iron_admin 0.4.1 → 0.6.0

data/app/controllers/iron_admin/concerns/json_params_coercion.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+module IronAdmin
+  module Concerns
+    # Coerces incoming `:json` form params from JSON strings (the textarea
+    # content rendered by `_form.html.haml`'s `when :json` branch) back into
+    # Ruby `Hash`/`Array`. Without this, the controller would assign the raw
+    # textarea string to the model's jsonb/json column, replacing the
+    # structured value with a string and silently losing data.
+    #
+    # Invalid JSON is left as-is so model-side validation can surface the
+    # error to the user instead of being swallowed.
+    module JsonParamsCoercion
+      extend ActiveSupport::Concern
+
+      private
+
+      def coerce_json_field_params!(parsed)
+        coerce_json_fields!(parsed, form_fields)
+        coerce_nested_json_field_params!(parsed)
+      end
+
+      def coerce_json_fields!(parsed, fields)
+        fields.each do |field|
+          next unless field.type == :json
+
+          value = parsed[field.name]
+          next unless value.is_a?(String)
+
+          # An empty textarea means "clear this field". Storing the empty
+          # string would serialize to a JSON string scalar (`""`) instead
+          # of clearing the column.
+          if value.empty?
+            parsed[field.name] = nil
+            next
+          end
+
+          parsed[field.name] = JSON.parse(value)
+        rescue JSON::ParserError
+          # Drop the key so the existing column value is preserved instead
+          # of being overwritten with the raw string (which AR would then
+          # store as a JSON string scalar, silently destroying the prior
+          # Hash/Array). The user keeps the form open via model-side
+          # validation in the typical case; full inline-error UX is tracked
+          # as a follow-up.
+          parsed.delete(field.name)
+        end
+      end
+
+      def coerce_nested_json_field_params!(parsed)
+        @resource_class.nested_associations.each do |nested|
+          nested_params = parsed[:"#{nested.name}_attributes"]
+          next unless nested_params.respond_to?(:each_value)
+
+          json_fields = nested.fields.select { |field| field.type == :json }
+          next if json_fields.empty?
+
+          child_params_collection = nested.kind == :has_many ? nested_params.each_value : [nested_params]
+
+          child_params_collection.each do |child_params|
+            coerce_json_fields!(child_params, json_fields)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/iron_admin/concerns/nested_permittable.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module IronAdmin
+  module Concerns
+    # Provides nested attribute strong parameter building for resource controllers.
+    module NestedPermittable
+      extend ActiveSupport::Concern
+
+      private
+
+      # Builds the permit list for a nested association's attributes.
+      #
+      # Includes all non-readonly field names, :id for matching existing records,
+      # :_destroy when allow_destroy is true, and the position_field when present.
+      #
+      # @param nested [IronAdmin::NestedAssociation]
+      # @return [Array] Permit list for strong params
+      def build_nested_permit_list(nested)
+        nested_fields = nested.fields.reject { |f| f.readonly?(iron_admin_current_user) }
+        permit_list = nested_fields.flat_map { |f| nested_field_permit(f) }
+        permit_list << :id
+        permit_list << :_destroy if nested.allow_destroy
+        permit_list << nested.position_field if nested.position_field
+        permit_list
+      end
+
+      def nested_field_permit(field)
+        case field.type
+        when :belongs_to then field.options[:foreign_key]
+        when :files then { field.name => [] }
+        else field.name
+        end
+      end
+    end
+  end
+end

data/app/controllers/iron_admin/concerns/scopeable.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+module IronAdmin
+  module Concerns
+    # Provides scope building and record finding methods for controllers.
+    # Extracts base_scope, record_scope, and find_record to keep controllers slim.
+    module Scopeable
+      extend ActiveSupport::Concern
+
+      private
+
+      def base_scope
+        scope = adapter.all
+        scope = IronAdmin.configuration.tenant_scope_block.call(scope) if IronAdmin.configuration.tenant_scope_block
+        scope
+      end
+
+      def collection_scope
+        scope = apply_scopes(apply_filters(base_scope))
+        scope = apply_search(scope)
+        scope = apply_sorting(scope)
+        apply_preloading(scope)
+      end
+
+      def record_scope
+        scope = base_scope
+        scope = adapter.unscope_column(scope, @resource_class.soft_delete_column) if @resource_class.soft_delete?
+        scope
+      end
+
+      def find_record(scope, id)
+        pk = adapter.primary_key
+
+        result = if pk.is_a?(Array)
+                   ids = id.to_s.split("_")
+                   raise IronAdmin::RecordNotFound if ids.size != pk.size
+
+                   pk.zip(ids).reduce(scope) { |s, (col, val)| adapter.filter(s, col.to_sym, val) }.first
+                 else
+                   adapter.filter(scope, pk.to_sym, id).first
+                 end
+
+        raise IronAdmin::RecordNotFound unless result
+
+        result
+      end
+
+      def current_scope_name
+        scope_name = params[:scope]
+        defined_scope = @resource_class.all_scopes.find { |s| s[:name].to_s == scope_name }
+        defined_scope ||= @resource_class.all_scopes.find { |s| s[:default] }
+        defined_scope&.dig(:name)&.to_s
+      end
+
+      def apply_scopes(scope)
+        defined_scope = @resource_class.all_scopes.find { |s| s[:name].to_s == params[:scope] }
+        defined_scope ||= @resource_class.all_scopes.find { |s| s[:default] }
+
+        return scope unless defined_scope
+
+        apply_resource_scope(scope, defined_scope[:scope])
+      end
+
+      def apply_resource_scope(scope, scope_body)
+        return scope.merge(scope_body) unless scope_body.respond_to?(:call)
+
+        scope_body.arity.zero? ? scope.instance_exec(&scope_body) : scope_body.call(scope)
+      end
+
+      def apply_sorting(scope)
+        sort_col = params[:sort].to_s
+        sort_col = IronAdmin.configuration.default_sort.to_s unless adapter.has_column?(sort_col)
+        valid_dir = %w[asc desc].include?(params[:direction].to_s.downcase)
+        sort_dir = valid_dir ? params[:direction] : IronAdmin.configuration.default_sort_direction
+        adapter.order_by(scope, sort_col, sort_dir)
+      end
+
+      def apply_preloading(scope)
+        preloads = @resource_class.preload_associations
+        preloads.any? ? adapter.preload(scope, preloads) : scope
+      end
+    end
+  end
+end

data/app/controllers/iron_admin/concerns/searchable.rb

@@ -29,38 +29,35 @@ module IronAdmin
       end
 
       def apply_field_search(scope, field, value)
-        return scope unless @resource_class.model.column_names.include?(field)
+        return scope unless adapter.has_column?(field)
         return scope unless field_visible?(field.to_sym)
 
-        conn = @resource_class.model.connection
-        table = conn.quote_table_name(@resource_class.model.table_name)
-        column = conn.quote_column_name(field)
-        like_op = conn.adapter_name.downcase.include?("postgresql") ? "ILIKE" : "LIKE"
-
-        if value.include?("..")
+        if value.include?("..") && range_search_column?(field)
           from_str, to_str = value.split("..", 2)
           from_date = parse_date(from_str)
           to_date = parse_date(to_str)
 
-          return scope.where(field => from_date..to_date) if from_date && to_date
-          return scope.where("#{table}.#{column} >= ?", from_date) if from_date
-          return scope.where("#{table}.#{column} <= ?", to_date) if to_date
+          return adapter.filter(scope, field, from_date..to_date) if from_date && to_date
+          return adapter.filter(scope, field, from_date..) if from_date
+          return adapter.filter(scope, field, ..to_date) if to_date
 
           return scope
         end
 
-        scope.where("#{table}.#{column} #{like_op} ?", "%#{value}%")
+        adapter.search_column(scope, field, value)
+      end
+
+      def range_search_column?(field)
+        adapter.columns.any? do |column|
+          column.name.to_s == field.to_s && column.type.in?(%i[date datetime])
+        end
       end
 
       def apply_general_search(scope, query)
         columns = visible_searchable_columns
         return scope if columns.empty?
 
-        conn = @resource_class.model.connection
-        table = conn.quote_table_name(@resource_class.model.table_name)
-        like_operator = conn.adapter_name.downcase.include?("postgresql") ? "ILIKE" : "LIKE"
-        conditions = columns.map { |col| "#{table}.#{conn.quote_column_name(col)} #{like_operator} :q" }
-        scope.where(conditions.join(" OR "), q: "%#{query}%")
+        adapter.search_columns(scope, columns, query)
       end
 
       def visible_searchable_columns

data/app/controllers/iron_admin/exports_controller.rb

@@ -9,13 +9,17 @@ module IronAdmin
   # @see IronAdmin::Resource#exports
   # @see IronAdmin::Resource#export_fields
   class ExportsController < ApplicationController
+    include Concerns::Filterable
+    include Concerns::Scopeable
+    include Concerns::Searchable
+
     before_action :set_resource_class
 
     # Exports resource data in the requested format.
     #
     # @return [void] Sends CSV file or renders JSON
     def show
-      records = base_scope
+      records = collection_scope
       fields = export_fields
 
       respond_to do |format|
@@ -27,7 +31,7 @@ module IronAdmin
         end
 
         format.json do
-          data = records.map { |r| fields.each_with_object({}) { |f, h| h[f.name] = safe_field_value(r, f) } }
+          data = records.map { |r| fields.each_with_object({}) { |f, h| h[f.name] = safe_field_value(r, f, :json) } }
           render json: data
         end
       end
@@ -40,10 +44,8 @@ module IronAdmin
       head(:not_found) and return unless @resource_class
     end
 
-    def base_scope
-      scope = @resource_class.model.all
-      scope = IronAdmin.configuration.tenant_scope_block.call(scope) if IronAdmin.configuration.tenant_scope_block
-      scope
+    def adapter
+      @resource_class.adapter
     end
 
     def export_fields
@@ -61,23 +63,25 @@ module IronAdmin
       require "csv"
       CSV.generate do |csv|
         csv << fields.map { |f| f.name.to_s.humanize }
-        records.find_each do |record|
-          csv << fields.map { |f| safe_field_value(record, f) }
+        adapter.find_each(records) do |record|
+          csv << fields.map { |f| safe_field_value(record, f, :csv) }
         end
       end
     end
 
-    def safe_field_value(record, field)
+    def safe_field_value(record, field, format)
       return "[Error: field not found]" unless record.respond_to?(field.name)
 
       value = record.public_send(field.name)
-      format_for_export(value, field)
+      format_for_export(value, field, format)
     rescue StandardError => e
       "[Error: #{e.message}]"
     end
 
-    def format_for_export(value, field)
+    def format_for_export(value, field, format)
       return "" if value.nil?
+      return value if format == :json && value.is_a?(Hash)
+      return value if format == :json && value.is_a?(Array)
 
       case field.type
       when :datetime, :date then value.iso8601

data/app/controllers/iron_admin/imports_controller.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+require "ostruct"
+
+module IronAdmin
+  class ImportsController < ApplicationController
+    before_action :set_resource_class
+    before_action :ensure_import_enabled
+    before_action :ensure_create_allowed
+
+    def new
+      @formats = @resource_class.import_formats
+      @fields = @resource_class.importable_fields(iron_admin_current_user)
+    end
+
+    def preview
+      return redirect_missing_file unless uploaded_file
+
+      @preview = importer.preview
+      @resource_name = @resource_class.resource_name
+      render :preview, formats: :html
+    rescue StandardError => e
+      redirect_to resource_import_path(@resource_class.resource_name), alert: e.message
+    end
+
+    def create
+      return redirect_missing_file unless uploaded_file
+
+      result = importer.execute!
+      redirect_to resources_path(@resource_class.resource_name),
+                  notice: I18n.t(
+                    "iron_admin.imports.create.success",
+                    created: result.created_count,
+                    updated: result.updated_count,
+                    failed: result.failed_count
+                  )
+    rescue StandardError => e
+      redirect_to resource_import_path(@resource_class.resource_name), alert: e.message
+    end
+
+    private
+
+    def set_resource_class
+      @resource_class = ResourceRegistry.find(params[:resource_name])
+      head(:not_found) and return unless @resource_class
+    end
+
+    def ensure_import_enabled
+      head(:not_found) and return unless @resource_class&.import_enabled?
+    end
+
+    def ensure_create_allowed
+      head(:forbidden) and return unless @resource_class.action_allowed?(:create)
+    end
+
+    def uploaded_file
+      params[:file]
+    end
+
+    def importer
+      Import::Importer.new(@resource_class, file: uploaded_file, format: import_format, context: import_context)
+    end
+
+    def import_format
+      params[:import_format].presence || params[:format].presence || uploaded_file_extension
+    end
+
+    def uploaded_file_extension
+      filename = uploaded_file&.original_filename
+      return unless filename
+
+      filename.split(".").last
+    end
+
+    def import_context
+      OpenStruct.new(current_user: iron_admin_current_user, controller: self)
+    end
+
+    def redirect_missing_file
+      redirect_to resource_import_path(@resource_class.resource_name), alert: I18n.t("iron_admin.imports.errors.missing_file")
+    end
+  end
+end

data/app/controllers/iron_admin/live_controller.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module IronAdmin
+  class LiveController < ApplicationController
+    def show
+      return head(:not_found) unless IronAdmin::Live.polling?
+
+      render plain: IronAdmin::Live.poll_cache.fetch(params[:stream]).join,
+             content_type: Mime[:turbo_stream]
+    end
+  end
+end