forest_liana 9.20.8 → 9.20.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dfcdfafce741a2f8305f64a7241219a6f9b54227dd310dd7269ff83043f0f35d
-  data.tar.gz: c3ce3c647b53d3cc7bd8c5d45ed98c887588112c6e5e7fc558ca6ca5ddf385f2
+  metadata.gz: 5449af5d3c0aa87c4c56f8417d3527e279690d22a34f02cb081cee74d2de06b1
+  data.tar.gz: '044797af4de1b516a177d859566fdbdea4e5458eb938c107077d01a19314a763'
 SHA512:
-  metadata.gz: debd8bdb65d707795b7e895769c3ec1bd1fc0796bc971edfad2d0446a6b19e1b2b78bdd1c64cd77b2dc615eecc5384b868d1e8ab01810646aa287fd8c7c1a1f1
-  data.tar.gz: 9534d5fd16d409d282dd806955386e730a428c3c8405b0beb0284bd317f6825a8f5cdf616ca662e4148a8df9703b23e0370772edd9a35d9c6dbca9e5fe72ff76
+  metadata.gz: cce3c3edaacf3cea3dfc9ea29f3a7391cf2e1a09b399784c1be06c767d6013e600d70c7ca2fa70673451c0e18431df0d521e3cff2285408c003ef4911ca18336
+  data.tar.gz: b56dc37e18b8f8e78e730c1d8eb844731134d22be8478a27e4ea576ff75df9523f6c6ba7b7da8b07a585b97419d9b2d3058656527acad2dcb94146533e9afabd

data/app/models/forest_liana/model/action.rb

@@ -81,4 +81,29 @@ class ForestLiana::Model::Action
   def persisted?
     false
   end
+
+  # Normalized at the boundary so every consumer sees one canonical value: the schema sent to
+  # Forest (the UI appends /hooks/load to it), the permission lookup comparing request paths,
+  # and the routes drawn from it. Leading slash kept as declared — consumers tolerate both.
+  def endpoint=(value)
+    @endpoint = value && value.to_s.gsub(%r{/+}, '/').delete_suffix('/')
+  end
+
+  def endpoint_under_forest_mount?
+    normalized_endpoint.start_with?('forest/')
+  end
+
+  def engine_relative_endpoint
+    normalized_endpoint.delete_prefix('forest')
+  end
+
+  def absolute_endpoint
+    "/#{normalized_endpoint}"
+  end
+
+  private
+
+  def normalized_endpoint
+    endpoint.to_s.delete_prefix('/')
+  end
 end

data/app/services/forest_liana/search_query_builder.rb

@@ -85,7 +85,7 @@ module ForestLiana
             !@resource.defined_enums[column.name][@search.downcase].nil?
             conditions << "#{column_name} =
               #{@resource.defined_enums[column.name][@search.downcase]}"
-          elsif !(column.respond_to?(:array) && column.array) && text_type?(column.type)
+          elsif !(column.respond_to?(:array) && column.array) && text_type?(column.type) && !malformed_uuid_search?
             conditions << "LOWER(#{column_name}) LIKE :search_value_for_string"
           end
         end
@@ -114,7 +114,7 @@ module ForestLiana
               resource = @resource.reflect_on_association(association.to_sym)
               unless (SchemaUtils.polymorphic?(resource))
                 resource.klass.columns.each do |column|
-                  if !(column.respond_to?(:array) && column.array) && text_type?(column.type)
+                  if !(column.respond_to?(:array) && column.array) && text_type?(column.type) && !malformed_uuid_search?
                     if @collection.search_fields.nil? || (association_search &&
                       association_search.include?(column.name))
                       conditions << association_search_condition(resource.table_name,
@@ -138,7 +138,7 @@ module ForestLiana
               unless association_search.empty?
                 resource = @resource.reflect_on_association(association.to_sym)
                 resource.klass.columns.each do |column|
-                  if !(column.respond_to?(:array) && column.array) && text_type?(column.type)
+                  if !(column.respond_to?(:array) && column.array) && text_type?(column.type) && !malformed_uuid_search?
                     if association_search.include?(column.name)
                       conditions << association_search_condition(resource.table_name,
                         column.name)
@@ -150,11 +150,18 @@ module ForestLiana
           end
         end
 
-        @records = @resource.where(
-          conditions.join(' OR '),
-          search_value_for_string: "%#{@search.downcase}%",
-          search_value_for_uuid: @search.to_s
-        ) unless conditions.empty?
+        if conditions.empty?
+          # NOTICE: a malformed-UUID search suppresses the only conditions it could
+          #         have produced (text LIKE scans); match nothing rather than fall
+          #         through to an unfiltered query that returns the whole table.
+          @records = @resource.none if malformed_uuid_search?
+        else
+          @records = @resource.where(
+            conditions.join(' OR '),
+            search_value_for_string: "%#{@search.downcase}%",
+            search_value_for_uuid: @search.to_s
+          )
+        end
       end
 
       @records
@@ -223,5 +230,17 @@ module ForestLiana
     def text_type?(type_sym)
       [:string, :text, :citext].include? type_sym
     end
+
+    # NOTICE: A search that is UUID-shaped but fails the strict REGEX_UUID (a
+    #         truncated or mistyped UUID) can never match a real UUID column and,
+    #         on text columns, only triggers `LOWER(col) LIKE '%…%'` sequential
+    #         scans that can hit the statement timeout. Valid UUIDs are excluded
+    #         so they keep matching UUIDs stored in varchar/text columns.
+    def malformed_uuid_search?
+      return false unless @search.is_a?(String)
+
+      @search.match?(/\A[0-9a-f]+-[0-9a-f]+-[0-9a-f]+-[0-9a-f]+-[0-9a-f]+\z/i) &&
+        !REGEX_UUID.match?(@search)
+    end
   end
 end

data/config/routes/actions.rb

@@ -1,10 +1,13 @@
 ForestLiana.apimap.each do |collection|
   if !collection.actions.empty?
     collection.actions.each do |action|
+      # Endpoints outside the mount are routed on the host app instead — see ForestLiana::Engine.
+      next unless action.endpoint_under_forest_mount?
+
       # Unconditional: clients probe /hooks/load even when no load hook is declared.
-      post action.endpoint.sub('forest', '') + '/hooks/load' => 'actions#load', action_name: ActiveSupport::Inflector.parameterize(action.name)
+      post action.engine_relative_endpoint + '/hooks/load' => 'actions#load', action_name: ActiveSupport::Inflector.parameterize(action.name)
       if action.hooks && action.hooks[:change].present?
-        post action.endpoint.sub('forest', '') + '/hooks/change' => 'actions#change', action_name: ActiveSupport::Inflector.parameterize(action.name)
+        post action.engine_relative_endpoint + '/hooks/change' => 'actions#change', action_name: ActiveSupport::Inflector.parameterize(action.name)
       end
     end
   end

data/lib/forest_liana/engine.rb

@@ -127,6 +127,32 @@ module ForestLiana
           end
         end
       end
+
+      ForestLiana::Engine.register_out_of_mount_hook_routes
+    end
+
+    # An endpoint outside the engine mount can only be served by the host router: a route drawn in
+    # the engine gets prefixed with the mount, where no client ever calls. Prepended so a host
+    # catch-all (SPA fallback) cannot shadow the hooks, and registered from after_initialize rather
+    # than from config/routes/actions.rb, which is re-evaluated on every reload and would stack a
+    # duplicate block per pass — prepended blocks persist across reloads on their own. Defined here
+    # so the block's closure captures this empty scope, not after_initialize's locals: the block is
+    # retained by the router for the process lifetime and would otherwise pin the bootstrapper.
+    def self.register_out_of_mount_hook_routes
+      Rails.application.routes.prepend do
+        ForestLiana.apimap.each do |collection|
+          collection.actions.each do |action|
+            next if action.endpoint_under_forest_mount?
+
+            post "#{action.absolute_endpoint}/hooks/load" => 'forest_liana/actions#load',
+              action_name: ActiveSupport::Inflector.parameterize(action.name)
+            if action.hooks && action.hooks[:change].present?
+              post "#{action.absolute_endpoint}/hooks/change" => 'forest_liana/actions#change',
+                action_name: ActiveSupport::Inflector.parameterize(action.name)
+            end
+          end
+        end
+      end
     end
   end
 end

data/lib/forest_liana/version.rb

@@ -1,3 +1,3 @@
 module ForestLiana
-  VERSION = "9.20.8"
+  VERSION = "9.20.10"
 end

data/spec/dummy/app/controllers/host_catch_all_controller.rb

@@ -0,0 +1,5 @@
+class HostCatchAllController < ActionController::Base
+  def index
+    render json: { caught_by: 'host catch-all' }
+  end
+end

data/spec/dummy/config/routes.rb

@@ -7,4 +7,7 @@ Rails.application.routes.draw do
   end
 
   mount ForestLiana::Engine => "/forest"
+
+  # Stands in for a host SPA fallback: hooks routes on out-of-mount endpoints must still win.
+  match '/api/*path', to: 'host_catch_all#index', via: :all
 end

data/spec/dummy/lib/forest_liana/collections/island.rb

@@ -180,6 +180,20 @@ class Forest::Island
       }
     }
 
+  action 'out_of_mount_action',
+    endpoint: '/api/custom/islands/out_of_mount_action',
+    fields: [foo],
+    hooks: {
+      :load => -> (context) {
+        context[:fields]
+      },
+      :change => {
+        'on_foo_changed' => -> (context) {
+          context[:fields]
+        }
+      }
+    }
+
   action 'multiple_enums_action',
     fields: [foo, multiple_enum],
     hooks: {

data/spec/models/forest_liana/model/action_spec.rb

@@ -0,0 +1,48 @@
+module ForestLiana
+  describe Model::Action do
+    def action_with(endpoint)
+      Model::Action.new(name: 'an action', endpoint: endpoint)
+    end
+
+    describe 'endpoint routing' do
+      it 'defaults to an endpoint under the mount, with or without a leading slash' do
+        action = Model::Action.new(name: 'an action')
+
+        expect(action.endpoint).to eq('forest/actions/an-action')
+        expect(action.endpoint_under_forest_mount?).to be true
+        expect(action.engine_relative_endpoint).to eq('/actions/an-action')
+
+        expect(action_with('/forest/actions/foo').endpoint_under_forest_mount?).to be true
+        expect(action_with('/forest/actions/foo').engine_relative_endpoint).to eq('/actions/foo')
+      end
+
+      it 'routes an endpoint outside the mount on the host, verbatim' do
+        action = action_with('/domains/organizations/suspensions/suspend')
+
+        expect(action.endpoint_under_forest_mount?).to be false
+        expect(action.absolute_endpoint).to eq('/domains/organizations/suspensions/suspend')
+      end
+
+      # A trailing or doubled slash would otherwise desynchronize the three consumers of the
+      # declared endpoint: the drawn route, the schema the UI appends /hooks/load to, and the
+      # permission lookup comparing request paths.
+      it 'normalizes redundant slashes at assignment, so every consumer sees one value' do
+        expect(action_with('/domains/x/suspend/').endpoint).to eq('/domains/x/suspend')
+        expect(action_with('//domains/x/suspend').endpoint).to eq('/domains/x/suspend')
+        expect(action_with('/domains/x/suspend/').absolute_endpoint).to eq('/domains/x/suspend')
+        expect(action_with('domains/x/suspend').endpoint).to eq('domains/x/suspend')
+        expect(action_with('/forest/actions/foo/').engine_relative_endpoint).to eq('/actions/foo')
+        expect(action_with('//forest/actions/foo').endpoint_under_forest_mount?).to be true
+      end
+
+      # `sub('forest', '')` used to match anywhere, mangling these into '/ry/actions/x' and '/my//x'.
+      it 'does not treat a path merely containing "forest" as being under the mount' do
+        expect(action_with('forestry/actions/x').endpoint_under_forest_mount?).to be false
+        expect(action_with('forestry/actions/x').absolute_endpoint).to eq('/forestry/actions/x')
+
+        expect(action_with('my/forest/x').endpoint_under_forest_mount?).to be false
+        expect(action_with('my/forest/x').absolute_endpoint).to eq('/my/forest/x')
+      end
+    end
+  end
+end

data/spec/requests/actions_controller_spec.rb

@@ -170,6 +170,53 @@ describe 'Requesting Actions routes', :type => :request  do
       end
     end
 
+    describe 'on an endpoint declared outside the engine mount' do
+      params = {
+        data: {
+          attributes: { ids: [1], collection_name: 'Island' }
+        }
+      }
+
+      # The dummy app declares a `/api/*path` catch-all standing in for a host SPA fallback: these
+      # routes have to outrank it, or the 404 this fix removes comes straight back.
+      it 'should serve /load at the endpoint the client calls' do
+        post '/api/custom/islands/out_of_mount_action/hooks/load', params: JSON.dump(params), headers: headers
+        expect(response.status).to eq(200)
+        expect(JSON.parse(response.body)['fields'].map { |field| field['field'] }).to eq(['foo'])
+      end
+
+      it 'should let the host catch-all keep every other path under it' do
+        post '/api/custom/islands/something_else', params: JSON.dump(params), headers: headers
+        expect(JSON.parse(response.body)).to eq({'caught_by' => 'host catch-all'})
+      end
+
+      it 'should serve /change at the endpoint the client calls' do
+        action = island.actions.select { |action| action.name == 'out_of_mount_action' }.first
+        foo = action.fields.select { |field| field[:field] == 'foo' }.first
+        updated_foo = foo.clone.merge({:previousValue => nil, :value => 'bar'})
+        p = {
+          data: {
+            attributes: {
+              ids: [1],
+              fields: [updated_foo],
+              collection_name: 'Island',
+              changed_field: 'foo'
+            }
+          }
+        }
+
+        post '/api/custom/islands/out_of_mount_action/hooks/change', params: JSON.dump(p), headers: headers
+        expect(response.status).to eq(200)
+        expect(JSON.parse(response.body)['fields'].map { |field| field['field'] }).to eq(['foo'])
+      end
+
+      it 'should not expose the hooks under the engine mount' do
+        expect {
+          post '/forest/api/custom/islands/out_of_mount_action/hooks/load', params: JSON.dump(params), headers: headers
+        }.to raise_error(ActionController::RoutingError)
+      end
+    end
+
     describe 'call /change' do
       it 'should respond 200' do
         action = island.actions.select { |action| action.name == 'my_action' }.first

data/spec/services/forest_liana/search_query_builder_spec.rb

@@ -16,6 +16,50 @@ module ForestLiana
     end
 
     describe '#perform' do
+      context 'when the search is a malformed UUID' do
+        # UUID-shaped but fails the strict REGEX_UUID (mistyped/truncated group).
+        # Starts with a letter so #to_i is 0 and adds no integer-`id` condition,
+        # leaving the text LIKE scans as the only possible matches.
+        let(:params) { { search: 'abcdef12-3456-4ae-ad4f-5662757713a2', searchExtended: '0' } }
+
+        before do
+          Tree.create!(name: 'Oak')
+          Tree.create!(name: 'Elm')
+        end
+
+        after { Tree.destroy_all }
+
+        it 'matches nothing instead of returning the unfiltered table' do
+          expect(builder.perform(Tree.all).count).to eq(0)
+        end
+      end
+
+      context 'when searchExtended is on and the search is a malformed UUID' do
+        # HashWithIndifferentAccess: the code reads @params['searchExtended'] (string).
+        let(:params) do
+          ActiveSupport::HashWithIndifferentAccess.new(
+            search: 'abcdef12-3456-4ae-ad4f-5662757713a2', searchExtended: '1'
+          )
+        end
+        let(:builder) { described_class.new(params, [:owner], collection, user) }
+
+        before { Tree.create!(name: 'Oak') }
+
+        after { Tree.destroy_all }
+
+        it 'does not build LIKE scans on associated text columns either' do
+          expect(builder.perform(Tree.all).to_sql).not_to match(/LIKE/i)
+        end
+      end
+
+      context 'when the search is a valid UUID' do
+        let(:params) { { search: '75fbcb43-f6f8-4cd1-861f-09a61fd1ddad', searchExtended: '0' } }
+
+        it 'still builds a LIKE scan on text columns (UUIDs stored as text)' do
+          expect(builder.perform(Tree.all).to_sql).to match(/LIKE/i)
+        end
+      end
+
       context 'when a column is an array uuid type' do
         let(:array_uuid_column) do
           double('Column', name: 'attachment_ids', type: :uuid, array: true).tap do |col|

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: forest_liana
 version: !ruby/object:Gem::Version
-  version: 9.20.8
+  version: 9.20.10
 platform: ruby
 authors:
 - Sandro Munda
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-05 00:00:00.000000000 Z
+date: 2026-08-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -371,6 +371,7 @@ files:
 - spec/dummy/app/config/routes.rb
 - spec/dummy/app/controllers/application_controller.rb
 - spec/dummy/app/controllers/forest/islands_controller.rb
+- spec/dummy/app/controllers/host_catch_all_controller.rb
 - spec/dummy/app/helpers/application_helper.rb
 - spec/dummy/app/models/address.rb
 - spec/dummy/app/models/application_record.rb
@@ -441,6 +442,7 @@ files:
 - spec/lib/forest_liana/collection_spec.rb
 - spec/lib/forest_liana/engine_spec.rb
 - spec/lib/forest_liana/schema_file_updater_spec.rb
+- spec/models/forest_liana/model/action_spec.rb
 - spec/rails_helper.rb
 - spec/requests/actions_controller_spec.rb
 - spec/requests/authentications_spec.rb
@@ -684,6 +686,7 @@ test_files:
 - spec/dummy/app/config/routes.rb
 - spec/dummy/app/controllers/application_controller.rb
 - spec/dummy/app/controllers/forest/islands_controller.rb
+- spec/dummy/app/controllers/host_catch_all_controller.rb
 - spec/dummy/app/helpers/application_helper.rb
 - spec/dummy/app/models/address.rb
 - spec/dummy/app/models/application_record.rb
@@ -754,6 +757,7 @@ test_files:
 - spec/lib/forest_liana/collection_spec.rb
 - spec/lib/forest_liana/engine_spec.rb
 - spec/lib/forest_liana/schema_file_updater_spec.rb
+- spec/models/forest_liana/model/action_spec.rb
 - spec/rails_helper.rb
 - spec/requests/actions_controller_spec.rb
 - spec/requests/authentications_spec.rb