iron_admin 0.5.0 → 0.6.0

data/lib/iron_admin/import/importer.rb

@@ -0,0 +1,231 @@
+# frozen_string_literal: true
+
+module IronAdmin
+  module Import
+    class Importer
+      PARSERS = {
+        csv: Parser::Csv,
+        json: Parser::Json,
+      }.freeze
+
+      def initialize(resource_class, file:, format:, context: nil)
+        @resource_class = resource_class
+        @file = file
+        @format = format.to_sym
+        @context = context
+        @type_caster = TypeCaster.new
+      end
+
+      def preview(limit: nil)
+        raw_rows = parse_rows
+        headers = headers_for(raw_rows)
+        mapping = mapper.map_headers(headers)
+        preview_limit = limit || import_options.fetch(:preview_rows, 20)
+        rows = raw_rows.first(preview_limit).each_with_index.map do |raw_row, index|
+          build_row(raw_row, index + 2, mapping)
+        end
+
+        ImportPreview.new(
+          total_rows: raw_rows.size,
+          headers: headers,
+          mapping: mapping,
+          rows: rows,
+          errors: rows.flat_map(&:errors)
+        )
+      end
+
+      def execute!
+        raw_rows = parse_rows
+        enforce_row_limit!(raw_rows)
+        mapping = mapper.map_headers(headers_for(raw_rows))
+        result_state = empty_result_state
+
+        adapter.transaction do
+          raw_rows.each_with_index do |raw_row, index|
+            import_row(raw_row, index + 2, mapping, result_state)
+          end
+        end
+
+        ImportResult.new(
+          created_count: result_state[:created_count],
+          updated_count: result_state[:updated_count],
+          failed_count: result_state[:errors].size,
+          errors: result_state[:errors],
+          rows: result_state[:rows]
+        )
+      end
+
+      private
+
+      def adapter
+        @resource_class.adapter
+      end
+
+      def import_options
+        @resource_class.import_options_hash
+      end
+
+      def mapper
+        ColumnMapper.new(@resource_class, current_user: current_user)
+      end
+
+      def current_user
+        @context.respond_to?(:current_user) ? @context.current_user : nil
+      end
+
+      def parse_rows
+        parser_class = PARSERS.fetch(@format) { raise ArgumentError, "Unsupported import format: #{@format}" }
+        raise ArgumentError, "#{@format} imports are not enabled" unless @resource_class.import_formats.include?(@format)
+
+        parser_class.new(@file).parse
+      end
+
+      def headers_for(raw_rows)
+        raw_rows.flat_map(&:keys).uniq
+      end
+
+      def empty_result_state
+        { created_count: 0, updated_count: 0, errors: [], rows: [] }
+      end
+
+      def import_row(raw_row, row_number, mapping, result_state)
+        row = build_row(raw_row, row_number, mapping, validate_model: false)
+        result_state[:rows] << row
+        return collect_existing_errors(row, result_state) if row.errors.any?
+
+        record = find_existing_record(row.attributes)
+        validation_errors = validate_record(record, row.attributes)
+        return add_error_messages(row, validation_errors, result_state) if validation_errors.any?
+
+        persist_errors = persist_row(record, row.attributes)
+        return add_error_messages(row, persist_errors, result_state) if persist_errors.any?
+
+        increment_success_count(record, result_state)
+      end
+
+      def collect_existing_errors(row, result_state)
+        result_state[:errors].concat(row.errors)
+      end
+
+      def add_error_messages(row, messages, result_state)
+        row.errors.concat(messages.map { |message| Error.new(row_number: row.number, message: message) })
+        collect_existing_errors(row, result_state)
+      end
+
+      def increment_success_count(record, result_state)
+        key = record ? :updated_count : :created_count
+        result_state[key] += 1
+      end
+
+      def build_row(raw_row, row_number, mapping, validate_model: true)
+        attributes = build_attributes(raw_row, mapping)
+        attributes = apply_transform(attributes)
+        validation_errors = custom_validation_errors(attributes)
+        validation_errors += validate_record(nil, attributes) if validate_model
+        row_errors = validation_errors.map { |message| Error.new(row_number: row_number, message: message) }
+
+        Row.new(number: row_number, attributes: attributes, errors: row_errors)
+      end
+
+      def build_attributes(raw_row, mapping)
+        fields = @resource_class.importable_fields(current_user).index_by(&:name)
+
+        mapping.each_with_object({}) do |(header, field_name), attributes|
+          field = fields[field_name]
+          next unless field
+
+          attributes[field_name] = @type_caster.cast(raw_row[header], field)
+        end
+      end
+
+      def apply_transform(attributes)
+        block = @resource_class.import_transform_block
+        return attributes unless block
+
+        transformed = if block.arity >= 2
+                        block.call(attributes, @context)
+                      else
+                        block.call(attributes)
+                      end
+
+        transformed || attributes
+      end
+
+      def validate_record(record, attributes)
+        model_record = record || adapter.build(attributes)
+        assign_attributes(model_record, attributes) if record
+        return [] unless model_record.respond_to?(:valid?) && !model_record.valid?
+
+        model_record.errors.full_messages
+      end
+
+      def custom_validation_errors(attributes)
+        block = @resource_class.import_validate_block
+        return [] unless block
+
+        result = if block.arity >= 2
+                   block.call(attributes, @context)
+                 else
+                   block.call(attributes)
+                 end
+
+        Array(result).compact.map(&:to_s)
+      end
+
+      def find_existing_record(attributes)
+        keys = @resource_class.import_upsert_key_names
+        return nil if keys.empty?
+
+        lookup = attributes.slice(*keys)
+        return nil unless lookup.size == keys.size && lookup.values.all?(&:present?)
+
+        # find_by_keys is an IronAdmin adapter hook, not an ActiveRecord dynamic finder.
+        return adapter.find_by_keys(lookup) unless IronAdmin.configuration.tenant_scope_block # rubocop:disable Rails/DynamicFindBy
+
+        scoped_existing_record(lookup)
+      end
+
+      def scoped_existing_record(lookup)
+        scope = adapter.all
+        scope = IronAdmin.configuration.tenant_scope_block.call(scope) if IronAdmin.configuration.tenant_scope_block
+
+        lookup.reduce(scope) do |current_scope, (key, value)|
+          adapter.filter(current_scope, key, value)
+        end.first
+      end
+
+      def persist_row(record, attributes)
+        if record
+          adapter.update_record(record, attributes) ? [] : record_error_messages(record)
+        else
+          new_record = adapter.create_record(attributes)
+          record_error_messages(new_record)
+        end
+      end
+
+      def record_error_messages(record)
+        return [] if !record.respond_to?(:errors) || record.errors.empty?
+
+        record.errors.full_messages
+      end
+
+      def assign_attributes(record, attributes)
+        if record.respond_to?(:assign_attributes)
+          record.assign_attributes(attributes)
+        else
+          attributes.each do |name, value|
+            setter = "#{name}="
+            record.public_send(setter, value) if record.respond_to?(setter)
+          end
+        end
+      end
+
+      def enforce_row_limit!(raw_rows)
+        max_rows = import_options[:max_rows]
+        return unless max_rows && raw_rows.size > max_rows
+
+        raise ArgumentError, "Import contains #{raw_rows.size} rows, exceeding the #{max_rows} row limit"
+      end
+    end
+  end
+end

data/lib/iron_admin/import/parser/csv.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+require "csv"
+
+module IronAdmin
+  module Import
+    module Parser
+      class Csv
+        def initialize(source, encoding: "UTF-8")
+          @source = source
+          @encoding = encoding
+        end
+
+        def parse
+          ::CSV.parse(read_source, headers: true, encoding: @encoding).filter_map do |row|
+            hash = row.to_h
+            next if hash.values.all? { |value| value.to_s.strip.blank? }
+
+            hash
+          end
+        end
+
+        private
+
+        def read_source
+          @source.rewind if @source.respond_to?(:rewind)
+          return @source.read if @source.respond_to?(:read)
+
+          File.read(@source.to_s)
+        end
+      end
+    end
+  end
+end

data/lib/iron_admin/import/parser/json.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+require "json"
+
+module IronAdmin
+  module Import
+    module Parser
+      class Json
+        def initialize(source)
+          @source = source
+        end
+
+        def parse
+          records = extract_records(::JSON.parse(read_source))
+          records.map { |row| row.transform_keys(&:to_s) }
+        end
+
+        private
+
+        def extract_records(parsed)
+          return parsed if parsed.is_a?(Array)
+          return parsed["records"] if parsed.is_a?(Hash) && parsed["records"].is_a?(Array)
+
+          raise ArgumentError, "JSON import must be an array or an object with a records array"
+        end
+
+        def read_source
+          @source.rewind if @source.respond_to?(:rewind)
+          return @source.read if @source.respond_to?(:read)
+
+          File.read(@source.to_s)
+        end
+      end
+    end
+  end
+end

data/lib/iron_admin/import/type_caster.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require "json"
+require "time"
+
+module IronAdmin
+  module Import
+    class TypeCaster
+      def cast(value, field)
+        return nil if blank_value?(value)
+
+        case field.type
+        when :boolean then cast_boolean(value)
+        when :integer then Integer(value)
+        when :float then Float(value)
+        when :decimal then BigDecimal(value.to_s)
+        when :number then cast_number(value)
+        when :json then cast_json(value)
+        when :date then Date.parse(value.to_s)
+        when :datetime then Time.zone.parse(value.to_s)
+        else value
+        end
+      end
+
+      private
+
+      def blank_value?(value)
+        value.nil? || (value.is_a?(String) && value.strip.blank?)
+      end
+
+      def cast_boolean(value)
+        ::ActiveModel::Type::Boolean.new.cast(value)
+      end
+
+      def cast_number(value)
+        string = value.to_s
+        string.include?(".") ? Float(string) : Integer(string)
+      end
+
+      def cast_json(value)
+        return value if value.is_a?(Hash) || value.is_a?(Array)
+
+        ::JSON.parse(value.to_s)
+      end
+    end
+  end
+end

data/lib/iron_admin/live/broadcaster.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require "erb"
+
+module IronAdmin
+  module Live
+    class Broadcaster
+      def initialize(cache: IronAdmin::Live.poll_cache)
+        @cache = cache
+      end
+
+      def broadcast_replace(stream, target:, html:)
+        broadcast_action(stream, action: :replace, target: target, html: html)
+      end
+
+      def broadcast_prepend(stream, target:, html:)
+        broadcast_action(stream, action: :prepend, target: target, html: html)
+      end
+
+      def broadcast_remove(stream, target:)
+        broadcast_action(stream, action: :remove, target: target)
+      end
+
+      private
+
+      def broadcast_action(stream, action:, target:, html: nil)
+        @cache.push(stream, turbo_stream(action: action, target: target, html: html))
+      end
+
+      def turbo_stream(action:, target:, html: nil)
+        action_attr = escape(action)
+        target_attr = escape(target)
+        return %(<turbo-stream action="#{action_attr}" target="#{target_attr}"></turbo-stream>) if html.nil?
+
+        %(<turbo-stream action="#{action_attr}" target="#{target_attr}"><template>#{html}</template></turbo-stream>)
+      end
+
+      def escape(value)
+        ERB::Util.html_escape(value.to_s)
+      end
+    end
+  end
+end

data/lib/iron_admin/live/poll_cache.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module IronAdmin
+  module Live
+    class PollCache
+      def initialize
+        @mutex = Mutex.new
+        @streams = Hash.new { |hash, key| hash[key] = [] }
+      end
+
+      def push(stream, payload)
+        @mutex.synchronize do
+          @streams[stream.to_s] << payload.to_s
+        end
+      end
+
+      def fetch(stream)
+        @mutex.synchronize do
+          @streams.delete(stream.to_s) || []
+        end
+      end
+
+      def clear!
+        @mutex.synchronize { @streams.clear }
+      end
+    end
+  end
+end

data/lib/iron_admin/live.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module IronAdmin
+  module Live
+    class << self
+      attr_writer :poll_cache
+
+      def enabled?
+        IronAdmin.configuration.live_updates != :disabled
+      end
+
+      def polling?
+        IronAdmin.configuration.live_updates == :polling
+      end
+
+      def poll_cache
+        @poll_cache ||= PollCache.new
+      end
+
+      def broadcaster
+        Broadcaster.new(cache: poll_cache)
+      end
+
+      def reset!
+        @poll_cache = PollCache.new
+      end
+    end
+  end
+end

data/lib/iron_admin/nested_association.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module IronAdmin
+  # Value object representing a nested association configured for inline editing.
+  #
+  # Wraps the resolved configuration from the Resource DSL (has_many/has_one with nested: true)
+  # into a structured object used by the NestedFormComponent and strong parameter builder.
+  #
+  # @see IronAdmin::Resource.nested_associations
+  NestedAssociation = Struct.new(
+    :name, :kind, :reflection, :fields,
+    :allow_destroy, :position_field,
+    keyword_init: true
+  )
+end

data/lib/iron_admin/nested_attributes_validator.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module IronAdmin
+  # Guard object that validates a model declares accepts_nested_attributes_for
+  # for a given association before allowing nested form configuration.
+  #
+  # Called during Resource.nested_associations resolution. Raises ArgumentError
+  # if the model is misconfigured.
+  #
+  # @example
+  #   NestedAttributesValidator.validate!(Order, :line_items)
+  class NestedAttributesValidator
+    # @param model_class [Class] The ActiveRecord model class
+    # @param association_name [Symbol, String] The association name to check
+    # @raise [ArgumentError] if the model does not declare accepts_nested_attributes_for
+    # @return [void]
+    def self.validate!(model_class, association_name)
+      return if model_class.nested_attributes_options.key?(association_name.to_sym)
+
+      raise ArgumentError,
+            "#{model_class} must declare `accepts_nested_attributes_for :#{association_name}` " \
+            "to use nested forms in IronAdmin"
+    end
+  end
+end

data/lib/iron_admin/policy.rb

@@ -4,29 +4,26 @@ module IronAdmin
   # Authorization policy for controlling access to resource actions.
   #
   # Policies define which actions users can perform on resources.
-  # They use a simple DSL with `allow` to grant permissions.
+  # They use a simple DSL with `allow` and `deny` to manage permissions.
   #
   # When no policy is defined for a resource, all actions are allowed by default.
   # Once a policy block is provided, actions must be explicitly allowed.
+  # Deny rules take precedence over allow rules.
   #
   # @example Basic policy in a resource
   #   class UserResource < IronAdmin::Resource
   #     policy do
   #       allow :read                           # Everyone can view
   #       allow :create, :update, if: ->(user) { user.admin? }
-  #       allow :delete, if: ->(user) { user.superadmin? }
+  #       deny :destroy                         # No one can delete
   #     end
   #   end
   #
-  # @example Policy with custom actions
+  # @example Policy with conditional deny
   #   class OrderResource < IronAdmin::Resource
-  #     action :refund do |record|
-  #       record.refund!
-  #     end
-  #
   #     policy do
-  #       allow :read, :update
-  #       allow :refund, if: ->(user) { user.finance_team? }
+  #       allow :read, :create, :update, :destroy
+  #       deny :destroy, if: ->(user) { !user.superadmin? }
   #     end
   #   end
   #
@@ -61,6 +58,7 @@ module IronAdmin
     #   end
     def initialize(&)
       @allow_rules = {}
+      @deny_rules = {}
       @configured = block_given?
       instance_eval(&) if block_given?
     end
@@ -86,6 +84,27 @@ module IronAdmin
       actions.each { |action| @allow_rules[action] = condition }
     end
 
+    # Denies permission for one or more actions.
+    #
+    # Deny rules take precedence over allow rules. If an action is both
+    # allowed and denied, the deny rule wins.
+    #
+    # @param actions [Array<Symbol>] Action names to deny
+    # @param if [Proc, nil] Optional condition proc that receives the user
+    #   and returns true if the action should be denied
+    #
+    # @example Unconditional deny
+    #   deny :destroy
+    #
+    # @example Conditional deny
+    #   deny :destroy, if: ->(user) { !user.superadmin? }
+    #
+    # @return [void]
+    def deny(*actions, if: nil)
+      condition = binding.local_variable_get(:if)
+      actions.each { |action| @deny_rules[action] = condition }
+    end
+
     # Checks if a CRUD action is allowed for the given user.
     #
     # Handles action aliases automatically:
@@ -103,6 +122,9 @@ module IronAdmin
     def allowed?(action, user)
       return true unless @configured
 
+      # Deny rules take precedence over allow rules
+      return false if denied?(action, user)
+
       # Check the action directly first
       if @allow_rules.key?(action)
         condition = @allow_rules[action]
@@ -131,20 +153,57 @@ module IronAdmin
     # Checks if a custom action (or bulk action) is allowed.
     #
     # Unlike {#allowed?}, this does not use action aliases.
-    # Custom actions must be explicitly allowed by name.
+    # Custom actions are allowed by default unless explicitly restricted
+    # via an `allow` rule with a condition. This separates custom action
+    # authorization from CRUD policy — custom actions are not gated by
+    # the CRUD allowlist.
     #
     # @param action_name [Symbol] The custom action name
     # @param user [Object] The current user object
     #
-    # @return [Boolean] True if the action is allowed, or if no policy is configured
+    # @return [Boolean] True if the action is allowed, or if no policy is configured,
+    #   or if the action has no explicit rule
     #
     # @example
     #   policy.action_allowed?(:refund, current_user)
     def action_allowed?(action_name, user)
       return true unless @configured
-      return false unless @allow_rules.key?(action_name)
 
-      condition = @allow_rules[action_name]
+      action = action_name.to_sym
+      return false if denied?(action, user)
+      return true unless @allow_rules.key?(action)
+
+      condition = @allow_rules[action]
+      condition.nil? || condition.call(user)
+    end
+
+    private
+
+    # Checks if an action is denied for the given user.
+    # Applies the same alias resolution as allowed? so that
+    # deny :read also denies :show/:index and vice versa.
+    #
+    # @param action [Symbol] The action to check
+    # @param user [Object] The current user object
+    # @return [Boolean] True if the action is explicitly denied
+    def denied?(action, user)
+      # Check the action directly
+      return deny_rule_matches?(action, user) if @deny_rules.key?(action)
+
+      # Check forward alias (e.g., :show -> :read)
+      aliased_action = ACTION_ALIASES[action]
+      return deny_rule_matches?(aliased_action, user) if aliased_action && @deny_rules.key?(aliased_action)
+
+      # Check reverse aliases (e.g., :read -> [:show, :index])
+      REVERSE_ALIASES[action]&.each do |reverse_action|
+        return deny_rule_matches?(reverse_action, user) if @deny_rules.key?(reverse_action)
+      end
+
+      false
+    end
+
+    def deny_rule_matches?(action, user)
+      condition = @deny_rules[action]
       condition.nil? || condition.call(user)
     end
   end