forest_liana 9.20.13 → 9.22.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3e53d6922c4422fed246ccc6d625ac21668788f962873e6b04e83689684e9a39
-  data.tar.gz: 63d031e91c573ec7413d82bfa0c718b3b61736d6aa6583efd5a7dc848e7baf1b
+  metadata.gz: 6042deb02adc0ae0d73c97cac99e2abdf0807cdf759cfd0cde116bf94fdc3dff
+  data.tar.gz: 351c37c6fd6cfc17e9c4de3c8f760b84527ca7c1d7a0e2df6976b67b8d549329
 SHA512:
-  metadata.gz: 3a56ce38a01bbebe42696a893bf6e50e762135c8b0579ac488e578468469a3a381963bee3ed1a9c5efb5c73b168aaf80bcfe410ec2f90c25ac80235c29799778
-  data.tar.gz: f93ccc8fcd6cfdbb189e623a3cd3095d79bbd8fd94a70cda8d0cf263476ea6fe3226617b8ebffc3b14a804153f975dddd6903a9791b7c75e85da5e15c72a3b91
+  metadata.gz: 7a952e5b05d2c1491f74b77a53e16012d89419af19040e6168488e000afba0651ebea4f3d7cb21b1ef3045598be8317c30930f7a1e6a681fd5458b8ce956672f
+  data.tar.gz: 9884f0447c34ccb867abf7a2b41326229391e6a3c2689ad9884a15d09ac0ad067ba3a7ebfb30df13cab9502524ef29cd69de941779bfd3185cd385a893261960

data/app/controllers/forest_liana/application_controller.rb

@@ -4,10 +4,24 @@ require 'csv'
 module ForestLiana
   class ApplicationController < ForestLiana::BaseController
     rescue_from ForestLiana::Ability::Exceptions::AccessDenied, with: :render_error
+    rescue_from ForestLiana::Errors::HTTP400Error, with: :render_error
     rescue_from ForestLiana::Errors::HTTP403Error, with: :render_error
     rescue_from ForestLiana::Errors::HTTP422Error, with: :render_error
+    rescue_from ForestLiana::Errors::PermissionsUnavailableError, with: :render_error
     rescue_from ForestLiana::Ability::Exceptions::ActionConditionError, with: :render_error
     rescue_from ForestLiana::Ability::Exceptions::UnknownCollection, with: :render_error
+    rescue_from ForestLiana::Ability::Exceptions::UnauthorizedFieldsError, with: :render_error
+    rescue_from ForestLiana::Ability::Exceptions::UnauthorizedQueryFieldError, with: :render_error
+    rescue_from ForestLiana::Ability::Exceptions::UnexposedQueryCollectionError, with: :render_error
+
+    # `render_error` above already gives these their 403 + name/data payload — every list here is
+    # for an action whose own `begin/rescue` would otherwise let a bare `rescue => error` swallow
+    # them into a 500 first. Those actions catch this list and re-`raise`, letting it reach here.
+    QUERY_PERMISSION_ERRORS = [
+      ForestLiana::Ability::Exceptions::UnauthorizedFieldsError,
+      ForestLiana::Ability::Exceptions::UnauthorizedQueryFieldError,
+      ForestLiana::Ability::Exceptions::UnexposedQueryCollectionError,
+    ].freeze
 
     def self.papertrail?
       Object.const_get('PaperTrail::Version').is_a?(Class) rescue false
@@ -40,7 +54,7 @@ module ForestLiana
 
     def serialize_model(record, options = {})
       options[:is_collection] = false
-      options[:context] = { unoptimized: true }.merge(options[:context] || {})
+      options[:context] = { unoptimized: options[:fields].nil? }.merge(options[:context] || {})
 
       json = ForestAdmin::JSONAPI::Serializer.serialize(record, options)
 
@@ -49,7 +63,7 @@ module ForestLiana
 
     def serialize_models(records, options = {}, fields_searched = [])
       options[:is_collection] = true
-      if options[:params] && options[:params][:fields].nil?
+      if options[:fields].nil?
         options[:context] = { unoptimized: true }.merge(options[:context] || {})
       end
 
@@ -110,9 +124,88 @@ module ForestLiana
       render serializer: nil, json: { meta: { count: 'deactivated'} }
     end
 
+    def count_deactivated?(model)
+      name = ForestLiana.name_for(model)
+      ForestLiana.apimap.find { |collection| collection.name.to_s == name }&.is_countable == false
+    end
+
     private
 
+    # NOTICE: What survives becomes(), which allocates a fresh instance and copies @attributes
+    #         onto it and nothing else. Shared by both controllers' get_record, unlike the rest of
+    #         their rendering, because getting it wrong is a correctness bug rather than a
+    #         difference of route.
+    #
+    #         An association proxy is bound to the reflection of the class that built it, and
+    #         association(name) hands back whatever sits under that key without re-checking it
+    #         against the new class. An STI subclass is free to redefine a same-named association
+    #         with its own class_name, scope or foreign_key, so copying such an entry wholesale
+    #         would serve the subclass's target under the base class's field — plausible, wrong,
+    #         and raising nothing. Only entries both classes reflect identically are carried over;
+    #         anything else is left to load lazily, the behaviour it had before this existed.
+    def carry_preloaded_associations(record, became)
+      cache = record.instance_variable_get(:@association_cache) || {}
+      carried = cache.select do |name, _|
+        record.class.reflect_on_association(name) == became.class.reflect_on_association(name)
+      end
+      became.instance_variable_set(:@association_cache, carried)
+
+      became
+    end
+
+    # NOTICE: Header-then-query fallback, decided here and nowhere else: the header is rewritten
+    #         into params[:fields], so every route keeps reading the projection it always read
+    #         and the header wins over the query params without any route knowing about it.
+    #
+    #         Declared as a before_action by the routes that project, and by them only: a count,
+    #         a stats or a write carries no projection, must not have its params rewritten by a
+    #         header meant for the list next to it, and must not answer a 400 for one. The same
+    #         rule as agent-nodejs, whose own suite pins the header ignored on count.
+    def apply_projection_header
+      header = request.headers[ForestLiana::ProjectionParser::HEADER_NAME]
+      return if header.nil?
+
+      root_model = projection_root_model
+      # NOTICE: An unresolvable collection is left to the route, which answers its own 404.
+      return if root_model.nil?
+
+      fields = ForestLiana::ProjectionParser.new(header, ForestLiana.name_for(root_model)).perform
+      params[:fields] = ActionController::Parameters.new(fields)
+    rescue ForestLiana::Errors::ExpectedError
+      # NOTICE: The deliberate 400 on a malformed header, which render_error answers.
+      raise
+    rescue => error
+      FOREST_REPORTER.report error
+      FOREST_LOGGER.error "Forest-Projection header error: #{error}\n#{format_stacktrace(error)}"
+      internal_server_error
+    end
+
+    # NOTICE: A projection is rooted on the collection the records come from, which is the
+    #         association target on the relationships routes, not the collection in the URL.
+    def projection_root_model
+      return nil if params[:collection].blank?
+
+      model = ForestLiana::SchemaUtils.find_model_from_collection_name(params[:collection])
+      return nil unless model.respond_to?(:reflect_on_association)
+      return model if params[:association_name].blank?
+
+      association = model.reflect_on_association(params[:association_name].to_sym)
+      # NOTICE: klass raises on a polymorphic reflection, and this runs in a before_action: the
+      #         guard is what keeps a 500 from replacing the 404 the route answers on its own. A
+      #         relationships index rejects a belongs_to, which a polymorphic relation always is.
+      return nil if association.nil? || ForestLiana::SchemaUtils.polymorphic?(association)
+
+      association.klass
+    end
+
     def render_error(exception)
+      # Same rule as render_expected_error, for the errors that reach here through a rescue_from
+      # instead: a 5xx is a server-side failure, reported and logged as one.
+      if exception.error_code.to_i >= 500
+        FOREST_REPORTER.report exception
+        ForestLiana::Errors::ExceptionHelper.recursively_print(exception, is_error: true)
+      end
+
       errors = {
         status: exception.error_code,
         detail: exception.message,
@@ -207,14 +300,27 @@ module ForestLiana
     end
 
     def render_csv getter, model
+      # Unlike index/show/update, an unreadable column here is dropped rather than refusing the
+      # whole export (named_collections: [] — nothing is ever "named") — matching agent-nodejs's
+      # own CSV route, which runs the same redactProjection as its JSON list but drops a denied
+      # column instead of 403ing the file whenever it doesn't error there either.
+      requested_fields = fields_per_model(params[:fields], model)
+      fields_to_serialize = redact_fields(forest_user, model, requested_fields, named_collections: [])
+
       set_headers_file
       set_headers_streaming
 
       response.status = 200
-      csv_header = params[:header].split(',')
       collection_name = ForestLiana.name_for(model)
-      field_names_requested = params[:fields][collection_name].split(',').map { |name| name.to_s }
-      fields_to_serialize = fields_per_model(params[:fields], model)
+      requested_field_names = params[:fields][collection_name].split(',').map { |name| name.to_s }
+      requested_header = params[:header].split(',')
+
+      # Keep the header row aligned with whatever redact_fields left in fields_to_serialize,
+      # the same way agent-nodejs's CsvGenerator.filterHeader drops a redacted column's label.
+      surviving = (fields_to_serialize[collection_name] || '').split(',')
+      kept = requested_field_names.zip(requested_header).select { |name, _| surviving.include?(name) }
+      field_names_requested = kept.map(&:first)
+      csv_header = kept.map(&:last)
 
       self.response_body = Enumerator.new do |content|
         content << ::CSV::Row.new(field_names_requested, csv_header, true).to_s

data/app/controllers/forest_liana/associations_controller.rb

@@ -1,14 +1,26 @@
 module ForestLiana
   class AssociationsController < ForestLiana::ApplicationController
+    include ForestLiana::Ability
+
+    # NOTICE: index covers the relationship list and its CSV export. count answers no
+    #         projection, and update/associate/dissociate none either.
     if Rails::VERSION::MAJOR < 4
       before_filter :find_resource, except: :count
       before_filter :find_association, except: :count
+      before_filter :apply_projection_header, only: :index
     else
       before_action :find_resource, except: :count
       before_action :find_association, except: :count
+      before_action :apply_projection_header, only: :index
     end
 
     def index
+      # Parity with agent-nodejs's list-related route: browse/export on the foreign collection.
+      # Authorized outside the begin, like update/associate/dissociate, so a denial reaches
+      # ApplicationController's rescue_from and keeps its name/data instead of falling into the
+      # generic ExpectedError rescue below.
+      action = request.format == 'csv' ? 'export' : 'browse'
+      forest_authorize!(action, forest_user, @association.klass)
       begin
         getter = HasManyGetter.new(@resource, @association, params, forest_user)
         getter.perform
@@ -17,6 +29,25 @@ module ForestLiana
           format.json { render_jsonapi(getter) }
           format.csv { render_csv(getter, @association.klass) }
         end
+      rescue ForestLiana::Ability::Exceptions::UnauthorizedFieldsError,
+             ForestLiana::Ability::Exceptions::UnauthorizedQueryFieldError => error
+        # A CSV request already has its response Content-Type/Content-Disposition set by the
+        # respond_to format match before this rescue ever runs — force JSON back, or the client
+        # downloads a ".csv" file whose content is this JSON error. UnauthorizedQueryFieldError is
+        # raised earlier (before respond_to picks a format) and doesn't strictly need this fix, but
+        # is caught here anyway since UnauthorizedFieldsError (raised during serialization, after
+        # the format is already picked) does — same response shape either way.
+        render(serializer: nil, json: { errors: [{
+          status: error.error_code,
+          detail: error.message,
+          name: error.name,
+          data: error.data
+        }] }, status: error.status, content_type: 'application/json')
+        response.headers.delete('Content-Disposition')
+      rescue *QUERY_PERMISSION_ERRORS
+        raise
+      rescue ForestLiana::Errors::ExpectedError => error
+        render_expected_error(error)
       rescue => error
         FOREST_REPORTER.report error
         FOREST_LOGGER.error "Association Index error: #{error}\n#{format_stacktrace(error)}"
@@ -32,11 +63,23 @@ module ForestLiana
       #         through and dereferencing a nil @association, which surfaced as
       #         a double-render / 500 rather than the intended 404.
       return if performed?
+      # Authorized outside the begin, like index above, so a denial keeps its name/data. A
+      # polymorphic @association already raises here (Rails: "Polymorphic associations do not
+      # support computing the class") — pre-existing, and shared with associate/dissociate below
+      # (index and update never reach it: both are structurally limited to a non-polymorphic
+      # macro before ever calling .klass).
+      forest_authorize!('browse', forest_user, @association.klass)
+      return deactivate_count_response if count_deactivated?(@association.klass)
+
       begin
         getter = HasManyGetter.new(@resource, @association, params, forest_user)
         getter.count
 
         render serializer: nil, json: { count: getter.records_count }
+      rescue *QUERY_PERMISSION_ERRORS
+        raise
+      rescue ForestLiana::Errors::ExpectedError => error
+        render_expected_error(error)
       rescue => error
         FOREST_REPORTER.report error
         FOREST_LOGGER.error "Association Index Count error: #{error}\n#{format_stacktrace(error)}"
@@ -45,6 +88,12 @@ module ForestLiana
     end
 
     def update
+      # BelongsToUpdater's writer saves the FK on the target for a has_one, on @resource only
+      # for a belongsTo. Authorized outside the begin, like ResourcesController's own actions, so
+      # a denial reaches ApplicationController's rescue_from and keeps its name/data.
+      edit_subject = @association.macro == :has_one ? @association.klass : @resource
+      forest_authorize!('edit', forest_user, edit_subject)
+      forest_authorize!('delete', forest_user, @association.klass) if BelongsToUpdater.replaces_destructively?(@association)
       begin
         updater = BelongsToUpdater.new(@resource, @association, params)
         updater.perform
@@ -55,6 +104,8 @@ module ForestLiana
         else
           head :no_content
         end
+      rescue ForestLiana::Errors::ExpectedError => error
+        render_expected_error(error)
       rescue => error
         FOREST_REPORTER.report error
         FOREST_LOGGER.error "Association Update error: #{error}\n#{format_stacktrace(error)}"
@@ -63,11 +114,14 @@ module ForestLiana
     end
 
     def associate
+      forest_authorize!('edit', forest_user, HasManyAssociator.authorize_target(@association))
       begin
         associator = HasManyAssociator.new(@resource, @association, params)
         associator.perform
 
         head :no_content
+      rescue ForestLiana::Errors::ExpectedError => error
+        render_expected_error(error)
       rescue => error
         FOREST_REPORTER.report error
         FOREST_LOGGER.error "Association Associate error: #{error}\n#{format_stacktrace(error)}"
@@ -76,6 +130,15 @@ module ForestLiana
     end
 
     def dissociate
+      if params[:delete].to_s == 'true'
+        # Explicit delete destroys the far record directly, regardless of association shape.
+        action = 'delete'
+        authorize_target = @association.klass
+      else
+        action = HasManyDissociator.destroys_on_unlink?(@association) ? 'delete' : 'edit'
+        authorize_target = HasManyDissociator.destroy_target(@association)
+      end
+      forest_authorize!(action, forest_user, authorize_target)
       begin
         dissociator = HasManyDissociator.new(@resource, @association, params, forest_user)
         dissociator.perform
@@ -83,6 +146,10 @@ module ForestLiana
         head :no_content
       rescue ActiveRecord::RecordNotDestroyed => error
         render json: { errors: [{ status: :bad_request, detail: error.message }] }, status: :bad_request
+      rescue *QUERY_PERMISSION_ERRORS
+        raise
+      rescue ForestLiana::Errors::ExpectedError => error
+        render_expected_error(error)
       rescue => error
         FOREST_REPORTER.report error
         FOREST_LOGGER.error "Association Dissociate error: #{error}\n#{format_stacktrace(error)}"
@@ -122,20 +189,33 @@ module ForestLiana
         @association.klass.columns.any? { |column| column.name == @association.klass.inheritance_column })
     end
 
+    # See ResourcesController#get_record — becomes() drops the association cache and the
+    # polymorphic singleton readers, and with them everything the getter preloaded for this page.
     def get_record record
-      is_sti_model? ? record.becomes(@association.klass) : record
+      return record unless is_sti_model?
+
+      carry_preloaded_associations(record, record.becomes(@association.klass))
     end
 
     def render_jsonapi getter
-      fields_to_serialize = fields_per_model(params[:fields], @association.klass)
-      records = getter.records.map { |record| get_record(record) }
-
       includes = getter.includes_for_serialization
-      if fields_to_serialize && includes.length > 0
-        association_name = ForestLiana.name_for(@association.klass)
-        fields_to_serialize[association_name] += ",#{includes.join(',')}"
+      requested_fields = fields_per_model(params[:fields], @association.klass)
+
+      # The getter may include a relation the caller's own field list omitted (search decoration,
+      # scoped includes); splice it in before redaction runs, so it is checked like any other field
+      # instead of bypassing the check entirely by being added back afterwards.
+      association_name = ForestLiana.name_for(@association.klass)
+      if requested_fields && includes.length > 0 && requested_fields[association_name]
+        requested_fields[association_name] += ",#{includes.join(',')}"
       end
 
+      fields_to_serialize = requested_fields || default_fields_to_serialize(@association.klass, includes)
+      fields_to_serialize = redact_fields(
+        forest_user, @association.klass, fields_to_serialize,
+        named_collections: requested_fields ? requested_fields.keys : []
+      )
+      records = getter.records.map { |record| get_record(record) }
+
       json = serialize_models(
         records,
         {
@@ -154,5 +234,26 @@ module ForestLiana
       collection_name = ForestLiana.name_for(model_association)
       @collection ||= ForestLiana.apimap.find { |collection| collection.name.to_s == collection_name }
     end
+
+    # See ResourcesController#default_fields_to_serialize for the rationale; duplicated rather than
+    # shared, matching how this controller already keeps its own render_jsonapi/get_record instead
+    # of reusing ResourcesController's.
+    def default_fields_to_serialize(root_model, included_relation_names)
+      fields = { ForestLiana.name_for(root_model) => collection_field_names(root_model) }
+
+      Array(included_relation_names).each do |relation_name|
+        reflection = root_model.reflect_on_association(relation_name.to_sym)
+        next if reflection.nil? || reflection.polymorphic?
+
+        related_name = ForestLiana.name_for(reflection.klass)
+        fields[related_name] ||= collection_field_names(reflection.klass)
+      end
+
+      fields
+    end
+
+    def collection_field_names(model)
+      ForestLiana::SchemaHelper.find_collection_from_model(model).fields.map { |field| field[:field] }.join(',')
+    end
   end
 end

data/app/controllers/forest_liana/base_controller.rb

@@ -10,6 +10,29 @@ module ForestLiana
 
     private
 
+    # The one shape for an expected error an action renders itself, rather than handing back to
+    # ApplicationController's rescue_from. A 5xx among them is a server-side failure wearing an
+    # expected-error class — a permissions fetch that could not be answered, an unimplemented
+    # method — so it is reported and logged as an error like any other 500 would be. Without that
+    # it reads as a client error, and the incident reaches nobody.
+    def render_expected_error(error)
+      if error.error_code.to_i >= 500
+        FOREST_REPORTER.report error
+        ForestLiana::Errors::ExceptionHelper.recursively_print(error, is_error: true)
+      else
+        error.display_error
+      end
+
+      # name/data carried like render_error does, when the class sets them: it is what tells a
+      # PermissionsUnavailableError from the RBAC refusals sharing its shape, on the client and in
+      # a support thread alike. Absent on the classes that set neither, exactly as before.
+      payload = { status: error.error_code, detail: error.message }
+      payload[:name] = error.name if error.try(:name)
+      payload[:data] = error.data if error.try(:data)
+
+      render(serializer: nil, json: ForestAdmin::JSONAPI::Serializer.serialize_errors([payload]), status: error.status)
+    end
+
     def reject_unauthorized_ip
       begin
         ip = request.remote_ip
@@ -24,11 +47,7 @@ module ForestLiana
           end
         end
       rescue ForestLiana::Errors::ExpectedError => exception
-        error_data = ForestAdmin::JSONAPI::Serializer.serialize_errors([{
-          status: exception.error_code,
-          detail: exception.message
-        }])
-        render(serializer: nil, json: error_data, status: exception.status)
+        render_expected_error(exception)
       rescue => exception
         FOREST_REPORTER.report exception
         FOREST_LOGGER.error(exception)

data/app/controllers/forest_liana/capabilities_controller.rb

@@ -0,0 +1,13 @@
+module ForestLiana
+  class CapabilitiesController < ForestLiana::ApplicationController
+    def index
+      capabilities = ForestLiana::CapabilitiesGetter.new(params[:collectionNames]).perform
+
+      render serializer: nil, json: capabilities, status: :ok
+    rescue => error
+      FOREST_REPORTER.report error
+      FOREST_LOGGER.error "Error while getting the capabilities: #{error.message}"
+      internal_server_error
+    end
+  end
+end

data/app/controllers/forest_liana/resources_controller.rb

@@ -8,10 +8,14 @@ module ForestLiana
 
     rescue_from ActiveRecord::RecordNotFound, :with => :record_not_found
 
+    # NOTICE: index covers the list and the CSV export, show the get-one. Every other action
+    #         here answers no projection, count included.
     if Rails::VERSION::MAJOR < 4
       before_filter :find_resource, except: :count
+      before_filter :apply_projection_header, only: [:index, :show]
     else
       before_action :find_resource, except: :count
+      before_action :apply_projection_header, only: [:index, :show]
     end
 
     def index
@@ -27,13 +31,25 @@ module ForestLiana
       rescue ForestLiana::Errors::LiveQueryError => error
         render json: { errors: [{ status: 422, detail: error.message }] },
           status: :unprocessable_entity, serializer: nil
-      rescue ForestLiana::Errors::ExpectedError => error
-        error.display_error
-        error_data = ForestAdmin::JSONAPI::Serializer.serialize_errors([{
+      rescue ForestLiana::Ability::Exceptions::UnauthorizedFieldsError,
+             ForestLiana::Ability::Exceptions::UnauthorizedQueryFieldError => error
+        # A CSV request already has its response Content-Type/Content-Disposition set by the
+        # respond_to format match before this rescue ever runs — force JSON back, or the client
+        # downloads a ".csv" file whose content is this JSON error. UnauthorizedQueryFieldError is
+        # raised earlier (before respond_to picks a format) and doesn't strictly need this fix, but
+        # is caught here anyway since UnauthorizedFieldsError (raised during serialization, after
+        # the format is already picked) does — same response shape either way.
+        render(serializer: nil, json: { errors: [{
           status: error.error_code,
-          detail: error.message
-        }])
-        render(serializer: nil, json: error_data, status: error.status)
+          detail: error.message,
+          name: error.name,
+          data: error.data
+        }] }, status: error.status, content_type: 'application/json')
+        response.headers.delete('Content-Disposition')
+      rescue *QUERY_PERMISSION_ERRORS
+        raise
+      rescue ForestLiana::Errors::ExpectedError => error
+        render_expected_error(error)
       rescue => error
         FOREST_REPORTER.report error
         FOREST_LOGGER.error "Records Index error: #{error}\n#{format_stacktrace(error)}"
@@ -44,6 +60,8 @@ module ForestLiana
     def count
       find_resource
       forest_authorize!('browse', forest_user, @resource)
+      return deactivate_count_response if count_deactivated?(@resource)
+
       begin
         getter = ForestLiana::ResourcesGetter.new(@resource, params, forest_user)
         getter.count
@@ -53,13 +71,10 @@ module ForestLiana
       rescue ForestLiana::Errors::LiveQueryError => error
         render json: { errors: [{ status: 422, detail: error.message }] },
           status: :unprocessable_entity, serializer: nil
+      rescue *QUERY_PERMISSION_ERRORS
+        raise
       rescue ForestLiana::Errors::ExpectedError => error
-        error.display_error
-        error_data = ForestAdmin::JSONAPI::Serializer.serialize_errors([{
-          status: error.error_code,
-          detail: error.message
-        }])
-        render(serializer: nil, json: error_data, status: error.status)
+        render_expected_error(error)
       rescue => error
         FOREST_REPORTER.report error
         FOREST_LOGGER.error "Records Index Count error: #{error}\n#{format_stacktrace(error)}"
@@ -73,9 +88,18 @@ module ForestLiana
         getter = ForestLiana::ResourceGetter.new(@resource, params, forest_user)
         getter.perform
 
-        render serializer: nil, json: render_record_jsonapi(getter.record)
+        render serializer: nil, json: render_record_jsonapi(getter.record, getter)
       rescue ActiveRecord::RecordNotFound
         render serializer: nil, json: { status: 404 }, status: :not_found
+      rescue *QUERY_PERMISSION_ERRORS
+        raise
+      rescue ForestLiana::Errors::ExpectedError => error
+        # Same shape as #index and #count: the permission errors above go back to
+        # ApplicationController's rescue_from for their name/data, every other expected error is
+        # rendered here with its own status (a 422 on a malformed field path) rather than
+        # re-raised. Re-raising the whole hierarchy would let the subclasses no rescue_from
+        # covers escape the controller entirely — no Forest error payload, and no report.
+        render_expected_error(error)
       rescue => error
         FOREST_REPORTER.report error
         FOREST_LOGGER.error "Record Show error: #{error}\n#{format_stacktrace(error)}"
@@ -162,6 +186,10 @@ module ForestLiana
         end
       rescue ActiveRecord::RecordNotDestroyed => error
         render json: { errors: [{ status: :bad_request, detail: error.message }] }, status: :bad_request
+      rescue *QUERY_PERMISSION_ERRORS
+        raise
+      rescue ForestLiana::Errors::ExpectedError => error
+        render_expected_error(error)
       rescue => error
         FOREST_REPORTER.report error
         FOREST_LOGGER.error "Records Destroy error: #{error}\n#{format_stacktrace(error)}"
@@ -203,26 +231,88 @@ module ForestLiana
         @resource.columns.any? { |column| column.name == @resource.inheritance_column })
     end
 
+    # NOTICE: becomes() allocates a fresh instance and copies @attributes onto it — not the
+    #         association cache, which init_internals has just emptied. What the getters
+    #         preloaded (smart_field_preloads, and the relations eager loaded for serialization)
+    #         would be dropped here and re-queried once per row, so an STI collection alone would
+    #         keep the N+1 the rest of this pipeline exists to remove.
+    #
+    #         The singleton readers preload_polymorphic_associations defines are lost too — they
+    #         belong to the old instance's singleton class — but their targets are not: Rails'
+    #         own Preloader writes a polymorphic target into the association cache as well, so
+    #         those ride along with everything else. That is what preload_polymorphic_associations
+    #         calls #call for on Rails 7+. Pinned by sti_record_conversion_spec.rb.
+    #
+    #         Carried over explicitly, and only where the two classes agree on what the name
+    #         means — see carry_preloaded_associations.
     def get_record record
-      is_sti_model? ? record.becomes(@resource) : record
+      return record unless is_sti_model?
+
+      carry_preloaded_associations(record, record.becomes(@resource))
     end
 
-    def render_record_jsonapi record
-      collection = ForestLiana::SchemaHelper.find_collection_from_model(@resource)
-      collection_fields = collection.fields.map { |field| field[:field] }
-      fields_to_serialize = {
-        ForestLiana.name_for(@resource) => collection_fields.join(',')
-      }
+    # NOTICE: create and update answer with the whole record: they carry no projection, so the
+    #         getter is absent and every field is part of the default expansion, not something the
+    #         caller named. show passes a getter; a field named through the projection header is
+    #         refused rather than redacted if unreadable, same as index's own render_jsonapi below.
+    def render_record_jsonapi record, getter = nil
+      requested_fields = getter&.projection? ? fields_per_model(params[:fields], @resource) : nil
+      fields_to_serialize = redact_fields(
+        forest_user, @resource,
+        requested_fields || default_fields_to_serialize(@resource, record_includes),
+        named_collections: requested_fields ? requested_fields.keys : []
+      )
+      fields_to_serialize = keep_relationship_links(fields_to_serialize) if requested_fields
 
       serialize_model(get_record(record), {
-        include: record_includes,
+        include: requested_fields ? getter.includes_for_serialization : record_includes,
         fields: fields_to_serialize
       })
     end
 
+    # NOTICE: A projection names what the caller reads off the record, never the to-many
+    #         relations: the frontend does not fetch them here, it follows their
+    #         `links.related` off this very payload to load each one on its own route. Left out
+    #         of `fields` they are not serialized at all, the links go with them, and every
+    #         related-data list on the record silently stays empty — its count, built from a
+    #         hand-made URL rather than from a link, keeps answering. They cost no query: a
+    #         to-many outside `include` serializes to its link and nothing else.
+    #
+    #         Added back after the redaction, and without a read check on the target collection:
+    #         a `links.related` is a URL, not data, and AssociationsController#index authorizes
+    #         `browse` on that very collection before answering it. Checking here would buy
+    #         nothing and cost a read permission lookup per to-many on every single get-one,
+    #         only to turn a Forest API hiccup into a 403 on a record the role may read.
+    def keep_relationship_links(fields_to_serialize)
+      root_name = ForestLiana.name_for(@resource)
+      projected = (fields_to_serialize[root_name] || '').split(',')
+      missing = to_many_field_names - projected
+      return fields_to_serialize if missing.empty?
+
+      fields_to_serialize.merge(root_name => (projected + missing).join(','))
+    end
+
+    # NOTICE: What every to-many has in common, whatever it is made of. Keying on
+    #         `field[:relationship]` would miss two of the three: SchemaAdapter types an
+    #         association by its camelized macro, so a has_and_belongs_to_many reads
+    #         "HasAndBelongsToMany" rather than "HasMany", and Collection#has_many — the smart
+    #         DSL — never sets the key at all. The frontend makes none of these distinctions: it
+    #         reads the array type, exactly as here. `reference` is what keeps a scalar list out:
+    #         an array-typed smart field references nothing, and is a computed value the caller
+    #         did not ask for rather than a relation with a link (User's `nicknames`).
+    def to_many_field_names
+      get_collection.fields
+                    .select { |field| field[:type].is_a?(Array) && field[:reference].present? }
+                    .map { |field| field[:field].to_s }
+    end
+
     def render_jsonapi getter
       records = getter.records.map { |record| get_record(record) }
-      fields_to_serialize = fields_per_model(params[:fields], @resource)
+      requested_fields = fields_per_model(params[:fields], @resource)
+      fields_to_serialize = requested_fields || default_fields_to_serialize(@resource, includes(getter))
+      fields_to_serialize = redact_fields(
+        forest_user, @resource, fields_to_serialize, named_collections: requested_fields ? requested_fields.keys : []
+      )
 
       json = serialize_models(
         records,
@@ -237,6 +327,29 @@ module ForestLiana
       render serializer: nil, json: json
     end
 
+    # The full-schema field list `fields[...]` expands to when the caller never sent it — mirrors
+    # `render_record_jsonapi`'s own full-collection expansion, fanned out over the relations the
+    # response actually includes. A polymorphic relation is left out of this per-collection map: it
+    # has no single target collection to expand, and it already appears in the root's own field list
+    # (below), which is what makes the relationship link itself visible.
+    def default_fields_to_serialize(root_model, included_relation_names)
+      fields = { ForestLiana.name_for(root_model) => collection_field_names(root_model) }
+
+      Array(included_relation_names).each do |relation_name|
+        reflection = root_model.reflect_on_association(relation_name.to_sym)
+        next if reflection.nil? || reflection.polymorphic?
+
+        related_name = ForestLiana.name_for(reflection.klass)
+        fields[related_name] ||= collection_field_names(reflection.klass)
+      end
+
+      fields
+    end
+
+    def collection_field_names(model)
+      ForestLiana::SchemaHelper.find_collection_from_model(model).fields.map { |field| field[:field] }.join(',')
+    end
+
     def get_collection
       collection_name = ForestLiana.name_for(@resource)
       @collection ||= ForestLiana.apimap.find { |collection| collection.name.to_s == collection_name }