forest_liana 9.22.5 → 9.22.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6ca262c2db5e774393d0dd9b9266bbd360cea72c8caeea733c7df95a32bd6f3c
-  data.tar.gz: 5917abff7f56a4df5bf38c885ab375dc7240f666826c46a5ddb92a4709110d8e
+  metadata.gz: 1899aa8f55f2188189973046573741eb4492ad3e47c8bac900125d7468cc1845
+  data.tar.gz: 8fe15b7c2eaca28fa7c74ad66af35eecc7299dcea6f0671b8e07fa36f07529cd
 SHA512:
-  metadata.gz: c60d6abc5f591ac151cf592e56f7790fc24db53984f4a646da46bf61ca1030b77d21713a4ee7d63a334ad9a70c5b934c982ce1fd76669e485be2c58e634fddcf
-  data.tar.gz: 55b8f9f4a71a17dcb8cb3c55b0a240e0576697ae5ca42116f266aa9b429d15aea49193222ea0f599a6feb892405f3fdfb565e1d1a033e4595c22f351e277e112
+  metadata.gz: d5c3b883ebdc5412f0a982b5cd12d23e361163471e5cbe39bc6e7ca956672f8a34ef06eb41300279ce0ac9ca79aab26f28377539e9ada69cf39f8716b17323d3
+  data.tar.gz: 320775ad84781e8b15a27b5cffa365975afa2da9e4d59317bf6bdf2cd9978951eac6b0671e989b6201203df37bc1450e349cd171a4eaf799d6f5a94a28ed56bc

data/app/services/forest_liana/ability/permission.rb

@@ -205,7 +205,7 @@ module ForestLiana
             if readable.call(entry[:owners][collection_key])
               acc[collection_key] = entry[:field_names].join(',')
             else
-              denied << denial_entry(collection_key, entry[:owners][collection_key], readable_collection_names) if named
+              denied << denial_entry(collection_key, entry[:owners][collection_key], readable_collection_names) if named && !FieldPath.unresolved?(entry[:owners][collection_key])
             end
           else
             kept = entry[:field_names].select do |field_name|
@@ -216,7 +216,7 @@ module ForestLiana
                 # differs from root_name — prefix the message so it doesn't read as if 'field_name'
                 # were a bare field of the root.
                 display_path = collection_key == root_name ? field_name : "#{collection_key}:#{field_name}"
-                denied << denial_entry(field_name, entry[:owners][field_name], readable_collection_names, display_path) if named
+                denied << denial_entry(field_name, entry[:owners][field_name], readable_collection_names, display_path) if named && !FieldPath.unresolved?(entry[:owners][field_name])
                 false
               end
             end
@@ -335,18 +335,40 @@ module ForestLiana
       # association, so FieldPath would otherwise resolve it to a column of +model+ itself — the
       # collection its `reference` actually points to is checked instead, the same target
       # `fields_per_model` already resolves a caller-named smart relation to.
-      def resolve_owner(model, field_name)
+      def resolve_owner(model, field_name, smart_field_fallback: true)
         smart_field = smart_belongs_to_field(model, field_name)
 
         return [smart_field[:reference].split('.').first] if smart_field
 
-        FieldPath.leaf_collection_names(model, field_name)
+        targets = FieldPath.leaf_collection_names(model, field_name)
+        return targets if targets.any? { |name| collection_exposed?(name) }
+
+        # No relation to an unexposed target reaches the caller, so a computed smart field of the same
+        # name is the only field this name can mean: its block reads the root row. A polymorphic
+        # relation is kept whatever its targets, and keeps its check.
+        return [ForestLiana.name_for(model)] if smart_field_fallback && only_computed_smart_field?(model, field_name, targets)
+
+        targets
       end
 
       def smart_belongs_to_field(model, field_name)
-        forest_collection = ForestLiana.apimap.find { |collection| collection.name.to_s == ForestLiana.name_for(model) }
+        forest_collection_for(model)&.fields_smart_belongs_to&.find { |field| field[:field].to_s == field_name }
+      end
+
+      # SchemaAdapter drops a relation to an excluded model, but keeps one whose target is missing from
+      # the apimap otherwise (a table absent at boot, a secondary database unreachable): skipped alike.
+      # A polymorphic relation's reference names the association, never one of its targets, so it stays.
+      def only_computed_smart_field?(model, field_name, unexposed_targets)
+        fields = forest_collection_for(model)&.fields.to_a.select { |field| field[:field].to_s == field_name }
+        fields = fields.reject do |field|
+          !field[:is_virtual] && unexposed_targets.include?(field[:reference].to_s.split('.').first)
+        end
+
+        fields.any? && fields.all? { |field| field[:is_virtual] && field[:reference].nil? && field[:integration].nil? }
+      end
 
-        forest_collection&.fields_smart_belongs_to&.find { |field| field[:field].to_s == field_name }
+      def forest_collection_for(model)
+        ForestLiana.apimap.find { |collection| collection.name.to_s == ForestLiana.name_for(model) }
       end
 
       # No role can ever be granted `read` on a collection absent from the apimap — a denial
@@ -378,7 +400,10 @@ module ForestLiana
       # partition (not split) so an empty or colon-only path resolves to '' (the root, pinned
       # readable) instead of nil.
       def query_target_collections(root_model, path)
-        resolve_owner(root_model, path.partition(':').first)
+        head, separator, = path.partition(':')
+        # A traversal names the relation itself, never a smart field: a String has no sub-field, and
+        # what the query joins for it is the relation's table.
+        resolve_owner(root_model, head, smart_field_fallback: separator.empty?)
       end
 
       def query_usage(action, root_model, path)

data/app/services/forest_liana/field_path.rb

@@ -1,7 +1,7 @@
 module ForestLiana
   class FieldPath
     # An empty list (a polymorphic relation with no declared target) is read as denied by
-    # readable_leaves?, not as nothing to check.
+    # readable_leaves?, not as nothing to check: a query refuses it, a projection drops it.
     #
     # A prefix naming no relation raises rather than falling back to the root collection, which
     # is pinned readable upstream — a fallback would turn "does not resolve" into "allowed".
@@ -30,6 +30,10 @@ module ForestLiana
       collection_names.any? && collection_names.all? { |name| readable_collection_names.include?(name) }
     end
 
+    def self.unresolved?(collection_names)
+      collection_names.empty?
+    end
+
     def self.leaf_label(collection_names)
       return 'an unresolved polymorphic relation' if collection_names.empty?
 

data/app/services/forest_liana/search_query_builder.rb

@@ -15,6 +15,7 @@ module ForestLiana
       @search = @params[:search].presence
       @user = user
       @filter_joins = []
+      @search_field_paths = []
     end
 
     def perform(resource)
@@ -31,6 +32,7 @@ module ForestLiana
       # already excludes itself on it and so can never be the reason @conditions_pushed is true.
       @conditions_pushed = false
       @lambda_contributed = false
+      @search_footprint_tracked = false
       @records = search_param
 
       caller_filter = @params[:filters].present? ? ForestLiana::ScopeManager.inject_context_variables(@params[:filters], @user) : nil
@@ -90,12 +92,13 @@ module ForestLiana
         # hadn't run at all — this can't currently tell "ran and did nothing" apart from "ran and
         # found real rows". Logged rather than silently discarded, since nothing else would ever
         # surface it to whoever built the smart-search hook.
-        if @lambda_contributed && !@conditions_pushed && malformed_uuid_search?
+        if @search_footprint_tracked && @lambda_contributed && !@conditions_pushed && malformed_uuid_search?
           FOREST_LOGGER.info "A smart-search lambda's result on the \"#{ForestLiana.name_for(root_model)}\" " \
             "collection was discarded: the search term (#{@search.inspect}) is UUID-shaped but " \
             'invalid, and no other condition constrained the query.'
         end
-        @records = @records.none unless @conditions_pushed || (@lambda_contributed && !malformed_uuid_search?)
+        # A host override of search_param that never calls super pushes no condition: its result is served as is.
+        @records = @records.none if @search_footprint_tracked && !@conditions_pushed && !(@lambda_contributed && !malformed_uuid_search?)
       end
 
       @records = sort_query
@@ -125,6 +128,7 @@ module ForestLiana
     end
 
     def search_param
+      @search_footprint_tracked = true
       @search_field_paths = []
 
       if @search

data/lib/forest_liana/version.rb

@@ -1,3 +1,3 @@
 module ForestLiana
-  VERSION = "9.22.5"
+  VERSION = "9.22.7"
 end

data/spec/dummy/lib/forest_liana/collections/boat.rb

@@ -0,0 +1,10 @@
+class Forest::Boat
+  include ForestLiana::Collection
+
+  collection :Boat
+
+  # Named like `belongs_to :harbor` on the model, as Qonto's `legal_form` (PRD-1429).
+  field :harbor, type: 'String' do
+    object.harbor&.name
+  end
+end

data/spec/dummy/lib/forest_liana/collections/captain.rb

@@ -0,0 +1,10 @@
+class Forest::Captain
+  include ForestLiana::Collection
+
+  collection :Captain
+
+  # Named like `has_one :license` on the model (PRD-1429).
+  field :license, type: 'String' do
+    object.license&.number
+  end
+end

data/spec/requests/smart_field_named_like_unexposed_relation_spec.rb

@@ -0,0 +1,125 @@
+require 'rails_helper'
+
+# Forest::Boat#harbor and Forest::Captain#license share their name with a relation of the model.
+# With the relation's target left out of the apimap, SchemaAdapter drops the relation and only the
+# smart field remains: the request reads it off the root row, not off the unexposed target.
+describe 'A computed smart field named like a relation to an unexposed collection', type: :request do
+  token = JWT.encode({ id: 38, email: 'michael.kelso@that70.show', first_name: 'Michael',
+                       last_name: 'Kelso', team: 'Operations', rendering_id: 16,
+                       exp: Time.now.to_i + 2.weeks.to_i, permission_level: 'admin' },
+                     ForestLiana.auth_secret, 'HS256')
+  headers = { 'Accept' => 'application/json', 'Content-Type' => 'application/json',
+              'Authorization' => "Bearer #{token}" }
+  page = { 'number' => '1', 'size' => '15' }
+
+  let!(:harbor) { Harbor.create!(name: 'Saint-Malo') }
+  let!(:captain) { Captain.create!(name: 'Haddock', license_number: 'FR-4421') }
+  let!(:license) { License.create!(number: 'FR-4421', expires_on: Date.new(2030, 1, 1)) }
+  let!(:boat) { Boat.create!(name: 'Karaboudjan', harbor: harbor, captain: captain) }
+
+  let(:unexposed) { [] }
+  let(:relations_kept) { false }
+
+  before do
+    allow(ForestLiana::IpWhitelist).to receive(:retrieve) { true }
+    allow(ForestLiana::IpWhitelist).to receive(:is_ip_whitelist_retrieved) { true }
+    allow(ForestLiana::IpWhitelist).to receive(:is_ip_valid) { true }
+    allow_any_instance_of(ForestLiana::Ability).to receive(:forest_authorize!) { true }
+    allow(ForestLiana::ScopeManager).to receive(:fetch_scopes)
+      .and_return('scopes' => {}, 'team' => { 'id' => '1', 'name' => 'Operations' })
+    allow(ForestLiana).to receive(:apimap).and_wrap_original do |original|
+      original.call.reject { |collection| unexposed.include?(collection.name.to_s) }
+    end
+    # The apimap was built at boot with every target exposed: drop the relations to the unexposed
+    # ones, as SchemaAdapter does for a model left out of it.
+    ForestLiana.apimap.each do |collection|
+      allow(collection).to receive(:fields).and_wrap_original do |original|
+        next original.call if relations_kept
+
+        original.call.reject { |field| unexposed.include?(field[:reference].to_s.split('.').first) }
+      end
+    end
+  end
+
+  def body
+    JSON.parse(response.body)
+  end
+
+  shared_examples 'serving the smart field off the root' do
+    context 'when the belongs_to target is unexposed' do
+      let(:unexposed) { ['Harbor'] }
+
+      it 'serves the list' do
+        get '/forest/Boat', params: { fields: { 'Boat' => 'id,name,harbor' }, page: page, timezone: 'Europe/Paris' },
+                            headers: headers
+
+        expect(response.status).to eq(200)
+        expect(body['data'].map { |row| row['attributes']['harbor'] }).to eq(['Saint-Malo'])
+      end
+
+      it 'serves the get-one' do
+        get "/forest/Boat/#{boat.id}", params: { fields: { 'Boat' => 'id,name,harbor' }, timezone: 'Europe/Paris' },
+                                       headers: headers
+
+        expect(response.status).to eq(200)
+        expect(body['data']['attributes']['harbor']).to eq('Saint-Malo')
+      end
+    end
+
+    context 'when the has_one target is unexposed' do
+      let(:unexposed) { ['License'] }
+
+      it 'serves the list' do
+        get '/forest/Captain', params: { fields: { 'Captain' => 'id,name,license' }, page: page, timezone: 'Europe/Paris' },
+                               headers: headers
+
+        expect(response.status).to eq(200)
+        expect(body['data'].map { |row| row['attributes']['license'] }).to eq(['FR-4421'])
+      end
+
+      it 'serves the get-one' do
+        get "/forest/Captain/#{captain.id}", params: { fields: { 'Captain' => 'id,name,license' }, timezone: 'Europe/Paris' },
+                                             headers: headers
+
+        expect(response.status).to eq(200)
+        expect(body['data']['attributes']['license']).to eq('FR-4421')
+      end
+    end
+  end
+
+  # A target missing from the apimap without being excluded (a table absent at boot, a secondary
+  # database unreachable) leaves its relation in the schema next to the smart field.
+  context 'when the relation to the unexposed target stays in the schema' do
+    let(:relations_kept) { true }
+
+    before { Rails.cache.write('forest.has_permission', false) }
+
+    include_examples 'serving the smart field off the root'
+
+    it "still refuses the unexposed target's own fields" do
+      unexposed << 'Harbor'
+
+      get '/forest/Boat', params: { fields: { 'Boat' => 'id,name,harbor', 'harbor' => 'name' }, page: page,
+                                    timezone: 'Europe/Paris' },
+                          headers: headers
+
+      expect(response.status).to eq(403)
+      expect(body['errors'].first['data']['unexposed_fields']).to eq(['name'])
+    end
+  end
+
+  context 'with skip_relation_read_permissions, as Qonto runs it' do
+    before do
+      allow(ForestLiana).to receive(:skip_relation_read_permissions?) { true }
+      Rails.cache.write('forest.has_permission', true)
+    end
+
+    include_examples 'serving the smart field off the root'
+  end
+
+  context 'without a permission system' do
+    before { Rails.cache.write('forest.has_permission', false) }
+
+    include_examples 'serving the smart field off the root'
+  end
+end

data/spec/requests/unresolved_polymorphic_relation_spec.rb

@@ -0,0 +1,64 @@
+require 'rails_helper'
+
+# devise_invitable declares `belongs_to :invited_by, polymorphic: true` with no `as: :invited_by`
+# inverse anywhere, so no target can be resolved for it (#824).
+describe 'A polymorphic relation with no declared target', type: :request do
+  token = JWT.encode({ id: 1, email: 'michael.kelso@that70.show', first_name: 'Michael',
+                       last_name: 'Kelso', team: 'Operations', rendering_id: 16,
+                       exp: Time.now.to_i + 2.weeks.to_i, permission_level: 'admin' },
+                     ForestLiana.auth_secret, 'HS256')
+  headers = { 'Accept' => 'application/json', 'Content-Type' => 'application/json',
+              'Authorization' => "Bearer #{token}" }
+
+  let!(:user) { User.create!(name: 'Michel') }
+  let!(:address) { Address.create!(line1: '1 Palm Street', city: 'Papeete', zipcode: '98713', addressable: user) }
+
+  before do
+    Rails.cache.clear
+    Rails.cache.write('forest.users', { '1' => { 'id' => 1, 'roleId' => 1, 'rendering_id' => '1' } })
+    Rails.cache.write('forest.has_permission', true)
+    enabled = { 'roles' => [1] }
+    allow_any_instance_of(ForestLiana::Ability::Fetch).to receive(:get_permissions)
+      .with('/liana/v4/permissions/environment').and_return(
+        'collections' => %w[Address User].to_h do |name|
+          [name, { 'collection' => %w[browseEnabled readEnabled editEnabled addEnabled deleteEnabled exportEnabled]
+                                     .to_h { |key| [key, enabled] }, 'actions' => {} }]
+        end
+      )
+    allow(ForestLiana::SchemaUtils).to receive(:polymorphic_models).and_call_original
+    allow(ForestLiana::SchemaUtils).to receive(:polymorphic_models)
+      .with(Address.reflect_on_association(:addressable)).and_return([])
+
+    allow(ForestLiana::IpWhitelist).to receive(:retrieve) { true }
+    allow(ForestLiana::IpWhitelist).to receive(:is_ip_whitelist_retrieved) { true }
+    allow(ForestLiana::IpWhitelist).to receive(:is_ip_valid) { true }
+    allow_any_instance_of(ForestLiana::Ability).to receive(:forest_authorize!) { true }
+    allow(ForestLiana::ScopeManager).to receive(:fetch_scopes)
+      .and_return('scopes' => {}, 'team' => { 'id' => '1', 'name' => 'Operations' })
+  end
+
+  after do
+    Address.destroy_all
+    User.destroy_all
+  end
+
+  it 'serves the get-one without the relation instead of refusing it' do
+    get "/forest/Address/#{address.id}",
+        params: { fields: { 'Address' => 'id,line1,addressable', 'addressable' => 'id' }, timezone: 'Europe/Paris' },
+        headers: headers
+
+    expect(response.status).to eq(200)
+    body = JSON.parse(response.body)
+    expect(body['data']['attributes']['line1']).to eq('1 Palm Street')
+    expect(body['data'].fetch('relationships', {})).not_to have_key('addressable')
+  end
+
+  it 'still refuses a sort on the relation' do
+    get '/forest/Address',
+        params: { fields: { 'Address' => 'id,line1' }, sort: 'addressable.id', page: { 'number' => '1', 'size' => '10' },
+                  timezone: 'Europe/Paris' },
+        headers: headers
+
+    expect(response.status).to eq(403)
+  end
+end

data/spec/services/forest_liana/ability/assert_can_read_query_fields_spec.rb

@@ -284,6 +284,64 @@ module ForestLiana
           end
         end
 
+        # PRD-1429: with `island` left out of the apimap, a computed smart field of the same name is
+        # what a bare path means. A traversal still means the relation, whose table the query joins.
+        describe 'a computed smart field sharing its name with a relation absent from the apimap' do
+          before do
+            forest_collection = double('forest_collection')
+            allow(forest_collection).to receive(:name).and_return('Tree')
+            allow(forest_collection).to receive(:fields_smart_belongs_to).and_return([])
+            allow(forest_collection).to receive(:fields).and_return([{ field: :island, is_virtual: true }])
+            allow(ForestLiana).to receive(:apimap).and_return([forest_collection])
+            write_permissions('Tree' => true)
+          end
+
+          it 'serves a sort on the smart field off the root' do
+            expect { dummy_class.assert_can_read_query_fields(user, Tree, sort_paths: ['island']) }
+              .not_to raise_error
+          end
+
+          it 'still refuses a filter traversing the relation' do
+            expect { dummy_class.assert_can_read_query_fields(user, Tree, filter_paths: ['island:name']) }
+              .to raise_error(ForestLiana::Ability::Exceptions::UnexposedQueryCollectionError)
+          end
+
+          context 'when the relation stays in the schema next to the smart field' do
+            before do
+              allow(ForestLiana.apimap.first).to receive(:fields).and_return(
+                [{ field: :island, reference: 'Island.id', relationship: 'BelongsTo', is_virtual: false },
+                 { field: :island, is_virtual: true }]
+              )
+            end
+
+            it 'serves a sort on the smart field off the root all the same' do
+              expect { dummy_class.assert_can_read_query_fields(user, Tree, sort_paths: ['island']) }
+                .not_to raise_error
+            end
+          end
+        end
+
+        # A polymorphic relation's reference names the association (`addressable.id`), never one of
+        # its targets, so it stays next to the smart field and keeps the name.
+        describe 'a computed smart field sharing its name with a polymorphic relation to unexposed targets' do
+          before do
+            forest_collection = double('forest_collection')
+            allow(forest_collection).to receive(:name).and_return('Address')
+            allow(forest_collection).to receive(:fields_smart_belongs_to).and_return([])
+            allow(forest_collection).to receive(:fields).and_return(
+              [{ field: 'addressable', reference: 'addressable.id', relationship: 'BelongsTo', is_virtual: false },
+               { field: :addressable, is_virtual: true }]
+            )
+            allow(ForestLiana).to receive(:apimap).and_return([forest_collection])
+            write_permissions('Address' => true)
+          end
+
+          it 'keeps refusing a sort on it' do
+            expect { dummy_class.assert_can_read_query_fields(user, Address, sort_paths: ['addressable']) }
+              .to raise_error(ForestLiana::Ability::Exceptions::UnexposedQueryCollectionError)
+          end
+        end
+
         describe 'polymorphic' do
           it 'serves a filter on a relation whose every target is readable' do
             write_permissions('Address' => true, 'User' => true, 'Island' => true)

data/spec/services/forest_liana/ability/redact_fields_spec.rb

@@ -299,13 +299,56 @@ module ForestLiana
         end
 
         describe 'a collection absent from the apimap' do
+          let(:fields) { [] }
+
           before do
             forest_collection = double('forest_collection')
             allow(forest_collection).to receive(:name).and_return('Tree')
             allow(forest_collection).to receive(:fields_smart_belongs_to).and_return([])
+            allow(forest_collection).to receive(:fields).and_return(fields)
             allow(ForestLiana).to receive(:apimap).and_return([forest_collection])
           end
 
+          # SchemaAdapter drops `island` from the schema here, leaving a computed smart field of the
+          # same name as the only field the caller can mean (PRD-1429).
+          context 'when a computed smart field shares its name with the relation' do
+            let(:fields) { [{ field: :island, is_virtual: true }] }
+
+            it 'serves it off the root instead of refusing the request' do
+              write_permissions('Tree' => true)
+
+              expect(dummy_class.redact_fields(user, Tree, { 'Tree' => 'name,island' }, named_collections: ['Tree']))
+                .to eq('Tree' => 'name,island')
+            end
+          end
+
+          # SchemaAdapter keeps the relation when Island is missing from the apimap without being
+          # excluded (a table absent at boot, a secondary database unreachable).
+          context 'when the relation stays in the schema next to the smart field' do
+            let(:fields) do
+              [{ field: :island, reference: 'Island.id', relationship: 'BelongsTo', is_virtual: false },
+               { field: :island, is_virtual: true }]
+            end
+
+            it 'serves the smart field off the root all the same' do
+              write_permissions('Tree' => true)
+
+              expect(dummy_class.redact_fields(user, Tree, { 'Tree' => 'name,island' }, named_collections: ['Tree']))
+                .to eq('Tree' => 'name,island')
+            end
+          end
+
+          context 'when only the relation stays in the schema' do
+            let(:fields) { [{ field: :island, reference: 'Island.id', relationship: 'BelongsTo', is_virtual: false }] }
+
+            it 'keeps refusing it' do
+              write_permissions('Tree' => true)
+
+              expect { dummy_class.redact_fields(user, Tree, { 'Tree' => 'island' }, named_collections: ['Tree']) }
+                .to raise_error(ForestLiana::Ability::Exceptions::UnauthorizedFieldsError)
+            end
+          end
+
           it 'names it as unexposed rather than as merely denied, since no role can be granted read on it' do
             write_permissions('Tree' => true, 'Island' => false)
 
@@ -328,6 +371,58 @@ module ForestLiana
           end
         end
 
+        # The exposed relation still reaches the response alongside the smart field, so its read
+        # check stands: only an unexposed target hands the name over to the smart field.
+        describe 'a computed smart field sharing its name with an exposed relation' do
+          before do
+            forest_collection = double('forest_collection')
+            allow(forest_collection).to receive(:name).and_return('Tree')
+            allow(forest_collection).to receive(:fields_smart_belongs_to).and_return([])
+            allow(forest_collection).to receive(:fields).and_return([{ field: :island, is_virtual: true }])
+            island_collection = double('island_collection')
+            allow(island_collection).to receive(:name).and_return('Island')
+            allow(ForestLiana).to receive(:apimap).and_return([forest_collection, island_collection])
+          end
+
+          it 'keeps checking the relation' do
+            write_permissions('Tree' => true, 'Island' => false)
+
+            expect { dummy_class.redact_fields(user, Tree, { 'Tree' => 'island' }, named_collections: ['Tree']) }
+              .to raise_error(ForestLiana::Ability::Exceptions::UnauthorizedFieldsError) do |error|
+                expect(error.message).to eq("You are not allowed to read 'island' from the 'Island' collection.")
+                expect(error.data[:unexposed_fields]).to be_nil
+              end
+          end
+        end
+
+        # SchemaAdapter keeps a polymorphic relation in the schema even when none of its targets is
+        # exposed, so a computed smart field of the same name does not take the name over.
+        describe 'a computed smart field sharing its name with a polymorphic relation to unexposed targets' do
+          before do
+            forest_collection = double('forest_collection')
+            allow(forest_collection).to receive(:name).and_return('Address')
+            allow(forest_collection).to receive(:fields_smart_belongs_to).and_return([])
+            allow(forest_collection).to receive(:fields).and_return(
+              [{ field: 'addressable', reference: 'addressable.id', relationship: 'BelongsTo', is_virtual: false },
+               { field: :addressable, is_virtual: true }]
+            )
+            allow(ForestLiana).to receive(:apimap).and_return([forest_collection])
+            write_permissions('Address' => true)
+          end
+
+          it 'keeps refusing the root field' do
+            expect { dummy_class.redact_fields(user, Address, { 'Address' => 'line1,addressable' }, named_collections: ['Address']) }
+              .to raise_error(ForestLiana::Ability::Exceptions::UnauthorizedFieldsError)
+          end
+
+          it "keeps refusing the targets' own fields" do
+            expect do
+              dummy_class.redact_fields(user, Address, { 'Address' => 'line1', 'addressable' => 'name' },
+                                        named_collections: %w[Address addressable])
+            end.to raise_error(ForestLiana::Ability::Exceptions::UnauthorizedFieldsError)
+          end
+        end
+
         # Every real collection stays in the apimap here (only Island is rejected), unlike the
         # describe block above — so 'owner' resolves to an exposed-but-denied User, not a second
         # unexposed collection, and the two entries' differently-shaped clauses still join as one
@@ -415,16 +510,17 @@ module ForestLiana
             %w[addresses addresses= address_ids address_ids=].each { |m| Island.undef_method(m) rescue nil }
           end
 
-          it 'treats a relation with no declared target as denied' do
+          it 'drops a relation with no declared target even when the caller named it' do
             write_permissions('Tree' => true)
             Tree.class_eval { belongs_to :subject, polymorphic: true, optional: true }
 
-            expect do
-              dummy_class.redact_fields(user, Tree, { 'subject' => 'id' }, named_collections: ['subject'])
-            end.to raise_error(
-              ForestLiana::Ability::Exceptions::UnauthorizedFieldsError,
-              "You are not allowed to read 'subject' from an unresolved polymorphic relation."
-            )
+            expect(dummy_class.redact_fields(user, Tree, { 'subject' => 'id' }, named_collections: ['subject']))
+              .to eq({})
+            expect(
+              dummy_class.redact_fields(
+                user, Tree, { 'Tree' => 'id,subject', 'subject' => 'id' }, named_collections: %w[Tree subject]
+              )
+            ).to eq('Tree' => 'id')
           ensure
             Tree._reflections.delete('subject')
             Tree._reflections.delete(:subject)

data/spec/services/forest_liana/search_query_builder_spec.rb

@@ -540,6 +540,89 @@ module ForestLiana
       end
     end
 
+    describe '#initialize' do
+      it 'starts with an empty search footprint' do
+        expect(builder.search_field_paths).to eq([])
+      end
+    end
+
+    describe 'when a host app overrides search_param without calling super' do
+      let(:builder_class) do
+        Class.new(described_class) do
+          def search_param
+            return @resource unless @search
+
+            @resource.where('LOWER(trees.name) LIKE ?', "%#{@search.downcase}%")
+          end
+        end
+      end
+      let(:builder) { builder_class.new(params, [], collection, user) }
+
+      before do
+        Tree.create!(name: 'Oak')
+        Tree.create!(name: 'Pine')
+      end
+      after { Tree.destroy_all }
+
+      context 'without a search' do
+        let(:params) { { searchExtended: '0' } }
+
+        it 'serves every record' do
+          expect(builder.perform(Tree.all).count).to eq(2)
+        end
+      end
+
+      context 'with a search the override matches' do
+        let(:params) { { search: 'oak', searchExtended: '0' } }
+
+        it "serves the override's result instead of emptying it" do
+          expect(builder.perform(Tree.all).map(&:name)).to eq(['Oak'])
+        end
+      end
+
+      context 'with a smart-search lambda and a malformed-UUID-shaped search' do
+        let(:builder_class) do
+          Class.new(described_class) do
+            def search_param
+              @resource
+            end
+          end
+        end
+
+        before do
+          allow(ForestLiana).to receive(:schema_for_resource).and_return(
+            ForestLiana::Model::Collection.new(
+              name: 'Tree', fields: [{ field: :custom, type: 'String', search: ->(query, _search) { query.where(name: 'Oak') } }]
+            )
+          )
+        end
+
+        let(:params) { { search: 'abcdef12-3456-4ae-ad4f-5662757713a2', searchExtended: '0' } }
+
+        it "serves the lambda's result without logging it as discarded" do
+          expect(FOREST_LOGGER).not_to receive(:info).with(/was discarded/)
+
+          expect(builder.perform(Tree.all).map(&:name)).to eq(['Oak'])
+        end
+      end
+
+      context 'when the override calls super' do
+        let(:builder_class) do
+          Class.new(described_class) do
+            def search_param
+              super
+            end
+          end
+        end
+        let(:collection) { ForestLiana::Model::Collection.new(name: 'Tree', fields: [], search_fields: ['nonexistent']) }
+        let(:params) { { search: 'nothing-matches-this', searchExtended: '0' } }
+
+        it 'still answers no records when nothing could match' do
+          expect(builder.perform(Tree.all).count).to eq(0)
+        end
+      end
+    end
+
     describe 'a blank or whitespace-only search' do
       let(:params) { ActiveSupport::HashWithIndifferentAccess.new(search: '   ', searchExtended: '1') }
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: forest_liana
 version: !ruby/object:Gem::Version
-  version: 9.22.5
+  version: 9.22.7
 platform: ruby
 authors:
 - Sandro Munda
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-01 00:00:00.000000000 Z
+date: 2026-10-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -454,6 +454,8 @@ files:
 - spec/dummy/db/schema.rb
 - spec/dummy/db/user_schema.rb
 - spec/dummy/lib/forest_liana/collections/address.rb
+- spec/dummy/lib/forest_liana/collections/boat.rb
+- spec/dummy/lib/forest_liana/collections/captain.rb
 - spec/dummy/lib/forest_liana/collections/island.rb
 - spec/dummy/lib/forest_liana/collections/location.rb
 - spec/dummy/lib/forest_liana/collections/owner.rb
@@ -484,9 +486,11 @@ files:
 - spec/requests/query_footprint_spec.rb
 - spec/requests/related_list_nested_through_spec.rb
 - spec/requests/resources_spec.rb
+- spec/requests/smart_field_named_like_unexposed_relation_spec.rb
 - spec/requests/stats_spec.rb
 - spec/requests/sti_record_conversion_spec.rb
 - spec/requests/test.ru
+- spec/requests/unresolved_polymorphic_relation_spec.rb
 - spec/requests/workflow_executions_spec.rb
 - spec/routing/routes_spec.rb
 - spec/serializers/forest_liana/missing_attribute_valve_spec.rb
@@ -808,6 +812,8 @@ test_files:
 - spec/dummy/db/schema.rb
 - spec/dummy/db/user_schema.rb
 - spec/dummy/lib/forest_liana/collections/address.rb
+- spec/dummy/lib/forest_liana/collections/boat.rb
+- spec/dummy/lib/forest_liana/collections/captain.rb
 - spec/dummy/lib/forest_liana/collections/island.rb
 - spec/dummy/lib/forest_liana/collections/location.rb
 - spec/dummy/lib/forest_liana/collections/owner.rb
@@ -838,9 +844,11 @@ test_files:
 - spec/requests/query_footprint_spec.rb
 - spec/requests/related_list_nested_through_spec.rb
 - spec/requests/resources_spec.rb
+- spec/requests/smart_field_named_like_unexposed_relation_spec.rb
 - spec/requests/stats_spec.rb
 - spec/requests/sti_record_conversion_spec.rb
 - spec/requests/test.ru
+- spec/requests/unresolved_polymorphic_relation_spec.rb
 - spec/requests/workflow_executions_spec.rb
 - spec/routing/routes_spec.rb
 - spec/serializers/forest_liana/missing_attribute_valve_spec.rb