forest_liana 9.22.12 → 9.22.13

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e9584149ffb7d20be9b8f4dacd36f5bf1d95c5276b1b34f35d86e750e0f696f2
-  data.tar.gz: 2d24e798d72ec62aabec3ebe9fdb070f857c8e511b02d4bbe8e8ce1880e03032
+  metadata.gz: fcbf97d59c4b454c53e5f068f969e8e503e2a722c1a011e2d03b7f9e73a0c152
+  data.tar.gz: cd6608d3c224d6daaedd240928a34cec77d49c35bfdf52fdb0d5b5187a23cf02
 SHA512:
-  metadata.gz: 87d06d138209e8ca03019c971e0aa24e0c55bb8f71f03df225cf8de312f2fcb7dbac04cd398308c8a2768f7226b9c36e06ccdbed6d63225a5abe5a0bc26cc448
-  data.tar.gz: 31a54daccf9d158680b28d5747f35a467943f94a779448f812f43dfe8f84ba9cd921297dc930a958d7b6bd1660f8d3becd15abb50480db9c516d8b7a21e98508
+  metadata.gz: 78dd9047c6f8647076342d0a99f223ad66c7c33590b6b8be4726901d4aa6b057eb97eb4137cd6de3852fcf06d505621b77e6d6b653bb699443e753b57955a782
+  data.tar.gz: c0dc2372c158fb2f86929279b3594ae6aec5b2270ae6fd74a19871c7dc26af89b0b20d8d5f8a822ddd6147ab11d89413f80df582168ea31e41e7fac847c2e430

data/app/controllers/forest_liana/actions_controller.rb

@@ -47,6 +47,12 @@ module ForestLiana
       {:field_changed => found_field_changed, :fields => fields, :params => params, :user => forest_user}
     end
 
+    def ensure_single_record_selection(action, attributes)
+      return if SingleRecordSelection.allowed?(action, attributes)
+
+      raise ForestLiana::Errors::HTTP422Error.new(SingleRecordSelection::MESSAGE)
+    end
+
     def handle_result(result, action)
       if result.nil? || !result.is_a?(Array)
         return render status: 500, json: { error: 'Error in smart action load hook: hook must return an array of fields' }
@@ -104,6 +110,8 @@ module ForestLiana
       if !action
         render status: 500, json: {error: 'Error in smart action load hook: cannot retrieve action from collection'}
       else
+        ensure_single_record_selection(action, load_request)
+
         # Get the smart action hook load context
         context = get_smart_action_load_ctx(action.fields)
 
@@ -132,6 +140,8 @@ module ForestLiana
         return render status: 500, json: {error: 'Error in smart action change hook: fields params must be an array'}
       end
 
+      ensure_single_record_selection(action, change_request)
+
       # Get the smart action hook change context
       context = get_smart_action_change_ctx(change_request[:fields], change_request[:changed_field])
 

data/app/services/forest_liana/ability/permission.rb

@@ -35,6 +35,7 @@ module ForestLiana
       end
 
       def is_smart_action_authorized?(user, collection, parameters, endpoint, http_method)
+        ensure_single_record_selection(collection, parameters, endpoint, http_method)
         return true unless has_permission_system?
 
         user_data = get_user_data(user['id'])
@@ -348,6 +349,24 @@ module ForestLiana
         actions
       end
 
+      def ensure_single_record_selection(collection, parameters, endpoint, http_method)
+        schema_action = find_action_from_endpoint(ForestLiana.name_for(collection), endpoint, http_method)
+        return unless schema_action&.type == 'single'
+
+        selections = [parameters[:data][:attributes], signed_approval_attributes(parameters)].compact
+        return if selections.all? { |attributes| SingleRecordSelection.allowed?(schema_action, attributes) }
+
+        raise ForestLiana::Errors::HTTP422Error.new(SingleRecordSelection::MESSAGE)
+      end
+
+      def signed_approval_attributes(parameters)
+        return unless parameters[:data][:attributes][:signed_approval_request]
+
+        RequestPermission.decodeSignedApprovalRequest(parameters)[:data][:attributes]
+      rescue JWT::DecodeError
+        nil
+      end
+
       def find_action_from_endpoint(collection_name, endpoint, http_method)
         collection = ForestLiana.apimap.find { |collection| collection.name.to_s == collection_name }
 

data/app/services/forest_liana/single_record_selection.rb

@@ -0,0 +1,11 @@
+module ForestLiana
+  module SingleRecordSelection
+    MESSAGE = 'This action can only be triggered on one record at a time.'
+
+    def self.allowed?(action, attributes)
+      return true unless action&.type == 'single'
+
+      !attributes[:all_records] && Array(attributes[:ids]).length == 1
+    end
+  end
+end

data/lib/forest_liana/version.rb

@@ -1,3 +1,3 @@
 module ForestLiana
-  VERSION = "9.22.12"
+  VERSION = "9.22.13"
 end

data/spec/requests/actions_controller_spec.rb

@@ -217,6 +217,47 @@ describe 'Requesting Actions routes', :type => :request  do
       end
     end
 
+    describe 'on a single-record action' do
+      let(:single_record_error) { 'This action can only be triggered on one record at a time.' }
+
+      before do
+        action = island.actions.find { |action| action.name == 'my_action' }
+        allow(action).to receive(:type).and_return('single')
+      end
+
+      def hook_params(attributes)
+        JSON.dump(data: { attributes: { collection_name: 'Island' }.merge(attributes) })
+      end
+
+      [
+        ['two ids', { ids: [1, 2] }],
+        ['no id', { ids: [] }],
+        ['a select-all', { ids: [1], all_records: true }],
+      ].each do |description, selection|
+        it "should refuse to load the form given #{description}" do
+          post '/forest/actions/my_action/hooks/load', params: hook_params(selection), headers: headers
+
+          expect(response.status).to eq(422)
+          expect(response.body).to include(single_record_error)
+        end
+      end
+
+      it 'should refuse a change given two ids' do
+        post '/forest/actions/my_action/hooks/change',
+          params: hook_params(ids: [1, 2], fields: [{ field: 'foo', hook: 'on_foo_changed' }], changed_field: 'foo'),
+          headers: headers
+
+        expect(response.status).to eq(422)
+        expect(response.body).to include(single_record_error)
+      end
+
+      it 'should load the form on exactly one id' do
+        post '/forest/actions/my_action/hooks/load', params: hook_params(ids: [1]), headers: headers
+
+        expect(response.status).to eq(200)
+      end
+    end
+
     describe 'call /change' do
       it 'should respond 200' do
         action = island.actions.select { |action| action.name == 'my_action' }.first

data/spec/services/forest_liana/ability/permission_spec.rb

@@ -428,6 +428,80 @@ module ForestLiana
           expect {dummy_class.is_smart_action_authorized?(user, String, parameters, '/forest/actions/my_action', 'POST')}
             .to raise_error(ForestLiana::Ability::Exceptions::UnknownCollection, 'The collection String doesn\'t exist')
         end
+
+        it 'should run a bulk action on several ids' do
+          parameters[:data][:attributes][:ids] = ['1', '2']
+
+          expect(dummy_class.is_smart_action_authorized?(user, Island, parameters, '/forest/actions/my_action', 'POST')).to equal true
+        end
+
+        describe 'with a single-record action' do
+          let(:single_record_error) { 'This action can only be triggered on one record at a time.' }
+
+          before do
+            island_action = ForestLiana.apimap.find { |collection| collection.name.to_s == 'Island' }
+              .actions.find { |action| action.name == 'my_action' }
+            allow(island_action).to receive(:type).and_return('single')
+          end
+
+          it 'should return true on exactly one id' do
+            expect(dummy_class.is_smart_action_authorized?(user, Island, parameters, '/forest/actions/my_action', 'POST')).to equal true
+          end
+
+          [
+            ['two ids', { ids: ['1', '2'] }],
+            ['no id', { ids: [] }],
+            ['a select-all', { ids: ['1'], all_records: true }],
+          ].each do |description, selection|
+            it "should refuse #{description} before checking permissions" do
+              parameters[:data][:attributes].merge!(selection)
+              expect(SmartActionChecker).not_to receive(:new)
+
+              expect { dummy_class.is_smart_action_authorized?(user, Island, parameters, '/forest/actions/my_action', 'POST') }
+                .to raise_error(ForestLiana::Errors::HTTP422Error, single_record_error)
+            end
+          end
+
+          def sign(ids)
+            JWT.encode(
+              { data: { attributes: parameters[:data][:attributes].to_h.merge(ids: ids, requester_id: 2) } },
+              ForestLiana.env_secret,
+              'HS256'
+            )
+          end
+
+          it 'should refuse to approve a request naming several ids' do
+            parameters[:data][:attributes][:signed_approval_request] = sign(['1', '2'])
+            expect(SmartActionChecker).not_to receive(:new)
+
+            expect { dummy_class.is_smart_action_authorized?(user, Island, parameters, '/forest/actions/my_action', 'POST') }
+              .to raise_error(ForestLiana::Errors::HTTP422Error, single_record_error)
+          end
+
+          it 'should refuse several ids sent beside a signed request naming one' do
+            parameters[:data][:attributes][:ids] = ['1', '2']
+            parameters[:data][:attributes][:signed_approval_request] = sign(['1'])
+            expect(SmartActionChecker).not_to receive(:new)
+
+            expect { dummy_class.is_smart_action_authorized?(user, Island, parameters, '/forest/actions/my_action', 'POST') }
+              .to raise_error(ForestLiana::Errors::HTTP422Error, single_record_error)
+          end
+
+          it 'should leave an undecodable signed request to the permission check' do
+            parameters[:data][:attributes][:signed_approval_request] = 'not-a-jwt'
+            expect(Permission::SmartActionChecker).to receive(:new).and_return(instance_double(Permission::SmartActionChecker, can_execute?: true))
+
+            expect(dummy_class.is_smart_action_authorized?(user, Island, parameters, '/forest/actions/my_action', 'POST')).to equal true
+          end
+
+          it 'should refuse several ids without a permission system' do
+            Rails.cache.write('forest.has_permission', false)
+            parameters[:data][:attributes][:ids] = ['1', '2']
+
+            expect { dummy_class.is_smart_action_authorized?(user, Island, parameters, '/forest/actions/my_action', 'POST') }
+              .to raise_error(ForestLiana::Errors::HTTP422Error, single_record_error)
+          end
+        end
       end
 
       describe 'when the server doesn\'t return an success response' do

data/spec/services/forest_liana/search_query_builder_spec.rb

@@ -751,6 +751,7 @@ module ForestLiana
 
       before do
         Rails.cache.write('forest.has_permission', false)
+        allow(ForestLiana::ScopeManager).to receive(:fetch_scopes).and_return({ 'scopes' => {}, 'team' => { 'id' => '1', 'name' => 'Operations' } })
         allow(ForestLiana::ScopeManager).to receive(:append_scope).and_call_original
         allow(ForestLiana::ScopeManager).to receive(:get_scope).and_return(nil)
       end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: forest_liana
 version: !ruby/object:Gem::Version
-  version: 9.22.12
+  version: 9.22.13
 platform: ruby
 authors:
 - Sandro Munda
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-13 00:00:00.000000000 Z
+date: 2026-10-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -332,6 +332,7 @@ files:
 - app/services/forest_liana/schema_utils.rb
 - app/services/forest_liana/scope_manager.rb
 - app/services/forest_liana/search_query_builder.rb
+- app/services/forest_liana/single_record_selection.rb
 - app/services/forest_liana/smart_action_field_validator.rb
 - app/services/forest_liana/smart_action_form_parser.rb
 - app/services/forest_liana/smart_field_dependencies.rb