graphiti 1.2.18 → 1.2.26

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f286647b00c9b97ec5c280e48e4758f31fbee7f00e19d22073b95c8f10956ad6
-  data.tar.gz: bf208a2b4971f7603bf287c2cfe4787b36525a8b6612e62a99b3bacd7cd80b45
+  metadata.gz: 872977a69e5cb7a4fd2cbe93953be2dbba89868f3c41267b8a72ce22ffb5c600
+  data.tar.gz: 2d189dcaa525e2d5a1b2ffd752a53cc28e0e381cb2411d8530e750175f9de92c
 SHA512:
-  metadata.gz: 1af7ee296afbe6cf900ceb6e3c7fd4e05fd8b0df81d91b748d2b970fdf77245298e755c024c150cde26e86636c3814a20ab45934b810af8ed501b2ec43449549
-  data.tar.gz: f51c1183ede1fd0e4e5aa91ec145b3cd1bc5f7e4633cd61e59232fc6575cb39ca85240fa8590d5b264b29b0522352888b6a7c684cd48a7f4e46b5e47a692155e
+  metadata.gz: 2e3b922df304f43f3404db5e0213dce76bd073d6d226a3c62620fc5ff0198c2a13a6c7ed3b48b92421cfb6396acb31c11e84edb099bdab915cc9b8917baa845b
+  data.tar.gz: 80a5f5f23638c598c64012032a7ab4aea3fc5ce515f6b72f9bdf93f19c1c50ee3fd9fd373a6ccec34e4f84f6cf3217257d10d93b4a870aa06e91be67e610c8b0

data/CHANGELOG.md

@@ -1,7 +1,7 @@
 ## Unreleased
 
 Features:
-
+- [242](https://github.com/graphiti-api/graphiti/pull/242) Bump `jsonapi-renderer` to `~0.2.2` now that (https://github.com/jsonapi-rb/jsonapi-renderer/pull/36) is fixed.
 - [158](https://github.com/graphiti-api/graphiti/pull/158) Filters options `allow_nil: true`
   Option can be set at the resource level `Resource.filters_accept_nil_by_default = true`. 
   By default this is set to false. (@zeisler)

data/Gemfile

@@ -3,6 +3,8 @@ source "https://rubygems.org"
 # Specify your gem's dependencies in graphiti.gemspec
 gemspec
 
+gem "standard", "0.4.7"
+
 group :test do
   gem "pry"
   gem "pry-byebug", platform: [:mri]

data/Guardfile

@@ -1,7 +1,7 @@
 guard :rspec, cmd: "bundle exec rspec --color --format documentation" do
   require "guard/rspec/dsl"
   dsl = Guard::RSpec::Dsl.new(self)
-  watch(%r{^spec/(.*)\/?(.*)_spec\.rb$})
+  watch(%r{^spec/(.*)/?(.*)_spec\.rb$})
 
   # Feel free to open issues for suggestions and improvements
 

data/graphiti.gemspec

@@ -19,7 +19,7 @@ Gem::Specification.new do |spec|
   spec.required_ruby_version = "~> 2.3"
 
   spec.add_dependency "jsonapi-serializable", "~> 0.3.0"
-  spec.add_dependency "jsonapi-renderer", "0.2.0"
+  spec.add_dependency "jsonapi-renderer", "~> 0.2", ">= 0.2.2"
   spec.add_dependency "dry-types", ">= 0.15.0", "< 2.0"
   spec.add_dependency "graphiti_errors", "~> 1.1.0"
   spec.add_dependency "concurrent-ruby", "~> 1.0"
@@ -31,5 +31,4 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "rake", "~> 10.0"
   spec.add_development_dependency "activemodel", ">= 4.1"
   spec.add_development_dependency "graphiti_spec_helpers", "1.0.beta.4"
-  spec.add_development_dependency "standard"
 end

data/lib/graphiti/adapters/active_record.rb

@@ -159,7 +159,7 @@ module Graphiti
 
       # Ensure fractional seconds don't matter
       def filter_datetime_eq(scope, attribute, value, is_not: false)
-        ranges = value.map { |v| (v..v + 1.second - 0.00000001) }
+        ranges = value.map { |v| (v..v + 1.second - 0.00000001) unless v.nil? }
         clause = {attribute => ranges}
         is_not ? scope.where.not(clause) : scope.where(clause)
       end

data/lib/graphiti/adapters/active_record/many_to_many_sideload.rb

@@ -8,6 +8,18 @@ class Graphiti::Adapters::ActiveRecord::ManyToManySideload < Graphiti::Sideload:
     foreign_key.keys.first
   end
 
+  def inverse_filter
+    return @inverse_filter if @inverse_filter
+
+    inferred_name = infer_inverse_association
+
+    if inferred_name
+      "#{inferred_name.to_s.singularize}_id"
+    else
+      super
+    end
+  end
+
   def belongs_to_many_filter(scope, value)
     if polymorphic?
       clauses = value.group_by { |v| v["type"] }.map { |group|
@@ -36,7 +48,8 @@ class Graphiti::Adapters::ActiveRecord::ManyToManySideload < Graphiti::Sideload:
 
   def filter_for(scope, value, type = nil)
     scope
-      .includes(through_relationship_name)
+      .preload(through_relationship_name)
+      .joins(through_relationship_name)
       .where(belongs_to_many_clause(value, type))
   end
 
@@ -75,4 +88,11 @@ class Graphiti::Adapters::ActiveRecord::ManyToManySideload < Graphiti::Sideload:
     value = through_reflection.foreign_key.to_sym
     {key => value}
   end
+
+  def infer_inverse_association
+    through_class = through_reflection.klass
+
+    foreign_reflection = through_class.reflections[name.to_s.singularize]
+    foreign_reflection && foreign_reflection.options[:inverse_of]
+  end
 end

data/lib/graphiti/debugger.rb

@@ -10,6 +10,8 @@ module Graphiti
 
     class << self
       def on_data(name, start, stop, id, payload)
+        return [] unless enabled
+
         took = ((stop - start) * 1000.0).round(2)
         params = scrub_params(payload[:params])
 
@@ -24,7 +26,7 @@ module Graphiti
         end
       end
 
-      def on_data_exception(payload, params)
+      private def on_data_exception(payload, params)
         unless payload[:exception_object].instance_variable_get(:@__graphiti_debug)
           add_chunk do |logs, json|
             logs << ["\n=== Graphiti Debug ERROR", :red, true]
@@ -49,11 +51,11 @@ module Graphiti
         end
       end
 
-      def results(raw_results)
+      private def results(raw_results)
         raw_results.map { |r| "[#{r.class.name}, #{r.id.inspect}]" }.join(", ")
       end
 
-      def on_sideload_data(payload, params, took)
+      private def on_sideload_data(payload, params, took)
         sideload = payload[:sideload]
         results = results(payload[:results])
         add_chunk(payload[:resource], payload[:parent]) do |logs, json|
@@ -72,7 +74,7 @@ module Graphiti
         end
       end
 
-      def on_primary_data(payload, params, took)
+      private def on_primary_data(payload, params, took)
         results = results(payload[:results])
         add_chunk(payload[:resource], payload[:parent]) do |logs, json|
           logs << [""]
@@ -90,6 +92,8 @@ module Graphiti
       end
 
       def on_render(name, start, stop, id, payload)
+        return [] unless enabled
+
         add_chunk do |logs|
           took = ((stop - start) * 1000.0).round(2)
           logs << [""]

data/lib/graphiti/errors.rb

@@ -366,6 +366,20 @@ module Graphiti
       end
     end
 
+    class UndefinedIDLookup < Base
+      def initialize(resource_class)
+        @resource_class = resource_class
+      end
+
+      def message
+        <<~MSG
+          Tried to resolve #{@resource_class} with an :id filter, but the filter was nil.
+          This can result in unscoping a query, which can cause incorrect values to be
+          returned which may or may not bypass standard access controls.
+        MSG
+      end
+    end
+
     class UnknownAttribute < AttributeError
       def message
         "#{super}, but could not find an attribute with that name."

data/lib/graphiti/extensions/extra_attribute.rb

@@ -43,7 +43,7 @@ module Graphiti
         def extra_attribute(name, options = {}, &blk)
           allow_field = proc {
             if options[:if]
-              next false unless instance_eval(&options[:if])
+              next false unless instance_exec(&options[:if])
             end
 
             @extra_fields &&

data/lib/graphiti/query.rb

@@ -1,8 +1,8 @@
 module Graphiti
   class Query
-    attr_reader :resource, :association_name, :params
+    attr_reader :resource, :association_name, :params, :action
 
-    def initialize(resource, params, association_name = nil, nested_include = nil, parents = [])
+    def initialize(resource, params, association_name = nil, nested_include = nil, parents = [], action = nil)
       @resource = resource
       @association_name = association_name
       @params = params
@@ -11,6 +11,7 @@ module Graphiti
       @params = @params.deep_symbolize_keys
       @include_param = nested_include || @params[:include]
       @parents = parents
+      @action = parse_action(action)
     end
 
     def association?
@@ -44,16 +45,19 @@ module Graphiti
 
     def hash
       @hash ||= {}.tap do |h|
-        h[:filter] = filters unless filters.empty?
-        h[:sort] = sorts unless sorts.empty?
-        h[:page] = pagination unless pagination.empty?
-        unless association?
-          h[:fields] = fields unless fields.empty?
-          h[:extra_fields] = extra_fields unless extra_fields.empty?
+        h[:filter] = filters
+        h[:sort] = sorts
+        h[:page] = pagination
+        if association?
+          resource_type = @resource.class.type
+          h[:extra_fields] = {resource_type => extra_fields[resource_type]} if extra_fields.key?(resource_type)
+        else
+          h[:fields] = fields
+          h[:extra_fields] = extra_fields
         end
-        h[:stats] = stats unless stats.empty?
-        h[:include] = sideload_hash unless sideload_hash.empty?
-      end
+        h[:stats] = stats
+        h[:include] = sideload_hash
+      end.reject { |_, value| value.empty? }
     end
 
     def zero_results?
@@ -92,7 +96,7 @@ module Graphiti
               sl_resource = resource_for_sideload(sideload)
               query_parents = parents + [self]
               sub_hash = sub_hash[:include] if sub_hash.key?(:include)
-              hash[key] = Query.new(sl_resource, @params, key, sub_hash, query_parents)
+              hash[key] = Query.new(sl_resource, @params, key, sub_hash, query_parents, :all)
             else
               handle_missing_sideload(key)
             end
@@ -312,5 +316,17 @@ module Graphiti
         end
       end
     end
+
+    def parse_action(action)
+      action ||= @params.fetch(:action, Graphiti.context[:namespace]).try(:to_sym)
+      case action
+      when :index
+        :all
+      when :show
+        :find
+      else
+        action
+      end
+    end
   end
 end

data/lib/graphiti/request_validator.rb

@@ -6,18 +6,18 @@ module Graphiti
       :deserialized_payload,
       to: :@validator
 
-    def initialize(root_resource, raw_params)
-      @validator = ValidatorFactory.create(root_resource, raw_params)
+    def initialize(root_resource, raw_params, action)
+      @validator = ValidatorFactory.create(root_resource, raw_params, action)
     end
 
     class ValidatorFactory
-      def self.create(root_resource, raw_params)
-        case raw_params["action"]
-        when "update" then
+      def self.create(root_resource, raw_params, action)
+        case action
+        when :update then
           RequestValidators::UpdateValidator
         else
           RequestValidators::Validator
-        end.new(root_resource, raw_params)
+        end.new(root_resource, raw_params, action)
       end
     end
   end

data/lib/graphiti/request_validators/validator.rb

@@ -3,10 +3,11 @@ module Graphiti
     class Validator
       attr_reader :errors
 
-      def initialize(root_resource, raw_params)
+      def initialize(root_resource, raw_params, action)
         @root_resource = root_resource
         @raw_params = raw_params
         @errors = Graphiti::Util::SimpleErrors.new(raw_params)
+        @action = action
       end
 
       def validate
@@ -68,6 +69,11 @@ module Graphiti
 
       def typecast_attributes(resource, attributes, payload_path)
         attributes.each_pair do |key, value|
+          # Only validate id if create action, otherwise it's only used for lookup
+          next if @action != :create &&
+            key == :id &&
+            resource.class.config[:attributes][:id][:writable] == false
+
           begin
             attributes[key] = resource.typecast(key, value, :writable)
           rescue Graphiti::Errors::UnknownAttribute

data/lib/graphiti/resource/dsl.rb

@@ -5,6 +5,7 @@ module Graphiti
 
       class_methods do
         def filter(name, *args, &blk)
+          name = name.to_sym
           opts = args.extract_options!
           type_override = args[0]
 
@@ -135,6 +136,7 @@ module Graphiti
             filterable: false
           }
           options = defaults.merge(options)
+          attribute_option(options, :readable)
           config[:extra_attributes][name] = options
           apply_extra_attributes_to_serializer
         end

data/lib/graphiti/resource/interface.rb

@@ -11,7 +11,7 @@ module Graphiti
 
         # @api private
         def _all(params, opts, base_scope)
-          runner = Runner.new(self, params, opts.delete(:query))
+          runner = Runner.new(self, params, opts.delete(:query), :all)
           opts[:params] = params
           runner.proxy(base_scope, opts)
         end
@@ -23,11 +23,14 @@ module Graphiti
 
         # @api private
         def _find(params = {}, base_scope = nil)
+          guard_nil_id!(params[:data])
+          guard_nil_id!(params)
+
           id = params[:data].try(:[], :id) || params.delete(:id)
           params[:filter] ||= {}
           params[:filter][:id] = id if id
 
-          runner = Runner.new(self, params)
+          runner = Runner.new(self, params, nil, :find)
           runner.proxy base_scope,
             single: true,
             raise_on_missing: true,
@@ -52,6 +55,13 @@ module Graphiti
             end
           end
         end
+
+        def guard_nil_id!(params)
+          return unless params
+          if params.key?(:id) && params[:id].nil?
+            raise Errors::UndefinedIDLookup.new(self)
+          end
+        end
       end
     end
   end

data/lib/graphiti/resource_proxy.rb

@@ -93,7 +93,7 @@ module Graphiti
       original = Graphiti.context[:namespace]
       begin
         Graphiti.context[:namespace] = action
-        ::Graphiti::RequestValidator.new(@resource, @payload.params).validate!
+        ::Graphiti::RequestValidator.new(@resource, @payload.params, action).validate!
         validator = persist {
           @resource.persist_with_relationships \
             @payload.meta(action: action),
@@ -118,6 +118,7 @@ module Graphiti
     end
 
     def destroy
+      data
       transaction_response = @resource.transaction do
         metadata = {method: :destroy}
         model = @resource.destroy(@query.filters[:id], metadata)
@@ -135,6 +136,7 @@ module Graphiti
     end
 
     def update_attributes
+      data
       save(action: :update)
     end
 

data/lib/graphiti/runner.rb

@@ -3,13 +3,13 @@ module Graphiti
     attr_reader :params
     attr_reader :deserialized_payload
 
-    def initialize(resource_class, params, query = nil)
+    def initialize(resource_class, params, query = nil, action = nil)
       @resource_class = resource_class
       @params = params
       @query = query
+      @action = action
 
-      validator = RequestValidator.new(jsonapi_resource, params)
-
+      validator = RequestValidator.new(jsonapi_resource, params, action)
       validator.validate!
 
       @deserialized_payload = validator.deserialized_payload
@@ -30,7 +30,7 @@ module Graphiti
     end
 
     def query
-      @query ||= Query.new(jsonapi_resource, params)
+      @query ||= Query.new(jsonapi_resource, params, nil, nil, [], @action)
     end
 
     def query_hash

data/lib/graphiti/sideload.rb

@@ -132,6 +132,10 @@ module Graphiti
       end
     end
 
+    def link_filter(parents)
+      base_filter(parents)
+    end
+
     # The parent resource is a remote,
     # AND the sideload is a remote to the same endpoint
     def shared_remote?

data/lib/graphiti/sideload/has_many.rb

@@ -1,8 +1,18 @@
 class Graphiti::Sideload::HasMany < Graphiti::Sideload
+  def initialize(name, opts)
+    @inverse_filter = opts[:inverse_filter]
+
+    super(name, opts)
+  end
+
   def type
     :has_many
   end
 
+  def inverse_filter
+    @inverse_filter || foreign_key
+  end
+
   def load_params(parents, query)
     query.hash.tap do |hash|
       hash[:filter] ||= {}
@@ -11,11 +21,19 @@ class Graphiti::Sideload::HasMany < Graphiti::Sideload
   end
 
   def base_filter(parents)
-    {foreign_key => ids_for_parents(parents).join(",")}
+    {foreign_key => parent_filter(parents)}
+  end
+
+  def link_filter(parents)
+    {inverse_filter => parent_filter(parents)}
   end
 
   private
 
+  def parent_filter(parents)
+    ids_for_parents(parents).join(",")
+  end
+
   def child_map(children)
     children.group_by(&foreign_key)
   end

data/lib/graphiti/sideload/many_to_many.rb

@@ -11,8 +11,12 @@ class Graphiti::Sideload::ManyToMany < Graphiti::Sideload::HasMany
     foreign_key.values.first
   end
 
+  def inverse_filter
+    @inverse_filter || true_foreign_key
+  end
+
   def base_filter(parents)
-    {true_foreign_key => ids_for_parents(parents).join(",")}
+    {true_foreign_key => parent_filter(parents)}
   end
 
   def infer_foreign_key
@@ -32,7 +36,7 @@ class Graphiti::Sideload::ManyToMany < Graphiti::Sideload::HasMany
     self_ref = self
     fk_type = parent_resource_class.attributes[:id][:type]
     fk_type = :hash if polymorphic?
-    resource_class.filter true_foreign_key, fk_type do
+    resource_class.filter inverse_filter, fk_type do
       eq do |scope, value|
         self_ref.belongs_to_many_filter(scope, value)
       end

data/lib/graphiti/util/link.rb

@@ -60,7 +60,7 @@ module Graphiti
       def params
         @params ||= {}.tap do |params|
           if @sideload.type != :belongs_to || @sideload.remote?
-            params[:filter] = @sideload.base_filter([@model])
+            params[:filter] = @sideload.link_filter([@model])
           end
 
           @sideload.params_proc&.call(params, [@model], context)

data/lib/graphiti/version.rb

@@ -1,3 +1,3 @@
 module Graphiti
-  VERSION = "1.2.18"
+  VERSION = "1.2.26"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: graphiti
 version: !ruby/object:Gem::Version
-  version: 1.2.18
+  version: 1.2.26
 platform: ruby
 authors:
 - Lee Richmond
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-05-20 00:00:00.000000000 Z
+date: 2020-09-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jsonapi-serializable
@@ -28,16 +28,22 @@ dependencies:
   name: jsonapi-renderer
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.2'
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 0.2.0
+        version: 0.2.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.2.0
+        version: '0.2'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.2.2
 - !ruby/object:Gem::Dependency
   name: dry-types
   requirement: !ruby/object:Gem::Requirement
@@ -184,20 +190,6 @@ dependencies:
     - - '='
       - !ruby/object:Gem::Version
         version: 1.0.beta.4
-- !ruby/object:Gem::Dependency
-  name: standard
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
 description: 
 email:
 - richmolj@gmail.com