graphiti 1.2.19 → 1.2.27

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cd17ed21a3a7d08e6a1cf0ee76827f1d539091f08234adf596fe9287089305c6
-  data.tar.gz: ee470506b0ccb4d5dc6e0a132021eb2f22e8b6de60e12733922a9a1ca51d0617
+  metadata.gz: fb8f1e8668da2d5d53c211b2f999a5109bf968815f1a700be6d5ee29537afc21
+  data.tar.gz: c60dd4731e33f6b495b82575989dc72376697ec21bbcbb01ce23021c61dbc26b
 SHA512:
-  metadata.gz: '058c85a01c7eeb6bf9318500d0b77d143d1b259872e5f98b8470dcce8ca5e5a31d3e4213e032e9c512dec4b00522a4c2030e851e2f0e2f41b23e900876b4c575'
-  data.tar.gz: 7680fe2ffca53e9d8c2ab9ac35ca5ad5c2eb1f4ae2417dc8e233f847ca4e36fad5ec383ed6971c0e325f7a4daa6cb6feffaf19971d1fbebd0437d0585ec24e32
+  metadata.gz: ecd5b910c32aff8592b16406fb8cf12e3d8d00585e671900966c594e475ea9a4d7b620d7d7ff52d35aad9190563fc29f5ce0e1014d886ee35ed46b72e1791ca8
+  data.tar.gz: e1273d26d0571ae89f0405933888ac17b10083cfe250da9cb7d7118a511efe381cc03176ec9f78e30e5157d2ec2588883c6d113a22a84a0d326e9ccf02b016dd

data/CHANGELOG.md

@@ -1,7 +1,7 @@
 ## Unreleased
 
 Features:
-
+- [242](https://github.com/graphiti-api/graphiti/pull/242) Bump `jsonapi-renderer` to `~0.2.2` now that (https://github.com/jsonapi-rb/jsonapi-renderer/pull/36) is fixed.
 - [158](https://github.com/graphiti-api/graphiti/pull/158) Filters options `allow_nil: true`
   Option can be set at the resource level `Resource.filters_accept_nil_by_default = true`. 
   By default this is set to false. (@zeisler)

data/Guardfile

@@ -1,7 +1,7 @@
 guard :rspec, cmd: "bundle exec rspec --color --format documentation" do
   require "guard/rspec/dsl"
   dsl = Guard::RSpec::Dsl.new(self)
-  watch(%r{^spec/(.*)\/?(.*)_spec\.rb$})
+  watch(%r{^spec/(.*)/?(.*)_spec\.rb$})
 
   # Feel free to open issues for suggestions and improvements
 

data/gemfiles/rails_4.gemfile

@@ -2,7 +2,7 @@
 
 source "https://rubygems.org"
 
-gem "rails", "~> 4.1"
+gem "rails", "~> 4.2"
 gem "rspec-rails"
 gem "sqlite3", "~> 1.3.6"
 gem "database_cleaner"

data/graphiti.gemspec

@@ -19,7 +19,7 @@ Gem::Specification.new do |spec|
   spec.required_ruby_version = "~> 2.3"
 
   spec.add_dependency "jsonapi-serializable", "~> 0.3.0"
-  spec.add_dependency "jsonapi-renderer", "0.2.0"
+  spec.add_dependency "jsonapi-renderer", "~> 0.2", ">= 0.2.2"
   spec.add_dependency "dry-types", ">= 0.15.0", "< 2.0"
   spec.add_dependency "graphiti_errors", "~> 1.1.0"
   spec.add_dependency "concurrent-ruby", "~> 1.0"
@@ -29,7 +29,7 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "kaminari", "~> 0.17"
   spec.add_development_dependency "bundler"
   spec.add_development_dependency "rake", "~> 10.0"
+  spec.add_development_dependency "standard", "0.4.7"
   spec.add_development_dependency "activemodel", ">= 4.1"
   spec.add_development_dependency "graphiti_spec_helpers", "1.0.beta.4"
-  spec.add_development_dependency "standard"
 end

data/lib/graphiti/adapters/active_record.rb

@@ -1,7 +1,7 @@
 module Graphiti
   module Adapters
     class ActiveRecord < ::Graphiti::Adapters::Abstract
-      require "graphiti/adapters/active_record/inferrence"
+      require "graphiti/adapters/active_record/inference"
       require "graphiti/adapters/active_record/has_many_sideload"
       require "graphiti/adapters/active_record/belongs_to_sideload"
       require "graphiti/adapters/active_record/has_one_sideload"
@@ -159,7 +159,7 @@ module Graphiti
 
       # Ensure fractional seconds don't matter
       def filter_datetime_eq(scope, attribute, value, is_not: false)
-        ranges = value.map { |v| (v..v + 1.second - 0.00000001) }
+        ranges = value.map { |v| (v..v + 1.second - 0.00000001) unless v.nil? }
         clause = {attribute => ranges}
         is_not ? scope.where.not(clause) : scope.where(clause)
       end

data/lib/graphiti/adapters/active_record/belongs_to_sideload.rb

@@ -1,5 +1,5 @@
 class Graphiti::Adapters::ActiveRecord::BelongsToSideload < Graphiti::Sideload::BelongsTo
-  include Graphiti::Adapters::ActiveRecord::Inferrence
+  include Graphiti::Adapters::ActiveRecord::Inference
 
   def default_base_scope
     resource_class.model.all

data/lib/graphiti/adapters/active_record/has_many_sideload.rb

@@ -1,5 +1,5 @@
 class Graphiti::Adapters::ActiveRecord::HasManySideload < Graphiti::Sideload::HasMany
-  include Graphiti::Adapters::ActiveRecord::Inferrence
+  include Graphiti::Adapters::ActiveRecord::Inference
 
   def default_base_scope
     resource_class.model.all

data/lib/graphiti/adapters/active_record/has_one_sideload.rb

@@ -1,5 +1,5 @@
 class Graphiti::Adapters::ActiveRecord::HasOneSideload < Graphiti::Sideload::HasOne
-  include Graphiti::Adapters::ActiveRecord::Inferrence
+  include Graphiti::Adapters::ActiveRecord::Inference
 
   def default_base_scope
     resource_class.model.all

data/lib/graphiti/adapters/active_record/{inferrence.rb → inference.rb}

@@ -1,6 +1,6 @@
-module Graphiti::Adapters::ActiveRecord::Inferrence
+module Graphiti::Adapters::ActiveRecord::Inference
   # If going AR to AR, use AR introspection
-  # If going AR to PORO, fall back to normal inferrence
+  # If going AR to PORO, fall back to normal inference
   def infer_foreign_key
     parent_model = parent_resource_class.model
     reflection = parent_model.reflections[association_name.to_s]

data/lib/graphiti/adapters/active_record/many_to_many_sideload.rb

@@ -8,6 +8,18 @@ class Graphiti::Adapters::ActiveRecord::ManyToManySideload < Graphiti::Sideload:
     foreign_key.keys.first
   end
 
+  def inverse_filter
+    return @inverse_filter if @inverse_filter
+
+    inferred_name = infer_inverse_association
+
+    if inferred_name
+      "#{inferred_name.to_s.singularize}_id"
+    else
+      super
+    end
+  end
+
   def belongs_to_many_filter(scope, value)
     if polymorphic?
       clauses = value.group_by { |v| v["type"] }.map { |group|
@@ -75,4 +87,11 @@ class Graphiti::Adapters::ActiveRecord::ManyToManySideload < Graphiti::Sideload:
     value = through_reflection.foreign_key.to_sym
     {key => value}
   end
+
+  def infer_inverse_association
+    through_class = through_reflection.klass
+
+    foreign_reflection = through_class.reflections[name.to_s.singularize]
+    foreign_reflection && foreign_reflection.options[:inverse_of]
+  end
 end

data/lib/graphiti/debugger.rb

@@ -10,6 +10,8 @@ module Graphiti
 
     class << self
       def on_data(name, start, stop, id, payload)
+        return [] unless enabled
+
         took = ((stop - start) * 1000.0).round(2)
         params = scrub_params(payload[:params])
 
@@ -24,7 +26,7 @@ module Graphiti
         end
       end
 
-      def on_data_exception(payload, params)
+      private def on_data_exception(payload, params)
         unless payload[:exception_object].instance_variable_get(:@__graphiti_debug)
           add_chunk do |logs, json|
             logs << ["\n=== Graphiti Debug ERROR", :red, true]
@@ -49,11 +51,11 @@ module Graphiti
         end
       end
 
-      def results(raw_results)
+      private def results(raw_results)
         raw_results.map { |r| "[#{r.class.name}, #{r.id.inspect}]" }.join(", ")
       end
 
-      def on_sideload_data(payload, params, took)
+      private def on_sideload_data(payload, params, took)
         sideload = payload[:sideload]
         results = results(payload[:results])
         add_chunk(payload[:resource], payload[:parent]) do |logs, json|
@@ -72,7 +74,7 @@ module Graphiti
         end
       end
 
-      def on_primary_data(payload, params, took)
+      private def on_primary_data(payload, params, took)
         results = results(payload[:results])
         add_chunk(payload[:resource], payload[:parent]) do |logs, json|
           logs << [""]
@@ -90,6 +92,8 @@ module Graphiti
       end
 
       def on_render(name, start, stop, id, payload)
+        return [] unless enabled
+
         add_chunk do |logs|
           took = ((stop - start) * 1000.0).round(2)
           logs << [""]

data/lib/graphiti/errors.rb

@@ -366,6 +366,20 @@ module Graphiti
       end
     end
 
+    class UndefinedIDLookup < Base
+      def initialize(resource_class)
+        @resource_class = resource_class
+      end
+
+      def message
+        <<~MSG
+          Tried to resolve #{@resource_class} with an :id filter, but the filter was nil.
+          This can result in unscoping a query, which can cause incorrect values to be
+          returned which may or may not bypass standard access controls.
+        MSG
+      end
+    end
+
     class UnknownAttribute < AttributeError
       def message
         "#{super}, but could not find an attribute with that name."

data/lib/graphiti/extensions/extra_attribute.rb

@@ -43,7 +43,7 @@ module Graphiti
         def extra_attribute(name, options = {}, &blk)
           allow_field = proc {
             if options[:if]
-              next false unless instance_eval(&options[:if])
+              next false unless instance_exec(&options[:if])
             end
 
             @extra_fields &&

data/lib/graphiti/query.rb

@@ -1,8 +1,8 @@
 module Graphiti
   class Query
-    attr_reader :resource, :association_name, :params
+    attr_reader :resource, :association_name, :params, :action
 
-    def initialize(resource, params, association_name = nil, nested_include = nil, parents = [])
+    def initialize(resource, params, association_name = nil, nested_include = nil, parents = [], action = nil)
       @resource = resource
       @association_name = association_name
       @params = params
@@ -11,6 +11,7 @@ module Graphiti
       @params = @params.deep_symbolize_keys
       @include_param = nested_include || @params[:include]
       @parents = parents
+      @action = parse_action(action)
     end
 
     def association?
@@ -95,7 +96,7 @@ module Graphiti
               sl_resource = resource_for_sideload(sideload)
               query_parents = parents + [self]
               sub_hash = sub_hash[:include] if sub_hash.key?(:include)
-              hash[key] = Query.new(sl_resource, @params, key, sub_hash, query_parents)
+              hash[key] = Query.new(sl_resource, @params, key, sub_hash, query_parents, :all)
             else
               handle_missing_sideload(key)
             end
@@ -315,5 +316,17 @@ module Graphiti
         end
       end
     end
+
+    def parse_action(action)
+      action ||= @params.fetch(:action, Graphiti.context[:namespace]).try(:to_sym)
+      case action
+      when :index
+        :all
+      when :show
+        :find
+      else
+        action
+      end
+    end
   end
 end

data/lib/graphiti/request_validator.rb

@@ -6,18 +6,18 @@ module Graphiti
       :deserialized_payload,
       to: :@validator
 
-    def initialize(root_resource, raw_params)
-      @validator = ValidatorFactory.create(root_resource, raw_params)
+    def initialize(root_resource, raw_params, action)
+      @validator = ValidatorFactory.create(root_resource, raw_params, action)
     end
 
     class ValidatorFactory
-      def self.create(root_resource, raw_params)
-        case raw_params["action"]
-        when "update" then
+      def self.create(root_resource, raw_params, action)
+        case action
+        when :update then
           RequestValidators::UpdateValidator
         else
           RequestValidators::Validator
-        end.new(root_resource, raw_params)
+        end.new(root_resource, raw_params, action)
       end
     end
   end

data/lib/graphiti/request_validators/validator.rb

@@ -3,10 +3,11 @@ module Graphiti
     class Validator
       attr_reader :errors
 
-      def initialize(root_resource, raw_params)
+      def initialize(root_resource, raw_params, action)
         @root_resource = root_resource
         @raw_params = raw_params
         @errors = Graphiti::Util::SimpleErrors.new(raw_params)
+        @action = action
       end
 
       def validate
@@ -68,6 +69,11 @@ module Graphiti
 
       def typecast_attributes(resource, attributes, payload_path)
         attributes.each_pair do |key, value|
+          # Only validate id if create action, otherwise it's only used for lookup
+          next if @action != :create &&
+            key == :id &&
+            resource.class.config[:attributes][:id][:writable] == false
+
           begin
             attributes[key] = resource.typecast(key, value, :writable)
           rescue Graphiti::Errors::UnknownAttribute

data/lib/graphiti/resource/dsl.rb

@@ -5,6 +5,7 @@ module Graphiti
 
       class_methods do
         def filter(name, *args, &blk)
+          name = name.to_sym
           opts = args.extract_options!
           type_override = args[0]
 
@@ -135,6 +136,7 @@ module Graphiti
             filterable: false
           }
           options = defaults.merge(options)
+          attribute_option(options, :readable)
           config[:extra_attributes][name] = options
           apply_extra_attributes_to_serializer
         end

data/lib/graphiti/resource/interface.rb

@@ -11,7 +11,7 @@ module Graphiti
 
         # @api private
         def _all(params, opts, base_scope)
-          runner = Runner.new(self, params, opts.delete(:query))
+          runner = Runner.new(self, params, opts.delete(:query), :all)
           opts[:params] = params
           runner.proxy(base_scope, opts)
         end
@@ -23,11 +23,14 @@ module Graphiti
 
         # @api private
         def _find(params = {}, base_scope = nil)
+          guard_nil_id!(params[:data])
+          guard_nil_id!(params)
+
           id = params[:data].try(:[], :id) || params.delete(:id)
           params[:filter] ||= {}
           params[:filter][:id] = id if id
 
-          runner = Runner.new(self, params)
+          runner = Runner.new(self, params, nil, :find)
           runner.proxy base_scope,
             single: true,
             raise_on_missing: true,
@@ -52,6 +55,13 @@ module Graphiti
             end
           end
         end
+
+        def guard_nil_id!(params)
+          return unless params
+          if params.key?(:id) && params[:id].nil?
+            raise Errors::UndefinedIDLookup.new(self)
+          end
+        end
       end
     end
   end

data/lib/graphiti/resource_proxy.rb

@@ -93,7 +93,7 @@ module Graphiti
       original = Graphiti.context[:namespace]
       begin
         Graphiti.context[:namespace] = action
-        ::Graphiti::RequestValidator.new(@resource, @payload.params).validate!
+        ::Graphiti::RequestValidator.new(@resource, @payload.params, action).validate!
         validator = persist {
           @resource.persist_with_relationships \
             @payload.meta(action: action),
@@ -118,6 +118,7 @@ module Graphiti
     end
 
     def destroy
+      data
       transaction_response = @resource.transaction do
         metadata = {method: :destroy}
         model = @resource.destroy(@query.filters[:id], metadata)
@@ -135,6 +136,7 @@ module Graphiti
     end
 
     def update_attributes
+      data
       save(action: :update)
     end
 

data/lib/graphiti/runner.rb

@@ -3,13 +3,13 @@ module Graphiti
     attr_reader :params
     attr_reader :deserialized_payload
 
-    def initialize(resource_class, params, query = nil)
+    def initialize(resource_class, params, query = nil, action = nil)
       @resource_class = resource_class
       @params = params
       @query = query
+      @action = action
 
-      validator = RequestValidator.new(jsonapi_resource, params)
-
+      validator = RequestValidator.new(jsonapi_resource, params, action)
       validator.validate!
 
       @deserialized_payload = validator.deserialized_payload
@@ -30,7 +30,7 @@ module Graphiti
     end
 
     def query
-      @query ||= Query.new(jsonapi_resource, params)
+      @query ||= Query.new(jsonapi_resource, params, nil, nil, [], @action)
     end
 
     def query_hash

data/lib/graphiti/sideload.rb

@@ -132,6 +132,10 @@ module Graphiti
       end
     end
 
+    def link_filter(parents)
+      base_filter(parents)
+    end
+
     # The parent resource is a remote,
     # AND the sideload is a remote to the same endpoint
     def shared_remote?

data/lib/graphiti/sideload/has_many.rb

@@ -1,8 +1,18 @@
 class Graphiti::Sideload::HasMany < Graphiti::Sideload
+  def initialize(name, opts)
+    @inverse_filter = opts[:inverse_filter]
+
+    super(name, opts)
+  end
+
   def type
     :has_many
   end
 
+  def inverse_filter
+    @inverse_filter || foreign_key
+  end
+
   def load_params(parents, query)
     query.hash.tap do |hash|
       hash[:filter] ||= {}
@@ -11,11 +21,19 @@ class Graphiti::Sideload::HasMany < Graphiti::Sideload
   end
 
   def base_filter(parents)
-    {foreign_key => ids_for_parents(parents).join(",")}
+    {foreign_key => parent_filter(parents)}
+  end
+
+  def link_filter(parents)
+    {inverse_filter => parent_filter(parents)}
   end
 
   private
 
+  def parent_filter(parents)
+    ids_for_parents(parents).join(",")
+  end
+
   def child_map(children)
     children.group_by(&foreign_key)
   end

data/lib/graphiti/sideload/many_to_many.rb

@@ -11,8 +11,12 @@ class Graphiti::Sideload::ManyToMany < Graphiti::Sideload::HasMany
     foreign_key.values.first
   end
 
+  def inverse_filter
+    @inverse_filter || true_foreign_key
+  end
+
   def base_filter(parents)
-    {true_foreign_key => ids_for_parents(parents).join(",")}
+    {true_foreign_key => parent_filter(parents)}
   end
 
   def infer_foreign_key
@@ -32,7 +36,7 @@ class Graphiti::Sideload::ManyToMany < Graphiti::Sideload::HasMany
     self_ref = self
     fk_type = parent_resource_class.attributes[:id][:type]
     fk_type = :hash if polymorphic?
-    resource_class.filter true_foreign_key, fk_type do
+    resource_class.filter inverse_filter, fk_type do
       eq do |scope, value|
         self_ref.belongs_to_many_filter(scope, value)
       end

data/lib/graphiti/util/link.rb

@@ -60,7 +60,7 @@ module Graphiti
       def params
         @params ||= {}.tap do |params|
           if @sideload.type != :belongs_to || @sideload.remote?
-            params[:filter] = @sideload.base_filter([@model])
+            params[:filter] = @sideload.link_filter([@model])
           end
 
           @sideload.params_proc&.call(params, [@model], context)

data/lib/graphiti/version.rb

@@ -1,3 +1,3 @@
 module Graphiti
-  VERSION = "1.2.19"
+  VERSION = "1.2.27"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: graphiti
 version: !ruby/object:Gem::Version
-  version: 1.2.19
+  version: 1.2.27
 platform: ruby
 authors:
 - Lee Richmond
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-05-20 00:00:00.000000000 Z
+date: 2020-09-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jsonapi-serializable
@@ -28,16 +28,22 @@ dependencies:
   name: jsonapi-renderer
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.2.0
+        version: '0.2'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.2.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.2'
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 0.2.0
+        version: 0.2.2
 - !ruby/object:Gem::Dependency
   name: dry-types
   requirement: !ruby/object:Gem::Requirement
@@ -156,6 +162,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '10.0'
+- !ruby/object:Gem::Dependency
+  name: standard
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.4.7
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.4.7
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
@@ -184,20 +204,6 @@ dependencies:
     - - '='
       - !ruby/object:Gem::Version
         version: 1.0.beta.4
-- !ruby/object:Gem::Dependency
-  name: standard
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
 description: 
 email:
 - richmolj@gmail.com
@@ -256,7 +262,7 @@ files:
 - lib/graphiti/adapters/active_record/belongs_to_sideload.rb
 - lib/graphiti/adapters/active_record/has_many_sideload.rb
 - lib/graphiti/adapters/active_record/has_one_sideload.rb
-- lib/graphiti/adapters/active_record/inferrence.rb
+- lib/graphiti/adapters/active_record/inference.rb
 - lib/graphiti/adapters/active_record/many_to_many_sideload.rb
 - lib/graphiti/adapters/graphiti_api.rb
 - lib/graphiti/adapters/null.rb