graphiti 2.0.2 → 2.1.0

data/lib/graphiti/resource.rb

@@ -150,6 +150,10 @@ module Graphiti
       persistence.run
     end
 
+    def model_attribute_for(name)
+      self.class.model_attribute_for(name)
+    end
+
     def stat(attribute, calculation)
       stats_dsl = stats[attribute] || stats[attribute.to_sym]
       raise Errors::StatNotFound.new(attribute, calculation) unless stats_dsl

data/lib/graphiti/resource_proxy.rb

@@ -125,14 +125,17 @@ module Graphiti
         scope = @scope.unpaginated_object
         if resource.adapter.can_group?
           if (group = @query.hash[:stats].delete(:group_by))
-            resource.get_attr!(group[0], :readable, request: true)
-            scope = resource.adapter.group(scope, group[0])
+            # A foreign key whose values render as public ids exposes nothing, so it may group even when unreadable.
+            flag = resource.class.public_id_source_for(group[0]) ? :filterable : :readable
+            resource.get_attr!(group[0], flag, request: true)
+            scope = resource.adapter.group(scope, resource.model_attribute_for(group[0]))
           end
         end
         payload = Stats::Payload.new @resource,
           @query,
           scope,
-          data
+          data,
+          group_by: group&.first
         payload.generate
       else
         {}

data/lib/graphiti/runner.rb

@@ -70,7 +70,9 @@ module Graphiti
         :sideload,
         :parent,
         :params,
-        :bypass_required_filters
+        :bypass_required_filters,
+        :bypass_default_filters,
+        :translating_public_ids
       )
 
       scope = jsonapi_scope(base, scope_opts)

data/lib/graphiti/schema.rb

@@ -103,6 +103,10 @@ module Graphiti
           stats: stats(r)
         }
 
+        if r.publishes_public_id?
+          config[:public_id] = r.config[:public_id]&.to_s || true
+        end
+
         if r.grouped_filters.any?
           config[:filter_group] = r.grouped_filters
         end

data/lib/graphiti/schema_diff.rb

@@ -46,6 +46,11 @@ module Graphiti
       if old_resource[:type] != new_resource[:type]
         @errors << "#{old_resource[:name]} changed type from #{old_resource[:type].inspect} to #{new_resource[:type].inspect}."
       end
+
+      # Every id a client holds, and every url built from one, stops resolving.
+      if old_resource[:public_id] != new_resource[:public_id]
+        @errors << "#{old_resource[:name]} changed public_id from #{old_resource[:public_id].inspect} to #{new_resource[:public_id].inspect}."
+      end
       yield
     end
 

data/lib/graphiti/scope.rb

@@ -153,6 +153,7 @@ module Graphiti
     def sync_resolve_sideloads(results)
       return if results == []
 
+      collect_foreign_keys(results)
       reset_captured_sideload_proxies
       each_applicable_sideload do |name, sideload, sideload_query|
         Graphiti.config.before_sideload&.call(Graphiti.context)
@@ -221,6 +222,12 @@ module Graphiti
       false
     end
 
+    def collect_foreign_keys(results)
+      return unless Graphiti.public_ids_declared? && !@opts[:translating_public_ids]
+
+      @resource.class.sideloads.each_value { |sideload| sideload.collect_foreign_keys(results, @query) }
+    end
+
     def each_applicable_sideload
       @query.sideloads.each_pair do |name, sideload_query|
         sideload = @resource.class.sideload(name)
@@ -246,6 +253,7 @@ module Graphiti
     def future_resolve_sideloads(results)
       return Concurrent::Promises.fulfilled_future(nil, self.class.global_thread_pool_executor) if results == []
 
+      collect_foreign_keys(results)
       reset_captured_sideload_proxies
       sideload_promises = []
       each_applicable_sideload do |name, sideload, sideload_query|

data/lib/graphiti/scoping/default_filter.rb

@@ -36,6 +36,8 @@ module Graphiti
     #
     # @return scope the scope object we are chaining/modifying
     def apply
+      return @scope if @opts[:bypass_default_filters]
+
       resource.default_filters.each_pair do |name, opts|
         next if overridden?(name)
         @scope = resource.instance_exec(@scope, resource.context, &opts[:filter])

data/lib/graphiti/scoping/filter.rb

@@ -19,8 +19,8 @@ module Graphiti
           resource, missing_dependent_filters
       end
 
-      each_filter do |filter, operator, value|
-        @scope = filter_scope(filter, operator, value)
+      each_filter do |filter, operator, value, primary_keys, decoded|
+        @scope = filter_scope(filter, operator, value, primary_keys, decoded)
       end
 
       resource.after_filtering(@scope)
@@ -28,18 +28,24 @@ module Graphiti
 
     private
 
-    def filter_scope(filter, operator, value)
+    def filter_scope(filter, operator, value, primary_keys, decoded)
       if (custom_scope = filter.values[0][:operators][operator])
-        @resource.instance_exec(@scope, value, resource.context, &custom_scope)
+        if takes_primary_keys?(filter, operator)
+          @resource.instance_exec(@scope, value, resource.context, primary_keys: primary_keys, &custom_scope)
+        else
+          @resource.instance_exec(@scope, value, resource.context, &custom_scope)
+        end
       else
-        filter_via_adapter(filter, operator, value)
+        filter_via_adapter(filter, operator, value, decoded)
       end
     end
 
-    def filter_via_adapter(filter, operator, value)
-      type_name = Types.name_for(filter.values.first[:type])
+    # A foreign key filter holds primary keys once its public ids are decoded, whatever type the attribute renders as.
+    def filter_via_adapter(filter, operator, value, decoded = false)
+      type_name = Types.name_for(decoded ? :integer_id : filter.values.first[:type])
+      type_name = :public_id if type_name == :string && [:eq, :not_eq].include?(operator) && resource.class.public_id_attribute?(filter.keys.first)
       method = :"filter_#{type_name}_#{operator}"
-      attribute = filter.keys.first
+      attribute = resource.model_attribute_for(filter.keys.first)
 
       if resource.adapter.respond_to?(method)
         resource.adapter.send(method, @scope, attribute, value)
@@ -53,27 +59,80 @@ module Graphiti
       filter_param.each_pair do |param_name, param_value|
         filter = find_filter!(param_name)
 
+        internal = param_value.is_a?(Util::InternalParam)
+        if internal
+          param_value = param_value.value
+        elsif filter.values[0][:internal]
+          raise Errors::InvalidAttributeAccess.new(resource, param_name, :filterable, request: true)
+        else
+          source = resource.class.public_id_source_for(filter.keys[0])
+        end
+
         normalize_param(filter, param_value).each do |operator, value|
           operator = operator.to_s.gsub("!", "not_").to_sym
           validate_operator(filter, operator)
+          custom = filter.values[0][:operators][operator]
+          decoded = !!source && !custom
+          value = decode_public_ids(source, value) if decoded
 
-          type = Types[filter.values[0][:type]]
-          unless type[:canonical_name] == :hash || !value.is_a?(String)
-            value = parse_string_value(filter.values[0], value)
-          end
-
-          check_blank_filters!(resource, filter, value)
-          value = parse_string_null(filter.values[0], value)
-          validate_singular(resource, filter, value)
-          value = coerce_types(filter.values[0], param_name.to_sym, value)
-          validate_allowlist(resource, filter, value)
-          validate_denylist(resource, filter, value)
+          decoding = source && takes_primary_keys?(filter, operator)
+          value = validated_and_cast(filter, param_name, value, decoding ? source : nil) unless internal
           value = value[0] if filter.values[0][:single]
-          yield filter, operator, value
+          primary_keys = decoded_for_block(filter, operator, source, value)
+          yield filter, operator, value, primary_keys, decoded
         end
       end
     end
 
+    # A block asking for primary_keys: was sent public ids, which cast like the source's id rather than the key.
+    def validated_and_cast(filter, param_name, value, public_id_source)
+      type = Types[filter.values[0][:type]]
+      unless type[:canonical_name] == :hash || !value.is_a?(String)
+        value = parse_string_value(filter.values[0], value)
+      end
+
+      check_blank_filters!(resource, filter, value)
+      value = parse_string_null(filter.values[0], value)
+      validate_singular(resource, filter, value)
+      value = public_id_source ? cast_as_public_ids(public_id_source, value) : coerce_types(filter.values[0], param_name.to_sym, value)
+      validate_allowlist(resource, filter, value)
+      validate_denylist(resource, filter, value)
+      value
+    end
+
+    def cast_as_public_ids(source, value)
+      source_instance = source.new
+      Array(value).map { |public_id| source_instance.typecast(:id, public_id, :filterable) }
+    end
+
+    def takes_primary_keys?(filter, operator)
+      Array(filter.values[0][:operators_taking_primary_keys]).include?(operator)
+    end
+
+    def decoded_for_block(filter, operator, source, value)
+      return unless takes_primary_keys?(filter, operator)
+      source ||= resource.class if filter.keys[0] == :id && resource.class.publishes_public_id?
+      return value unless source
+
+      keys = decode_public_ids(source, value)
+      filter.values[0][:single] ? keys.first : keys
+    end
+
+    def decode_public_ids(source_resource_class, value)
+      case value
+      when Hash
+        value.transform_values { |operand| decode_public_ids(source_resource_class, operand) }
+      when Array
+        lookup_primary_keys(source_resource_class, value)
+      else
+        lookup_primary_keys(source_resource_class, value.to_s.split(","))
+      end
+    end
+
+    def lookup_primary_keys(source_resource_class, public_ids)
+      source_resource_class.decode_public_ids(public_ids)
+    end
+
     def coerce_types(filter, name, value)
       type_name = filter[:type]
       is_array = type_name.to_s.starts_with?("array_of") ||

data/lib/graphiti/scoping/sort.rb

@@ -31,7 +31,7 @@ module Graphiti
           @scope = if sort[:proc]
             resource.instance_exec(@scope, direction, &sort[:proc])
           else
-            resource.adapter.order(@scope, attribute, direction)
+            resource.adapter.order(@scope, resource.model_attribute_for(attribute), direction)
           end
         end
       end

data/lib/graphiti/sideload/belongs_to.rb

@@ -17,7 +17,7 @@ class Graphiti::Sideload::BelongsTo < Graphiti::Sideload
 
   def resource_ids_blocker
     return :unreadable unless renderable_at_all?
-    return :custom_primary_key unless foreign_key_is_related_id?
+    return :custom_primary_key unless foreign_key_is_related_id? || resolves_public_ids?
     return :polymorphic_child if polymorphic_child?
     return :scope_block if self.class.scope_proc
     return :params_block if self.class.params_proc
@@ -28,12 +28,6 @@ class Graphiti::Sideload::BelongsTo < Graphiti::Sideload
     nil
   end
 
-  # base_filter matches the foreign key against primary_key, so a custom
-  # primary_key means the key holds that column's value, not the related id.
-  def foreign_key_is_related_id?
-    primary_key == :id
-  end
-
   def load_params(parents, query)
     query.hash.tap do |hash|
       hash[:filter] ||= {}
@@ -43,7 +37,49 @@ class Graphiti::Sideload::BelongsTo < Graphiti::Sideload
 
   def base_filter(parents)
     parent_ids = ids_for_parents(parents)
-    {primary_key => parent_ids.join(",")}
+    return {primary_key_filter => Graphiti::Util::InternalParam.new(parent_ids)} if primary_key_filter == :_primary_key
+
+    {primary_key_filter => parent_ids.join(",")}
+  end
+
+  def resolves_public_ids?
+    @resolves_public_ids ||= target_publishes_id? && resource_class.filters.key?(primary_key_filter)
+  end
+
+  def link_hides_primary_key?
+    !target_publishes_id? || resolves_public_ids?
+  end
+
+  def register_public_id_source
+    return unless target_publishes_id? && resource_class_loaded? && parent_resource_class.model_declared?
+
+    parent_resource_class.guard_public_id_leak!(foreign_key)
+  end
+
+  def rendered_id_for(foreign_key, query)
+    return foreign_key unless target_publishes_id?
+    return unless resolves_public_ids?
+
+    public_id_map(query)[foreign_key]
+  end
+
+  # The serializer reports a foreign key the record cannot answer with a better error.
+  def collect_foreign_keys(parents, query)
+    return unless resource_class_loaded? && resolves_public_ids?
+    return unless parents.first.respond_to?(foreign_key)
+
+    public_id_map(query).add(ids_for_parents(parents))
+  end
+
+  def primary_key_filter
+    return primary_key unless target_publishes_id?
+    return :_primary_key if primary_key == :id || primary_key.to_s == resource_class.model_primary_key.to_s
+
+    primary_key
+  end
+
+  def foreign_key_is_related_id?
+    primary_key_filter == :id
   end
 
   def ids_for_parents(parents)
@@ -75,6 +111,14 @@ class Graphiti::Sideload::BelongsTo < Graphiti::Sideload
 
   private
 
+  def target_publishes_id?
+    @target_publishes_id ||= Graphiti.public_ids_declared? && resource_class.publishes_public_id?
+  end
+
+  def public_id_map(query)
+    query.public_id_maps.compute_if_absent(self) { Graphiti::Util::PublicIdMap.new(resource_class, primary_key_filter) }
+  end
+
   def child_map(children)
     children.index_by(&primary_key)
   end

data/lib/graphiti/sideload/has_many.rb

@@ -21,11 +21,30 @@ class Graphiti::Sideload::HasMany < Graphiti::Sideload
   end
 
   def base_filter(parents)
-    {foreign_key => parent_filter(parents)}
+    {foreign_key => internal_parent_filter(parents, foreign_key)}
   end
 
   def link_filter(parents)
-    {inverse_filter => parent_filter(parents)}
+    {inverse_filter => public_parent_filter(parents)}
+  end
+
+  def link_hides_primary_key?
+    return true unless links_by_public_id?
+
+    resource_class.public_id_source_for(inverse_filter) == parent_resource_class &&
+      resource_class.filter_accepts_public_ids?(inverse_filter)
+  end
+
+  def links_by_public_id?
+    @links_by_public_id ||= Graphiti.public_ids_declared? && primary_key == :id && !!parent_resource_class&.publishes_public_id?
+  end
+
+  def register_public_id_source
+    return unless links_by_public_id? && resource_class_loaded?
+    return if parent_resource_class.abstract_class? || !parent_resource_class.model_loaded?
+
+    Graphiti.public_id_sources.register(resource_class, inverse_filter, parent_resource_class)
+    resource_class.guard_public_id_leak!(inverse_filter)
   end
 
   private
@@ -34,6 +53,18 @@ class Graphiti::Sideload::HasMany < Graphiti::Sideload
     ids_for_parents(parents).join(",")
   end
 
+  def internal_parent_filter(parents, filter_name)
+    return parent_filter(parents) unless resource_class.public_id_source_for(filter_name)
+
+    Graphiti::Util::InternalParam.new(ids_for_parents(parents))
+  end
+
+  def public_parent_filter(parents)
+    return parent_filter(parents) unless links_by_public_id?
+
+    parents.map { |parent| parent_resource_class.public_id_for(parent) }.compact.uniq.join(",")
+  end
+
   def child_map(children)
     children.group_by(&foreign_key)
   end

data/lib/graphiti/sideload/many_to_many.rb

@@ -16,7 +16,7 @@ class Graphiti::Sideload::ManyToMany < Graphiti::Sideload::HasMany
   end
 
   def base_filter(parents)
-    {true_foreign_key => parent_filter(parents)}
+    {true_foreign_key => internal_parent_filter(parents, true_foreign_key)}
   end
 
   def infer_foreign_key
@@ -39,8 +39,8 @@ class Graphiti::Sideload::ManyToMany < Graphiti::Sideload::HasMany
     # Do not recreate if filter already exists
     unless resource_class.config[:filters].has_key?(inverse_filter.to_sym)
       resource_class.filter inverse_filter, fk_type do
-        eq do |scope, value|
-          self_ref.belongs_to_many_filter(scope, value)
+        eq do |scope, value, primary_keys:|
+          self_ref.belongs_to_many_filter(scope, primary_keys)
         end
       end
     end

data/lib/graphiti/sideload.rb

@@ -198,8 +198,18 @@ module Graphiti
 
     # A custom link block means the author wants the link, so a false default does not silence it.
     def link_mode
-      return @link unless @link.nil?
+      mode = requested_link_mode
+      return false unless mode
+      return false unless link_proc || link_hides_primary_key?
 
+      mode
+    end
+
+    def requested_link_mode
+      @link.nil? ? default_link_mode : @link
+    end
+
+    def default_link_mode
       default = @parent_resource_class.relationship_links
       (link_proc && default == false) ? true : default
     end
@@ -208,6 +218,20 @@ module Graphiti
       link_mode != false
     end
 
+    def link_hides_primary_key?
+      true
+    end
+
+    def collect_foreign_keys(parents, query)
+    end
+
+    def register_public_id_source
+    end
+
+    def rendered_id_for(foreign_key, query)
+      foreign_key
+    end
+
     def link_filter(parents)
       base_filter(parents)
     end

data/lib/graphiti/stats/payload.rb

@@ -14,11 +14,12 @@ module Graphiti
     #     meta: { stats: { total: { count: 100 } } }
     #   }
     class Payload
-      def initialize(resource, query, scope, data)
+      def initialize(resource, query, scope, data, group_by: nil)
         @resource = resource
         @query = query
         @scope = scope
         @data = data
+        @group_by = group_by
       end
 
       # Generate the payload for +{ meta: { stats: { ... } } }+
@@ -38,14 +39,30 @@ module Graphiti
       end
 
       def calculate_stat(name, function)
-        args = [@scope, name]
+        args = [@scope, @resource.model_attribute_for(name)]
         args << @resource.context if function.arity >= 3
         args << @data if function.arity == 4
-        function.call(*args)
+        translate_group_keys(function.call(*args))
       end
 
       private
 
+      def translate_group_keys(result)
+        return result unless result.is_a?(Hash) && @group_by
+
+        source = @resource.class.public_id_source_for(@group_by)
+        return result unless source
+
+        public_ids = source.public_ids_by(:_primary_key, result.keys.compact)
+        result.each_with_object({}) do |(primary_key, value), translated|
+          if primary_key.nil?
+            translated[nil] = value
+          elsif public_ids.key?(primary_key)
+            translated[public_ids[primary_key]] = value
+          end
+        end
+      end
+
       def each_calculation(name, calculations)
         calculations.each do |calc|
           function = @resource.stat(name, calc)

data/lib/graphiti/util/internal_param.rb

@@ -0,0 +1,16 @@
+module Graphiti
+  module Util
+    # Request params can only ever be strings, arrays and hashes, so a value wrapped in this class must have come from Graphiti itself.
+    class InternalParam
+      attr_reader :value
+
+      def initialize(value)
+        @value = value
+      end
+
+      def blank?
+        value.blank?
+      end
+    end
+  end
+end

data/lib/graphiti/util/link.rb

@@ -1,9 +1,10 @@
 module Graphiti
   module Util
     class Link
-      def initialize(sideload, model)
+      def initialize(sideload, model, query = nil)
         @sideload = sideload
         @model = model
+        @query = query
         @linkable = true
 
         if @sideload.type == :polymorphic_belongs_to
@@ -30,12 +31,18 @@ module Graphiti
         return false if @polymorphic_sideload_not_found
 
         if @sideload.type == :belongs_to
-          !@model.send(@sideload.foreign_key).nil?
+          !related_id.nil?
         else
           @linkable
         end
       end
 
+      def related_id
+        return @related_id if defined?(@related_id)
+
+        @related_id = @sideload.rendered_id_for(@model.send(@sideload.foreign_key), @query)
+      end
+
       def raw_url
         if @sideload.link_proc
           @sideload.link_proc.call(@model)
@@ -76,7 +83,7 @@ module Graphiti
         @path ||=
           path = @sideload.resource.endpoint[:url].to_s
         if @sideload.type == :belongs_to && !@sideload.remote?
-          path = "#{path}/#{@model.send(@sideload.foreign_key)}"
+          path = "#{path}/#{related_id}"
         end
         path
       end

data/lib/graphiti/util/persistence.rb

@@ -102,7 +102,7 @@ class Graphiti::Util::Persistence
   def apply_derived_attributes(attributes, payload_attributes)
     return unless @assigned_model
 
-    derived = attributes.reject { |key, value| payload_attributes[key] == value }
+    derived = @resource.decode_foreign_keys(attributes).reject { |key, value| payload_attributes[key] == value }
     return if derived.empty?
 
     @resource.assign_attributes(@assigned_model, derived, metadata)

data/lib/graphiti/util/public_id_block.rb

@@ -0,0 +1,15 @@
+module Graphiti
+  module Util
+    class PublicIdBlock
+      attr_reader :encoder, :decoder
+
+      def encode(&blk)
+        @encoder = blk
+      end
+
+      def decode(&blk)
+        @decoder = blk
+      end
+    end
+  end
+end

data/lib/graphiti/util/public_id_map.rb

@@ -0,0 +1,34 @@
+module Graphiti
+  module Util
+    class PublicIdMap
+      def initialize(resource_class, filter_name)
+        @resource_class = resource_class
+        @filter_name = filter_name
+        @pending = Concurrent::Map.new
+        @resolved = {}
+      end
+
+      def add(primary_keys)
+        primary_keys.each { |key| @pending[key] = true unless @resolved.key?(key) }
+      end
+
+      def [](primary_key)
+        return if primary_key.nil?
+
+        resolve(@pending.keys) unless @pending.empty?
+        resolve([primary_key]) unless @resolved.key?(primary_key)
+        @resolved[primary_key]
+      end
+
+      private
+
+      def resolve(primary_keys)
+        found = @resource_class.public_ids_by(@filter_name, primary_keys)
+        primary_keys.each do |key|
+          @pending.delete(key)
+          @resolved[key] = found[key]
+        end
+      end
+    end
+  end
+end

data/lib/graphiti/util/public_id_sources.rb

@@ -0,0 +1,27 @@
+module Graphiti
+  module Util
+    class PublicIdSources
+      def initialize
+        @sources = {}
+      end
+
+      def register(child_resource_class, filter_name, parent_resource_class)
+        key = [child_resource_class.name, filter_name.to_sym]
+        registered = @sources[key]
+        if registered && registered.name != parent_resource_class.name
+          raise Errors::ConflictingPublicIdSource.new(child_resource_class, filter_name, registered, parent_resource_class)
+        end
+        @sources[key] = parent_resource_class
+      end
+
+      def [](child_resource_class, filter_name)
+        klass = child_resource_class
+        while klass
+          source = @sources[[klass.name, filter_name.to_sym]]
+          return source if source
+          klass = klass.superclass
+        end
+      end
+    end
+  end
+end

data/lib/graphiti/util/serializer_relationships.rb

@@ -83,10 +83,12 @@ module Graphiti
                   .new(resource_class_ref, sideload_ref, @object)
               end
 
-              unless foreign_key.nil?
+              related_id = sideload_ref.rendered_id_for(foreign_key, @proxy.query)
+
+              unless related_id.nil?
                 {
                   type: sideload_ref.resource.type,
-                  id: foreign_key.to_s
+                  id: related_id.to_s
                 }
               end
             end
@@ -98,7 +100,7 @@ module Graphiti
             self_ref.send(:validate_link!) unless self_ref.send(:eagerly_validate_links?)
 
             link(:related) do
-              ::Graphiti::Util::Link.new(sideload_ref, @object).generate
+              ::Graphiti::Util::Link.new(sideload_ref, @object, @proxy.query).generate
             end
           end
         end