forest_admin_agent 1.45.1 → 1.45.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2757eb5bbc5c7a2bd1c7dc0a554460a9b75954a7bccd427589a291c78c8f3bcc
-  data.tar.gz: 333ee405b76b63bd287f66f04cab2e7a34792fed14c4ce0e55af4d920b3c9df6
+  metadata.gz: b3d274612ae79795715d531ee72fce9566b2f6bc0ca79fd2f60538498f8cef8e
+  data.tar.gz: 54daad3999b1ff2bdcef2257c9638dd2896c160083f852f6e4501cef3288d478
 SHA512:
-  metadata.gz: 578b2cafdbc0f60732f3af1e7f3e4457883d6e2b8a5838a6fe419ebe505353268646adf064a071658e223a7119a1e654db762b2cec88183e4fe2ae0a4fca0e01
-  data.tar.gz: 77deb1e0711c2534132aef6c9316b0c0a518546339a0a3670922474ee3a2c92cd38847a7efbbe491c679db103778f27796f4e656fd977e7f88149d17414d4cde
+  metadata.gz: c585bcad5f56d230eeb0dfd382c0a5543bf0a01b97bfee5499ae70e8533055f17b1b1093156ea18daf53ef06fa6daf57c953107da0da94a6461cde8620173f13
+  data.tar.gz: 361983398aa5072601e09aea9ddaf75209a9582edc1b28291be9aa144a4c85f512394ea4ef1e40d3449cdb97c39d798ba8564625ee44b7403a1bf99f94218c2d

data/lib/forest_admin_agent/auth/oidc_client_manager.rb

@@ -1,4 +1,3 @@
-require 'filecache'
 require 'openid_connect'
 require_relative 'oauth2/oidc_config'
 require_relative 'oauth2/forest_provider'
@@ -25,7 +24,7 @@ module ForestAdminAgent
       private
 
       def setup_cache(env_secret, config_agent)
-        cache = FileCache.new('auth_issuer', (config_agent[:cache_dir]).to_s, TTL)
+        cache = ForestAdminAgent::Utils::SafeFileCache.new('auth_issuer', (config_agent[:cache_dir]).to_s, TTL)
         cache.get_or_set env_secret do
           oidc_config = retrieve_config(config_agent[:forest_server_url])
           credentials = register(

data/lib/forest_admin_agent/routes/action/actions.rb

@@ -48,11 +48,11 @@ module ForestAdminAgent
 
         def handle_request(args = {})
           context = build(args)
+          ensure_served_action(context)
           args = middleware_custom_action_approval_request_data(args)
           filter_for_caller = get_record_selection(args, context)
-          get_record_selection(args, context, include_user_scope: false)
 
-          context.permissions.can_smart_action?(args, context.collection, filter_for_caller)
+          context.permissions.can_smart_action?(args, context.collection, filter_for_caller, action_name: @action_name)
 
           raw_data = args.dig(:params, :data, :attributes, :values)
 
@@ -82,6 +82,7 @@ module ForestAdminAgent
 
         def handle_hook_request(args = {})
           context = build(args)
+          ensure_served_action(context)
           forest_fields = args.dig(:params, :data, :attributes, :fields)
           data = (if forest_fields
                     Schema::ForestValueConverter.make_form_data_from_fields(context.datasource,
@@ -117,6 +118,14 @@ module ForestAdminAgent
 
         private
 
+        def ensure_served_action(context)
+          served_index = @route_collection.schema[:actions].keys.index(@action_name)
+          return if context.collection.schema[:actions].keys.index(@action_name) == served_index
+
+          raise ForestAdminAgent::Http::Exceptions::BadRequestError,
+                "The collection #{context.collection.name} does not have this smart action"
+        end
+
         # Recorded as pending before the action runs and confirmed after, so an action that takes the process
         # down with it still leaves evidence that it started. A failed run is worth recording too — "who tried
         # to run this" is usually the interesting part — and an action answering with an Error result failed
@@ -211,11 +220,11 @@ module ForestAdminAgent
           )[0])
         end
 
-        def get_record_selection(args, context, include_user_scope: true)
+        def get_record_selection(args, context)
           attributes = args.dig(:params, :data, :attributes)
 
           # Match user filter + search + scope? + segment
-          scope = include_user_scope ? context.permissions.get_scope(context.collection) : nil
+          scope = context.permissions.get_scope(context.collection)
           filter = Filter.new(
             condition_tree: ConditionTreeFactory.intersect(
               [

data/lib/forest_admin_agent/routes/resources/list.rb

@@ -61,13 +61,14 @@ module ForestAdminAgent
         def handle_search_decorator(search_value, records, collection)
           decorator = { decorators: [] }
           unless search_value.nil?
+            search_value = search_value.downcase
             records.each_with_index do |entry, index|
               decorator[:decorators][index] = { id: Utils::Id.pack_id(collection, entry), search: [] }
               # attributes method is defined on ActiveRecord::Base model
               attributes = entry.respond_to?(:attributes) ? entry.attributes : entry
 
               attributes.each do |field_key, field_value|
-                if !field_value.is_a?(Array) && field_value.to_s.downcase.include?(search_value.downcase)
+                if !field_value.is_a?(Array) && field_value.to_s.downcase.include?(search_value)
                   decorator[:decorators][index][:search] << field_key
                 end
               end

data/lib/forest_admin_agent/routes/security/scope_invalidation.rb

@@ -18,7 +18,8 @@ module ForestAdminAgent
 
         def handle_request(args)
           build(args)
-          Permissions.invalidate_cache('forest.rendering')
+          rendering_id = args.dig(:params, 'renderingId')
+          Permissions.invalidate_rendering_cache(rendering_id.to_s.strip.empty? ? nil : rendering_id)
 
           { content: nil, status: 204 }
         end

data/lib/forest_admin_agent/serializer/forest_serializer.rb

@@ -5,9 +5,8 @@ module ForestAdminAgent
     class ForestSerializer
       include JSONAPI::Serializer
 
-      attr_accessor :attributes_map
-      attr_accessor :to_one_associations
-      attr_accessor :to_many_associations
+      TO_ONE_TYPES = %w[OneToOne ManyToOne PolymorphicManyToOne PolymorphicOneToOne].freeze
+      TO_MANY_TYPES = %w[OneToMany ManyToMany PolymorphicOneToMany].freeze
 
       JSONAPI::Serializer.send(:include, ForestSerializerOverride)
 
@@ -26,6 +25,50 @@ module ForestAdminAgent
 
       def self.reset_cache!
         @@primary_keys = {}
+        @@layouts = {}.compare_by_identity
+      end
+
+      # Keyed by the collection object, not its name: two datasources can expose a collection under
+      # the same name, and the decorator stack returns the same object for a name once built.
+      def self.layout_for(collection)
+        @@layouts ||= {}.compare_by_identity
+        @@layouts[collection] ||= build_layout(collection)
+      end
+
+      def self.build_layout(collection)
+        fields = collection.schema[:fields]
+        relation = lambda do |types|
+          fields.each_with_object({}) do |(name, field), layout|
+            next unless types.include?(field.type)
+
+            layout[name] = { attr_or_block: name, options: { include_links: true, include_data: false }.freeze }.freeze
+          end.freeze
+        end
+
+        {
+          fields: fields,
+          attributes: fields.each_with_object({}) do |(name, field), layout|
+            layout[name] = { attr_or_block: name, options: {}.freeze }.freeze if field.type == 'Column'
+          end.freeze,
+          to_one: relation.call(TO_ONE_TYPES),
+          to_many: relation.call(TO_MANY_TYPES)
+        }.freeze
+      end
+
+      def layout
+        @layout ||= self.class.layout_for(ForestAdminAgent::Facades::Container.datasource.get_collection(type))
+      end
+
+      def attributes_map
+        layout[:attributes]
+      end
+
+      def to_one_associations
+        layout[:to_one]
+      end
+
+      def to_many_associations
+        layout[:to_many]
       end
 
       def id
@@ -40,25 +83,7 @@ module ForestAdminAgent
         attribute_name.to_s
       end
 
-      def add_attribute(name, options = {}, &block)
-        @attributes_map ||= {}
-        @attributes_map[name] = format_field(name, options)
-      end
-
-      def format_field(name, options)
-        {
-          attr_or_block: block_given? ? block : name,
-          options: options,
-        }
-      end
-
       def attributes
-        forest_collection = ForestAdminAgent::Facades::Container.datasource.get_collection(
-          @options[:class_name].gsub('::', '__')
-        )
-        fields = forest_collection.schema[:fields].select { |_field_name, field| field.type == 'Column' }
-        fields.each { |field_name, _field| add_attribute(field_name) }
-        return {} if attributes_map.nil?
         attributes = {}
 
         attributes_map.each do |attribute_name, attr_data|
@@ -86,22 +111,13 @@ module ForestAdminAgent
         end
       end
 
-      def add_to_one_association(name, options = {}, &block)
-        options[:include_links] = options.fetch(:include_links, true)
-        options[:include_data] = options.fetch(:include_data, false)
-        @to_one_associations ||= {}
-        @to_one_associations[name] = format_field(name, options)
-      end
-
       # A PolymorphicManyToOne can't be SQL-joined, so list projections return a phantom object with no
       # primary key. Rebuild the id from the foreign key on the owner record.
       def has_one_relationship(attribute_name, attr_data)
         object = super
         return object if object.nil? # relation not projected (e.g. update/store responses)
 
-        field = ForestAdminAgent::Facades::Container.datasource
-                                                    .get_collection(@options[:class_name].gsub('::', '__'))
-                                                    .schema[:fields][attribute_name.to_s]
+        field = layout[:fields][attribute_name.to_s]
         return object unless field&.type == 'PolymorphicManyToOne'
 
         foreign_key = @object[field.foreign_key]
@@ -115,9 +131,8 @@ module ForestAdminAgent
       end
 
       def has_one_relationships
-        return {} if @to_one_associations.nil?
         data = {}
-        @to_one_associations.each do |attribute_name, attr_data|
+        to_one_associations.each do |attribute_name, attr_data|
           next if !should_include_attr?(attribute_name, attr_data)
           data[attribute_name.to_sym] = attr_data
         end
@@ -125,34 +140,16 @@ module ForestAdminAgent
       end
 
       def has_many_relationships
-        return {} if @to_many_associations.nil?
         data = {}
-        @to_many_associations.each do |attribute_name, attr_data|
+        to_many_associations.each do |attribute_name, attr_data|
           next if !should_include_attr?(attribute_name, attr_data)
           data[attribute_name.to_sym] = attr_data
         end
         data
       end
 
-      def add_to_many_association(name, options = {}, &block)
-        options[:include_links] = options.fetch(:include_links, true)
-        options[:include_data] = options.fetch(:include_data, false)
-        @to_many_associations ||= {}
-        @to_many_associations[name] = format_field(name, options)
-      end
-
       def relationships
         datasource = ForestAdminAgent::Facades::Container.datasource
-        forest_collection = datasource.get_collection(@options[:class_name].gsub('::', '__'))
-        relations_to_many = forest_collection.schema[:fields].select do |_field_name, field|
-          %w[OneToMany ManyToMany PolymorphicOneToMany].include?(field.type)
-        end
-        relations_to_one = forest_collection.schema[:fields].select do |_field_name, field|
-          %w[OneToOne ManyToOne PolymorphicManyToOne PolymorphicOneToOne].include?(field.type)
-        end
-
-        relations_to_one.each { |field_name, _field| add_to_one_association(field_name) }
-
         data = {}
         has_one_relationships.each do |attribute_name, attr_data|
           formatted_attribute_name = format_name(attribute_name)
@@ -170,8 +167,7 @@ module ForestAdminAgent
           # Only include 'data' key if the relationship object exists
           # Omit 'data' key entirely when null instead of setting it to null
           unless object.nil? || (object.respond_to?(:empty?) && object.empty?)
-            relation = datasource.get_collection(@options[:class_name].gsub('::', '__'))
-                                 .schema[:fields][attribute_name.to_s]
+            relation = layout[:fields][attribute_name.to_s]
             options = @options.clone
             if relation.type == 'PolymorphicManyToOne'
               options[:class_name] = @object[relation.foreign_key_type_field]
@@ -191,8 +187,6 @@ module ForestAdminAgent
           end
         end
 
-        relations_to_many.each { |field_name, _field| add_to_many_association(field_name) }
-
         has_many_relationships.each do |attribute_name, attr_data|
           formatted_attribute_name = format_name(attribute_name)
           data[formatted_attribute_name] = {}
@@ -208,7 +202,7 @@ module ForestAdminAgent
           if @_include_linkages.include?(formatted_attribute_name) || attr_data[:options][:include_data]
             data[formatted_attribute_name]['data'] = []
             objects = has_many_relationship(attribute_name, attr_data) || []
-            relation = datasource.get_collection(@options[:class_name].gsub('::', '__')).schema[:fields][attribute_name.to_s]
+            relation = layout[:fields][attribute_name.to_s]
             options = @options.clone
             options[:class_name] = datasource.get_collection(relation.foreign_collection).name
             objects.each do |obj|

data/lib/forest_admin_agent/serializer/forest_serializer_override.rb

@@ -17,7 +17,6 @@ module ForestAdminAgent
               next if attribute_name == :_include
 
               serializer = JSONAPI::Serializer.find_serializer(root_object, options)
-              serializer.relationships
               unformatted_attr_name = serializer.unformat_name(attribute_name).to_sym
 
               # We know the name of this relationship, but we don't know where it is stored internally.
@@ -55,9 +54,7 @@ module ForestAdminAgent
               # in the response.
               objects = is_collection ? object : [object]
 
-              relation = ForestAdminAgent::Facades::Container.datasource
-                                                             .get_collection(options[:class_name].gsub('::', '__'))
-                                                             .schema[:fields][attribute_name]
+              relation = serializer.layout[:fields][attribute_name]
               if relation.type == 'PolymorphicManyToOne'
                 relation_class_name = root_object[relation.foreign_key_type_field]
               else

data/lib/forest_admin_agent/services/ip_whitelist.rb

@@ -1,5 +1,4 @@
 require 'ipaddress'
-require 'filecache'
 require 'json'
 
 module ForestAdminAgent
@@ -14,7 +13,11 @@ module ForestAdminAgent
 
       def initialize
         @forest_api = ForestAdminAgent::Http::ForestAdminApiRequester.new
-        @cache = FileCache.new(
+        @cache = self.class.build_cache
+      end
+
+      def self.build_cache
+        ForestAdminAgent::Utils::SafeFileCache.new(
           'ip_whitelist',
           Facades::Container.config_from_cache[:cache_dir].to_s,
           Facades::Container.config_from_cache[:permission_expiration]
@@ -22,12 +25,7 @@ module ForestAdminAgent
       end
 
       def self.invalidate_cache
-        cache = FileCache.new(
-          'ip_whitelist',
-          Facades::Container.config_from_cache[:cache_dir].to_s,
-          Facades::Container.config_from_cache[:permission_expiration]
-        )
-        cache.delete(CACHE_KEY) unless cache.get(CACHE_KEY).nil?
+        build_cache.delete(CACHE_KEY)
       end
 
       def use_ip_whitelist

data/lib/forest_admin_agent/services/permissions.rb

@@ -1,4 +1,3 @@
-require 'filecache'
 require 'deepsort'
 
 module ForestAdminAgent
@@ -10,6 +9,9 @@ module ForestAdminAgent
       include ForestAdminDatasourceToolkit::Components::Query::ConditionTree
 
       USERS_RELOAD_INTERVAL_IN_SECONDS = 60
+      # Renderings live in their own domain because FileCache cannot delete by key prefix: clearing
+      # the domain is the only way to drop every rendering when the server does not say which one.
+      RENDERINGS_CACHE_DOMAIN = 'permissions-renderings'.freeze
 
       @users_reload_mutex = Mutex.new
 
@@ -18,30 +20,49 @@ module ForestAdminAgent
       def initialize(caller)
         @caller = caller
         @forest_api = ForestAdminAgent::Http::ForestAdminApiRequester.new
-        @cache = FileCache.new(
-          'permissions',
+        @cache = self.class.build_cache('permissions')
+        @memo = {}
+      end
+
+      def rendering_cache
+        @rendering_cache ||= self.class.build_cache(RENDERINGS_CACHE_DOMAIN)
+      end
+
+      def self.build_cache(domain)
+        ForestAdminAgent::Utils::SafeFileCache.new(
+          domain,
           Facades::Container.config_from_cache[:cache_dir].to_s,
           Facades::Container.config_from_cache[:permission_expiration]
         )
       end
 
       def self.invalidate_cache(id_cache = nil)
-        cache = FileCache.new(
-          'permissions',
-          Facades::Container.config_from_cache[:cache_dir].to_s,
-          Facades::Container.config_from_cache[:permission_expiration]
-        )
+        cache = build_cache('permissions')
 
         if id_cache.nil?
           cache.clear
+          build_cache(RENDERINGS_CACHE_DOMAIN).clear
           @users_reload_mutex.synchronize { @users_reloaded_at = nil }
         end
 
-        cache.delete(id_cache) unless cache.get(id_cache).nil?
+        cache.delete(id_cache)
 
         ForestAdminAgent::Facades::Container.logger.log('Info', "Invalidating #{id_cache} cache..")
       end
 
+      def self.invalidate_rendering_cache(rendering_id = nil)
+        cache = build_cache(RENDERINGS_CACHE_DOMAIN)
+
+        if rendering_id.nil?
+          cache.clear
+        else
+          cache.delete(rendering_id.to_s)
+        end
+
+        target = rendering_id.nil? ? 'every rendering' : "rendering #{rendering_id}"
+        ForestAdminAgent::Facades::Container.logger.log('Info', "Invalidating #{target} permissions cache..")
+      end
+
       def self.users_reload_allowed?
         @users_reload_mutex.synchronize do
           now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
@@ -210,20 +231,19 @@ module ForestAdminAgent
         is_allowed
       end
 
-      def can_smart_action?(request, collection, filter, allow_fetch: true)
+      def can_smart_action?(request, collection, filter, action_name:, allow_fetch: true)
         return true unless permission_system?
 
         user_data = get_user_data(caller.id)
         collections_data = get_collections_permissions_data(force_fetch: allow_fetch)
-        action = find_action_from_endpoint(collection.name, request[:headers]['REQUEST_PATH'], request[:headers]['REQUEST_METHOD'])
 
-        collection_actions = validate_smart_action_permissions(collections_data, collection, action)
+        collection_actions = validate_smart_action_permissions(collections_data, collection, action_name)
 
         smart_action_approval = SmartActionChecker.new(
           request[:params],
           collection,
           # The schema scope lets the checker skip select-all resolution for global actions.
-          collection_actions[action['name'].to_sym].merge(scope: collection.schema[:actions][action['name']]&.scope),
+          collection_actions[action_name.to_sym].merge(scope: collection.schema[:actions][action_name]&.scope),
           caller,
           user_data[:roleId],
           filter
@@ -232,7 +252,7 @@ module ForestAdminAgent
         is_allowed = smart_action_approval.can_execute?
         ForestAdminAgent::Facades::Container.logger.log(
           'Debug',
-          "User #{user_data[:roleId]} is #{"not" unless is_allowed} allowed to perform #{action["name"]}"
+          "User #{user_data[:roleId]} is #{"not" unless is_allowed} allowed to perform #{action_name}"
         )
 
         is_allowed
@@ -279,8 +299,16 @@ module ForestAdminAgent
 
       private
 
+      def cached(store, key, &fetch)
+        @memo.fetch([store, key]) { @memo[[store, key]] = store.get_or_set(key, &fetch) }
+      end
+
+      def forget(store, key)
+        @memo.delete([store, key])
+      end
+
       def cached_users
-        cache.get_or_set('forest.users') do
+        cached(cache, 'forest.users') do
           response = fetch('/liana/v4/permissions/users')
           users = {}
 
@@ -295,9 +323,8 @@ module ForestAdminAgent
       end
 
       def reload_users
-        return cached_users unless self.class.users_reload_allowed?
-
-        self.class.invalidate_cache('forest.users')
+        self.class.invalidate_cache('forest.users') if self.class.users_reload_allowed?
+        forget(cache, 'forest.users')
         cached_users
       end
 
@@ -442,9 +469,12 @@ module ForestAdminAgent
       end
 
       def get_collections_permissions_data(force_fetch: false)
-        self.class.invalidate_cache('forest.collections') if force_fetch == true
+        if force_fetch == true
+          self.class.invalidate_cache('forest.collections')
+          forget(cache, 'forest.collections')
+        end
 
-        cache.get_or_set('forest.collections') do
+        cached(cache, 'forest.collections') do
           response = fetch('/liana/v4/permissions/environment')
           collections = {}
 
@@ -484,9 +514,12 @@ module ForestAdminAgent
       end
 
       def get_rendering_data(rendering_id, force_fetch: false)
-        self.class.invalidate_cache('forest.rendering') if force_fetch == true
+        if force_fetch == true
+          self.class.invalidate_rendering_cache(rendering_id)
+          forget(rendering_cache, rendering_id.to_s)
+        end
 
-        cache.get_or_set('forest.rendering') do
+        cached(rendering_cache, rendering_id.to_s) do
           data = {}
           response = fetch("/liana/v4/permissions/renderings/#{rendering_id}")
 
@@ -501,26 +534,12 @@ module ForestAdminAgent
       end
 
       def permission_system?
-        cache.get_or_set('forest.has_permission') do
+        cached(cache, 'forest.has_permission') do
           response = fetch('/liana/v4/permissions/environment')
           { enable: response != true }
         end[:enable]
       end
 
-      def find_action_from_endpoint(collection_name, path, http_method)
-        endpoint = path.partition('/forest/')[1..].join
-        schema_file = JSON.parse(File.read(Facades::Container.config_from_cache[:schema_path]))
-        actions = schema_file['collections']&.find { |collection| collection['name'] == collection_name }&.dig('actions')
-
-        return nil if actions.nil? || actions.empty?
-
-        action = actions.find { |a| a['endpoint'] == endpoint && a['httpMethod'].casecmp(http_method).zero? }
-
-        raise BadRequestError, "The collection #{collection_name} does not have this smart action" if action.nil?
-
-        action
-      end
-
       def decode_crud_permissions(collection)
         unless collection.is_a?(Hash) && collection.key?(:collection)
           ForestAdminAgent::Facades::Container.logger.log(
@@ -693,7 +712,7 @@ module ForestAdminAgent
         has_permission
       end
 
-      def validate_smart_action_permissions(collections_data, collection, action)
+      def validate_smart_action_permissions(collections_data, collection, action_name)
         collection_key = collection.name.to_sym
 
         unless collections_data.key?(collection_key)
@@ -713,13 +732,13 @@ module ForestAdminAgent
           raise ForbiddenError, "No actions configured for collection '#{collection.name}'"
         end
 
-        action_key = action['name'].to_sym
+        action_key = action_name.to_sym
         unless collection_actions.key?(action_key)
           ForestAdminAgent::Facades::Container.logger.log(
             'Warn',
-            "Smart action '#{action["name"]}' not found in permissions for collection '#{collection.name}'"
+            "Smart action '#{action_name}' not found in permissions for collection '#{collection.name}'"
           )
-          raise ForbiddenError, "Smart action '#{action["name"]}' is not configured"
+          raise ForbiddenError, "Smart action '#{action_name}' is not configured"
         end
 
         collection_actions

data/lib/forest_admin_agent/services/sse_cache_invalidation.rb

@@ -9,7 +9,7 @@ module ForestAdminAgent
       MESSAGE_CACHE_KEYS = {
         'refresh-users': %w[forest.users],
         'refresh-roles': %w[forest.collections],
-        'refresh-renderings': %w[forest.collections forest.rendering]
+        'refresh-renderings': %w[forest.collections]
         # TODO: add one for ip whitelist when server implement it
       }.freeze
 
@@ -32,6 +32,7 @@ module ForestAdminAgent
                   "invalidate cache #{MESSAGE_CACHE_KEYS[event.type]} for event #{event.type}"
                 )
               end
+              invalidate_renderings(event.data) if event.type == :'refresh-renderings'
 
               ForestAdminAgent::Facades::Container.logger.log(
                 'Info',
@@ -57,6 +58,23 @@ module ForestAdminAgent
           )
         end
       end
+
+      # An event that does not name its renderings could concern any of them, so all are dropped.
+      def self.invalidate_renderings(data)
+        rendering_ids = begin
+          parsed = JSON.parse(data.to_s)
+          parsed['renderingIds'] if parsed.is_a?(Hash)
+        rescue JSON::ParserError
+          nil
+        end
+
+        if rendering_ids.is_a?(Array) && rendering_ids.any?
+          rendering_ids.each { |rendering_id| Permissions.invalidate_rendering_cache(rendering_id) }
+        else
+          Permissions.invalidate_rendering_cache
+        end
+      end
+      private_class_method :invalidate_renderings
     end
   end
 end

data/lib/forest_admin_agent/utils/safe_file_cache.rb

@@ -0,0 +1,52 @@
+require 'filecache'
+require 'securerandom'
+
+module ForestAdminAgent
+  module Utils
+    # Same on-disk layout as FileCache, so processes running either version share one cache.
+    class SafeFileCache < FileCache
+      def get(key)
+        path = path_for(key)
+        return nil if expired?(path)
+
+        File.open(path, 'rb') { |file| Marshal.load(file) } # rubocop:disable Security/MarshalLoad
+      rescue Errno::ENOENT, ArgumentError, TypeError, EOFError
+        nil
+      end
+
+      def set(key, value)
+        path = path_for(key)
+        FileUtils.mkdir_p(File.dirname(path))
+        temp_path = File.join(File.dirname(path), ".#{File.basename(path)}.#{Process.pid}.#{SecureRandom.hex(4)}")
+
+        File.open(temp_path, 'wb') { |file| Marshal.dump(value, file) }
+        File.rename(temp_path, path)
+      rescue Errno::ENOENT
+        nil
+      ensure
+        FileUtils.rm_f(temp_path) if temp_path
+      end
+
+      def delete(key)
+        FileUtils.rm_f(path_for(key))
+      end
+
+      def clear
+        FileUtils.rm_rf(get_root)
+        FileUtils.mkdir_p(get_root)
+      end
+
+      private
+
+      def path_for(key)
+        md5 = Digest::MD5.hexdigest(key.to_s)
+
+        File.join(get_root, *md5[0...@depth].chars, md5)
+      end
+
+      def expired?(path)
+        @expiry.positive? && Time.now - File.mtime(path) >= @expiry
+      end
+    end
+  end
+end

data/lib/forest_admin_agent/utils/schema/schema_emitter.rb

@@ -6,7 +6,7 @@ module ForestAdminAgent
     module Schema
       class SchemaEmitter
         LIANA_NAME = "agent-ruby"
-        LIANA_VERSION = "1.45.1"
+        LIANA_VERSION = "1.45.2"
 
         def self.generate(datasource)
           datasource.collections

data/lib/forest_admin_agent/version.rb

@@ -1,3 +1,3 @@
 module ForestAdminAgent
-  VERSION = "1.45.1"
+  VERSION = "1.45.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: forest_admin_agent
 version: !ruby/object:Gem::Version
-  version: 1.45.1
+  version: 1.45.2
 platform: ruby
 authors:
 - Matthieu
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-10-10 00:00:00.000000000 Z
+date: 2026-10-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -419,6 +419,7 @@ files:
 - lib/forest_admin_agent/utils/is_segment_query_allowed_on_connection.rb
 - lib/forest_admin_agent/utils/query_string_parser.rb
 - lib/forest_admin_agent/utils/query_validator.rb
+- lib/forest_admin_agent/utils/safe_file_cache.rb
 - lib/forest_admin_agent/utils/schema/action_fields.rb
 - lib/forest_admin_agent/utils/schema/forest_value_converter.rb
 - lib/forest_admin_agent/utils/schema/frontend_filterable.rb