forest_liana 9.20.13 → 9.21.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3e53d6922c4422fed246ccc6d625ac21668788f962873e6b04e83689684e9a39
-  data.tar.gz: 63d031e91c573ec7413d82bfa0c718b3b61736d6aa6583efd5a7dc848e7baf1b
+  metadata.gz: 9d52c5a01f048d047defb33c61e8a1eb1062e9b71f9e998717b984715b622812
+  data.tar.gz: 9b911cdda6df160758eaaa7cedcd9ac13b47eebf3deec4224c744713de5f2990
 SHA512:
-  metadata.gz: 3a56ce38a01bbebe42696a893bf6e50e762135c8b0579ac488e578468469a3a381963bee3ed1a9c5efb5c73b168aaf80bcfe410ec2f90c25ac80235c29799778
-  data.tar.gz: f93ccc8fcd6cfdbb189e623a3cd3095d79bbd8fd94a70cda8d0cf263476ea6fe3226617b8ebffc3b14a804153f975dddd6903a9791b7c75e85da5e15c72a3b91
+  metadata.gz: 6ea5bc520843d98179d34607094ea1f6b991a0f817d2f9a82b716babeedeeba29ce513a713c79039f75bc4d5bd844de1a64c5265af106666464ce37bc6522eff
+  data.tar.gz: 196c876c1b02b19c85522aa48b6f6856fd27eff601c5edb2897b4e036ebf8318d3f26a8bcc13998d4fe3efd0d2a4e8677330390e803b69809db61b3da04209cf

data/app/controllers/forest_liana/smart_actions_controller.rb

@@ -2,6 +2,7 @@ module ForestLiana
   class SmartActionsController < ForestLiana::ApplicationController
     rescue_from ForestLiana::Ability::Exceptions::TriggerForbidden, with: :render_error
     rescue_from ForestLiana::Ability::Exceptions::RequireApproval, with: :render_error
+    rescue_from ForestLiana::Ability::Exceptions::ApprovalSelectionTooLarge, with: :render_error
     rescue_from ForestLiana::Ability::Exceptions::ActionConditionError, with: :render_error
     include ForestLiana::Ability
     if Rails::VERSION::MAJOR < 4

data/app/services/forest_liana/ability/exceptions/approval_selection_too_large.rb

@@ -0,0 +1,17 @@
+module ForestLiana
+  module Ability
+    module Exceptions
+      class ApprovalSelectionTooLarge < ForestLiana::Errors::ExpectedError
+        def initialize(max, backtrace = nil)
+          super(
+            422,
+                :unprocessable_entity,
+                "This action requires approval and cannot be triggered on more than #{max} records at once. Please refine your selection.",
+                'ApprovalSelectionTooLargeError',
+            backtrace,
+          )
+        end
+      end
+    end
+  end
+end

data/app/services/forest_liana/ability/exceptions/require_approval.rb

@@ -3,8 +3,9 @@ module ForestLiana
     module Exceptions
       class RequireApproval < ForestLiana::Errors::ExpectedError
         attr_reader :data
-        def initialize(data, backtrace = nil)
-          @data = data
+        def initialize(role_ids_allowed_to_approve, backtrace = nil, record_ids = nil)
+          @data = { roleIdsAllowedToApprove: role_ids_allowed_to_approve }
+          @data[:recordIds] = record_ids if record_ids
           super(
             403,
                 :forbidden,

data/app/services/forest_liana/ability/permission/smart_action_checker.rb

@@ -2,12 +2,18 @@ module ForestLiana
   module Ability
     module Permission
       class SmartActionChecker
+        # The Forest server's hard cap on approval record ids - keep in sync.
+        MAX_RECORDS_FOR_APPROVAL = 500
 
-        def initialize(parameters, collection, smart_action, user)
+        # `user` is the permissions-API user (id/roleId); `forest_user` is the JWT user, the one
+        # ResourcesGetter needs (rendering_id for scopes).
+        def initialize(parameters, collection, smart_action, user, action_type = nil, forest_user = nil)
           @parameters = parameters
           @collection = collection
           @smart_action = smart_action
           @user = user
+          @action_type = action_type
+          @forest_user = forest_user
         end
 
         def can_execute?
@@ -36,7 +42,12 @@ module ForestLiana
             return true if condition_by_role_id(@smart_action['triggerConditions']).blank? || match_conditions('triggerConditions')
           elsif @smart_action['approvalRequired'].include?(@user['roleId'])
             if condition_by_role_id(@smart_action['approvalRequiredConditions']).blank? || match_conditions('approvalRequiredConditions')
-              raise ForestLiana::Ability::Exceptions::RequireApproval.new(@smart_action['userApprovalEnabled'])
+              # Global actions target no specific records — never resolve.
+              if @parameters[:data][:attributes][:all_records] && @action_type != 'global'
+                record_ids = select_all_record_ids
+              end
+
+              raise ForestLiana::Ability::Exceptions::RequireApproval.new(@smart_action['userApprovalEnabled'], nil, record_ids)
             else
               return true if condition_by_role_id(@smart_action['triggerConditions']).blank? || match_conditions('triggerConditions')
             end
@@ -45,6 +56,32 @@ module ForestLiana
           raise ForestLiana::Ability::Exceptions::TriggerForbidden.new
         end
 
+        def select_all_record_ids
+          excluded_ids = @parameters[:data][:attributes][:all_records_ids_excluded] || []
+
+          # The exclusion list is client-controlled: it must not re-inflate the bounded fetch.
+          if excluded_ids.length > MAX_RECORDS_FOR_APPROVAL
+            raise ForestLiana::Ability::Exceptions::ApprovalSelectionTooLarge.new(MAX_RECORDS_FOR_APPROVAL)
+          end
+
+          # cap + excluded + 1 raw ids suffice to detect an over-cap selection after exclusions.
+          ids = ForestLiana::ResourcesGetter.get_ids_from_request(
+            @parameters, @forest_user, limit: MAX_RECORDS_FOR_APPROVAL + excluded_ids.length + 1
+          )
+
+          if ids.length > MAX_RECORDS_FOR_APPROVAL
+            raise ForestLiana::Ability::Exceptions::ApprovalSelectionTooLarge.new(MAX_RECORDS_FOR_APPROVAL)
+          end
+
+          # Composite pks come back as arrays: encode them like SerializerFactory#id does.
+          ids.map { |id| id.is_a?(Array) ? id.to_json : id.to_s }
+        rescue ForestLiana::Errors::ExpectedError
+          raise
+        rescue StandardError => exception
+          FOREST_LOGGER.error "Select all record ids resolution error: #{exception.message}"
+          raise ForestLiana::Errors::HTTP422Error.new('Unable to resolve the "select all" selection')
+        end
+
         def match_conditions(condition_name)
           begin
             attributes = @parameters[:data][:attributes]

data/app/services/forest_liana/ability/permission.rb

@@ -39,9 +39,9 @@ module ForestLiana
         collections_data = get_collections_permissions_data
         collection_name = ForestLiana.name_for(collection)
         begin
-          action = find_action_from_endpoint(collection_name, endpoint, http_method).name
+          schema_action = find_action_from_endpoint(collection_name, endpoint, http_method)
 
-          smart_action_approval = SmartActionChecker.new(parameters, collection, collections_data[collection_name][:actions][action], user_data)
+          smart_action_approval = SmartActionChecker.new(parameters, collection, collections_data[collection_name][:actions][schema_action.name], user_data, schema_action.type, user)
           smart_action_approval.can_execute?
         rescue ForestLiana::Errors::ExpectedError => exception
           raise exception

data/app/services/forest_liana/resources_getter.rb

@@ -19,13 +19,13 @@ module ForestLiana
       @base_records_for_batch = @records
     end
 
-    def self.get_ids_from_request(params, user)
+    def self.get_ids_from_request(params, user, limit: nil)
       attributes = params.dig('data', 'attributes')
       return attributes[:ids] if attributes&.fetch(:all_records, false) == false && attributes[:ids]
 
       attributes = merge_subset_query(attributes)
       resources_getter = initialize_resources_getter(attributes, user)
-      ids = fetch_ids(resources_getter)
+      ids = fetch_ids(resources_getter, limit: limit)
 
       filter_excluded_ids(ids, attributes[:all_records_ids_excluded])
     end
@@ -256,15 +256,22 @@ module ForestLiana
       ]
     end
 
-    def self.fetch_ids(resources_getter)
+    def self.fetch_ids(resources_getter, limit: nil)
       ids = []
-      resources_getter.query_for_batch.find_in_batches { |records| ids += records.map(&:id) }
+      resources_getter.query_for_batch.find_in_batches do |records|
+        ids += records.map(&:id)
+        break if limit && ids.length >= limit
+      end
 
-      ids
+      limit ? ids.first(limit) : ids
     end
 
     def self.filter_excluded_ids(ids, ids_excluded)
-      ids_excluded ? ids.reject { |id| ids_excluded.map(&:to_s).include?(id.to_s) } : ids
+      return ids if ids_excluded.blank?
+
+      excluded = ids_excluded.map(&:to_s)
+      # Composite pks are arrays; the frontend excludes them in their serialized JSON form.
+      ids.reject { |id| excluded.include?(id.is_a?(Array) ? id.to_json : id.to_s) }
     end
 
     def search_query

data/lib/forest_liana/engine.rb

@@ -14,9 +14,11 @@ module Rack
     class Resource
       def to_preflight_headers(env)
         h = to_headers(env)
-        h['Access-Control-Allow-Private-Network'] = 'true' if env['HTTP_ACCESS_CONTROL_REQUEST_PRIVATE_NETWORK'] == 'true'
+        # HTTP header names are case-insensitive, but Rack 3 stopped normalizing casing on the way
+        # out: an uppercase key here reaches the server as-is, and Rack::Lint rejects it.
+        h['access-control-allow-private-network'] = 'true' if env['HTTP_ACCESS_CONTROL_REQUEST_PRIVATE_NETWORK'] == 'true'
         if env[HTTP_ACCESS_CONTROL_REQUEST_HEADERS]
-          h.merge!('Access-Control-Allow-Headers' => env[HTTP_ACCESS_CONTROL_REQUEST_HEADERS])
+          h.merge!('access-control-allow-headers' => env[HTTP_ACCESS_CONTROL_REQUEST_HEADERS])
         end
         h
       end

data/lib/forest_liana/version.rb

@@ -1,3 +1,3 @@
 module ForestLiana
-  VERSION = "9.20.13"
+  VERSION = "9.21.0"
 end

data/spec/dummy/app/models/user.rb

@@ -3,5 +3,10 @@ class User < ActiveRecord::Base
   has_many :trees_cut, class_name: 'Tree', inverse_of: :cutter
   has_many :addresses, as: :addressable
 
-  enum title: [ :king, :villager, :outlaw ]
+  # The keyword form is the only one Rails 6.1 knows; Rails 8 only keeps the positional one.
+  if Rails.gem_version >= Gem::Version.new('7.0')
+    enum :title, [ :king, :villager, :outlaw ]
+  else
+    enum title: [ :king, :villager, :outlaw ]
+  end
 end

data/spec/dummy/config/database.yml

@@ -16,16 +16,21 @@ development:
 # Warning: The database defined as "test" will be erased and
 # re-generated from your development database when you run "rake".
 # Do not set this db to the same as development or production.
+#
+# `garage`/`user` back Car/Driver (GarageRecord/UserRecord, connects_to database: { writing: ...
+# }): the 3-tier form is required from Rails 8.0 on — `configs_for(env_name: 'test')` stops
+# recognizing a top-level key as scoped to the environment, so `db:migrate` sees only `primary`
+# and the two cross-database tables are never created.
 test:
-  <<: *default
-  database: db/test.sqlite3
-  
-garage:
-  <<: *default
-  database: db/test2.sqlite3
-user:
-  <<: *default
-  database: db/test3.sqlite3
+  primary:
+    <<: *default
+    database: db/test.sqlite3
+  garage:
+    <<: *default
+    database: db/test2.sqlite3
+  user:
+    <<: *default
+    database: db/test3.sqlite3
 
 production:
   <<: *default

data/spec/dummy/config/environments/test.rb

@@ -20,8 +20,9 @@ Rails.application.configure do
   config.consider_all_requests_local       = true
   config.action_controller.perform_caching = false
 
-  # Raise exceptions instead of rendering exception templates.
-  config.action_dispatch.show_exceptions = false
+  # Raise exceptions instead of rendering exception templates. Rails 8 dropped the boolean form,
+  # and a leftover `false` there falls through to "show all" — rendered 500s instead of raises.
+  config.action_dispatch.show_exceptions = Rails.gem_version >= Gem::Version.new('7.1') ? :none : false
 
   # Disable request forgery protection in test environment.
   config.action_controller.allow_forgery_protection = false

data/spec/dummy/db/migrate/20220719094127_create_cars.rb

@@ -1,5 +1,11 @@
 class CreateCars < ActiveRecord::Migration[6.0]
   def change
+    # `garage` is registered per-environment (3-tier database.yml, required from Rails 8 for
+    # `connects_to` to resolve it at all), so db:migrate now discovers it as its own database and
+    # replays this same file's migrations_paths against it too — this file already ran once by the
+    # time that happens.
+    return if Car.connection.table_exists?(:cars)
+
     Car.connection.create_table :cars do |t|
       t.string :model
       t.references :driver, index: true

data/spec/dummy/db/migrate/20220719094450_create_drivers.rb

@@ -1,5 +1,8 @@
 class CreateDrivers < ActiveRecord::Migration[6.0]
   def change
+    # See CreateCars: db:migrate replays this file against `user`'s own migration run too.
+    return if Driver.connection.table_exists?(:drivers)
+
     Driver.connection.create_table :drivers do |t|
       t.string :firstname
     end

data/spec/lib/forest_liana/bootstrapper_spec.rb

@@ -19,7 +19,16 @@ module ForestLiana
           rails_models.any? { |rails_model| model <= rails_model }
         end
       end
-      let(:rails_models) { [ActiveRecord::InternalMetadata, ActiveRecord::SchemaMigration] }
+      # Rails 7.1 stopped making these ActiveRecord::Base descendants (they became per-connection,
+      # dynamically generated), so ForestLiana.models — walked via ActiveRecord::Base.descendants —
+      # never sees them there in the first place.
+      let(:rails_models) do
+        if Rails.gem_version >= Gem::Version.new('7.1')
+          []
+        else
+          [ActiveRecord::InternalMetadata, ActiveRecord::SchemaMigration]
+        end
+      end
 
       let(:expected_application_models) do
         [
@@ -42,7 +51,7 @@ module ForestLiana
         ForestLiana::Bootstrapper.new
 
         expect(ForestLiana.models).to match_array(ForestLiana.models.uniq)
-        expect(ForestLiana.models).to include(*rails_models)
+        expect(ForestLiana.models).to include(*rails_models) if rails_models.any?
         expect(application_models).to match_array(expected_application_models)
       end
 

data/spec/rails_helper.rb

@@ -32,7 +32,11 @@ rescue ActiveRecord::PendingMigrationError => e
 end
 RSpec.configure do |config|
   # Remove this line if you're not using ActiveRecord or ActiveRecord fixtures
-  config.fixture_path = "#{::Rails.root}/spec/fixtures"
+  if config.respond_to?(:fixture_paths=)
+    config.fixture_paths = ["#{::Rails.root}/spec/fixtures"]
+  else
+    config.fixture_path = "#{::Rails.root}/spec/fixtures"
+  end
 
   # If you're not using ActiveRecord, or you'd prefer not to run each of your
   # examples within a transaction, remove the following line or assign false

data/spec/requests/cors_spec.rb

@@ -50,6 +50,12 @@ describe Rack::Cors do
       assert !last_response.headers['Access-Control-Allow-Private-Network'].nil?
       assert last_response.headers['Access-Control-Allow-Private-Network'] == 'true'
     end
+
+    it 'should allow request headers' do
+      preflight_request('http://localhost:3000', '/', headers: 'authorization,content-type')
+      assert !last_response.headers['Access-Control-Allow-Headers'].nil?
+      assert last_response.headers['Access-Control-Allow-Headers'] == 'authorization,content-type'
+    end
   end
 
   protected

data/spec/services/forest_liana/ability/permission/smart_action_checker_spec.rb

@@ -173,6 +173,138 @@ module ForestLiana
           expect{smart_action_checker.can_execute?}.to raise_error ForestLiana::Ability::Exceptions::RequireApproval
         end
 
+        it 'should expose the approver role ids and skip record ids on an explicit selection' do
+          parameters = ActionController::Parameters.new(params).permit!
+          action['approvalRequired'] = [1]
+          action['userApprovalEnabled'] = [7]
+          allow(ForestLiana::ResourcesGetter).to receive(:get_ids_from_request)
+          smart_action_checker = ForestLiana::Ability::Permission::SmartActionChecker.new(parameters, Island, action, user)
+
+          expect{smart_action_checker.can_execute?}.to raise_error(ForestLiana::Ability::Exceptions::RequireApproval) do |error|
+            expect(error.data[:roleIdsAllowedToApprove]).to eq([7])
+            expect(error.data).not_to have_key(:recordIds)
+          end
+          expect(ForestLiana::ResourcesGetter).not_to have_received(:get_ids_from_request)
+        end
+
+        let(:forest_user) { { 'id' => 1, 'rendering_id' => 13 } }
+
+        it 'should include the resolved record ids in the error on a "select all" trigger' do
+          select_all_params = params.deep_dup
+          select_all_params['data']['attributes'][:all_records] = true
+          select_all_params['data']['attributes'][:ids] = []
+          parameters = ActionController::Parameters.new(select_all_params).permit!
+          action['approvalRequired'] = [1]
+          action['userApprovalEnabled'] = [7]
+          allow(ForestLiana::ResourcesGetter).to receive(:get_ids_from_request).and_return([1, 2, 3])
+          smart_action_checker = ForestLiana::Ability::Permission::SmartActionChecker.new(parameters, Island, action, user, nil, forest_user)
+
+          expect{smart_action_checker.can_execute?}.to raise_error(ForestLiana::Ability::Exceptions::RequireApproval) do |error|
+            expect(error.data[:roleIdsAllowedToApprove]).to eq([7])
+            expect(error.data[:recordIds]).to eq(%w[1 2 3])
+          end
+          # cap + excluded ids (none here) + 1: bounds the fetch instead of materializing the table.
+          # The JWT user (not the permissions one) must be used: scopes need its rendering_id.
+          expect(ForestLiana::ResourcesGetter).to have_received(:get_ids_from_request)
+            .with(anything, forest_user, limit: 501)
+        end
+
+        it 'should widen the fetch limit by the exclusion list size' do
+          select_all_params = params.deep_dup
+          select_all_params['data']['attributes'][:all_records] = true
+          select_all_params['data']['attributes'][:ids] = []
+          select_all_params['data']['attributes'][:all_records_ids_excluded] = (1..100).map(&:to_s)
+          parameters = ActionController::Parameters.new(select_all_params).permit!
+          action['approvalRequired'] = [1]
+          action['userApprovalEnabled'] = [7]
+          allow(ForestLiana::ResourcesGetter).to receive(:get_ids_from_request).and_return((1..500).map(&:to_s))
+          smart_action_checker = ForestLiana::Ability::Permission::SmartActionChecker.new(parameters, Island, action, user, nil, forest_user)
+
+          expect{smart_action_checker.can_execute?}.to raise_error(ForestLiana::Ability::Exceptions::RequireApproval)
+          # Without the excluded term, a 600-record / 100-excluded selection silently
+          # resolves to 401 ids instead of the full 500.
+          expect(ForestLiana::ResourcesGetter).to have_received(:get_ids_from_request)
+            .with(anything, forest_user, limit: 601)
+        end
+
+        it 'should encode composite primary keys the way the serializer builds record ids' do
+          select_all_params = params.deep_dup
+          select_all_params['data']['attributes'][:all_records] = true
+          select_all_params['data']['attributes'][:ids] = []
+          parameters = ActionController::Parameters.new(select_all_params).permit!
+          action['approvalRequired'] = [1]
+          action['userApprovalEnabled'] = [7]
+          allow(ForestLiana::ResourcesGetter).to receive(:get_ids_from_request).and_return([[1, 'abc'], [2, 'def']])
+          smart_action_checker = ForestLiana::Ability::Permission::SmartActionChecker.new(parameters, Island, action, user, nil, forest_user)
+
+          expect{smart_action_checker.can_execute?}.to raise_error(ForestLiana::Ability::Exceptions::RequireApproval) do |error|
+            expect(error.data[:recordIds]).to eq(['[1,"abc"]', '[2,"def"]'])
+          end
+        end
+
+        it 'should not resolve record ids on a "select all" trigger of a global action' do
+          select_all_params = params.deep_dup
+          select_all_params['data']['attributes'][:all_records] = true
+          select_all_params['data']['attributes'][:ids] = []
+          parameters = ActionController::Parameters.new(select_all_params).permit!
+          action['approvalRequired'] = [1]
+          action['userApprovalEnabled'] = [7]
+          allow(ForestLiana::ResourcesGetter).to receive(:get_ids_from_request)
+          smart_action_checker = ForestLiana::Ability::Permission::SmartActionChecker.new(parameters, Island, action, user, 'global')
+
+          expect{smart_action_checker.can_execute?}.to raise_error(ForestLiana::Ability::Exceptions::RequireApproval) do |error|
+            expect(error.data).not_to have_key(:recordIds)
+          end
+          expect(ForestLiana::ResourcesGetter).not_to have_received(:get_ids_from_request)
+        end
+
+        it 'should refuse a "select all" trigger resolving over 500 record ids' do
+          select_all_params = params.deep_dup
+          select_all_params['data']['attributes'][:all_records] = true
+          select_all_params['data']['attributes'][:ids] = []
+          parameters = ActionController::Parameters.new(select_all_params).permit!
+          action['approvalRequired'] = [1]
+          allow(ForestLiana::ResourcesGetter).to receive(:get_ids_from_request).and_return((1..501).map(&:to_s))
+          smart_action_checker = ForestLiana::Ability::Permission::SmartActionChecker.new(parameters, Island, action, user, nil, forest_user)
+
+          expect{smart_action_checker.can_execute?}.to raise_error(
+            ForestLiana::Ability::Exceptions::ApprovalSelectionTooLarge,
+            /more than 500 records/
+          )
+        end
+
+        it 'should refuse a "select all" trigger with an oversized exclusion list without querying' do
+          select_all_params = params.deep_dup
+          select_all_params['data']['attributes'][:all_records] = true
+          select_all_params['data']['attributes'][:ids] = []
+          select_all_params['data']['attributes'][:all_records_ids_excluded] = (1..501).map(&:to_s)
+          parameters = ActionController::Parameters.new(select_all_params).permit!
+          action['approvalRequired'] = [1]
+          allow(ForestLiana::ResourcesGetter).to receive(:get_ids_from_request)
+          smart_action_checker = ForestLiana::Ability::Permission::SmartActionChecker.new(parameters, Island, action, user, nil, forest_user)
+
+          expect{smart_action_checker.can_execute?}.to raise_error(
+            ForestLiana::Ability::Exceptions::ApprovalSelectionTooLarge
+          )
+          expect(ForestLiana::ResourcesGetter).not_to have_received(:get_ids_from_request)
+        end
+
+        it 'should raise a 422 when the id resolution fails unexpectedly' do
+          select_all_params = params.deep_dup
+          select_all_params['data']['attributes'][:all_records] = true
+          select_all_params['data']['attributes'][:ids] = []
+          parameters = ActionController::Parameters.new(select_all_params).permit!
+          action['approvalRequired'] = [1]
+          allow(ForestLiana::ResourcesGetter).to receive(:get_ids_from_request)
+            .and_raise(StandardError.new('Unable to fetch scopes'))
+          smart_action_checker = ForestLiana::Ability::Permission::SmartActionChecker.new(parameters, Island, action, user, nil, forest_user)
+
+          expect{smart_action_checker.can_execute?}.to raise_error(
+            ForestLiana::Errors::HTTP422Error,
+            /Unable to resolve/
+          )
+        end
+
         it 'should raise RequireApproval error if match approvalRequiredConditions' do
           parameters = ActionController::Parameters.new(params).permit!
           action['approvalRequired'] = [1]

data/spec/services/forest_liana/has_many_getter_pagination_spec.rb

@@ -44,8 +44,15 @@ module ForestLiana
     end
 
     after(:each) do
+      # Rails 7.2 switched _reflections/reflections to symbol keys; deleting only the string form
+      # is a silent no-op there. Rails 7.2 also memoizes reflect_on_all_associations and only busts
+      # that cache from add_reflection, never on a direct _reflections mutation — without the
+      # explicit clear, the deleted association keeps leaking into every later spec.
       Tree._reflections.delete('island_neighbour')
+      Tree._reflections.delete(:island_neighbour)
       Tree.reflections.delete('island_neighbour')
+      Tree.reflections.delete(:island_neighbour)
+      Tree.clear_reflections_cache
       %w[island_neighbour island_neighbour= build_island_neighbour
          create_island_neighbour create_island_neighbour! reload_island_neighbour].each do |m|
         Tree.undef_method(m) rescue nil

data/spec/services/forest_liana/has_many_getter_spec.rb

@@ -327,10 +327,17 @@ module ForestLiana
           end
 
           after do
+            # Rails 7.2 switched _reflections/reflections to symbol keys; deleting only the string
+            # form is a silent no-op there. Rails 7.2 also memoizes reflect_on_all_associations and
+            # only busts that cache from add_reflection, never on a direct _reflections mutation —
+            # without the explicit clear, the deleted association keeps leaking into later specs.
             %w[addressable].each do |name|
               Tree._reflections.delete(name)
+              Tree._reflections.delete(name.to_sym)
               Tree.reflections.delete(name)
+              Tree.reflections.delete(name.to_sym)
             end
+            Tree.clear_reflections_cache
             %w[addressable addressable= addressable_id addressable_type].each do |m|
               Tree.undef_method(m) rescue nil
             end

data/spec/services/forest_liana/resources_getter_spec.rb

@@ -166,6 +166,32 @@ module ForestLiana
       end
     end
 
+    describe '.fetch_ids' do
+      it 'returns all the matching ids when no limit is given' do
+        expect(described_class.fetch_ids(getter).length).to eq 30
+      end
+
+      it 'returns at most limit ids' do
+        expect(described_class.fetch_ids(getter, limit: 5).length).to eq 5
+      end
+    end
+
+    describe '.filter_excluded_ids' do
+      it 'removes excluded simple ids' do
+        expect(described_class.filter_excluded_ids([1, 2, 3], ['2'])).to eq [1, 3]
+      end
+
+      it 'removes excluded composite ids given in their serialized JSON form' do
+        expect(described_class.filter_excluded_ids([[1, 'abc'], [2, 'def']], ['[1,"abc"]']))
+          .to eq [[2, 'def']]
+      end
+
+      it 'returns the ids untouched without exclusions' do
+        expect(described_class.filter_excluded_ids([1, 2], [])).to eq [1, 2]
+        expect(described_class.filter_excluded_ids([1, 2], nil)).to eq [1, 2]
+      end
+    end
+
     describe 'when on a model having a reserved SQL word as name' do
       let(:resource) { Reference }
       let(:fields) { { resource.name => 'id' } }

data/spec/services/forest_liana/schema_adapter_default_values_spec.rb

@@ -58,10 +58,16 @@ module ForestLiana
           @original_apimap = ForestLiana.apimap.dup
           @original_models = ForestLiana.models.dup
 
+          # The keyword form is the only one Rails 6.1 knows; Rails 8 only keeps the positional one.
           Object.const_set(:EnumFieldModel, Class.new(ActiveRecord::Base) do
             self.table_name = 'enum_field_models'
-            enum status: { inactive: 0, active: 1, archived: 2 }
-            enum role: { user: "0", admin: "1", superadmin: "2" }
+            if Rails.gem_version >= Gem::Version.new('7.0')
+              enum :status, { inactive: 0, active: 1, archived: 2 }
+              enum :role, { user: "0", admin: "1", superadmin: "2" }
+            else
+              enum status: { inactive: 0, active: 1, archived: 2 }
+              enum role: { user: "0", admin: "1", superadmin: "2" }
+            end
           end)
 
           ActiveRecord::Migration.suppress_messages do

data/test/dummy/app/models/has_one_field.rb

@@ -1,5 +1,10 @@
 class HasOneField < ActiveRecord::Base
-  enum status: [:submitted, :pending, :rejected]
+  # The keyword form is the only one Rails 6.1 knows; Rails 8 only keeps the positional one.
+  if Rails.gem_version >= Gem::Version.new('7.0')
+    enum :status, [:submitted, :pending, :rejected]
+  else
+    enum status: [:submitted, :pending, :rejected]
+  end
 
   has_one :belongs_to_field
   has_one :belongs_to_class_name_field, foreign_key: :foo_id

data/test/dummy/app/models/serialize_field.rb

@@ -1,3 +1,8 @@
 class SerializeField < ActiveRecord::Base
-  serialize :field, Array
+  # The positional coder was removed in Rails 7.2; `type:` only exists from 7.1.
+  if Rails.gem_version >= Gem::Version.new('7.1')
+    serialize :field, type: Array
+  else
+    serialize :field, Array
+  end
 end

data/test/dummy/config/environments/test.rb

@@ -20,8 +20,9 @@ Rails.application.configure do
   config.consider_all_requests_local       = true
   config.action_controller.perform_caching = false
 
-  # Raise exceptions instead of rendering exception templates.
-  config.action_dispatch.show_exceptions = false
+  # Raise exceptions instead of rendering exception templates. Rails 8 dropped the boolean form,
+  # and a leftover `false` there falls through to "show all" — rendered 500s instead of raises.
+  config.action_dispatch.show_exceptions = Rails.gem_version >= Gem::Version.new('7.1') ? :none : false
 
   # Disable request forgery protection in test environment.
   config.action_controller.allow_forgery_protection = false

data/test/test_helper.rb

@@ -14,7 +14,10 @@ Minitest.backtrace_filter = Minitest::BacktraceFilter.new
 Dir["#{File.dirname(__FILE__)}/support/**/*.rb"].each { |f| require f }
 
 # Load fixtures from the engine
-if ActiveSupport::TestCase.respond_to?(:fixture_path=)
+if ActiveSupport::TestCase.respond_to?(:fixture_paths=)
+  ActiveSupport::TestCase.fixture_paths = [File.expand_path("../fixtures", __FILE__)]
+  ActiveSupport::TestCase.fixtures :all
+elsif ActiveSupport::TestCase.respond_to?(:fixture_path=)
   ActiveSupport::TestCase.fixture_path = File.expand_path("../fixtures", __FILE__)
   ActiveSupport::TestCase.fixtures :all
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: forest_liana
 version: !ruby/object:Gem::Version
-  version: 9.20.13
+  version: 9.21.0
 platform: ruby
 authors:
 - Sandro Munda
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-25 00:00:00.000000000 Z
+date: 2026-09-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -276,6 +276,7 @@ files:
 - app/services/forest_liana/ability.rb
 - app/services/forest_liana/ability/exceptions/access_denied.rb
 - app/services/forest_liana/ability/exceptions/action_condition_error.rb
+- app/services/forest_liana/ability/exceptions/approval_selection_too_large.rb
 - app/services/forest_liana/ability/exceptions/require_approval.rb
 - app/services/forest_liana/ability/exceptions/trigger_forbidden.rb
 - app/services/forest_liana/ability/exceptions/unknown_collection.rb
@@ -368,7 +369,6 @@ files:
 - spec/dummy/app/assets/config/manifest.js
 - spec/dummy/app/assets/javascripts/application.js
 - spec/dummy/app/assets/stylesheets/application.css
-- spec/dummy/app/config/routes.rb
 - spec/dummy/app/controllers/application_controller.rb
 - spec/dummy/app/controllers/forest/islands_controller.rb
 - spec/dummy/app/controllers/host_catch_all_controller.rb
@@ -402,7 +402,6 @@ files:
 - spec/dummy/config/environments/development.rb
 - spec/dummy/config/environments/production.rb
 - spec/dummy/config/environments/test.rb
-- spec/dummy/config/initializers/assets.rb
 - spec/dummy/config/initializers/backtrace_silencers.rb
 - spec/dummy/config/initializers/cookies_serializer.rb
 - spec/dummy/config/initializers/filter_parameter_logging.rb
@@ -517,7 +516,6 @@ files:
 - test/dummy/config/environments/development.rb
 - test/dummy/config/environments/production.rb
 - test/dummy/config/environments/test.rb
-- test/dummy/config/initializers/assets.rb
 - test/dummy/config/initializers/backtrace_silencers.rb
 - test/dummy/config/initializers/cookies_serializer.rb
 - test/dummy/config/initializers/filter_parameter_logging.rb
@@ -627,7 +625,6 @@ test_files:
 - test/dummy/config/environments/development.rb
 - test/dummy/config/environments/production.rb
 - test/dummy/config/environments/test.rb
-- test/dummy/config/initializers/assets.rb
 - test/dummy/config/initializers/backtrace_silencers.rb
 - test/dummy/config/initializers/cookies_serializer.rb
 - test/dummy/config/initializers/filter_parameter_logging.rb
@@ -684,7 +681,6 @@ test_files:
 - spec/dummy/app/assets/config/manifest.js
 - spec/dummy/app/assets/javascripts/application.js
 - spec/dummy/app/assets/stylesheets/application.css
-- spec/dummy/app/config/routes.rb
 - spec/dummy/app/controllers/application_controller.rb
 - spec/dummy/app/controllers/forest/islands_controller.rb
 - spec/dummy/app/controllers/host_catch_all_controller.rb
@@ -717,7 +713,6 @@ test_files:
 - spec/dummy/config/environments/development.rb
 - spec/dummy/config/environments/production.rb
 - spec/dummy/config/environments/test.rb
-- spec/dummy/config/initializers/assets.rb
 - spec/dummy/config/initializers/backtrace_silencers.rb
 - spec/dummy/config/initializers/cookies_serializer.rb
 - spec/dummy/config/initializers/filter_parameter_logging.rb

data/spec/dummy/app/config/routes.rb

@@ -1,3 +0,0 @@
-Rails.application.routes.draw do
-  mount ForestLiana::Engine => "/forest"
-end

data/spec/dummy/config/initializers/assets.rb

@@ -1,11 +0,0 @@
-# Be sure to restart your server when you modify this file.
-
-# Version of your assets, change this if you want to expire all your assets.
-Rails.application.config.assets.version = '1.0'
-
-# Add additional assets to the asset load path
-# Rails.application.config.assets.paths << Emoji.images_path
-
-# Precompile additional assets.
-# application.js, application.css, and all non-JS/CSS in app/assets folder are already added.
-# Rails.application.config.assets.precompile += %w( search.js )

data/test/dummy/config/initializers/assets.rb

@@ -1,11 +0,0 @@
-# Be sure to restart your server when you modify this file.
-
-# Version of your assets, change this if you want to expire all your assets.
-Rails.application.config.assets.version = '1.0'
-
-# Add additional assets to the asset load path
-# Rails.application.config.assets.paths << Emoji.images_path
-
-# Precompile additional assets.
-# application.js, application.css, and all non-JS/CSS in app/assets folder are already added.
-# Rails.application.config.assets.precompile += %w( search.js )