forest_liana 9.22.6 → 9.22.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bf311206c7fdea9b79789aba4523930ddccdf1904826d04c36e5e72995eb8640
-  data.tar.gz: 8f1aff957bd3471d3766ec99e5d1ac0e7c808fc96b7193432efde480c85cbfbe
+  metadata.gz: 1899aa8f55f2188189973046573741eb4492ad3e47c8bac900125d7468cc1845
+  data.tar.gz: 8fe15b7c2eaca28fa7c74ad66af35eecc7299dcea6f0671b8e07fa36f07529cd
 SHA512:
-  metadata.gz: edd1873169d8762a7c8687de26c98dd062aca95b3a2c522f6c9ac8c1167ef9d9c26810c148dd6113053414b5cc7e5ae63b3d722ba6a12938f141f1d9a8e2fa5e
-  data.tar.gz: f80f9add4df869e43af24d2944e379d8deb2b27207b66d7fa1ec1e8bc91c8be8dcd4c570ce01ae06423823756cf65574d0c49c57de020626123c0b79726bd718
+  metadata.gz: d5c3b883ebdc5412f0a982b5cd12d23e361163471e5cbe39bc6e7ca956672f8a34ef06eb41300279ce0ac9ca79aab26f28377539e9ada69cf39f8716b17323d3
+  data.tar.gz: 320775ad84781e8b15a27b5cffa365975afa2da9e4d59317bf6bdf2cd9978951eac6b0671e989b6201203df37bc1450e349cd171a4eaf799d6f5a94a28ed56bc

data/app/services/forest_liana/ability/permission.rb

@@ -205,7 +205,7 @@ module ForestLiana
             if readable.call(entry[:owners][collection_key])
               acc[collection_key] = entry[:field_names].join(',')
             else
-              denied << denial_entry(collection_key, entry[:owners][collection_key], readable_collection_names) if named
+              denied << denial_entry(collection_key, entry[:owners][collection_key], readable_collection_names) if named && !FieldPath.unresolved?(entry[:owners][collection_key])
             end
           else
             kept = entry[:field_names].select do |field_name|
@@ -216,7 +216,7 @@ module ForestLiana
                 # differs from root_name — prefix the message so it doesn't read as if 'field_name'
                 # were a bare field of the root.
                 display_path = collection_key == root_name ? field_name : "#{collection_key}:#{field_name}"
-                denied << denial_entry(field_name, entry[:owners][field_name], readable_collection_names, display_path) if named
+                denied << denial_entry(field_name, entry[:owners][field_name], readable_collection_names, display_path) if named && !FieldPath.unresolved?(entry[:owners][field_name])
                 false
               end
             end

data/app/services/forest_liana/field_path.rb

@@ -1,7 +1,7 @@
 module ForestLiana
   class FieldPath
     # An empty list (a polymorphic relation with no declared target) is read as denied by
-    # readable_leaves?, not as nothing to check.
+    # readable_leaves?, not as nothing to check: a query refuses it, a projection drops it.
     #
     # A prefix naming no relation raises rather than falling back to the root collection, which
     # is pinned readable upstream — a fallback would turn "does not resolve" into "allowed".
@@ -30,6 +30,10 @@ module ForestLiana
       collection_names.any? && collection_names.all? { |name| readable_collection_names.include?(name) }
     end
 
+    def self.unresolved?(collection_names)
+      collection_names.empty?
+    end
+
     def self.leaf_label(collection_names)
       return 'an unresolved polymorphic relation' if collection_names.empty?
 

data/lib/forest_liana/version.rb

@@ -1,3 +1,3 @@
 module ForestLiana
-  VERSION = "9.22.6"
+  VERSION = "9.22.7"
 end

data/spec/requests/unresolved_polymorphic_relation_spec.rb

@@ -0,0 +1,64 @@
+require 'rails_helper'
+
+# devise_invitable declares `belongs_to :invited_by, polymorphic: true` with no `as: :invited_by`
+# inverse anywhere, so no target can be resolved for it (#824).
+describe 'A polymorphic relation with no declared target', type: :request do
+  token = JWT.encode({ id: 1, email: 'michael.kelso@that70.show', first_name: 'Michael',
+                       last_name: 'Kelso', team: 'Operations', rendering_id: 16,
+                       exp: Time.now.to_i + 2.weeks.to_i, permission_level: 'admin' },
+                     ForestLiana.auth_secret, 'HS256')
+  headers = { 'Accept' => 'application/json', 'Content-Type' => 'application/json',
+              'Authorization' => "Bearer #{token}" }
+
+  let!(:user) { User.create!(name: 'Michel') }
+  let!(:address) { Address.create!(line1: '1 Palm Street', city: 'Papeete', zipcode: '98713', addressable: user) }
+
+  before do
+    Rails.cache.clear
+    Rails.cache.write('forest.users', { '1' => { 'id' => 1, 'roleId' => 1, 'rendering_id' => '1' } })
+    Rails.cache.write('forest.has_permission', true)
+    enabled = { 'roles' => [1] }
+    allow_any_instance_of(ForestLiana::Ability::Fetch).to receive(:get_permissions)
+      .with('/liana/v4/permissions/environment').and_return(
+        'collections' => %w[Address User].to_h do |name|
+          [name, { 'collection' => %w[browseEnabled readEnabled editEnabled addEnabled deleteEnabled exportEnabled]
+                                     .to_h { |key| [key, enabled] }, 'actions' => {} }]
+        end
+      )
+    allow(ForestLiana::SchemaUtils).to receive(:polymorphic_models).and_call_original
+    allow(ForestLiana::SchemaUtils).to receive(:polymorphic_models)
+      .with(Address.reflect_on_association(:addressable)).and_return([])
+
+    allow(ForestLiana::IpWhitelist).to receive(:retrieve) { true }
+    allow(ForestLiana::IpWhitelist).to receive(:is_ip_whitelist_retrieved) { true }
+    allow(ForestLiana::IpWhitelist).to receive(:is_ip_valid) { true }
+    allow_any_instance_of(ForestLiana::Ability).to receive(:forest_authorize!) { true }
+    allow(ForestLiana::ScopeManager).to receive(:fetch_scopes)
+      .and_return('scopes' => {}, 'team' => { 'id' => '1', 'name' => 'Operations' })
+  end
+
+  after do
+    Address.destroy_all
+    User.destroy_all
+  end
+
+  it 'serves the get-one without the relation instead of refusing it' do
+    get "/forest/Address/#{address.id}",
+        params: { fields: { 'Address' => 'id,line1,addressable', 'addressable' => 'id' }, timezone: 'Europe/Paris' },
+        headers: headers
+
+    expect(response.status).to eq(200)
+    body = JSON.parse(response.body)
+    expect(body['data']['attributes']['line1']).to eq('1 Palm Street')
+    expect(body['data'].fetch('relationships', {})).not_to have_key('addressable')
+  end
+
+  it 'still refuses a sort on the relation' do
+    get '/forest/Address',
+        params: { fields: { 'Address' => 'id,line1' }, sort: 'addressable.id', page: { 'number' => '1', 'size' => '10' },
+                  timezone: 'Europe/Paris' },
+        headers: headers
+
+    expect(response.status).to eq(403)
+  end
+end

data/spec/services/forest_liana/ability/redact_fields_spec.rb

@@ -510,16 +510,17 @@ module ForestLiana
             %w[addresses addresses= address_ids address_ids=].each { |m| Island.undef_method(m) rescue nil }
           end
 
-          it 'treats a relation with no declared target as denied' do
+          it 'drops a relation with no declared target even when the caller named it' do
             write_permissions('Tree' => true)
             Tree.class_eval { belongs_to :subject, polymorphic: true, optional: true }
 
-            expect do
-              dummy_class.redact_fields(user, Tree, { 'subject' => 'id' }, named_collections: ['subject'])
-            end.to raise_error(
-              ForestLiana::Ability::Exceptions::UnauthorizedFieldsError,
-              "You are not allowed to read 'subject' from an unresolved polymorphic relation."
-            )
+            expect(dummy_class.redact_fields(user, Tree, { 'subject' => 'id' }, named_collections: ['subject']))
+              .to eq({})
+            expect(
+              dummy_class.redact_fields(
+                user, Tree, { 'Tree' => 'id,subject', 'subject' => 'id' }, named_collections: %w[Tree subject]
+              )
+            ).to eq('Tree' => 'id')
           ensure
             Tree._reflections.delete('subject')
             Tree._reflections.delete(:subject)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: forest_liana
 version: !ruby/object:Gem::Version
-  version: 9.22.6
+  version: 9.22.7
 platform: ruby
 authors:
 - Sandro Munda
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-01 00:00:00.000000000 Z
+date: 2026-10-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -490,6 +490,7 @@ files:
 - spec/requests/stats_spec.rb
 - spec/requests/sti_record_conversion_spec.rb
 - spec/requests/test.ru
+- spec/requests/unresolved_polymorphic_relation_spec.rb
 - spec/requests/workflow_executions_spec.rb
 - spec/routing/routes_spec.rb
 - spec/serializers/forest_liana/missing_attribute_valve_spec.rb
@@ -847,6 +848,7 @@ test_files:
 - spec/requests/stats_spec.rb
 - spec/requests/sti_record_conversion_spec.rb
 - spec/requests/test.ru
+- spec/requests/unresolved_polymorphic_relation_spec.rb
 - spec/requests/workflow_executions_spec.rb
 - spec/routing/routes_spec.rb
 - spec/serializers/forest_liana/missing_attribute_valve_spec.rb