forest_liana 9.22.4 → 9.22.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f8365b7c92d4157a34acd7f00af2c3d515976b96884eef48c0a0e72c775b1ea0
-  data.tar.gz: a61cfdd476921b56e293014854693c3aa39ffd6d8474544273be222f91c5d0db
+  metadata.gz: bf311206c7fdea9b79789aba4523930ddccdf1904826d04c36e5e72995eb8640
+  data.tar.gz: 8f1aff957bd3471d3766ec99e5d1ac0e7c808fc96b7193432efde480c85cbfbe
 SHA512:
-  metadata.gz: 8ee81334205b47404f4fc9349fcde08b8d38be877a525a1cfb8bc1481de1b435d88b0724d48552cbc111735a751b2f84c60a49cc4142a5a7c3a9fab6df201d49
-  data.tar.gz: dec06373edbb86308bb9577c0f20d61a747ad9fa0fac691b1f70fadada3d2e27406337b188eda61f10c5ad96405c6d65db77bd4e5144dd079e9445d1b1a13cc4
+  metadata.gz: edd1873169d8762a7c8687de26c98dd062aca95b3a2c522f6c9ac8c1167ef9d9c26810c148dd6113053414b5cc7e5ae63b3d722ba6a12938f141f1d9a8e2fa5e
+  data.tar.gz: f80f9add4df869e43af24d2944e379d8deb2b27207b66d7fa1ec1e8bc91c8be8dcd4c570ce01ae06423823756cf65574d0c49c57de020626123c0b79726bd718

data/app/services/forest_liana/ability/permission.rb

@@ -335,18 +335,40 @@ module ForestLiana
       # association, so FieldPath would otherwise resolve it to a column of +model+ itself — the
       # collection its `reference` actually points to is checked instead, the same target
       # `fields_per_model` already resolves a caller-named smart relation to.
-      def resolve_owner(model, field_name)
+      def resolve_owner(model, field_name, smart_field_fallback: true)
         smart_field = smart_belongs_to_field(model, field_name)
 
         return [smart_field[:reference].split('.').first] if smart_field
 
-        FieldPath.leaf_collection_names(model, field_name)
+        targets = FieldPath.leaf_collection_names(model, field_name)
+        return targets if targets.any? { |name| collection_exposed?(name) }
+
+        # No relation to an unexposed target reaches the caller, so a computed smart field of the same
+        # name is the only field this name can mean: its block reads the root row. A polymorphic
+        # relation is kept whatever its targets, and keeps its check.
+        return [ForestLiana.name_for(model)] if smart_field_fallback && only_computed_smart_field?(model, field_name, targets)
+
+        targets
       end
 
       def smart_belongs_to_field(model, field_name)
-        forest_collection = ForestLiana.apimap.find { |collection| collection.name.to_s == ForestLiana.name_for(model) }
+        forest_collection_for(model)&.fields_smart_belongs_to&.find { |field| field[:field].to_s == field_name }
+      end
+
+      # SchemaAdapter drops a relation to an excluded model, but keeps one whose target is missing from
+      # the apimap otherwise (a table absent at boot, a secondary database unreachable): skipped alike.
+      # A polymorphic relation's reference names the association, never one of its targets, so it stays.
+      def only_computed_smart_field?(model, field_name, unexposed_targets)
+        fields = forest_collection_for(model)&.fields.to_a.select { |field| field[:field].to_s == field_name }
+        fields = fields.reject do |field|
+          !field[:is_virtual] && unexposed_targets.include?(field[:reference].to_s.split('.').first)
+        end
+
+        fields.any? && fields.all? { |field| field[:is_virtual] && field[:reference].nil? && field[:integration].nil? }
+      end
 
-        forest_collection&.fields_smart_belongs_to&.find { |field| field[:field].to_s == field_name }
+      def forest_collection_for(model)
+        ForestLiana.apimap.find { |collection| collection.name.to_s == ForestLiana.name_for(model) }
       end
 
       # No role can ever be granted `read` on a collection absent from the apimap — a denial
@@ -378,7 +400,10 @@ module ForestLiana
       # partition (not split) so an empty or colon-only path resolves to '' (the root, pinned
       # readable) instead of nil.
       def query_target_collections(root_model, path)
-        resolve_owner(root_model, path.partition(':').first)
+        head, separator, = path.partition(':')
+        # A traversal names the relation itself, never a smart field: a String has no sub-field, and
+        # what the query joins for it is the relation's table.
+        resolve_owner(root_model, head, smart_field_fallback: separator.empty?)
       end
 
       def query_usage(action, root_model, path)

data/app/services/forest_liana/base_getter.rb

@@ -544,8 +544,13 @@ module ForestLiana
           # Skip ActiveStorage associations - already processed above
           next if is_active_storage_association?(association)
 
+          # NOTICE: A preloaded :through only reads keys off the rows this query builds: the root
+          #         row, and the narrowed rows of a first hop it joins. Walking the whole chain would
+          #         name tables it never joins.
+          if through_chain.any? && !joined?(association, joined_relations)
+            select_preload_hop_keys(select, [association.name], joined_relations)
           # For :through associations, recursively add all intermediate foreign keys
-          if through_chain.any?
+          elsif through_chain.any?
             current_resource = projected_resource
             through_chain.reverse.each do |through_name|
               through_assoc = current_resource.reflect_on_association(through_name)
@@ -694,7 +699,11 @@ module ForestLiana
     # those rows are the narrowed ones built off the JOIN, so its key has to be named here too.
     # It was not, and the list answered 500 rather than the one field (PRD-1316).
     def select_dependency_preload_keys(select, relation_path, joined_relations)
-      chains = flatten_dependency_hops(relation_path.relations)
+      select_preload_hop_keys(select, relation_path.relations, joined_relations)
+    end
+
+    def select_preload_hop_keys(select, relations, joined_relations)
+      chains = flatten_dependency_hops(relations)
       return if chains.empty?
 
       narrowed_hops(chains, joined_relations).each do |owner, reflection|

data/app/services/forest_liana/search_query_builder.rb

@@ -15,6 +15,7 @@ module ForestLiana
       @search = @params[:search].presence
       @user = user
       @filter_joins = []
+      @search_field_paths = []
     end
 
     def perform(resource)
@@ -31,6 +32,7 @@ module ForestLiana
       # already excludes itself on it and so can never be the reason @conditions_pushed is true.
       @conditions_pushed = false
       @lambda_contributed = false
+      @search_footprint_tracked = false
       @records = search_param
 
       caller_filter = @params[:filters].present? ? ForestLiana::ScopeManager.inject_context_variables(@params[:filters], @user) : nil
@@ -90,12 +92,13 @@ module ForestLiana
         # hadn't run at all — this can't currently tell "ran and did nothing" apart from "ran and
         # found real rows". Logged rather than silently discarded, since nothing else would ever
         # surface it to whoever built the smart-search hook.
-        if @lambda_contributed && !@conditions_pushed && malformed_uuid_search?
+        if @search_footprint_tracked && @lambda_contributed && !@conditions_pushed && malformed_uuid_search?
           FOREST_LOGGER.info "A smart-search lambda's result on the \"#{ForestLiana.name_for(root_model)}\" " \
             "collection was discarded: the search term (#{@search.inspect}) is UUID-shaped but " \
             'invalid, and no other condition constrained the query.'
         end
-        @records = @records.none unless @conditions_pushed || (@lambda_contributed && !malformed_uuid_search?)
+        # A host override of search_param that never calls super pushes no condition: its result is served as is.
+        @records = @records.none if @search_footprint_tracked && !@conditions_pushed && !(@lambda_contributed && !malformed_uuid_search?)
       end
 
       @records = sort_query
@@ -125,6 +128,7 @@ module ForestLiana
     end
 
     def search_param
+      @search_footprint_tracked = true
       @search_field_paths = []
 
       if @search

data/lib/forest_liana/version.rb

@@ -1,3 +1,3 @@
 module ForestLiana
-  VERSION = "9.22.4"
+  VERSION = "9.22.6"
 end

data/spec/dummy/app/models/boat.rb

@@ -0,0 +1,8 @@
+class Boat < ActiveRecord::Base
+  belongs_to :harbor
+  belongs_to :captain
+
+  # Its second hop is keyed on captains.license_number, which the preloader reads off the captain
+  # rows: narrowed ones when Harbor's boats related list joins captain to sort on it.
+  has_one :captain_license, through: :captain, source: :license
+end

data/spec/dummy/app/models/captain.rb

@@ -0,0 +1,3 @@
+class Captain < ActiveRecord::Base
+  has_one :license, primary_key: :license_number, foreign_key: :number
+end

data/spec/dummy/app/models/harbor.rb

@@ -0,0 +1,3 @@
+class Harbor < ActiveRecord::Base
+  has_many :boats
+end

data/spec/dummy/app/models/license.rb

@@ -0,0 +1,2 @@
+class License < ActiveRecord::Base
+end

data/spec/dummy/app/models/membership.rb

@@ -1,4 +1,9 @@
 class Membership < ActiveRecord::Base
   belongs_to :island
   belongs_to :user
+
+  # A :through of a :through: displayed on Island's memberships related list, the hop past the
+  # first reads `locations`, a table that list preloads rather than joins (issue #818).
+  has_one :location, through: :island
+  has_one :location_island, through: :location, source: :island
 end

data/spec/dummy/db/migrate/20261001120000_create_harbors_boats_captains_licenses.rb

@@ -0,0 +1,23 @@
+class CreateHarborsBoatsCaptainsLicenses < ActiveRecord::Migration[6.0]
+  def change
+    create_table :harbors do |t|
+      t.string :name
+    end
+
+    create_table :captains do |t|
+      t.string :name
+      t.string :license_number
+    end
+
+    create_table :licenses do |t|
+      t.string :number
+      t.date :expires_on
+    end
+
+    create_table :boats do |t|
+      t.string :name
+      t.references :harbor
+      t.references :captain
+    end
+  end
+end

data/spec/dummy/db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 2026_09_24_120000) do
+ActiveRecord::Schema.define(version: 2026_10_01_120000) do
 
   create_table "addresses", force: :cascade do |t|
     t.string "line1"
@@ -29,6 +29,19 @@ ActiveRecord::Schema.define(version: 2026_09_24_120000) do
     t.datetime "updated_at", precision: 6, null: false
   end
 
+  create_table "boats", force: :cascade do |t|
+    t.string "name"
+    t.integer "harbor_id"
+    t.integer "captain_id"
+    t.index ["captain_id"], name: "index_boats_on_captain_id"
+    t.index ["harbor_id"], name: "index_boats_on_harbor_id"
+  end
+
+  create_table "captains", force: :cascade do |t|
+    t.string "name"
+    t.string "license_number"
+  end
+
   create_table "flags", force: :cascade do |t|
     t.integer "island_id"
     t.string "color"
@@ -37,6 +50,10 @@ ActiveRecord::Schema.define(version: 2026_09_24_120000) do
     t.index ["island_id"], name: "index_flags_on_island_id"
   end
 
+  create_table "harbors", force: :cascade do |t|
+    t.string "name"
+  end
+
   create_table "isle", force: :cascade do |t|
     t.string "name"
     t.binary "map"
@@ -44,6 +61,11 @@ ActiveRecord::Schema.define(version: 2026_09_24_120000) do
     t.datetime "updated_at"
   end
 
+  create_table "licenses", force: :cascade do |t|
+    t.string "number"
+    t.date "expires_on"
+  end
+
   create_table "locations", force: :cascade do |t|
     t.string "coordinates"
     t.integer "island_id"

data/spec/dummy/lib/forest_liana/collections/boat.rb

@@ -0,0 +1,10 @@
+class Forest::Boat
+  include ForestLiana::Collection
+
+  collection :Boat
+
+  # Named like `belongs_to :harbor` on the model, as Qonto's `legal_form` (PRD-1429).
+  field :harbor, type: 'String' do
+    object.harbor&.name
+  end
+end

data/spec/dummy/lib/forest_liana/collections/captain.rb

@@ -0,0 +1,10 @@
+class Forest::Captain
+  include ForestLiana::Collection
+
+  collection :Captain
+
+  # Named like `has_one :license` on the model (PRD-1429).
+  field :license, type: 'String' do
+    object.license&.number
+  end
+end

data/spec/lib/forest_liana/bootstrapper_spec.rb

@@ -66,8 +66,12 @@ module ForestLiana
         [
           Address,
           Article,
+          Boat,
+          Captain,
           Flag,
+          Harbor,
           Island,
+          License,
           Location,
           Manufacturer,
           Membership,

data/spec/requests/related_list_nested_through_spec.rb

@@ -0,0 +1,55 @@
+require 'rails_helper'
+
+describe 'A related list displaying a has_one :through', type: :request do
+  before do
+    allow(ForestLiana::IpWhitelist).to receive(:retrieve) { true }
+    allow(ForestLiana::IpWhitelist).to receive(:is_ip_whitelist_retrieved) { true }
+    allow(ForestLiana::IpWhitelist).to receive(:is_ip_valid) { true }
+    allow_any_instance_of(ForestLiana::Ability).to receive(:forest_authorize!) { true }
+    Rails.cache.write('forest.has_permission', false)
+    allow(ForestLiana::ScopeManager).to receive(:fetch_scopes)
+      .and_return('scopes' => {}, 'team' => { 'id' => '1', 'name' => 'Operations' })
+  end
+
+  token = JWT.encode({ id: 38, email: 'michael.kelso@that70.show', first_name: 'Michael',
+                       last_name: 'Kelso', team: 'Operations', rendering_id: 16,
+                       exp: Time.now.to_i + 2.weeks.to_i, permission_level: 'admin' },
+                     ForestLiana.auth_secret, 'HS256')
+  headers = { 'Accept' => 'application/json', 'Content-Type' => 'application/json',
+              'Authorization' => "Bearer #{token}" }
+
+  let!(:user) { User.create!(name: 'Michel', title: :king) }
+  let!(:island) { Island.create!(name: 'Skull') }
+  let!(:location) { Location.create!(coordinates: '12345', island: island) }
+  let!(:membership) { Membership.create!(island: island, user: user) }
+
+  it 'serves a :through going through another :through' do
+    get "/forest/Island/#{island.id}/relationships/memberships",
+        params: { fields: { 'Membership' => 'id,location_island', 'location_island' => 'name' },
+                  page: { 'number' => '1', 'size' => '15' }, sort: '-id', timezone: 'Europe/Paris' },
+        headers: headers
+
+    expect(response.status).to eq(200)
+    body = JSON.parse(response.body)
+    expect(body['data'].map { |row| row.dig('relationships', 'location_island', 'data', 'id') }).to eq([island.id.to_s])
+    expect(body['included'].map { |record| record.dig('attributes', 'name') }).to eq(['Skull'])
+  end
+
+  # Sorting on captain joins it with only the columns the list shows, and the preloader reads the
+  # license's key, captains.license_number, off those narrowed rows.
+  it 'serves a :through whose first hop is joined and keys the next hop on a non-primary column' do
+    harbor = Harbor.create!(name: 'Saint-Malo')
+    captain = Captain.create!(name: 'Haddock', license_number: 'FR-4421')
+    license = License.create!(number: 'FR-4421', expires_on: Date.new(2030, 1, 1))
+    Boat.create!(name: 'Karaboudjan', harbor: harbor, captain: captain)
+
+    get "/forest/Harbor/#{harbor.id}/relationships/boats",
+        params: { fields: { 'Boat' => 'id,captain,captain_license', 'captain' => 'name', 'captain_license' => 'number' },
+                  page: { 'number' => '1', 'size' => '15' }, sort: 'captain.name', timezone: 'Europe/Paris' },
+        headers: headers
+
+    expect(response.status).to eq(200)
+    body = JSON.parse(response.body)
+    expect(body['data'].map { |row| row.dig('relationships', 'captain_license', 'data', 'id') }).to eq([license.id.to_s])
+  end
+end

data/spec/requests/smart_field_named_like_unexposed_relation_spec.rb

@@ -0,0 +1,125 @@
+require 'rails_helper'
+
+# Forest::Boat#harbor and Forest::Captain#license share their name with a relation of the model.
+# With the relation's target left out of the apimap, SchemaAdapter drops the relation and only the
+# smart field remains: the request reads it off the root row, not off the unexposed target.
+describe 'A computed smart field named like a relation to an unexposed collection', type: :request do
+  token = JWT.encode({ id: 38, email: 'michael.kelso@that70.show', first_name: 'Michael',
+                       last_name: 'Kelso', team: 'Operations', rendering_id: 16,
+                       exp: Time.now.to_i + 2.weeks.to_i, permission_level: 'admin' },
+                     ForestLiana.auth_secret, 'HS256')
+  headers = { 'Accept' => 'application/json', 'Content-Type' => 'application/json',
+              'Authorization' => "Bearer #{token}" }
+  page = { 'number' => '1', 'size' => '15' }
+
+  let!(:harbor) { Harbor.create!(name: 'Saint-Malo') }
+  let!(:captain) { Captain.create!(name: 'Haddock', license_number: 'FR-4421') }
+  let!(:license) { License.create!(number: 'FR-4421', expires_on: Date.new(2030, 1, 1)) }
+  let!(:boat) { Boat.create!(name: 'Karaboudjan', harbor: harbor, captain: captain) }
+
+  let(:unexposed) { [] }
+  let(:relations_kept) { false }
+
+  before do
+    allow(ForestLiana::IpWhitelist).to receive(:retrieve) { true }
+    allow(ForestLiana::IpWhitelist).to receive(:is_ip_whitelist_retrieved) { true }
+    allow(ForestLiana::IpWhitelist).to receive(:is_ip_valid) { true }
+    allow_any_instance_of(ForestLiana::Ability).to receive(:forest_authorize!) { true }
+    allow(ForestLiana::ScopeManager).to receive(:fetch_scopes)
+      .and_return('scopes' => {}, 'team' => { 'id' => '1', 'name' => 'Operations' })
+    allow(ForestLiana).to receive(:apimap).and_wrap_original do |original|
+      original.call.reject { |collection| unexposed.include?(collection.name.to_s) }
+    end
+    # The apimap was built at boot with every target exposed: drop the relations to the unexposed
+    # ones, as SchemaAdapter does for a model left out of it.
+    ForestLiana.apimap.each do |collection|
+      allow(collection).to receive(:fields).and_wrap_original do |original|
+        next original.call if relations_kept
+
+        original.call.reject { |field| unexposed.include?(field[:reference].to_s.split('.').first) }
+      end
+    end
+  end
+
+  def body
+    JSON.parse(response.body)
+  end
+
+  shared_examples 'serving the smart field off the root' do
+    context 'when the belongs_to target is unexposed' do
+      let(:unexposed) { ['Harbor'] }
+
+      it 'serves the list' do
+        get '/forest/Boat', params: { fields: { 'Boat' => 'id,name,harbor' }, page: page, timezone: 'Europe/Paris' },
+                            headers: headers
+
+        expect(response.status).to eq(200)
+        expect(body['data'].map { |row| row['attributes']['harbor'] }).to eq(['Saint-Malo'])
+      end
+
+      it 'serves the get-one' do
+        get "/forest/Boat/#{boat.id}", params: { fields: { 'Boat' => 'id,name,harbor' }, timezone: 'Europe/Paris' },
+                                       headers: headers
+
+        expect(response.status).to eq(200)
+        expect(body['data']['attributes']['harbor']).to eq('Saint-Malo')
+      end
+    end
+
+    context 'when the has_one target is unexposed' do
+      let(:unexposed) { ['License'] }
+
+      it 'serves the list' do
+        get '/forest/Captain', params: { fields: { 'Captain' => 'id,name,license' }, page: page, timezone: 'Europe/Paris' },
+                               headers: headers
+
+        expect(response.status).to eq(200)
+        expect(body['data'].map { |row| row['attributes']['license'] }).to eq(['FR-4421'])
+      end
+
+      it 'serves the get-one' do
+        get "/forest/Captain/#{captain.id}", params: { fields: { 'Captain' => 'id,name,license' }, timezone: 'Europe/Paris' },
+                                             headers: headers
+
+        expect(response.status).to eq(200)
+        expect(body['data']['attributes']['license']).to eq('FR-4421')
+      end
+    end
+  end
+
+  # A target missing from the apimap without being excluded (a table absent at boot, a secondary
+  # database unreachable) leaves its relation in the schema next to the smart field.
+  context 'when the relation to the unexposed target stays in the schema' do
+    let(:relations_kept) { true }
+
+    before { Rails.cache.write('forest.has_permission', false) }
+
+    include_examples 'serving the smart field off the root'
+
+    it "still refuses the unexposed target's own fields" do
+      unexposed << 'Harbor'
+
+      get '/forest/Boat', params: { fields: { 'Boat' => 'id,name,harbor', 'harbor' => 'name' }, page: page,
+                                    timezone: 'Europe/Paris' },
+                          headers: headers
+
+      expect(response.status).to eq(403)
+      expect(body['errors'].first['data']['unexposed_fields']).to eq(['name'])
+    end
+  end
+
+  context 'with skip_relation_read_permissions, as Qonto runs it' do
+    before do
+      allow(ForestLiana).to receive(:skip_relation_read_permissions?) { true }
+      Rails.cache.write('forest.has_permission', true)
+    end
+
+    include_examples 'serving the smart field off the root'
+  end
+
+  context 'without a permission system' do
+    before { Rails.cache.write('forest.has_permission', false) }
+
+    include_examples 'serving the smart field off the root'
+  end
+end

data/spec/services/forest_liana/ability/assert_can_read_query_fields_spec.rb

@@ -284,6 +284,64 @@ module ForestLiana
           end
         end
 
+        # PRD-1429: with `island` left out of the apimap, a computed smart field of the same name is
+        # what a bare path means. A traversal still means the relation, whose table the query joins.
+        describe 'a computed smart field sharing its name with a relation absent from the apimap' do
+          before do
+            forest_collection = double('forest_collection')
+            allow(forest_collection).to receive(:name).and_return('Tree')
+            allow(forest_collection).to receive(:fields_smart_belongs_to).and_return([])
+            allow(forest_collection).to receive(:fields).and_return([{ field: :island, is_virtual: true }])
+            allow(ForestLiana).to receive(:apimap).and_return([forest_collection])
+            write_permissions('Tree' => true)
+          end
+
+          it 'serves a sort on the smart field off the root' do
+            expect { dummy_class.assert_can_read_query_fields(user, Tree, sort_paths: ['island']) }
+              .not_to raise_error
+          end
+
+          it 'still refuses a filter traversing the relation' do
+            expect { dummy_class.assert_can_read_query_fields(user, Tree, filter_paths: ['island:name']) }
+              .to raise_error(ForestLiana::Ability::Exceptions::UnexposedQueryCollectionError)
+          end
+
+          context 'when the relation stays in the schema next to the smart field' do
+            before do
+              allow(ForestLiana.apimap.first).to receive(:fields).and_return(
+                [{ field: :island, reference: 'Island.id', relationship: 'BelongsTo', is_virtual: false },
+                 { field: :island, is_virtual: true }]
+              )
+            end
+
+            it 'serves a sort on the smart field off the root all the same' do
+              expect { dummy_class.assert_can_read_query_fields(user, Tree, sort_paths: ['island']) }
+                .not_to raise_error
+            end
+          end
+        end
+
+        # A polymorphic relation's reference names the association (`addressable.id`), never one of
+        # its targets, so it stays next to the smart field and keeps the name.
+        describe 'a computed smart field sharing its name with a polymorphic relation to unexposed targets' do
+          before do
+            forest_collection = double('forest_collection')
+            allow(forest_collection).to receive(:name).and_return('Address')
+            allow(forest_collection).to receive(:fields_smart_belongs_to).and_return([])
+            allow(forest_collection).to receive(:fields).and_return(
+              [{ field: 'addressable', reference: 'addressable.id', relationship: 'BelongsTo', is_virtual: false },
+               { field: :addressable, is_virtual: true }]
+            )
+            allow(ForestLiana).to receive(:apimap).and_return([forest_collection])
+            write_permissions('Address' => true)
+          end
+
+          it 'keeps refusing a sort on it' do
+            expect { dummy_class.assert_can_read_query_fields(user, Address, sort_paths: ['addressable']) }
+              .to raise_error(ForestLiana::Ability::Exceptions::UnexposedQueryCollectionError)
+          end
+        end
+
         describe 'polymorphic' do
           it 'serves a filter on a relation whose every target is readable' do
             write_permissions('Address' => true, 'User' => true, 'Island' => true)

data/spec/services/forest_liana/ability/redact_fields_spec.rb

@@ -299,13 +299,56 @@ module ForestLiana
         end
 
         describe 'a collection absent from the apimap' do
+          let(:fields) { [] }
+
           before do
             forest_collection = double('forest_collection')
             allow(forest_collection).to receive(:name).and_return('Tree')
             allow(forest_collection).to receive(:fields_smart_belongs_to).and_return([])
+            allow(forest_collection).to receive(:fields).and_return(fields)
             allow(ForestLiana).to receive(:apimap).and_return([forest_collection])
           end
 
+          # SchemaAdapter drops `island` from the schema here, leaving a computed smart field of the
+          # same name as the only field the caller can mean (PRD-1429).
+          context 'when a computed smart field shares its name with the relation' do
+            let(:fields) { [{ field: :island, is_virtual: true }] }
+
+            it 'serves it off the root instead of refusing the request' do
+              write_permissions('Tree' => true)
+
+              expect(dummy_class.redact_fields(user, Tree, { 'Tree' => 'name,island' }, named_collections: ['Tree']))
+                .to eq('Tree' => 'name,island')
+            end
+          end
+
+          # SchemaAdapter keeps the relation when Island is missing from the apimap without being
+          # excluded (a table absent at boot, a secondary database unreachable).
+          context 'when the relation stays in the schema next to the smart field' do
+            let(:fields) do
+              [{ field: :island, reference: 'Island.id', relationship: 'BelongsTo', is_virtual: false },
+               { field: :island, is_virtual: true }]
+            end
+
+            it 'serves the smart field off the root all the same' do
+              write_permissions('Tree' => true)
+
+              expect(dummy_class.redact_fields(user, Tree, { 'Tree' => 'name,island' }, named_collections: ['Tree']))
+                .to eq('Tree' => 'name,island')
+            end
+          end
+
+          context 'when only the relation stays in the schema' do
+            let(:fields) { [{ field: :island, reference: 'Island.id', relationship: 'BelongsTo', is_virtual: false }] }
+
+            it 'keeps refusing it' do
+              write_permissions('Tree' => true)
+
+              expect { dummy_class.redact_fields(user, Tree, { 'Tree' => 'island' }, named_collections: ['Tree']) }
+                .to raise_error(ForestLiana::Ability::Exceptions::UnauthorizedFieldsError)
+            end
+          end
+
           it 'names it as unexposed rather than as merely denied, since no role can be granted read on it' do
             write_permissions('Tree' => true, 'Island' => false)
 
@@ -328,6 +371,58 @@ module ForestLiana
           end
         end
 
+        # The exposed relation still reaches the response alongside the smart field, so its read
+        # check stands: only an unexposed target hands the name over to the smart field.
+        describe 'a computed smart field sharing its name with an exposed relation' do
+          before do
+            forest_collection = double('forest_collection')
+            allow(forest_collection).to receive(:name).and_return('Tree')
+            allow(forest_collection).to receive(:fields_smart_belongs_to).and_return([])
+            allow(forest_collection).to receive(:fields).and_return([{ field: :island, is_virtual: true }])
+            island_collection = double('island_collection')
+            allow(island_collection).to receive(:name).and_return('Island')
+            allow(ForestLiana).to receive(:apimap).and_return([forest_collection, island_collection])
+          end
+
+          it 'keeps checking the relation' do
+            write_permissions('Tree' => true, 'Island' => false)
+
+            expect { dummy_class.redact_fields(user, Tree, { 'Tree' => 'island' }, named_collections: ['Tree']) }
+              .to raise_error(ForestLiana::Ability::Exceptions::UnauthorizedFieldsError) do |error|
+                expect(error.message).to eq("You are not allowed to read 'island' from the 'Island' collection.")
+                expect(error.data[:unexposed_fields]).to be_nil
+              end
+          end
+        end
+
+        # SchemaAdapter keeps a polymorphic relation in the schema even when none of its targets is
+        # exposed, so a computed smart field of the same name does not take the name over.
+        describe 'a computed smart field sharing its name with a polymorphic relation to unexposed targets' do
+          before do
+            forest_collection = double('forest_collection')
+            allow(forest_collection).to receive(:name).and_return('Address')
+            allow(forest_collection).to receive(:fields_smart_belongs_to).and_return([])
+            allow(forest_collection).to receive(:fields).and_return(
+              [{ field: 'addressable', reference: 'addressable.id', relationship: 'BelongsTo', is_virtual: false },
+               { field: :addressable, is_virtual: true }]
+            )
+            allow(ForestLiana).to receive(:apimap).and_return([forest_collection])
+            write_permissions('Address' => true)
+          end
+
+          it 'keeps refusing the root field' do
+            expect { dummy_class.redact_fields(user, Address, { 'Address' => 'line1,addressable' }, named_collections: ['Address']) }
+              .to raise_error(ForestLiana::Ability::Exceptions::UnauthorizedFieldsError)
+          end
+
+          it "keeps refusing the targets' own fields" do
+            expect do
+              dummy_class.redact_fields(user, Address, { 'Address' => 'line1', 'addressable' => 'name' },
+                                        named_collections: %w[Address addressable])
+            end.to raise_error(ForestLiana::Ability::Exceptions::UnauthorizedFieldsError)
+          end
+        end
+
         # Every real collection stays in the apimap here (only Island is rejected), unlike the
         # describe block above — so 'owner' resolves to an exposed-but-denied User, not a second
         # unexposed collection, and the two entries' differently-shaped clauses still join as one

data/spec/services/forest_liana/search_query_builder_spec.rb

@@ -540,6 +540,89 @@ module ForestLiana
       end
     end
 
+    describe '#initialize' do
+      it 'starts with an empty search footprint' do
+        expect(builder.search_field_paths).to eq([])
+      end
+    end
+
+    describe 'when a host app overrides search_param without calling super' do
+      let(:builder_class) do
+        Class.new(described_class) do
+          def search_param
+            return @resource unless @search
+
+            @resource.where('LOWER(trees.name) LIKE ?', "%#{@search.downcase}%")
+          end
+        end
+      end
+      let(:builder) { builder_class.new(params, [], collection, user) }
+
+      before do
+        Tree.create!(name: 'Oak')
+        Tree.create!(name: 'Pine')
+      end
+      after { Tree.destroy_all }
+
+      context 'without a search' do
+        let(:params) { { searchExtended: '0' } }
+
+        it 'serves every record' do
+          expect(builder.perform(Tree.all).count).to eq(2)
+        end
+      end
+
+      context 'with a search the override matches' do
+        let(:params) { { search: 'oak', searchExtended: '0' } }
+
+        it "serves the override's result instead of emptying it" do
+          expect(builder.perform(Tree.all).map(&:name)).to eq(['Oak'])
+        end
+      end
+
+      context 'with a smart-search lambda and a malformed-UUID-shaped search' do
+        let(:builder_class) do
+          Class.new(described_class) do
+            def search_param
+              @resource
+            end
+          end
+        end
+
+        before do
+          allow(ForestLiana).to receive(:schema_for_resource).and_return(
+            ForestLiana::Model::Collection.new(
+              name: 'Tree', fields: [{ field: :custom, type: 'String', search: ->(query, _search) { query.where(name: 'Oak') } }]
+            )
+          )
+        end
+
+        let(:params) { { search: 'abcdef12-3456-4ae-ad4f-5662757713a2', searchExtended: '0' } }
+
+        it "serves the lambda's result without logging it as discarded" do
+          expect(FOREST_LOGGER).not_to receive(:info).with(/was discarded/)
+
+          expect(builder.perform(Tree.all).map(&:name)).to eq(['Oak'])
+        end
+      end
+
+      context 'when the override calls super' do
+        let(:builder_class) do
+          Class.new(described_class) do
+            def search_param
+              super
+            end
+          end
+        end
+        let(:collection) { ForestLiana::Model::Collection.new(name: 'Tree', fields: [], search_fields: ['nonexistent']) }
+        let(:params) { { search: 'nothing-matches-this', searchExtended: '0' } }
+
+        it 'still answers no records when nothing could match' do
+          expect(builder.perform(Tree.all).count).to eq(0)
+        end
+      end
+    end
+
     describe 'a blank or whitespace-only search' do
       let(:params) { ActiveSupport::HashWithIndifferentAccess.new(search: '   ', searchExtended: '1') }
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: forest_liana
 version: !ruby/object:Gem::Version
-  version: 9.22.4
+  version: 9.22.6
 platform: ruby
 authors:
 - Sandro Munda
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-28 00:00:00.000000000 Z
+date: 2026-10-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -386,11 +386,15 @@ files:
 - spec/dummy/app/models/address.rb
 - spec/dummy/app/models/application_record.rb
 - spec/dummy/app/models/article.rb
+- spec/dummy/app/models/boat.rb
+- spec/dummy/app/models/captain.rb
 - spec/dummy/app/models/car.rb
 - spec/dummy/app/models/driver.rb
 - spec/dummy/app/models/flag.rb
 - spec/dummy/app/models/garage_record.rb
+- spec/dummy/app/models/harbor.rb
 - spec/dummy/app/models/island.rb
+- spec/dummy/app/models/license.rb
 - spec/dummy/app/models/location.rb
 - spec/dummy/app/models/manufacturer.rb
 - spec/dummy/app/models/membership.rb
@@ -446,9 +450,12 @@ files:
 - spec/dummy/db/migrate/20260914120000_create_articles_and_taggings.rb
 - spec/dummy/db/migrate/20260922120000_create_trees_users.rb
 - spec/dummy/db/migrate/20260924120000_add_maker_name_to_products.rb
+- spec/dummy/db/migrate/20261001120000_create_harbors_boats_captains_licenses.rb
 - spec/dummy/db/schema.rb
 - spec/dummy/db/user_schema.rb
 - spec/dummy/lib/forest_liana/collections/address.rb
+- spec/dummy/lib/forest_liana/collections/boat.rb
+- spec/dummy/lib/forest_liana/collections/captain.rb
 - spec/dummy/lib/forest_liana/collections/island.rb
 - spec/dummy/lib/forest_liana/collections/location.rb
 - spec/dummy/lib/forest_liana/collections/owner.rb
@@ -477,7 +484,9 @@ files:
 - spec/requests/projection_header_spec.rb
 - spec/requests/projection_inherited_loads_spec.rb
 - spec/requests/query_footprint_spec.rb
+- spec/requests/related_list_nested_through_spec.rb
 - spec/requests/resources_spec.rb
+- spec/requests/smart_field_named_like_unexposed_relation_spec.rb
 - spec/requests/stats_spec.rb
 - spec/requests/sti_record_conversion_spec.rb
 - spec/requests/test.ru
@@ -734,11 +743,15 @@ test_files:
 - spec/dummy/app/models/address.rb
 - spec/dummy/app/models/application_record.rb
 - spec/dummy/app/models/article.rb
+- spec/dummy/app/models/boat.rb
+- spec/dummy/app/models/captain.rb
 - spec/dummy/app/models/car.rb
 - spec/dummy/app/models/driver.rb
 - spec/dummy/app/models/flag.rb
 - spec/dummy/app/models/garage_record.rb
+- spec/dummy/app/models/harbor.rb
 - spec/dummy/app/models/island.rb
+- spec/dummy/app/models/license.rb
 - spec/dummy/app/models/location.rb
 - spec/dummy/app/models/manufacturer.rb
 - spec/dummy/app/models/membership.rb
@@ -794,9 +807,12 @@ test_files:
 - spec/dummy/db/migrate/20260914120000_create_articles_and_taggings.rb
 - spec/dummy/db/migrate/20260922120000_create_trees_users.rb
 - spec/dummy/db/migrate/20260924120000_add_maker_name_to_products.rb
+- spec/dummy/db/migrate/20261001120000_create_harbors_boats_captains_licenses.rb
 - spec/dummy/db/schema.rb
 - spec/dummy/db/user_schema.rb
 - spec/dummy/lib/forest_liana/collections/address.rb
+- spec/dummy/lib/forest_liana/collections/boat.rb
+- spec/dummy/lib/forest_liana/collections/captain.rb
 - spec/dummy/lib/forest_liana/collections/island.rb
 - spec/dummy/lib/forest_liana/collections/location.rb
 - spec/dummy/lib/forest_liana/collections/owner.rb
@@ -825,7 +841,9 @@ test_files:
 - spec/requests/projection_header_spec.rb
 - spec/requests/projection_inherited_loads_spec.rb
 - spec/requests/query_footprint_spec.rb
+- spec/requests/related_list_nested_through_spec.rb
 - spec/requests/resources_spec.rb
+- spec/requests/smart_field_named_like_unexposed_relation_spec.rb
 - spec/requests/stats_spec.rb
 - spec/requests/sti_record_conversion_spec.rb
 - spec/requests/test.ru