graphiti 2.1.0 → 2.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dd25841a045956cda400bc9fd72f0eaac514cd7b0c393145607383bdfb4f9628
-  data.tar.gz: bb457041c8ed31b7f527614cf241fb43e626f8abc465d2ee5fca851081be94c1
+  metadata.gz: af05146072fd78f20acdaa5b02efb3853936050991fdbec6b95c877e5d2135b5
+  data.tar.gz: 5edcc4716bb8e514aecd912e7ad5bc0c1e3db599b7048109060d3aee655ada9a
 SHA512:
-  metadata.gz: cedef768a22bd9a6058a1d0c527c60c34478b6aa3091c31c8524a1feb7dad33bd5912c4beddf5d8b6f49f964a1ff32b1eff8c778cc12a55a3e420c8914127923
-  data.tar.gz: 8638ac3f7ea8702df0ac0f475cfd5c820d477921e5a4af85b6dd5b845a507d3a81914ffde73ecfeaa86fc4a4cf992044399ae8482d0339f0dc403fef0f301122
+  metadata.gz: 9a343df743086251a11b6349f9a1a79b1cdcf370c57505c5fc65640e0a316524a98221c4b4dc34bbe51fca3357fff23a5fa03e9f3c26e37c478dd21e03669aec
+  data.tar.gz: 042a48e0dbf92f54d2b2cb2292bec09fbc4914ef7e2df4d2422401e0b93ee6b1078a15ec14d580f090c2aaf7fdaabb9b2b49ce623ea43480497598912ef9eb04

data/.github/workflows/docs.yml

@@ -12,8 +12,6 @@ on:
       - 'docs/**'
       - 'website/**'
       - '.github/workflows/docs.yml'
-  release:
-    types: [published]
   workflow_dispatch: {}
 
 # One static group: deploys from different branches force-push the same

data/.github/workflows/release.yml

@@ -36,3 +36,8 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GEM_HOST_API_KEY: ${{ secrets.GEM_HOST_API_KEY }}
         run: npx semantic-release
+      # A release published with GITHUB_TOKEN never fires other workflows' release triggers, so the docs are rebuilt by hand.
+      - name: Rebuild docs with the new version label
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh workflow run docs.yml --ref "$GITHUB_REF_NAME"

data/Appraisals

@@ -16,9 +16,12 @@
 #   Rails 8.0 / 8.1 -> gem "sqlite3", ">= 2.1"
 # "~> 1.4" rather than "~> 1.4.0" is deliberate: it resolves to 1.7.x, which
 # still builds on modern Rubies, where 1.4.x no longer does.
+#
+# Rails 7.1 through 8.0 pass quirks_mode to JSON.generate, which json 3 rejects.
 
 appraise "rails-7-1" do
   gem "rails", "~> 7.1.0"
+  gem "json", "< 3"
   gem "rspec-rails"
   gem "responders"
   gem "sqlite3", "~> 1.4"
@@ -26,6 +29,7 @@ end
 
 appraise "rails-7-2" do
   gem "rails", "~> 7.2.0"
+  gem "json", "< 3"
   gem "rspec-rails"
   gem "responders"
   gem "sqlite3", "~> 2.1"
@@ -33,6 +37,7 @@ end
 
 appraise "rails-8-0" do
   gem "rails", "~> 8.0.0"
+  gem "json", "< 3"
   gem "rspec-rails"
   gem "responders"
   gem "sqlite3", "~> 2.1"

data/CHANGELOG.md

@@ -1,5 +1,20 @@
 graphiti changelog
 
+## [2.1.2](https://github.com/graphiti-api/graphiti/compare/v2.1.1...v2.1.2) (2026-10-12)
+
+
+### Bug Fixes
+
+* a polymorphic resource renders each child that publishes a public id by that id instead of raising ([8d5e0fb](https://github.com/graphiti-api/graphiti/commit/8d5e0fbbdd71d706c3a57b11c866fc36727d6ef8))
+* several resources can declare the same polymorphic_has_many while publishing public ids ([d6e332c](https://github.com/graphiti-api/graphiti/commit/d6e332c73e4ef7ed969e10c3444e802701f46232))
+
+## [2.1.1](https://github.com/graphiti-api/graphiti/compare/v2.1.0...v2.1.1) (2026-09-07)
+
+
+### Bug Fixes
+
+* a filter you declare by hand always beats the one an attribute generates ([955875b](https://github.com/graphiti-api/graphiti/commit/955875b2a28ef67980e240399deb70620f44b935))
+
 # [2.1.0](https://github.com/graphiti-api/graphiti/compare/v2.0.2...v2.1.0) (2026-09-04)
 
 

data/gemfiles/rails_7_1.gemfile

@@ -3,6 +3,7 @@
 source "https://rubygems.org"
 
 gem "rails", "~> 7.1.0"
+gem "json", "< 3"
 gem "rspec-rails"
 gem "responders"
 gem "sqlite3", "~> 1.4"

data/gemfiles/rails_7_2.gemfile

@@ -3,6 +3,7 @@
 source "https://rubygems.org"
 
 gem "rails", "~> 7.2.0"
+gem "json", "< 3"
 gem "rspec-rails"
 gem "responders"
 gem "sqlite3", "~> 2.1"

data/gemfiles/rails_8_0.gemfile

@@ -3,6 +3,7 @@
 source "https://rubygems.org"
 
 gem "rails", "~> 8.0.0"
+gem "json", "< 3"
 gem "rspec-rails"
 gem "responders"
 gem "sqlite3", "~> 2.1"

data/lib/graphiti/filter_operators.rb

@@ -20,7 +20,6 @@ module Graphiti
       def method_missing(name, *args, &blk)
         @procs[name] = blk
       end
-      # rubocop: enable Style/MethodMissingSuper
 
       def respond_to_missing?(*args)
         true

data/lib/graphiti/resource/configuration.rb

@@ -99,6 +99,7 @@ module Graphiti
         def serializer=(val)
           if val
             if super(Class.new(val))
+              serializer.resource_class = self if serializer.respond_to?(:resource_class=)
               apply_attributes_to_serializer
             end
           else
@@ -336,7 +337,7 @@ module Graphiti
           attribute = attributes[attribute_name.to_sym]
           return unless attribute && attribute[:readable] && !attribute[:proc]
 
-          source = public_id_source_for(attribute_name)
+          source = public_id_source_for(attribute_name) || (Graphiti.public_ids_declared? && Graphiti.public_id_sources.any(self, attribute_name))
           raise Errors::PublicIdLeak.new(self, attribute_name, source) if source
         end
 
@@ -348,10 +349,11 @@ module Graphiti
           filter[:operators][:eq].nil? || Array(filter[:operators_taking_primary_keys]).include?(:eq)
         end
 
-        def public_id_source_for(filter_name)
+        def public_id_source_for(filter_name, polymorphic_type = nil)
           return unless Graphiti.public_ids_declared?
 
           name = filter_name.to_sym
+          return Graphiti.public_id_sources[self, name, polymorphic_type] if polymorphic_type
           return self if name == :id && config[:public_id_decode]
 
           source = Graphiti.public_id_sources[self, name]

data/lib/graphiti/resource/dsl.rb

@@ -16,6 +16,7 @@ module Graphiti
 
             aliases = [name, opts[:aliases]].flatten.compact
             operators = FilterOperators.build(self, att[:type], opts, &blk)
+            operators = operators.merge(custom_operators(name)) if opts[:via_attribute_dsl]
 
             case Graphiti::Types[att[:type]][:canonical_name]
             when :boolean
@@ -173,7 +174,7 @@ module Graphiti
 
         # The hidden filter only ever sees keys Graphiti read off models, so its type is never used to cast anything.
         def public_id_proc
-          proc { @resource.class.public_id_for(@object) }
+          proc { (self.class.resource_class || @resource.class).public_id_for(@object) }
         end
 
         def apply_public_id
@@ -253,6 +254,12 @@ module Graphiti
         end
         private :relationship_option
 
+        # Declaring an attribute regenerates its filter, which must not silently outrank a filter declared by hand.
+        def custom_operators(name)
+          (config[:filters][name]&.[](:operators) || {}).compact
+        end
+        private :custom_operators
+
         def blanks_for(name, opts)
           if opts.key?(:deny_empty)
             DEPRECATOR.warn("The deny_empty: filter option is deprecated. Use blanks: :rejected.")

data/lib/graphiti/scoping/filter.rb

@@ -65,7 +65,7 @@ module Graphiti
         elsif filter.values[0][:internal]
           raise Errors::InvalidAttributeAccess.new(resource, param_name, :filterable, request: true)
         else
-          source = resource.class.public_id_source_for(filter.keys[0])
+          source = resource.class.public_id_source_for(filter.keys[0], requested_polymorphic_type(filter.keys[0]))
         end
 
         normalize_param(filter, param_value).each do |operator, value|
@@ -84,6 +84,18 @@ module Graphiti
       end
     end
 
+    def requested_polymorphic_type(filter_name)
+      return unless Graphiti.public_ids_declared?
+
+      type_filter = Graphiti.public_id_sources.type_filter(resource.class, filter_name)
+      return unless type_filter
+
+      requested = filter_param[type_filter]
+      requested = requested.values.first if requested.is_a?(Hash)
+      types = requested.is_a?(String) ? requested.split(",") : Array(requested)
+      types.first if types.one?
+    end
+
     # A block asking for primary_keys: was sent public ids, which cast like the source's id rather than the key.
     def validated_and_cast(filter, param_name, value, public_id_source)
       type = Types[filter.values[0][:type]]

data/lib/graphiti/serializer.rb

@@ -18,6 +18,7 @@ module Graphiti
     # relationship is told apart from one already applied, and from one the
     # application wrote by hand.
     class_attribute :relationship_sideloads
+    class_attribute :resource_class
     self.attributes_applied_via_resource = []
     self.extra_attributes_applied_via_resource = []
     # See #requested_relationships

data/lib/graphiti/sideload/has_many.rb

@@ -31,10 +31,14 @@ class Graphiti::Sideload::HasMany < Graphiti::Sideload
   def link_hides_primary_key?
     return true unless links_by_public_id?
 
-    resource_class.public_id_source_for(inverse_filter) == parent_resource_class &&
+    resource_class.public_id_source_for(inverse_filter, polymorphic_type) == parent_resource_class &&
       resource_class.filter_accepts_public_ids?(inverse_filter)
   end
 
+  def polymorphic_type
+    parent_resource_class.model.name if polymorphic_has_many?
+  end
+
   def links_by_public_id?
     @links_by_public_id ||= Graphiti.public_ids_declared? && primary_key == :id && !!parent_resource_class&.publishes_public_id?
   end
@@ -43,7 +47,8 @@ class Graphiti::Sideload::HasMany < Graphiti::Sideload
     return unless links_by_public_id? && resource_class_loaded?
     return if parent_resource_class.abstract_class? || !parent_resource_class.model_loaded?
 
-    Graphiti.public_id_sources.register(resource_class, inverse_filter, parent_resource_class)
+    type_filter = :"#{polymorphic_as}_type" if polymorphic_has_many?
+    Graphiti.public_id_sources.register(resource_class, inverse_filter, parent_resource_class, polymorphic_type: polymorphic_type, type_filter: type_filter)
     resource_class.guard_public_id_leak!(inverse_filter)
   end
 
@@ -54,7 +59,7 @@ class Graphiti::Sideload::HasMany < Graphiti::Sideload
   end
 
   def internal_parent_filter(parents, filter_name)
-    return parent_filter(parents) unless resource_class.public_id_source_for(filter_name)
+    return parent_filter(parents) unless resource_class.public_id_source_for(filter_name, polymorphic_type)
 
     Graphiti::Util::InternalParam.new(ids_for_parents(parents))
   end

data/lib/graphiti/sideload/polymorphic_belongs_to.rb

@@ -10,7 +10,6 @@ class Graphiti::Sideload::PolymorphicBelongsTo < Graphiti::Sideload::BelongsTo
     def method_missing(name, *args, &blk)
       @calls << [name, args, blk]
     end
-    # rubocop: enable Style/MethodMissingSuper
 
     def respond_to_missing?(*args)
       true

data/lib/graphiti/stats/dsl.rb

@@ -49,7 +49,6 @@ module Graphiti
       def method_missing(meth, *args, &blk)
         @calculations[meth] = blk
       end
-      # rubocop: enable Style/MethodMissingSuper
 
       def respond_to_missing?(*args)
         true

data/lib/graphiti/util/public_id_sources.rb

@@ -3,24 +3,49 @@ module Graphiti
     class PublicIdSources
       def initialize
         @sources = {}
+        @type_filters = {}
       end
 
-      def register(child_resource_class, filter_name, parent_resource_class)
-        key = [child_resource_class.name, filter_name.to_sym]
+      # Every parent of a polymorphic has_many shares one inverse filter, so each registers under the type its type filter names.
+      def register(child_resource_class, filter_name, parent_resource_class, polymorphic_type: nil, type_filter: nil)
+        key = [child_resource_class.name, filter_name.to_sym, polymorphic_type]
         registered = @sources[key]
         if registered && registered.name != parent_resource_class.name
           raise Errors::ConflictingPublicIdSource.new(child_resource_class, filter_name, registered, parent_resource_class)
         end
         @sources[key] = parent_resource_class
+        @type_filters[[child_resource_class.name, filter_name.to_sym]] = type_filter.to_sym if type_filter
       end
 
-      def [](child_resource_class, filter_name)
-        klass = child_resource_class
-        while klass
-          source = @sources[[klass.name, filter_name.to_sym]]
+      def [](child_resource_class, filter_name, polymorphic_type = nil)
+        each_ancestor_name(child_resource_class) do |name|
+          source = @sources[[name, filter_name.to_sym, polymorphic_type]]
           return source if source
+        end
+      end
+
+      def type_filter(child_resource_class, filter_name)
+        each_ancestor_name(child_resource_class) do |name|
+          type_filter = @type_filters[[name, filter_name.to_sym]]
+          return type_filter if type_filter
+        end
+      end
+
+      def any(child_resource_class, filter_name)
+        each_ancestor_name(child_resource_class) do |name|
+          entry = @sources.find { |(child, filter, _type), _source| child == name && filter == filter_name.to_sym }
+          return entry.last if entry
+        end
+      end
+
+      private
+
+      def each_ancestor_name(klass)
+        while klass
+          yield klass.name
           klass = klass.superclass
         end
+        nil
       end
     end
   end

data/lib/graphiti/version.rb

@@ -1,3 +1,3 @@
 module Graphiti
-  VERSION = "2.1.0"
+  VERSION = "2.1.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: graphiti
 version: !ruby/object:Gem::Version
-  version: 2.1.0
+  version: 2.1.2
 platform: ruby
 authors:
 - Lee Richmond
@@ -439,7 +439,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.16
+rubygems_version: 4.0.20
 specification_version: 4
 summary: Easily build jsonapi.org-compatible APIs
 test_files: []