.0"
 
         def self.generate(datasource)
           datasource.collections

data/lib/forest_admin_agent/version.rb

@@ -1,3 +1,3 @@
 module ForestAdminAgent
-  VERSION = "1.42.0"
+  VERSION = "1.43.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: forest_admin_agent
 version: !ruby/object:Gem::Version
-  version: 1.42.0
+  version: 1.43.0
 platform: ruby
 authors:
 - Matthieu
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-09-02 00:00:00.000000000 Z
+date: 2026-09-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport