graphiti 1.13.1 → 1.13.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '00079e4b8294e1599af72b809255cd45241c9ce730b52da2bd2cb0f43ca1896d'
-  data.tar.gz: bd94a8f30ac9c6ba15faee254c86399d08b43ff0c7583b667100a6d07a3f6428
+  metadata.gz: f75003b9d958879d44777f39f94e8221224b3826d80a8fe6e420e510ea4dd163
+  data.tar.gz: 0d0dda07deaefcc5fdfc7c91f44b3b7677b82ed950770ddb08cf24d49ea5e10e
 SHA512:
-  metadata.gz: 9691a12e9e2f38d3f3efa1988166d8d721fbda285a4a5b66e9bd532817029d745a4787cd6b62260e800a8de213b86ed4ac0ddf67e92bfa0db4fa22fa6c25d402
-  data.tar.gz: fb40fdeb2791635ec48d512a0eeae788bfaf6472c8f9de23894d166610c702acb3bad6728b69647b4934ab2bb2ac814ac1dd767d4aaccb240e6d5981c18414bc
+  metadata.gz: 57117fb28dc6f0434c91b57e8b7960caeb5bdb33d2d2768009138ec66f10d7d057c472c696e07debeb4af149e5de4ddfcffb30741b473810d4b589a7ac4adc8e
+  data.tar.gz: 394c4e38acfc68b78c966ecf3cb7dbd73a5038a5163c8c72045e185eb02a9ed4f919c20ee2598b015cfc27f04b749d1fc7f5b306856befd13d006cb81d0a73af

data/CHANGELOG.md

@@ -1,5 +1,20 @@
 graphiti changelog
 
+## [1.13.3](https://github.com/graphiti-api/graphiti/compare/v1.13.2...v1.13.3) (2026-08-09)
+
+
+### Bug Fixes
+
+* reject invalid page parameters ([#537](https://github.com/graphiti-api/graphiti/issues/537)) ([fbb5683](https://github.com/graphiti-api/graphiti/commit/fbb5683393301e17ffcea84990ac5a95bdd3e15f)), closes [#347](https://github.com/graphiti-api/graphiti/issues/347)
+* treat empty polymorphic configuration as unset ([#538](https://github.com/graphiti-api/graphiti/issues/538)) ([a27eeea](https://github.com/graphiti-api/graphiti/commit/a27eeea6eeb72749376c1f7959cadc89012142b9)), closes [#199](https://github.com/graphiti-api/graphiti/issues/199)
+
+## [1.13.2](https://github.com/graphiti-api/graphiti/compare/v1.13.1...v1.13.2) (2026-08-07)
+
+
+### Bug Fixes
+
+* drop the relationship guard install notice ([65b8be6](https://github.com/graphiti-api/graphiti/commit/65b8be65455a7d034c9dca082434c1dbfe610a7a))
+
 ## [1.13.1](https://github.com/graphiti-api/graphiti/compare/v1.13.0...v1.13.1) (2026-08-02)
 
 

data/graphiti.gemspec

@@ -18,24 +18,6 @@ Gem::Specification.new do |spec|
   spec.require_paths = ["lib"]
   spec.required_ruby_version = ">= 2.7"
 
-  # TODO: remove once the 1.12 upgrade window has passed
-  spec.post_install_message = <<~MSG
-    Graphiti: relationship readable:/writable: guards are now enforced.
-
-    Symbols, strings, and procs passed to a relationship's readable/writable
-    guards were always interpreted as true and never actually called before this
-    conditional relationship change. They are now evaluated per-request, where
-    unreadable relationships are omitted from responses and includes, and unwritable
-    relationships reject writes.
-
-    To list every affected relationship in your app:
-
-      bin/rails runner 'puts Graphiti.guarded_relationships'
-
-    Audit these before deploying. Apps using schema.json will also see affected 
-    relationships flagged as "became guarded" by the schema check.
-  MSG
-
   spec.add_dependency "jsonapi-serializable", "~> 0.3.0"
   spec.add_dependency "jsonapi-renderer", "~> 0.2", ">= 0.2.2"
   spec.add_dependency "dry-types", ">= 0.15.0", "< 2.0"

data/lib/graphiti/request_validators/validator.rb

@@ -11,10 +11,12 @@ module Graphiti
       end
 
       def validate
+        validate_page
+
         # Right now, all requests - even reads - go through the validator
         # In the future these should have their own validation logic, but
         # for now we can just bypass
-        return true unless @params.has_key?(:data)
+        return errors.blank? unless @params.has_key?(:data)
 
         resource = @root_resource
 
@@ -48,6 +50,13 @@ module Graphiti
 
       private
 
+      def validate_page
+        page = @params[:page]
+        return if page.nil? || page.respond_to?(:each_pair)
+
+        @errors.add(:page, :invalid, message: "must be an object")
+      end
+
       def process_relationships(resource, relationships, payload_path)
         relationships.each_key do |name|
           unless resource.class.sideload(name.to_sym)

data/lib/graphiti/resource/configuration.rb

@@ -21,6 +21,10 @@ module Graphiti
           send(:prepend, Polymorphism)
         end
 
+        def polymorphic?
+          polymorphic.present?
+        end
+
         def type=(val)
           val = val&.to_sym
           if (val = super)

data/lib/graphiti/resource/polymorphism.rb

@@ -8,6 +8,8 @@ module Graphiti
       end
 
       def serializer_for(model)
+        return super unless self.class.polymorphic?
+
         if polymorphic_child?
           serializer
         else
@@ -17,10 +19,14 @@ module Graphiti
       end
 
       def associate_all(*args)
+        return super unless self.class.polymorphic?
+
         _associate(:associate_all, *args)
       end
 
       def associate(*args)
+        return super unless self.class.polymorphic?
+
         _associate(:associate, *args)
       end
 
@@ -34,6 +40,8 @@ module Graphiti
 
       module ClassMethods
         def inherited(klass)
+          return super unless polymorphic?
+
           klass.type = nil
           klass.model = klass.infer_model
           klass.endpoint = klass.infer_endpoint
@@ -42,6 +50,8 @@ module Graphiti
         end
 
         def sideload(name)
+          return super unless polymorphic?
+
           if (split_on = name.to_s.split(/^on__/)).length > 1
             on_type, name = split_on[1].split("--").map(&:to_sym)
           end

data/lib/graphiti/version.rb

@@ -1,3 +1,3 @@
 module Graphiti
-  VERSION = "1.13.1"
+  VERSION = "1.13.3"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: graphiti
 version: !ruby/object:Gem::Version
-  version: 1.13.1
+  version: 1.13.3
 platform: ruby
 authors:
 - Lee Richmond
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-08-02 00:00:00.000000000 Z
+date: 2026-08-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jsonapi-serializable
@@ -371,14 +371,7 @@ homepage: https://github.com/graphiti-api/graphiti
 licenses:
 - MIT
 metadata: {}
-post_install_message: "Graphiti: relationship readable:/writable: guards are now enforced.\n\nSymbols,
-  strings, and procs passed to a relationship's readable/writable\nguards were always
-  interpreted as true and never actually called before this\nconditional relationship
-  change. They are now evaluated per-request, where\nunreadable relationships are
-  omitted from responses and includes, and unwritable\nrelationships reject writes.\n\nTo
-  list every affected relationship in your app:\n\n  bin/rails runner 'puts Graphiti.guarded_relationships'\n\nAudit
-  these before deploying. Apps using schema.json will also see affected \nrelationships
-  flagged as \"became guarded\" by the schema check.\n"
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib