forest_liana 9.22.13 → 9.22.15

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fcbf97d59c4b454c53e5f068f969e8e503e2a722c1a011e2d03b7f9e73a0c152
-  data.tar.gz: cd6608d3c224d6daaedd240928a34cec77d49c35bfdf52fdb0d5b5187a23cf02
+  metadata.gz: dc9e247d2d65125925e14127a256acb70326504b4c1e2fc90daaf3b792736025
+  data.tar.gz: 7039ebbb67be595efd366b94d57a35881448f9747cba39cf2e8e35b1f88a083e
 SHA512:
-  metadata.gz: 78dd9047c6f8647076342d0a99f223ad66c7c33590b6b8be4726901d4aa6b057eb97eb4137cd6de3852fcf06d505621b77e6d6b653bb699443e753b57955a782
-  data.tar.gz: c0dc2372c158fb2f86929279b3594ae6aec5b2270ae6fd74a19871c7dc26af89b0b20d8d5f8a822ddd6147ab11d89413f80df582168ea31e41e7fac847c2e430
+  metadata.gz: 3bf2d66f16eaedc067bfca8422a0274255bc9bc6d86057e251bdb65dd41191859e02344f2712356511c437bf03a525c5ff11b2a7f4ebb972104420baafcd1fbc
+  data.tar.gz: 07b0b79be5105719f3cffbb590717731031d3e1cd0fc81eb6e5d2c72a60f7413e411661f4f301a97294fc08e4cadac9e1d547ceb9c9cec1b9b0bbeadae569b3b

data/app/controllers/forest_liana/devise_controller.rb

@@ -1,11 +1,15 @@
 module ForestLiana
-  class DeviseController < ForestLiana::ApplicationController
-    def change_password
-      resource = SchemaUtils.find_model_from_collection_name(
-        params['data']['attributes']['collection_name'])
+  class DeviseController < ForestLiana::SmartActionsController
+    rescue_from ActiveRecord::RecordNotFound, with: :render_target_not_found
 
-      user = resource.find(params['data']['attributes']['ids'].first)
-      user.password = params['data']['attributes']['values']['New password']
+    def change_password
+      attributes = @parameters[:data][:attributes]
+      # The inherited scope check skips composite primary keys.
+      scoped_records = ForestLiana::ScopeManager.apply_scopes_on_records(
+        @resource, forest_user, ForestLiana.name_for(@resource), @parameters[:timezone]
+      )
+      user = scoped_records.find(attributes[:ids].first)
+      user.password = attributes[:values]['New password']
       user.save
 
       if user.valid?
@@ -16,6 +20,11 @@ module ForestLiana
         }
       end
     end
+
+    private
+
+    def render_target_not_found
+      render serializer: nil, json: { error: 'Smart Action: target record not found' }, status: :bad_request
+    end
   end
 end
-

data/app/controllers/forest_liana/smart_actions_controller.rb

@@ -6,11 +6,13 @@ module ForestLiana
     rescue_from ForestLiana::Ability::Exceptions::ActionConditionError, with: :render_error
     include ForestLiana::Ability
     if Rails::VERSION::MAJOR < 4
+      before_filter :refuse_requester_id_outside_signed_request
       before_filter :get_smart_action_request
       before_filter :find_resource
       before_filter :check_permission_for_smart_route
       before_filter :ensure_record_ids_in_scope
     else
+      before_action :refuse_requester_id_outside_signed_request
       before_action :get_smart_action_request
       before_action :find_resource
       before_action :check_permission_for_smart_route
@@ -19,6 +21,10 @@ module ForestLiana
 
     private
 
+    def refuse_requester_id_outside_signed_request
+      raise ForestLiana::Errors::HTTP422Error.new if params.dig(:data, :attributes, :requester_id)
+    end
+
     def get_smart_action_request
       begin
         params[:data][:attributes]

data/app/services/forest_liana/query_stat_getter.rb

@@ -13,14 +13,11 @@ module ForestLiana
     end
 
     def perform
-      context_variables = Utils::ContextVariables.new(nil, nil, @params['contextVariables'])
-      raw_query = Utils::ContextVariablesInjector.inject_context_in_value(@params['query'].strip, context_variables)
-
-      LiveQueryChecker.new(raw_query, 'Live Query Chart').validate()
+      query = @params['query'].strip
+      LiveQueryChecker.new(query, 'Live Query Chart').validate()
 
-      if @params['record_id']
-        raw_query.gsub!('?', @params['record_id'].to_s)
-      end
+      context_variables = Utils::ContextVariables.new(nil, nil, @params['contextVariables'])
+      raw_query = Utils::LiveQueryInjector.inject(query, context_variables, @params['record_id'])
       result = ActiveRecord::Base.connection.execute(raw_query)
 
       case @params['type']

data/app/services/forest_liana/schema_adapter.rb

@@ -32,6 +32,7 @@ module ForestLiana
         collection.actions << ForestLiana::Model::Action.new({
           id: "#{collection.name}.Change password",
           name: "Change password",
+          type: 'single',
           fields: [{
             field: 'New password',
             type: 'String'

data/app/services/forest_liana/utils/context_variables_injector.rb

@@ -1,30 +1,33 @@
 module ForestLiana
   module Utils
     class ContextVariablesInjector
+      PLACEHOLDER = /{{([^}]+)}}/
 
       def self.inject_context_in_value(value, context_variables)
         inject_context_in_value_custom(value) do |context_variable_key|
-          value = context_variables.get_value(context_variable_key)
-          if value.nil?
-            available_keys = context_variables.respond_to?(:keys) ? context_variables.keys.join(', ') : 'unknown'
-            available_context = context_variables.inspect
-            error_message = "Unknown context variable: '#{context_variable_key}'. " \
-                          "Please check the query for any typos. " \
-                          "Available context variables: #{available_keys}. "
-            raise error_message
-          end
-          value.is_a?(Array) || value.is_a?(Hash) ? value.to_json : value.to_s
+          context_value(context_variable_key, context_variables)
         end
       end
 
+      def self.context_value(context_variable_key, context_variables)
+        value = context_variables.get_value(context_variable_key)
+        if value.nil?
+          available_keys = context_variables.respond_to?(:keys) ? context_variables.keys.join(', ') : 'unknown'
+          error_message = "Unknown context variable: '#{context_variable_key}'. " \
+                        "Please check the query for any typos. " \
+                        "Available context variables: #{available_keys}. "
+          raise error_message
+        end
+        value.is_a?(Array) || value.is_a?(Hash) ? value.to_json : value.to_s
+      end
+
       def self.inject_context_in_value_custom(value)
         return value unless value.is_a?(String)
 
         value_with_context_variables_injected = value
-        regex = /{{([^}]+)}}/
         encountered_variables = []
 
-        while (match = regex.match(value_with_context_variables_injected))
+        while (match = PLACEHOLDER.match(value_with_context_variables_injected))
           context_variable_key = match[1]
 
           value_with_context_variables_injected = value_with_context_variables_injected.gsub(

data/app/services/forest_liana/utils/live_query_injector.rb

@@ -0,0 +1,136 @@
+require 'strscan'
+
+module ForestLiana
+  module Utils
+    class LiveQueryInjector
+      PLACEHOLDER = Regexp.union(ContextVariablesInjector::PLACEHOLDER, '?')
+      VERBATIM_VALUE = /\A(?:\d+(?:\.\d+)?(?:,\d+(?:\.\d+)?)*|true|false)\z/i
+      CHARACTERS_CLOSING_QUOTED_TEXT = /["`'\\$\]\r\n\0]/
+      LINE_COMMENT = /--[^\n]*/
+      MYSQL_LINE_COMMENT = /--(?=[[:space:][:cntrl:]]|\z)[^\n]*/
+      BLOCK_COMMENT = %r{/\*.*?(?:\*/|\z)}m
+      NESTED_BLOCK_COMMENT = %r{(?<comment>/\*(?:[^/*]|/(?!\*)|\*(?!/)|\g<comment>)*(?:\*/|\z))}m
+      BRACKET_QUOTED = /\[[^\]]*\]?/
+      WORD = /[[:alpha:]_][[:alnum:]_$]*/
+      STRING_CONTINUATION = /[ \t\f\r]*\n[[:space:]]*(?=')/
+      DOLLAR_QUOTED = /\$([[:alpha:]_][[:alnum:]_]*|)\$.*?(?:\$\1\$|\z)/m
+
+      def self.inject(query, context_variables, record_id, connection = ActiveRecord::Base.connection)
+        new(context_variables, record_id, connection).inject(query)
+      end
+
+      def initialize(context_variables, record_id, connection)
+        @context_variables = context_variables
+        @record_id = record_id
+        @connection = connection
+        @mysql = connection.adapter_name.match?(/mysql|trilogy/i)
+        @postgresql = connection.adapter_name.match?(/postg/i)
+        @bracket_quotes = connection.adapter_name.match?(/sqlite|sqlserver/i)
+        @nested_comments = @postgresql || connection.adapter_name.match?(/sqlserver/i)
+        @backslash_escapes = @mysql && mysql_backslash_escapes?
+      end
+
+      def inject(query)
+        scanner = StringScanner.new(query)
+        injected = +''
+        injected << next_token(scanner) until scanner.eos?
+        injected
+      end
+
+      private
+
+      def next_token(scanner)
+        if (comment = scan_comment(scanner))
+          comment
+        elsif (word = scanner.scan(WORD))
+          return word unless @postgresql && word.casecmp?('e') && scanner.peek(1) == "'"
+
+          word + inject_in_string(scan_escape_string(scanner), backslash_escapes: true, escape_backslashes: true)
+        elsif (string = scanner.scan(quoted_pattern("'", backslash_escapes: @backslash_escapes)))
+          inject_in_string(string, backslash_escapes: @backslash_escapes, escape_backslashes: false)
+        elsif (quoted = scan_quoted_text(scanner))
+          inject_in_quoted_text(quoted)
+        elsif (placeholder = scanner.scan(PLACEHOLDER))
+          inject_in_code(placeholder)
+        else
+          scanner.getch
+        end
+      end
+
+      def mysql_backslash_escapes?
+        !@connection.select_value('SELECT @@SESSION.sql_mode').to_s.include?('NO_BACKSLASH_ESCAPES')
+      end
+
+      def scan_comment(scanner)
+        scanner.scan(@mysql ? MYSQL_LINE_COMMENT : LINE_COMMENT) ||
+          scanner.scan(@nested_comments ? NESTED_BLOCK_COMMENT : BLOCK_COMMENT) ||
+          (@mysql && scanner.scan(/#[^\n]*/))
+      end
+
+      def scan_escape_string(scanner)
+        escape_string = scanner.scan(quoted_pattern("'", backslash_escapes: true))
+        while (continuation = scanner.scan(STRING_CONTINUATION))
+          escape_string << continuation << scanner.scan(quoted_pattern("'", backslash_escapes: true))
+        end
+        escape_string
+      end
+
+      def scan_quoted_text(scanner)
+        scanner.scan(quoted_pattern('"', backslash_escapes: @backslash_escapes)) ||
+          scanner.scan(quoted_pattern('`')) ||
+          (@postgresql && scanner.scan(DOLLAR_QUOTED)) ||
+          (@bracket_quotes && scanner.scan(BRACKET_QUOTED))
+      end
+
+      def quoted_pattern(quote, backslash_escapes: false)
+        escaped = Regexp.escape(quote)
+        content = backslash_escapes ? "[^#{escaped}\\\\]|\\\\.|#{escaped}#{escaped}" : "[^#{escaped}]|#{escaped}#{escaped}"
+        /#{escaped}(?:#{content})*#{escaped}?/m
+      end
+
+      def inject_in_code(placeholder)
+        replace_placeholders(placeholder) do |text|
+          text.match?(VERBATIM_VALUE) ? text : @connection.quote(text)
+        end
+      end
+
+      def inject_in_string(string, backslash_escapes:, escape_backslashes:)
+        replace_placeholders(string) do |text, placeholder, preceding_text|
+          if backslash_escapes && preceding_text[/\\*\z/].length.odd?
+            raise ForestLiana::Errors::LiveQueryError.new(
+              "Live Query Chart: #{placeholder} cannot follow a backslash inside a string."
+            )
+          end
+          escape_backslashes ? text.gsub(/[\\']/) { |character| character * 2 } : @connection.quote_string(text)
+        end
+      end
+
+      def inject_in_quoted_text(quoted)
+        replace_placeholders(quoted) do |text, placeholder|
+          if text.match?(CHARACTERS_CLOSING_QUOTED_TEXT)
+            raise ForestLiana::Errors::LiveQueryError.new(
+              "Live Query Chart: The value of #{placeholder} cannot contain quotes, brackets, backslashes, " \
+              'dollar signs or line breaks when it is written inside a quoted identifier or a dollar-quoted string.'
+            )
+          end
+          text
+        end
+      end
+
+      def replace_placeholders(text)
+        text.gsub(PLACEHOLDER) do |placeholder|
+          context_variable_key = Regexp.last_match(1)
+          preceding_text = Regexp.last_match.pre_match
+          if context_variable_key
+            value = ContextVariablesInjector.context_value(context_variable_key, @context_variables)
+            yield(value, placeholder, preceding_text)
+          elsif @record_id.nil?
+            placeholder
+          else
+            yield(@record_id.to_s, placeholder, preceding_text)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/forest_liana/version.rb

@@ -1,3 +1,3 @@
 module ForestLiana
-  VERSION = "9.22.13"
+  VERSION = "9.22.15"
 end

data/spec/requests/actions_controller_spec.rb

@@ -563,6 +563,17 @@ describe 'Requesting Actions routes', :type => :request  do
       end
     end
 
+    describe 'with a requester named outside a signed approval request' do
+      it 'should respond 422 and NOT perform the action' do
+        params[:data][:attributes][:requester_id] = 99
+        expect_any_instance_of(Forest::IslandsController).not_to receive(:test)
+
+        post '/forest/actions/test', params: JSON.dump(params), headers: headers
+
+        expect(response.status).to eq(422)
+      end
+    end
+
     describe 'with scopes' do
       before(:each) do
         allow_any_instance_of(ForestLiana::Ability).to receive(:forest_authorize!) { true }

data/spec/requests/devise_controller_spec.rb

@@ -0,0 +1,271 @@
+require 'rails_helper'
+
+describe 'Change password action', type: :request do
+  let(:rendering_id) { 13 }
+  let(:role_id) { 1 }
+  let(:trigger_roles) { [role_id] }
+  let(:approval_roles) { [] }
+  let(:approver_roles) { [] }
+  let(:scope_filters) { { 'scopes' => {}, 'team' => { 'id' => '1', 'name' => 'Operations' } } }
+  let(:cache) { ActiveSupport::Cache::MemoryStore.new }
+  let(:island_collection) { ForestLiana.apimap.find { |collection| collection.name.to_s == 'Island' } }
+  let(:change_password_action) do
+    ForestLiana::Model::Action.new(
+      id: 'Island.Change password',
+      name: 'Change password',
+      type: 'single',
+      fields: [{ field: 'New password', type: 'String' }]
+    )
+  end
+
+  let(:token) do
+    JWT.encode({
+      id: 38,
+      email: 'michael.kelso@that70.show',
+      first_name: 'Michael',
+      last_name: 'Kelso',
+      team: 'Operations',
+      rendering_id: rendering_id,
+      exp: Time.now.to_i + 2.weeks.to_i,
+      permission_level: 'user'
+    }, ForestLiana.auth_secret, 'HS256')
+  end
+
+  let(:headers) do
+    {
+      'Accept' => 'application/json',
+      'Content-Type' => 'application/json',
+      'Authorization' => "Bearer #{token}"
+    }
+  end
+
+  let(:attributes) do
+    {
+      collection_name: 'Island',
+      ids: ['1'],
+      all_records: false,
+      values: { 'New password' => 'n3w-p4ssw0rd' },
+      smart_action_id: 'Island-Change password'
+    }
+  end
+
+  let(:params) { { data: { attributes: attributes, type: 'custom-action-requests' }, timezone: 'Europe/Paris' } }
+
+  def environment_permissions
+    enabled = { 'roles' => [role_id] }
+    crud = %w[browseEnabled readEnabled editEnabled addEnabled deleteEnabled exportEnabled].to_h { |key| [key, enabled] }
+    change_password = {
+      'triggerEnabled' => { 'roles' => trigger_roles },
+      'triggerConditions' => [],
+      'approvalRequired' => { 'roles' => approval_roles },
+      'approvalRequiredConditions' => [],
+      'userApprovalEnabled' => { 'roles' => approver_roles },
+      'userApprovalConditions' => [],
+      'selfApprovalEnabled' => { 'roles' => [] }
+    }
+
+    { 'collections' => { 'Island' => { 'collection' => crud, 'actions' => { 'Change password' => change_password } } } }
+  end
+
+  before(:all) { Island.send(:attr_accessor, :password) }
+  after(:all) { Island.send(:remove_method, :password, :password=) }
+
+  before do
+    island_collection.actions << change_password_action
+    Island.create!(id: 1, name: 'Corsica')
+
+    allow(Rails).to receive(:cache).and_return(cache)
+    allow_any_instance_of(ForestLiana::Ability::Fetch).to receive(:get_permissions) do |_, path|
+      case path
+      when '/liana/v4/permissions/environment' then environment_permissions
+      when '/liana/v4/permissions/users' then [{ 'id' => 38, 'roleId' => role_id }]
+      end
+    end
+
+    ForestLiana::ScopeManager.invalidate_scope_cache(rendering_id)
+    allow(ForestLiana::ScopeManager).to receive(:fetch_scopes).and_return(scope_filters)
+    allow(ForestLiana::IpWhitelist).to receive(:is_ip_whitelist_retrieved) { true }
+    allow(ForestLiana::IpWhitelist).to receive(:is_ip_valid) { true }
+  end
+
+  after do
+    island_collection.actions.delete(change_password_action)
+    Island.destroy_all
+  end
+
+  def change_password
+    post '/forest/actions/change-password', params: JSON.dump(params), headers: headers
+  end
+
+  context 'when the user is allowed to trigger the action on the collection' do
+    it 'responds 204 and sets the new password on the targeted record' do
+      expect_any_instance_of(Island).to receive(:password=).with('n3w-p4ssw0rd').and_call_original
+
+      change_password
+
+      expect(response.status).to eq(204)
+    end
+  end
+
+  context 'when the user scope excludes the targeted record at lookup' do
+    it 'resolves the record within the user scope and leaves the password unchanged' do
+      expect(ForestLiana::ScopeManager).to receive(:apply_scopes_on_records)
+        .with(Island, hash_including('id' => 38, 'rendering_id' => rendering_id), 'Island', 'Europe/Paris')
+        .and_return(Island.none)
+      expect_any_instance_of(Island).not_to receive(:password=)
+
+      change_password
+
+      expect(response.status).to eq(400)
+      expect(JSON.parse(response.body)).to eq('error' => 'Smart Action: target record not found')
+    end
+  end
+
+  context 'when the user is not allowed to trigger the action on the collection' do
+    let(:trigger_roles) { [] }
+
+    it 'responds 403 and leaves the password unchanged' do
+      expect_any_instance_of(Island).not_to receive(:password=)
+
+      change_password
+
+      expect(response.status).to eq(403)
+      expect(JSON.parse(response.body)['errors'].first).to include(
+        'name' => 'CustomActionTriggerForbiddenError',
+        'detail' => "You don't have the permission to trigger this action"
+      )
+    end
+  end
+
+  context 'when the user role must have the action approved' do
+    let(:approval_roles) { [role_id] }
+
+    it 'responds 403 asking for approval and leaves the password unchanged' do
+      expect_any_instance_of(Island).not_to receive(:password=)
+
+      change_password
+
+      expect(response.status).to eq(403)
+      expect(JSON.parse(response.body)['errors'].first).to include(
+        'name' => 'CustomActionRequiresApprovalError',
+        'detail' => 'This action requires to be approved.'
+      )
+    end
+  end
+
+  context 'when the request carries no smart action id' do
+    let(:attributes) { super().except(:smart_action_id) }
+
+    it 'responds 400 and leaves the password unchanged' do
+      expect_any_instance_of(Island).not_to receive(:password=)
+
+      change_password
+
+      expect(response.status).to eq(400)
+    end
+  end
+
+  context 'when the targeted record is outside the user scope' do
+    let(:scope_filters) do
+      {
+        'scopes' => {
+          'Island' => {
+            'aggregator' => 'and',
+            'conditions' => [{ 'field' => 'name', 'operator' => 'equal', 'value' => 'Ré' }]
+          }
+        },
+        'team' => { 'id' => 43, 'name' => 'Operations' }
+      }
+    end
+
+    it 'responds 400 and leaves the password unchanged' do
+      expect_any_instance_of(Island).not_to receive(:password=)
+
+      change_password
+
+      expect(response.status).to eq(400)
+      expect(JSON.parse(response.body)).to eq('error' => 'Smart Action: target record not found')
+    end
+  end
+
+  context 'when the request selects all records' do
+    let(:attributes) { super().merge(all_records: true, all_records_ids_excluded: []) }
+
+    it 'responds 422 and leaves the password unchanged' do
+      expect_any_instance_of(Island).not_to receive(:password=)
+
+      change_password
+
+      expect(response.status).to eq(422)
+      expect(JSON.parse(response.body)['errors'].first).to include('detail' => ForestLiana::SingleRecordSelection::MESSAGE)
+    end
+  end
+
+  context 'when the request targets several records' do
+    let(:attributes) { super().merge(ids: %w[1 2]) }
+
+    it 'responds 422 and leaves the password unchanged' do
+      expect_any_instance_of(Island).not_to receive(:password=)
+
+      change_password
+
+      expect(response.status).to eq(422)
+      expect(JSON.parse(response.body)['errors'].first).to include('detail' => ForestLiana::SingleRecordSelection::MESSAGE)
+    end
+  end
+
+  context 'when the request names a requester outside a signed approval request' do
+    let(:attributes) { super().merge(requester_id: 99) }
+
+    it 'responds 422 and leaves the password unchanged' do
+      expect_any_instance_of(Island).not_to receive(:password=)
+
+      change_password
+
+      expect(response.status).to eq(422)
+    end
+  end
+
+  context 'when an approver executes a signed approval request' do
+    let(:approval_roles) { [role_id] }
+    let(:approver_roles) { [role_id] }
+    let(:approved_ids) { ['1'] }
+    let(:signed_approval_request) do
+      JWT.encode(
+        { data: { attributes: attributes.merge(ids: approved_ids, requester_id: 99) } },
+        ForestLiana.env_secret,
+        'HS256'
+      )
+    end
+    let(:params) do
+      {
+        data: {
+          attributes: attributes.except(:values).merge(signed_approval_request: signed_approval_request),
+          type: 'custom-action-requests'
+        },
+        timezone: 'Europe/Paris'
+      }
+    end
+
+    it 'responds 204 and sets the approved password on the targeted record' do
+      expect_any_instance_of(Island).to receive(:password=).with('n3w-p4ssw0rd').and_call_original
+
+      change_password
+
+      expect(response.status).to eq(204)
+    end
+
+    context 'and the approved request targets several records' do
+      let(:approved_ids) { %w[1 2] }
+
+      it 'responds 422 and leaves the password unchanged' do
+        expect_any_instance_of(Island).not_to receive(:password=)
+
+        change_password
+
+        expect(response.status).to eq(422)
+        expect(JSON.parse(response.body)['errors'].first).to include('detail' => ForestLiana::SingleRecordSelection::MESSAGE)
+      end
+    end
+  end
+end

data/spec/services/forest_liana/query_stat_getter_spec.rb

@@ -0,0 +1,267 @@
+module ForestLiana
+  describe QueryStatGetter do
+    let!(:aragorn) { User.create!(name: 'Aragorn') }
+    let!(:obrien) { User.create!(name: "O'Brien") }
+    let!(:sam) { User.create!(name: 'Sam') }
+
+    def value_of(query, record_id: nil, context_variables: nil)
+      params = { 'type' => 'Value', 'query' => query }
+      params['record_id'] = record_id unless record_id.nil?
+      params['contextVariables'] = context_variables unless context_variables.nil?
+
+      getter = QueryStatGetter.new(params)
+      getter.perform
+      getter.record.value[:countCurrent]
+    end
+
+    describe 'record id' do
+      it 'matches the record whose integer id replaces ?' do
+        expect(value_of('SELECT COUNT(*) AS value FROM users WHERE id = ?', record_id: aragorn.id)).to eq(1)
+      end
+
+      it 'matches the record whose integer id is sent as a string' do
+        expect(value_of('SELECT COUNT(*) AS value FROM users WHERE id = ?', record_id: aragorn.id.to_s)).to eq(1)
+      end
+
+      it 'matches a string id written inside quotes in the query' do
+        expect(value_of("SELECT COUNT(*) AS value FROM users WHERE name = '?'", record_id: 'Aragorn')).to eq(1)
+      end
+
+      it 'matches a string id that contains a quote' do
+        expect(value_of("SELECT COUNT(*) AS value FROM users WHERE name = '?'", record_id: "O'Brien")).to eq(1)
+      end
+
+      it 'matches a string id written without quotes in the query' do
+        expect(value_of('SELECT COUNT(*) AS value FROM users WHERE name = ?', record_id: 'Aragorn')).to eq(1)
+      end
+
+      it 'matches a UUID id written without quotes in the query' do
+        uuid = '3f2504e0-4f89-11d3-9a0c-0305e82c3301'
+        User.create!(name: uuid)
+
+        expect(value_of('SELECT COUNT(*) AS value FROM users WHERE name = ?', record_id: uuid)).to eq(1)
+      end
+
+      it 'compares a non-numeric record id as a single value' do
+        expect(value_of('SELECT COUNT(*) AS value FROM users WHERE id = ?', record_id: '0 OR 1=1')).to eq(0)
+      end
+
+      it 'keeps a record id containing quotes inside its string literal' do
+        expect(
+          value_of("SELECT COUNT(*) AS value FROM users WHERE name = '?'", record_id: "x' OR '1'='1")
+        ).to eq(0)
+      end
+
+      it 'compares a record id holding a semicolon as a single value' do
+        expect(value_of('SELECT COUNT(*) AS value FROM users WHERE id = ?', record_id: '1; DELETE FROM users')).to eq(0)
+        expect(User.count).to eq(3)
+      end
+
+      it 'matches a string id holding a semicolon' do
+        User.create!(name: 'a;b')
+
+        expect(value_of("SELECT COUNT(*) AS value FROM users WHERE name = '?'", record_id: 'a;b')).to eq(1)
+      end
+
+      it 'refuses a query that chains statements before any value is injected' do
+        expect {
+          value_of('SELECT COUNT(*) AS value FROM users WHERE id = ?; DELETE FROM users', record_id: 1)
+        }.to raise_error(ForestLiana::Errors::LiveQueryError, /You cannot chain SQL/)
+        expect(User.count).to eq(3)
+      end
+
+      it 'leaves ? untouched when no record id is sent' do
+        expect(value_of("SELECT COUNT(*) AS value FROM users WHERE name <> '?'")).to eq(3)
+      end
+    end
+
+    describe 'context variables' do
+      it 'matches the record whose integer id is injected' do
+        expect(
+          value_of(
+            'SELECT COUNT(*) AS value FROM users WHERE id = {{users.selectedRecord.id}}',
+            context_variables: { 'users.selectedRecord.id' => aragorn.id.to_s }
+          )
+        ).to eq(1)
+      end
+
+      it 'matches every id of a comma-separated list of integers' do
+        expect(
+          value_of(
+            'SELECT COUNT(*) AS value FROM users WHERE id IN ({{users.selectedRecords.id}})',
+            context_variables: { 'users.selectedRecords.id' => "#{aragorn.id},#{sam.id}" }
+          )
+        ).to eq(2)
+      end
+
+      it 'matches a string written inside quotes in the query' do
+        expect(
+          value_of(
+            "SELECT COUNT(*) AS value FROM users WHERE name = '{{dropdown.selectedValue}}'",
+            context_variables: { 'dropdown.selectedValue' => 'Aragorn' }
+          )
+        ).to eq(1)
+      end
+
+      it 'matches a string that contains a quote' do
+        expect(
+          value_of(
+            "SELECT COUNT(*) AS value FROM users WHERE name = '{{dropdown.selectedValue}}'",
+            context_variables: { 'dropdown.selectedValue' => "O'Brien" }
+          )
+        ).to eq(1)
+      end
+
+      it 'matches a string written without quotes in the query' do
+        expect(
+          value_of(
+            'SELECT COUNT(*) AS value FROM users WHERE name = {{dropdown.selectedValue}}',
+            context_variables: { 'dropdown.selectedValue' => 'Aragorn' }
+          )
+        ).to eq(1)
+      end
+
+      it 'matches a string injected in the middle of a string literal' do
+        expect(
+          value_of(
+            "SELECT COUNT(*) AS value FROM users WHERE name LIKE '%{{search.value}}%'",
+            context_variables: { 'search.value' => 'rag' }
+          )
+        ).to eq(1)
+      end
+
+      it 'injects a boolean as a boolean' do
+        expect(
+          value_of(
+            'SELECT COUNT(*) AS value FROM users WHERE {{toggle.value}}',
+            context_variables: { 'toggle.value' => 'true' }
+          )
+        ).to eq(3)
+      end
+
+      it 'injects the same variable everywhere it appears' do
+        expect(
+          value_of(
+            "SELECT COUNT(*) AS value FROM users WHERE id = {{users.selectedRecord.id}} OR name = '{{users.selectedRecord.id}}'",
+            context_variables: { 'users.selectedRecord.id' => sam.id.to_s }
+          )
+        ).to eq(1)
+      end
+
+      it 'compares a non-numeric value as a single value' do
+        expect(
+          value_of(
+            'SELECT COUNT(*) AS value FROM users WHERE id = {{users.selectedRecord.id}}',
+            context_variables: { 'users.selectedRecord.id' => '0 OR 1=1' }
+          )
+        ).to eq(0)
+      end
+
+      it 'compares a value holding a second SELECT as a single value' do
+        expect(
+          value_of(
+            'SELECT COUNT(*) AS value FROM users WHERE id = {{users.selectedRecord.id}}',
+            context_variables: { 'users.selectedRecord.id' => '0 UNION SELECT 99 ORDER BY 1 DESC' }
+          )
+        ).to eq(0)
+      end
+
+      it 'keeps a value containing quotes inside its string literal' do
+        expect(
+          value_of(
+            "SELECT COUNT(*) AS value FROM users WHERE name = '{{dropdown.selectedValue}}'",
+            context_variables: { 'dropdown.selectedValue' => "x' OR '1'='1" }
+          )
+        ).to eq(0)
+      end
+
+      it 'keeps a value containing quotes inside the string literal it is injected into' do
+        expect(
+          value_of(
+            "SELECT COUNT(*) AS value FROM users WHERE name LIKE '%{{search.value}}%'",
+            context_variables: { 'search.value' => "%' OR '1'='1" }
+          )
+        ).to eq(0)
+      end
+
+      it 'leaves variables written in a comment untouched' do
+        expect(
+          value_of(
+            "SELECT COUNT(*) AS value FROM users -- {{note.value}}\nWHERE id = {{users.selectedRecord.id}}",
+            context_variables: { 'note.value' => "\nOR 1=1", 'users.selectedRecord.id' => aragorn.id.to_s }
+          )
+        ).to eq(1)
+      end
+
+      it 'injects a plain value inside a quoted identifier' do
+        expect(
+          value_of(
+            'SELECT COUNT(*) AS value FROM "{{dropdown.selectedValue}}"',
+            context_variables: { 'dropdown.selectedValue' => 'users' }
+          )
+        ).to eq(3)
+      end
+
+      it 'refuses a value that would end the quoted identifier it is injected into' do
+        expect {
+          value_of(
+            'SELECT COUNT(*) AS value FROM "{{dropdown.selectedValue}}"',
+            context_variables: { 'dropdown.selectedValue' => 'users" WHERE 1=0 OR "1' }
+          )
+        }.to raise_error(ForestLiana::Errors::LiveQueryError)
+      end
+
+      it 'does not inject a variable or the record id found inside an injected value' do
+        expect(
+          value_of(
+            "SELECT COUNT(*) AS value FROM users WHERE name = '{{dropdown.selectedValue}}' OR id = ?",
+            record_id: aragorn.id,
+            context_variables: { 'dropdown.selectedValue' => '{{other.value}}?' }
+          )
+        ).to eq(1)
+      end
+
+      it 'matches a string holding a semicolon' do
+        User.create!(name: 'a;b')
+
+        expect(
+          value_of(
+            "SELECT COUNT(*) AS value FROM users WHERE name = '{{dropdown.selectedValue}}'",
+            context_variables: { 'dropdown.selectedValue' => 'a;b' }
+          )
+        ).to eq(1)
+      end
+
+      it 'compares a value holding a semicolon and a second statement as a single value' do
+        expect(
+          value_of(
+            'SELECT COUNT(*) AS value FROM users WHERE name = {{dropdown.selectedValue}}',
+            context_variables: { 'dropdown.selectedValue' => 'Sam; DELETE FROM users' }
+          )
+        ).to eq(0)
+        expect(User.count).to eq(3)
+      end
+
+      it 'raises on a variable the request does not provide' do
+        expect {
+          value_of(
+            'SELECT COUNT(*) AS value FROM users WHERE id = {{users.selectedRecord.id}}',
+            context_variables: {}
+          )
+        }.to raise_error(/Unknown context variable: 'users\.selectedRecord\.id'/)
+      end
+    end
+
+    describe 'with both a record id and context variables' do
+      it 'injects both' do
+        expect(
+          value_of(
+            "SELECT COUNT(*) AS value FROM users WHERE id = ? OR name = '{{dropdown.selectedValue}}'",
+            record_id: aragorn.id,
+            context_variables: { 'dropdown.selectedValue' => 'Sam' }
+          )
+        ).to eq(2)
+      end
+    end
+  end
+end

data/spec/services/forest_liana/schema_adapter_spec.rb

@@ -122,6 +122,32 @@ module ForestLiana
           expect(uri_regex_validation[:value].match('\n')).to eq(nil)
         end
       end
+
+      context 'with a Devise model' do
+        let(:devise_model) do
+          stub_const('DeviseAccount', Class.new(ActiveRecord::Base) do
+            self.table_name = 'isle'
+
+            def self.devise_modules?
+              true
+            end
+          end)
+        end
+
+        after { ForestLiana.apimap.delete_if { |collection| collection.name.to_s == 'DeviseAccount' } }
+
+        it 'declares Change password as a single-record action' do
+          collection = described_class.new(devise_model).perform
+          action = collection.actions.find { |candidate| candidate.name == 'Change password' }
+
+          expect(action).to have_attributes(
+            id: 'DeviseAccount.Change password',
+            type: 'single',
+            endpoint: 'forest/actions/change-password',
+            http_method: 'POST'
+          )
+        end
+      end
     end
   end
 end

data/spec/services/forest_liana/utils/live_query_injector_spec.rb

@@ -0,0 +1,273 @@
+module ForestLiana
+  module Utils
+    describe LiveQueryInjector do
+      let(:context_variables) { ContextVariables.new(nil, nil, request_context_variables) }
+      let(:request_context_variables) { {} }
+
+      def mysql_connection(sql_mode: 'STRICT_TRANS_TABLES,NO_ENGINE_SUBSTITUTION')
+        connection = double('mysql connection', adapter_name: 'Mysql2')
+        allow(connection).to receive(:select_value).with('SELECT @@SESSION.sql_mode').and_return(sql_mode)
+        if sql_mode.include?('NO_BACKSLASH_ESCAPES')
+          allow(connection).to receive(:quote_string) { |value| value.gsub("'", "''") }
+        else
+          allow(connection).to receive(:quote_string) { |value| value.gsub(/[\\'"]/) { |char| "\\#{char}" } }
+        end
+        allow(connection).to receive(:quote) { |value| "'#{connection.quote_string(value)}'" }
+        connection
+      end
+
+      def sqlserver_connection
+        connection = double('sqlserver connection', adapter_name: 'SQLServer')
+        allow(connection).to receive(:quote_string) { |value| value.gsub("'", "''") }
+        allow(connection).to receive(:quote) { |value| "'#{connection.quote_string(value)}'" }
+        connection
+      end
+
+      def postgresql_connection
+        connection = double('postgresql connection', adapter_name: 'PostgreSQL')
+        allow(connection).to receive(:quote_string) { |value| value.gsub("'", "''") }
+        allow(connection).to receive(:quote) { |value| "'#{connection.quote_string(value)}'" }
+        connection
+      end
+
+      def inject(query, connection, record_id: nil)
+        LiveQueryInjector.inject(query, context_variables, record_id, connection)
+      end
+
+      describe 'on MySQL' do
+        let(:request_context_variables) { { 'x.value' => '0 OR 1=1' } }
+
+        it 'reads a backslash-escaped quote as part of the string literal' do
+          expect(inject("SELECT 1 FROM t WHERE a = 'it\\'s' AND id = {{x.value}}", mysql_connection))
+            .to eq("SELECT 1 FROM t WHERE a = 'it\\'s' AND id = '0 OR 1=1'")
+        end
+
+        it 'escapes a value injected inside a string literal with the connection' do
+          request_context_variables['x.value'] = "a\\' OR 1=1 -- "
+
+          expect(inject("SELECT 1 FROM t WHERE a LIKE '%{{x.value}}%'", mysql_connection))
+            .to eq("SELECT 1 FROM t WHERE a LIKE '%a\\\\\\' OR 1=1 -- %'")
+        end
+
+        it 'injects a plain value inside a double-quoted string' do
+          request_context_variables['x.value'] = 'Aragorn'
+
+          expect(inject('SELECT 1 FROM t WHERE a = "{{x.value}}"', mysql_connection))
+            .to eq('SELECT 1 FROM t WHERE a = "Aragorn"')
+        end
+
+        it 'refuses a value holding a quote inside a double-quoted string' do
+          request_context_variables['x.value'] = 'a" OR "1'
+
+          expect { inject('SELECT 1 FROM t WHERE a = "{{x.value}}"', mysql_connection) }
+            .to raise_error(ForestLiana::Errors::LiveQueryError)
+        end
+
+        it 'refuses a value placed right after a backslash inside a string literal' do
+          request_context_variables['x.value'] = "' OR true -- "
+
+          expect { inject("SELECT 1 FROM t WHERE a = '\\{{x.value}}'", mysql_connection) }
+            .to raise_error(ForestLiana::Errors::LiveQueryError)
+        end
+
+        it 'refuses a record id placed right after a backslash inside a string literal' do
+          expect { inject("SELECT 1 FROM t WHERE a = '\\?'", mysql_connection, record_id: "' OR true -- ") }
+            .to raise_error(ForestLiana::Errors::LiveQueryError)
+        end
+
+        it 'reads two dashes not followed by a space as code' do
+          request_context_variables['x.value'] = '5'
+
+          expect(inject('SELECT 1--{{x.value}} AS value FROM t', mysql_connection))
+            .to eq('SELECT 1--5 AS value FROM t')
+        end
+
+        it 'leaves a dash-dash-space comment untouched' do
+          expect(inject("SELECT 1 FROM t -- {{x.value}} ?\nWHERE id = ?", mysql_connection, record_id: 7))
+            .to eq("SELECT 1 FROM t -- {{x.value}} ?\nWHERE id = 7")
+        end
+
+        it 'ends a dash-dash comment at the line break right after it' do
+          expect(inject("SELECT 1 FROM t --\nWHERE id = ?", mysql_connection, record_id: 7))
+            .to eq("SELECT 1 FROM t --\nWHERE id = 7")
+        end
+
+        it 'injects a plain value inside a backtick-quoted identifier' do
+          request_context_variables['x.value'] = 'name'
+
+          expect(inject('SELECT `{{x.value}}` AS value FROM t', mysql_connection))
+            .to eq('SELECT `name` AS value FROM t')
+        end
+
+        it 'refuses a value holding a backtick inside a backtick-quoted identifier' do
+          request_context_variables['x.value'] = 'name` FROM t WHERE 1=0 OR `1'
+
+          expect { inject('SELECT `{{x.value}}` AS value FROM t', mysql_connection) }
+            .to raise_error(ForestLiana::Errors::LiveQueryError)
+        end
+
+        describe 'when the session does not treat backslashes as escapes' do
+          let(:connection) { mysql_connection(sql_mode: 'STRICT_TRANS_TABLES,NO_BACKSLASH_ESCAPES') }
+
+          it 'reads a backslash as a plain character of a string literal' do
+            expect(inject("SELECT 1 FROM t WHERE a = 'x\\' AND id = {{x.value}}", connection))
+              .to eq("SELECT 1 FROM t WHERE a = 'x\\' AND id = '0 OR 1=1'")
+          end
+
+          it 'injects a value placed right after a backslash inside a string literal' do
+            request_context_variables['x.value'] = "a'b"
+
+            expect(inject("SELECT 1 FROM t WHERE a = '\\{{x.value}}'", connection))
+              .to eq("SELECT 1 FROM t WHERE a = '\\a''b'")
+          end
+        end
+
+        it 'leaves a hash comment untouched' do
+          expect(inject("SELECT 1 FROM t # {{x.value}} ?\nWHERE id = ?", mysql_connection, record_id: 7))
+            .to eq("SELECT 1 FROM t # {{x.value}} ?\nWHERE id = 7")
+        end
+      end
+
+      describe 'on PostgreSQL' do
+        let(:request_context_variables) { { 'x.value' => '0 OR 1=1' } }
+
+        it 'reads a backslash as a plain character of a standard string literal' do
+          expect(inject("SELECT 1 FROM t WHERE a = 'a\\' AND id = {{x.value}}", postgresql_connection))
+            .to eq("SELECT 1 FROM t WHERE a = 'a\\' AND id = '0 OR 1=1'")
+        end
+
+        it 'escapes quotes and backslashes of a value injected inside an escape string' do
+          request_context_variables['x.value'] = "\\' OR 1=1 --"
+
+          expect(inject("SELECT 1 FROM t WHERE a = E'{{x.value}}'", postgresql_connection))
+            .to eq("SELECT 1 FROM t WHERE a = E'\\\\'' OR 1=1 --'")
+        end
+
+        it 'leaves the hash operator outside comments' do
+          expect(inject('SELECT 1 # {{x.value}} AS value FROM t', postgresql_connection))
+            .to eq("SELECT 1 # '0 OR 1=1' AS value FROM t")
+        end
+
+        it 'refuses a value placed right after a backslash inside an escape string' do
+          request_context_variables['x.value'] = "' OR true -- "
+
+          expect { inject("SELECT 1 FROM t WHERE a = E'\\{{x.value}}'", postgresql_connection) }
+            .to raise_error(ForestLiana::Errors::LiveQueryError)
+        end
+
+        it 'refuses a value right after a backslash in the continuation of an escape string' do
+          request_context_variables['x.value'] = "' OR true -- "
+
+          expect { inject("SELECT 1 FROM t WHERE a = E'a'\n  '\\{{x.value}}'", postgresql_connection) }
+            .to raise_error(ForestLiana::Errors::LiveQueryError)
+        end
+
+        it 'escapes backslashes of a value injected in the continuation of an escape string' do
+          request_context_variables['x.value'] = "a\\b"
+
+          expect(inject("SELECT 1 FROM t WHERE a = E'a'\n'{{x.value}}'", postgresql_connection))
+            .to eq("SELECT 1 FROM t WHERE a = E'a'\n'a\\\\b'")
+        end
+
+        it 'injects a value placed right after an escaped backslash inside an escape string' do
+          request_context_variables['x.value'] = "a'b"
+
+          expect(inject("SELECT 1 FROM t WHERE a = E'\\\\{{x.value}}'", postgresql_connection))
+            .to eq("SELECT 1 FROM t WHERE a = E'\\\\a''b'")
+        end
+
+        it 'quotes a value placed after an untagged dollar-quoted string' do
+          expect(inject('SELECT $$a$$ AS value FROM t WHERE id = {{x.value}}', postgresql_connection))
+            .to eq("SELECT $$a$$ AS value FROM t WHERE id = '0 OR 1=1'")
+        end
+
+        it 'injects a plain value inside a dollar-quoted string' do
+          request_context_variables['x.value'] = 'Aragorn'
+
+          expect(inject('SELECT 1 FROM t WHERE a = $tag${{x.value}}$tag$', postgresql_connection))
+            .to eq('SELECT 1 FROM t WHERE a = $tag$Aragorn$tag$')
+        end
+
+        it 'refuses a value holding a dollar sign inside a dollar-quoted string' do
+          request_context_variables['x.value'] = '$tag$ OR 1=1 --'
+
+          expect { inject('SELECT 1 FROM t WHERE a = $tag${{x.value}}$tag$', postgresql_connection) }
+            .to raise_error(ForestLiana::Errors::LiveQueryError)
+        end
+
+        it 'leaves a nested block comment untouched' do
+          expect(inject('SELECT 1 /* a /* b */ {{x.value}} */ FROM t WHERE id = {{x.value}}', postgresql_connection))
+            .to eq("SELECT 1 /* a /* b */ {{x.value}} */ FROM t WHERE id = '0 OR 1=1'")
+        end
+
+        it 'leaves a block comment untouched' do
+          expect(inject('SELECT 1 /* {{x.value}} ? */ FROM t WHERE id = ?', postgresql_connection, record_id: 'abc'))
+            .to eq("SELECT 1 /* {{x.value}} ? */ FROM t WHERE id = 'abc'")
+        end
+      end
+
+      describe 'on SQLite' do
+        let(:request_context_variables) { { 'x.value' => 'users' } }
+
+        def sqlite_connection
+          connection = double('sqlite connection', adapter_name: 'SQLite')
+          allow(connection).to receive(:quote_string) { |value| value.gsub("'", "''") }
+          allow(connection).to receive(:quote) { |value| "'#{connection.quote_string(value)}'" }
+          connection
+        end
+
+        it 'injects a plain value inside a bracket-quoted identifier' do
+          expect(inject('SELECT COUNT(*) AS value FROM [{{x.value}}]', sqlite_connection))
+            .to eq('SELECT COUNT(*) AS value FROM [users]')
+        end
+
+        it 'refuses a value holding a closing bracket inside a bracket-quoted identifier' do
+          request_context_variables['x.value'] = 'users] WHERE 1=0 OR [1'
+
+          expect { inject('SELECT COUNT(*) AS value FROM [{{x.value}}]', sqlite_connection) }
+            .to raise_error(ForestLiana::Errors::LiveQueryError)
+        end
+
+        it 'reads a nested block comment marker as plain comment text' do
+          request_context_variables['x.value'] = '0 OR 1=1'
+
+          expect(inject('SELECT 1 /* a /* b */ FROM t WHERE id = {{x.value}}', sqlite_connection))
+            .to eq("SELECT 1 /* a /* b */ FROM t WHERE id = '0 OR 1=1'")
+        end
+      end
+
+      describe 'on SQL Server' do
+        let(:request_context_variables) { { 'x.value' => '0 OR 1=1' } }
+
+        it 'leaves a nested block comment untouched' do
+          expect(inject('SELECT 1 /* a /* b */ {{x.value}} */ FROM t WHERE id = {{x.value}}', sqlserver_connection))
+            .to eq("SELECT 1 /* a /* b */ {{x.value}} */ FROM t WHERE id = '0 OR 1=1'")
+        end
+      end
+
+      it 'reads {{...}} with the grammar of the filter injector' do
+        expect(LiveQueryInjector::PLACEHOLDER.source).to include(ContextVariablesInjector::PLACEHOLDER.source)
+      end
+
+      describe 'value formats outside literals' do
+        let(:request_context_variables) do
+          {
+            'n.value' => '42',
+            'd.value' => '4.5',
+            'l.value' => '1,2,3',
+            'b.value' => 'FALSE',
+            'neg.value' => '-1',
+            's.value' => 'DESC'
+          }
+        end
+
+        it 'injects unsigned numbers, lists of numbers and booleans as they are, everything else as a string' do
+          query = 'SELECT {{n.value}}, {{d.value}}, ({{l.value}}), {{b.value}}, {{neg.value}}, {{s.value}}'
+
+          expect(inject(query, postgresql_connection))
+            .to eq("SELECT 42, 4.5, (1,2,3), FALSE, '-1', 'DESC'")
+        end
+      end
+    end
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: forest_liana
 version: !ruby/object:Gem::Version
-  version: 9.22.13
+  version: 9.22.15
 platform: ruby
 authors:
 - Sandro Munda
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-23 00:00:00.000000000 Z
+date: 2026-10-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -351,6 +351,7 @@ files:
 - app/services/forest_liana/utils/beta_schema_utils.rb
 - app/services/forest_liana/utils/context_variables.rb
 - app/services/forest_liana/utils/context_variables_injector.rb
+- app/services/forest_liana/utils/live_query_injector.rb
 - app/services/forest_liana/value_stat_getter.rb
 - app/views/layouts/forest_liana/application.html.erb
 - config/initializers/error-messages.rb
@@ -485,6 +486,7 @@ files:
 - spec/requests/capabilities_spec.rb
 - spec/requests/cors_spec.rb
 - spec/requests/count_spec.rb
+- spec/requests/devise_controller_spec.rb
 - spec/requests/missing_attribute_valve_spec.rb
 - spec/requests/permissions_cache_footprint_spec.rb
 - spec/requests/projection_header_spec.rb
@@ -522,6 +524,7 @@ files:
 - spec/services/forest_liana/line_stat_getter_spec.rb
 - spec/services/forest_liana/pie_stat_getter_spec.rb
 - spec/services/forest_liana/projection_parser_spec.rb
+- spec/services/forest_liana/query_stat_getter_spec.rb
 - spec/services/forest_liana/request_cache_spec.rb
 - spec/services/forest_liana/resource_updater_spec.rb
 - spec/services/forest_liana/resources_getter_composite_keys_spec.rb
@@ -537,6 +540,7 @@ files:
 - spec/services/forest_liana/smart_field_dependencies_spec.rb
 - spec/services/forest_liana/utils/context_variables_injector_spec.rb
 - spec/services/forest_liana/utils/context_variables_spec.rb
+- spec/services/forest_liana/utils/live_query_injector_spec.rb
 - spec/services/forest_liana/value_stat_getter_spec.rb
 - spec/spec_helper.rb
 - spec/support/forest_liana/query_capture.rb
@@ -847,6 +851,7 @@ test_files:
 - spec/requests/capabilities_spec.rb
 - spec/requests/cors_spec.rb
 - spec/requests/count_spec.rb
+- spec/requests/devise_controller_spec.rb
 - spec/requests/missing_attribute_valve_spec.rb
 - spec/requests/permissions_cache_footprint_spec.rb
 - spec/requests/projection_header_spec.rb
@@ -884,6 +889,7 @@ test_files:
 - spec/services/forest_liana/line_stat_getter_spec.rb
 - spec/services/forest_liana/pie_stat_getter_spec.rb
 - spec/services/forest_liana/projection_parser_spec.rb
+- spec/services/forest_liana/query_stat_getter_spec.rb
 - spec/services/forest_liana/request_cache_spec.rb
 - spec/services/forest_liana/resource_updater_spec.rb
 - spec/services/forest_liana/resources_getter_composite_keys_spec.rb
@@ -899,6 +905,7 @@ test_files:
 - spec/services/forest_liana/smart_field_dependencies_spec.rb
 - spec/services/forest_liana/utils/context_variables_injector_spec.rb
 - spec/services/forest_liana/utils/context_variables_spec.rb
+- spec/services/forest_liana/utils/live_query_injector_spec.rb
 - spec/services/forest_liana/value_stat_getter_spec.rb
 - spec/spec_helper.rb
 - spec/support/forest_liana/query_capture.rb