forest_admin_agent 1.45.0 → 1.45.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b82038f1c254bc91295ded423735b4f481a3c0b997d4c246d606396ad476acec
-  data.tar.gz: 8bae29e2cbb6d1af5b9ebf4228a918eaace4b5489e26aa1ba7a098856da3bb38
+  metadata.gz: b3d274612ae79795715d531ee72fce9566b2f6bc0ca79fd2f60538498f8cef8e
+  data.tar.gz: 54daad3999b1ff2bdcef2257c9638dd2896c160083f852f6e4501cef3288d478
 SHA512:
-  metadata.gz: 336ea0d4c27df5a65ed30f6d5e64fd2a4645ae229a9fb874ea21b2c5501cef641c3a18bd91736cb52ed3b0b085dffbe9aa2f17f59471efcf62ab0fcd3ca3dfb4
-  data.tar.gz: 637d76398dc40a32ec459bb3ae3bdd783c82665a272988185efa1229823639f2cc64b564dbc7be6f1248f31a39f23af241d29bf636d1f48c4b0a7e0306826a55
+  metadata.gz: c585bcad5f56d230eeb0dfd382c0a5543bf0a01b97bfee5499ae70e8533055f17b1b1093156ea18daf53ef06fa6daf57c953107da0da94a6461cde8620173f13
+  data.tar.gz: 361983398aa5072601e09aea9ddaf75209a9582edc1b28291be9aa144a4c85f512394ea4ef1e40d3449cdb97c39d798ba8564625ee44b7403a1bf99f94218c2d

data/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2023-2026 Forest Admin
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

data/forest_admin_agent.gemspec

@@ -12,7 +12,7 @@ Gem::Specification.new do |spec|
   spec.summary      = "Ruby agent for Forest Admin."
   spec.description  = "Forest is a modern admin interface that works on all major web frameworks. This gem makes Forest
 admin work on any Ruby application."
-  spec.license = "GPL-3.0"
+  spec.license = "Apache-2.0"
   spec.required_ruby_version = ">= 3.0.0"
 
   spec.metadata["homepage_uri"] = spec.homepage
@@ -25,7 +25,7 @@ admin work on any Ruby application."
   spec.files = Dir.chdir(__dir__) do
     `git ls-files -z`.split("\x0").reject do |f|
       (File.expand_path(f) == __FILE__) ||
-        f.start_with?(*%w[bin/ test/ spec/ .git Gemfile LICENSE])
+        f.start_with?(*%w[bin/ test/ spec/ .git Gemfile])
     end
   end
 

data/lib/forest_admin_agent/auth/oidc_client_manager.rb

@@ -1,4 +1,3 @@
-require 'filecache'
 require 'openid_connect'
 require_relative 'oauth2/oidc_config'
 require_relative 'oauth2/forest_provider'
@@ -25,7 +24,7 @@ module ForestAdminAgent
       private
 
       def setup_cache(env_secret, config_agent)
-        cache = FileCache.new('auth_issuer', (config_agent[:cache_dir]).to_s, TTL)
+        cache = ForestAdminAgent::Utils::SafeFileCache.new('auth_issuer', (config_agent[:cache_dir]).to_s, TTL)
         cache.get_or_set env_secret do
           oidc_config = retrieve_config(config_agent[:forest_server_url])
           credentials = register(

data/lib/forest_admin_agent/routes/action/actions.rb

@@ -48,11 +48,11 @@ module ForestAdminAgent
 
         def handle_request(args = {})
           context = build(args)
+          ensure_served_action(context)
           args = middleware_custom_action_approval_request_data(args)
           filter_for_caller = get_record_selection(args, context)
-          get_record_selection(args, context, include_user_scope: false)
 
-          context.permissions.can_smart_action?(args, context.collection, filter_for_caller)
+          context.permissions.can_smart_action?(args, context.collection, filter_for_caller, action_name: @action_name)
 
           raw_data = args.dig(:params, :data, :attributes, :values)
 
@@ -82,6 +82,7 @@ module ForestAdminAgent
 
         def handle_hook_request(args = {})
           context = build(args)
+          ensure_served_action(context)
           forest_fields = args.dig(:params, :data, :attributes, :fields)
           data = (if forest_fields
                     Schema::ForestValueConverter.make_form_data_from_fields(context.datasource,
@@ -117,6 +118,14 @@ module ForestAdminAgent
 
         private
 
+        def ensure_served_action(context)
+          served_index = @route_collection.schema[:actions].keys.index(@action_name)
+          return if context.collection.schema[:actions].keys.index(@action_name) == served_index
+
+          raise ForestAdminAgent::Http::Exceptions::BadRequestError,
+                "The collection #{context.collection.name} does not have this smart action"
+        end
+
         # Recorded as pending before the action runs and confirmed after, so an action that takes the process
         # down with it still leaves evidence that it started. A failed run is worth recording too — "who tried
         # to run this" is usually the interesting part — and an action answering with an Error result failed
@@ -211,11 +220,11 @@ module ForestAdminAgent
           )[0])
         end
 
-        def get_record_selection(args, context, include_user_scope: true)
+        def get_record_selection(args, context)
           attributes = args.dig(:params, :data, :attributes)
 
           # Match user filter + search + scope? + segment
-          scope = include_user_scope ? context.permissions.get_scope(context.collection) : nil
+          scope = context.permissions.get_scope(context.collection)
           filter = Filter.new(
             condition_tree: ConditionTreeFactory.intersect(
               [

data/lib/forest_admin_agent/routes/resources/list.rb

@@ -61,13 +61,14 @@ module ForestAdminAgent
         def handle_search_decorator(search_value, records, collection)
           decorator = { decorators: [] }
           unless search_value.nil?
+            search_value = search_value.downcase
             records.each_with_index do |entry, index|
               decorator[:decorators][index] = { id: Utils::Id.pack_id(collection, entry), search: [] }
               # attributes method is defined on ActiveRecord::Base model
               attributes = entry.respond_to?(:attributes) ? entry.attributes : entry
 
               attributes.each do |field_key, field_value|
-                if !field_value.is_a?(Array) && field_value.to_s.downcase.include?(search_value.downcase)
+                if !field_value.is_a?(Array) && field_value.to_s.downcase.include?(search_value)
                   decorator[:decorators][index][:search] << field_key
                 end
               end

data/lib/forest_admin_agent/routes/security/scope_invalidation.rb

@@ -18,7 +18,8 @@ module ForestAdminAgent
 
         def handle_request(args)
           build(args)
-          Permissions.invalidate_cache('forest.rendering')
+          rendering_id = args.dig(:params, 'renderingId')
+          Permissions.invalidate_rendering_cache(rendering_id.to_s.strip.empty? ? nil : rendering_id)
 
           { content: nil, status: 204 }
         end

data/lib/forest_admin_agent/serializer/forest_serializer.rb

@@ -5,9 +5,8 @@ module ForestAdminAgent
     class ForestSerializer
       include JSONAPI::Serializer
 
-      attr_accessor :attributes_map
-      attr_accessor :to_one_associations
-      attr_accessor :to_many_associations
+      TO_ONE_TYPES = %w[OneToOne ManyToOne PolymorphicManyToOne PolymorphicOneToOne].freeze
+      TO_MANY_TYPES = %w[OneToMany ManyToMany PolymorphicOneToMany].freeze
 
       JSONAPI::Serializer.send(:include, ForestSerializerOverride)
 
@@ -26,6 +25,50 @@ module ForestAdminAgent
 
       def self.reset_cache!
         @@primary_keys = {}
+        @@layouts = {}.compare_by_identity
+      end
+
+      # Keyed by the collection object, not its name: two datasources can expose a collection under
+      # the same name, and the decorator stack returns the same object for a name once built.
+      def self.layout_for(collection)
+        @@layouts ||= {}.compare_by_identity
+        @@layouts[collection] ||= build_layout(collection)
+      end
+
+      def self.build_layout(collection)
+        fields = collection.schema[:fields]
+        relation = lambda do |types|
+          fields.each_with_object({}) do |(name, field), layout|
+            next unless types.include?(field.type)
+
+            layout[name] = { attr_or_block: name, options: { include_links: true, include_data: false }.freeze }.freeze
+          end.freeze
+        end
+
+        {
+          fields: fields,
+          attributes: fields.each_with_object({}) do |(name, field), layout|
+            layout[name] = { attr_or_block: name, options: {}.freeze }.freeze if field.type == 'Column'
+          end.freeze,
+          to_one: relation.call(TO_ONE_TYPES),
+          to_many: relation.call(TO_MANY_TYPES)
+        }.freeze
+      end
+
+      def layout
+        @layout ||= self.class.layout_for(ForestAdminAgent::Facades::Container.datasource.get_collection(type))
+      end
+
+      def attributes_map
+        layout[:attributes]
+      end
+
+      def to_one_associations
+        layout[:to_one]
+      end
+
+      def to_many_associations
+        layout[:to_many]
       end
 
       def id
@@ -40,25 +83,7 @@ module ForestAdminAgent
         attribute_name.to_s
       end
 
-      def add_attribute(name, options = {}, &block)
-        @attributes_map ||= {}
-        @attributes_map[name] = format_field(name, options)
-      end
-
-      def format_field(name, options)
-        {
-          attr_or_block: block_given? ? block : name,
-          options: options,
-        }
-      end
-
       def attributes
-        forest_collection = ForestAdminAgent::Facades::Container.datasource.get_collection(
-          @options[:class_name].gsub('::', '__')
-        )
-        fields = forest_collection.schema[:fields].select { |_field_name, field| field.type == 'Column' }
-        fields.each { |field_name, _field| add_attribute(field_name) }
-        return {} if attributes_map.nil?
         attributes = {}
 
         attributes_map.each do |attribute_name, attr_data|
@@ -86,22 +111,13 @@ module ForestAdminAgent
         end
       end
 
-      def add_to_one_association(name, options = {}, &block)
-        options[:include_links] = options.fetch(:include_links, true)
-        options[:include_data] = options.fetch(:include_data, false)
-        @to_one_associations ||= {}
-        @to_one_associations[name] = format_field(name, options)
-      end
-
       # A PolymorphicManyToOne can't be SQL-joined, so list projections return a phantom object with no
       # primary key. Rebuild the id from the foreign key on the owner record.
       def has_one_relationship(attribute_name, attr_data)
         object = super
         return object if object.nil? # relation not projected (e.g. update/store responses)
 
-        field = ForestAdminAgent::Facades::Container.datasource
-                                                    .get_collection(@options[:class_name].gsub('::', '__'))
-                                                    .schema[:fields][attribute_name.to_s]
+        field = layout[:fields][attribute_name.to_s]
         return object unless field&.type == 'PolymorphicManyToOne'
 
         foreign_key = @object[field.foreign_key]
@@ -115,9 +131,8 @@ module ForestAdminAgent
       end
 
       def has_one_relationships
-        return {} if @to_one_associations.nil?
         data = {}
-        @to_one_associations.each do |attribute_name, attr_data|
+        to_one_associations.each do |attribute_name, attr_data|
           next if !should_include_attr?(attribute_name, attr_data)
           data[attribute_name.to_sym] = attr_data
         end
@@ -125,34 +140,16 @@ module ForestAdminAgent
       end
 
       def has_many_relationships
-        return {} if @to_many_associations.nil?
         data = {}
-        @to_many_associations.each do |attribute_name, attr_data|
+        to_many_associations.each do |attribute_name, attr_data|
           next if !should_include_attr?(attribute_name, attr_data)
           data[attribute_name.to_sym] = attr_data
         end
         data
       end
 
-      def add_to_many_association(name, options = {}, &block)
-        options[:include_links] = options.fetch(:include_links, true)
-        options[:include_data] = options.fetch(:include_data, false)
-        @to_many_associations ||= {}
-        @to_many_associations[name] = format_field(name, options)
-      end
-
       def relationships
         datasource = ForestAdminAgent::Facades::Container.datasource
-        forest_collection = datasource.get_collection(@options[:class_name].gsub('::', '__'))
-        relations_to_many = forest_collection.schema[:fields].select do |_field_name, field|
-          %w[OneToMany ManyToMany PolymorphicOneToMany].include?(field.type)
-        end
-        relations_to_one = forest_collection.schema[:fields].select do |_field_name, field|
-          %w[OneToOne ManyToOne PolymorphicManyToOne PolymorphicOneToOne].include?(field.type)
-        end
-
-        relations_to_one.each { |field_name, _field| add_to_one_association(field_name) }
-
         data = {}
         has_one_relationships.each do |attribute_name, attr_data|
           formatted_attribute_name = format_name(attribute_name)
@@ -170,8 +167,7 @@ module ForestAdminAgent
           # Only include 'data' key if the relationship object exists
           # Omit 'data' key entirely when null instead of setting it to null
           unless object.nil? || (object.respond_to?(:empty?) && object.empty?)
-            relation = datasource.get_collection(@options[:class_name].gsub('::', '__'))
-                                 .schema[:fields][attribute_name.to_s]
+            relation = layout[:fields][attribute_name.to_s]
             options = @options.clone
             if relation.type == 'PolymorphicManyToOne'
               options[:class_name] = @object[relation.foreign_key_type_field]
@@ -191,8 +187,6 @@ module ForestAdminAgent
           end
         end
 
-        relations_to_many.each { |field_name, _field| add_to_many_association(field_name) }
-
         has_many_relationships.each do |attribute_name, attr_data|
           formatted_attribute_name = format_name(attribute_name)
           data[formatted_attribute_name] = {}
@@ -208,7 +202,7 @@ module ForestAdminAgent
           if @_include_linkages.include?(formatted_attribute_name) || attr_data[:options][:include_data]
             data[formatted_attribute_name]['data'] = []
             objects = has_many_relationship(attribute_name, attr_data) || []
-            relation = datasource.get_collection(@options[:class_name].gsub('::', '__')).schema[:fields][attribute_name.to_s]
+            relation = layout[:fields][attribute_name.to_s]
             options = @options.clone
             options[:class_name] = datasource.get_collection(relation.foreign_collection).name
             objects.each do |obj|

data/lib/forest_admin_agent/serializer/forest_serializer_override.rb

@@ -17,7 +17,6 @@ module ForestAdminAgent
               next if attribute_name == :_include
 
               serializer = JSONAPI::Serializer.find_serializer(root_object, options)
-              serializer.relationships
               unformatted_attr_name = serializer.unformat_name(attribute_name).to_sym
 
               # We know the name of this relationship, but we don't know where it is stored internally.
@@ -55,9 +54,7 @@ module ForestAdminAgent
               # in the response.
               objects = is_collection ? object : [object]
 
-              relation = ForestAdminAgent::Facades::Container.datasource
-                                                             .get_collection(options[:class_name].gsub('::', '__'))
-                                                             .schema[:fields][attribute_name]
+              relation = serializer.layout[:fields][attribute_name]
               if relation.type == 'PolymorphicManyToOne'
                 relation_class_name = root_object[relation.foreign_key_type_field]
               else

data/lib/forest_admin_agent/services/ip_whitelist.rb

@@ -1,5 +1,4 @@
 require 'ipaddress'
-require 'filecache'
 require 'json'
 
 module ForestAdminAgent
@@ -14,7 +13,11 @@ module ForestAdminAgent
 
       def initialize
         @forest_api = ForestAdminAgent::Http::ForestAdminApiRequester.new
-        @cache = FileCache.new(
+        @cache = self.class.build_cache
+      end
+
+      def self.build_cache
+        ForestAdminAgent::Utils::SafeFileCache.new(
           'ip_whitelist',
           Facades::Container.config_from_cache[:cache_dir].to_s,
           Facades::Container.config_from_cache[:permission_expiration]
@@ -22,12 +25,7 @@ module ForestAdminAgent
       end
 
       def self.invalidate_cache
-        cache = FileCache.new(
-          'ip_whitelist',
-          Facades::Container.config_from_cache[:cache_dir].to_s,
-          Facades::Container.config_from_cache[:permission_expiration]
-        )
-        cache.delete(CACHE_KEY) unless cache.get(CACHE_KEY).nil?
+        build_cache.delete(CACHE_KEY)
       end
 
       def use_ip_whitelist

data/lib/forest_admin_agent/services/permissions.rb

@@ -1,4 +1,3 @@
-require 'filecache'
 require 'deepsort'
 
 module ForestAdminAgent
@@ -10,6 +9,9 @@ module ForestAdminAgent
       include ForestAdminDatasourceToolkit::Components::Query::ConditionTree
 
       USERS_RELOAD_INTERVAL_IN_SECONDS = 60
+      # Renderings live in their own domain because FileCache cannot delete by key prefix: clearing
+      # the domain is the only way to drop every rendering when the server does not say which one.
+      RENDERINGS_CACHE_DOMAIN = 'permissions-renderings'.freeze
 
       @users_reload_mutex = Mutex.new
 
@@ -18,30 +20,49 @@ module ForestAdminAgent
       def initialize(caller)
         @caller = caller
         @forest_api = ForestAdminAgent::Http::ForestAdminApiRequester.new
-        @cache = FileCache.new(
-          'permissions',
+        @cache = self.class.build_cache('permissions')
+        @memo = {}
+      end
+
+      def rendering_cache
+        @rendering_cache ||= self.class.build_cache(RENDERINGS_CACHE_DOMAIN)
+      end
+
+      def self.build_cache(domain)
+        ForestAdminAgent::Utils::SafeFileCache.new(
+          domain,
           Facades::Container.config_from_cache[:cache_dir].to_s,
           Facades::Container.config_from_cache[:permission_expiration]
         )
       end
 
       def self.invalidate_cache(id_cache = nil)
-        cache = FileCache.new(
-          'permissions',
-          Facades::Container.config_from_cache[:cache_dir].to_s,
-          Facades::Container.config_from_cache[:permission_expiration]
-        )
+        cache = build_cache('permissions')
 
         if id_cache.nil?
           cache.clear
+          build_cache(RENDERINGS_CACHE_DOMAIN).clear
           @users_reload_mutex.synchronize { @users_reloaded_at = nil }
         end
 
-        cache.delete(id_cache) unless cache.get(id_cache).nil?
+        cache.delete(id_cache)
 
         ForestAdminAgent::Facades::Container.logger.log('Info', "Invalidating #{id_cache} cache..")
       end
 
+      def self.invalidate_rendering_cache(rendering_id = nil)
+        cache = build_cache(RENDERINGS_CACHE_DOMAIN)
+
+        if rendering_id.nil?
+          cache.clear
+        else
+          cache.delete(rendering_id.to_s)
+        end
+
+        target = rendering_id.nil? ? 'every rendering' : "rendering #{rendering_id}"
+        ForestAdminAgent::Facades::Container.logger.log('Info', "Invalidating #{target} permissions cache..")
+      end
+
       def self.users_reload_allowed?
         @users_reload_mutex.synchronize do
           now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
@@ -210,20 +231,19 @@ module ForestAdminAgent
         is_allowed
       end
 
-      def can_smart_action?(request, collection, filter, allow_fetch: true)
+      def can_smart_action?(request, collection, filter, action_name:, allow_fetch: true)
         return true unless permission_system?
 
         user_data = get_user_data(caller.id)
         collections_data = get_collections_permissions_data(force_fetch: allow_fetch)
-        action = find_action_from_endpoint(collection.name, request[:headers]['REQUEST_PATH'], request[:headers]['REQUEST_METHOD'])
 
-        collection_actions = validate_smart_action_permissions(collections_data, collection, action)
+        collection_actions = validate_smart_action_permissions(collections_data, collection, action_name)
 
         smart_action_approval = SmartActionChecker.new(
           request[:params],
           collection,
           # The schema scope lets the checker skip select-all resolution for global actions.
-          collection_actions[action['name'].to_sym].merge(scope: collection.schema[:actions][action['name']]&.scope),
+          collection_actions[action_name.to_sym].merge(scope: collection.schema[:actions][action_name]&.scope),
           caller,
           user_data[:roleId],
           filter
@@ -232,7 +252,7 @@ module ForestAdminAgent
         is_allowed = smart_action_approval.can_execute?
         ForestAdminAgent::Facades::Container.logger.log(
           'Debug',
-          "User #{user_data[:roleId]} is #{"not" unless is_allowed} allowed to perform #{action["name"]}"
+          "User #{user_data[:roleId]} is #{"not" unless is_allowed} allowed to perform #{action_name}"
         )
 
         is_allowed
@@ -279,8 +299,16 @@ module ForestAdminAgent
 
       private
 
+      def cached(store, key, &fetch)
+        @memo.fetch([store, key]) { @memo[[store, key]] = store.get_or_set(key, &fetch) }
+      end
+
+      def forget(store, key)
+        @memo.delete([store, key])
+      end
+
       def cached_users
-        cache.get_or_set('forest.users') do
+        cached(cache, 'forest.users') do
           response = fetch('/liana/v4/permissions/users')
           users = {}
 
@@ -295,9 +323,8 @@ module ForestAdminAgent
       end
 
       def reload_users
-        return cached_users unless self.class.users_reload_allowed?
-
-        self.class.invalidate_cache('forest.users')
+        self.class.invalidate_cache('forest.users') if self.class.users_reload_allowed?
+        forget(cache, 'forest.users')
         cached_users
       end
 
@@ -442,9 +469,12 @@ module ForestAdminAgent
       end
 
       def get_collections_permissions_data(force_fetch: false)
-        self.class.invalidate_cache('forest.collections') if force_fetch == true
+        if force_fetch == true
+          self.class.invalidate_cache('forest.collections')
+          forget(cache, 'forest.collections')
+        end
 
-        cache.get_or_set('forest.collections') do
+        cached(cache, 'forest.collections') do
           response = fetch('/liana/v4/permissions/environment')
           collections = {}
 
@@ -484,9 +514,12 @@ module ForestAdminAgent
       end
 
       def get_rendering_data(rendering_id, force_fetch: false)
-        self.class.invalidate_cache('forest.rendering') if force_fetch == true
+        if force_fetch == true
+          self.class.invalidate_rendering_cache(rendering_id)
+          forget(rendering_cache, rendering_id.to_s)
+        end
 
-        cache.get_or_set('forest.rendering') do
+        cached(rendering_cache, rendering_id.to_s) do
           data = {}
           response = fetch("/liana/v4/permissions/renderings/#{rendering_id}")
 
@@ -501,26 +534,12 @@ module ForestAdminAgent
       end
 
       def permission_system?
-        cache.get_or_set('forest.has_permission') do
+        cached(cache, 'forest.has_permission') do
           response = fetch('/liana/v4/permissions/environment')
           { enable: response != true }
         end[:enable]
       end
 
-      def find_action_from_endpoint(collection_name, path, http_method)
-        endpoint = path.partition('/forest/')[1..].join
-        schema_file = JSON.parse(File.read(Facades::Container.config_from_cache[:schema_path]))
-        actions = schema_file['collections']&.find { |collection| collection['name'] == collection_name }&.dig('actions')
-
-        return nil if actions.nil? || actions.empty?
-
-        action = actions.find { |a| a['endpoint'] == endpoint && a['httpMethod'].casecmp(http_method).zero? }
-
-        raise BadRequestError, "The collection #{collection_name} does not have this smart action" if action.nil?
-
-        action
-      end
-
       def decode_crud_permissions(collection)
         unless collection.is_a?(Hash) && collection.key?(:collection)
           ForestAdminAgent::Facades::Container.logger.log(
@@ -693,7 +712,7 @@ module ForestAdminAgent
         has_permission
       end
 
-      def validate_smart_action_permissions(collections_data, collection, action)
+      def validate_smart_action_permissions(collections_data, collection, action_name)
         collection_key = collection.name.to_sym
 
         unless collections_data.key?(collection_key)
@@ -713,13 +732,13 @@ module ForestAdminAgent
           raise ForbiddenError, "No actions configured for collection '#{collection.name}'"
         end
 
-        action_key = action['name'].to_sym
+        action_key = action_name.to_sym
         unless collection_actions.key?(action_key)
           ForestAdminAgent::Facades::Container.logger.log(
             'Warn',
-            "Smart action '#{action["name"]}' not found in permissions for collection '#{collection.name}'"
+            "Smart action '#{action_name}' not found in permissions for collection '#{collection.name}'"
           )
-          raise ForbiddenError, "Smart action '#{action["name"]}' is not configured"
+          raise ForbiddenError, "Smart action '#{action_name}' is not configured"
         end
 
         collection_actions

data/lib/forest_admin_agent/services/sse_cache_invalidation.rb

@@ -9,7 +9,7 @@ module ForestAdminAgent
       MESSAGE_CACHE_KEYS = {
         'refresh-users': %w[forest.users],
         'refresh-roles': %w[forest.collections],
-        'refresh-renderings': %w[forest.collections forest.rendering]
+        'refresh-renderings': %w[forest.collections]
         # TODO: add one for ip whitelist when server implement it
       }.freeze
 
@@ -32,6 +32,7 @@ module ForestAdminAgent
                   "invalidate cache #{MESSAGE_CACHE_KEYS[event.type]} for event #{event.type}"
                 )
               end
+              invalidate_renderings(event.data) if event.type == :'refresh-renderings'
 
               ForestAdminAgent::Facades::Container.logger.log(
                 'Info',
@@ -57,6 +58,23 @@ module ForestAdminAgent
           )
         end
       end
+
+      # An event that does not name its renderings could concern any of them, so all are dropped.
+      def self.invalidate_renderings(data)
+        rendering_ids = begin
+          parsed = JSON.parse(data.to_s)
+          parsed['renderingIds'] if parsed.is_a?(Hash)
+        rescue JSON::ParserError
+          nil
+        end
+
+        if rendering_ids.is_a?(Array) && rendering_ids.any?
+          rendering_ids.each { |rendering_id| Permissions.invalidate_rendering_cache(rendering_id) }
+        else
+          Permissions.invalidate_rendering_cache
+        end
+      end
+      private_class_method :invalidate_renderings
     end
   end
 end

data/lib/forest_admin_agent/utils/safe_file_cache.rb

@@ -0,0 +1,52 @@
+require 'filecache'
+require 'securerandom'
+
+module ForestAdminAgent
+  module Utils
+    # Same on-disk layout as FileCache, so processes running either version share one cache.
+    class SafeFileCache < FileCache
+      def get(key)
+        path = path_for(key)
+        return nil if expired?(path)
+
+        File.open(path, 'rb') { |file| Marshal.load(file) } # rubocop:disable Security/MarshalLoad
+      rescue Errno::ENOENT, ArgumentError, TypeError, EOFError
+        nil
+      end
+
+      def set(key, value)
+        path = path_for(key)
+        FileUtils.mkdir_p(File.dirname(path))
+        temp_path = File.join(File.dirname(path), ".#{File.basename(path)}.#{Process.pid}.#{SecureRandom.hex(4)}")
+
+        File.open(temp_path, 'wb') { |file| Marshal.dump(value, file) }
+        File.rename(temp_path, path)
+      rescue Errno::ENOENT
+        nil
+      ensure
+        FileUtils.rm_f(temp_path) if temp_path
+      end
+
+      def delete(key)
+        FileUtils.rm_f(path_for(key))
+      end
+
+      def clear
+        FileUtils.rm_rf(get_root)
+        FileUtils.mkdir_p(get_root)
+      end
+
+      private
+
+      def path_for(key)
+        md5 = Digest::MD5.hexdigest(key.to_s)
+
+        File.join(get_root, *md5[0...@depth].chars, md5)
+      end
+
+      def expired?(path)
+        @expiry.positive? && Time.now - File.mtime(path) >= @expiry
+      end
+    end
+  end
+end

data/lib/forest_admin_agent/utils/schema/schema_emitter.rb

@@ -6,7 +6,7 @@ module ForestAdminAgent
     module Schema
       class SchemaEmitter
         LIANA_NAME = "agent-ruby"
-        LIANA_VERSION = "1.45.0"
+        LIANA_VERSION = "1.45.2"
 
         def self.generate(datasource)
           datasource.collections

data/lib/forest_admin_agent/version.rb

@@ -1,3 +1,3 @@
 module ForestAdminAgent
-  VERSION = "1.45.0"
+  VERSION = "1.45.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: forest_admin_agent
 version: !ruby/object:Gem::Version
-  version: 1.45.0
+  version: 1.45.2
 platform: ruby
 authors:
 - Matthieu
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-10-07 00:00:00.000000000 Z
+date: 2026-10-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -331,6 +331,7 @@ extra_rdoc_files: []
 files:
 - ".rspec"
 - AUDIT_TRAIL.md
+- LICENSE
 - Rakefile
 - forest_admin
 - forest_admin_agent.gemspec
@@ -418,6 +419,7 @@ files:
 - lib/forest_admin_agent/utils/is_segment_query_allowed_on_connection.rb
 - lib/forest_admin_agent/utils/query_string_parser.rb
 - lib/forest_admin_agent/utils/query_validator.rb
+- lib/forest_admin_agent/utils/safe_file_cache.rb
 - lib/forest_admin_agent/utils/schema/action_fields.rb
 - lib/forest_admin_agent/utils/schema/forest_value_converter.rb
 - lib/forest_admin_agent/utils/schema/frontend_filterable.rb
@@ -440,7 +442,7 @@ files:
 - sig/forest_admin_agent/routes/system/health_check.rbs
 homepage: https://www.forestadmin.com
 licenses:
-- GPL-3.0
+- Apache-2.0
 metadata:
   homepage_uri: https://www.forestadmin.com
   source_code_uri: https://github.com/ForestAdmin/agent-ruby