iron_admin 0.5.0 → 0.6.0

data/app/controllers/iron_admin/concerns/scopeable.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+module IronAdmin
+  module Concerns
+    # Provides scope building and record finding methods for controllers.
+    # Extracts base_scope, record_scope, and find_record to keep controllers slim.
+    module Scopeable
+      extend ActiveSupport::Concern
+
+      private
+
+      def base_scope
+        scope = adapter.all
+        scope = IronAdmin.configuration.tenant_scope_block.call(scope) if IronAdmin.configuration.tenant_scope_block
+        scope
+      end
+
+      def collection_scope
+        scope = apply_scopes(apply_filters(base_scope))
+        scope = apply_search(scope)
+        scope = apply_sorting(scope)
+        apply_preloading(scope)
+      end
+
+      def record_scope
+        scope = base_scope
+        scope = adapter.unscope_column(scope, @resource_class.soft_delete_column) if @resource_class.soft_delete?
+        scope
+      end
+
+      def find_record(scope, id)
+        pk = adapter.primary_key
+
+        result = if pk.is_a?(Array)
+                   ids = id.to_s.split("_")
+                   raise IronAdmin::RecordNotFound if ids.size != pk.size
+
+                   pk.zip(ids).reduce(scope) { |s, (col, val)| adapter.filter(s, col.to_sym, val) }.first
+                 else
+                   adapter.filter(scope, pk.to_sym, id).first
+                 end
+
+        raise IronAdmin::RecordNotFound unless result
+
+        result
+      end
+
+      def current_scope_name
+        scope_name = params[:scope]
+        defined_scope = @resource_class.all_scopes.find { |s| s[:name].to_s == scope_name }
+        defined_scope ||= @resource_class.all_scopes.find { |s| s[:default] }
+        defined_scope&.dig(:name)&.to_s
+      end
+
+      def apply_scopes(scope)
+        defined_scope = @resource_class.all_scopes.find { |s| s[:name].to_s == params[:scope] }
+        defined_scope ||= @resource_class.all_scopes.find { |s| s[:default] }
+
+        return scope unless defined_scope
+
+        apply_resource_scope(scope, defined_scope[:scope])
+      end
+
+      def apply_resource_scope(scope, scope_body)
+        return scope.merge(scope_body) unless scope_body.respond_to?(:call)
+
+        scope_body.arity.zero? ? scope.instance_exec(&scope_body) : scope_body.call(scope)
+      end
+
+      def apply_sorting(scope)
+        sort_col = params[:sort].to_s
+        sort_col = IronAdmin.configuration.default_sort.to_s unless adapter.has_column?(sort_col)
+        valid_dir = %w[asc desc].include?(params[:direction].to_s.downcase)
+        sort_dir = valid_dir ? params[:direction] : IronAdmin.configuration.default_sort_direction
+        adapter.order_by(scope, sort_col, sort_dir)
+      end
+
+      def apply_preloading(scope)
+        preloads = @resource_class.preload_associations
+        preloads.any? ? adapter.preload(scope, preloads) : scope
+      end
+    end
+  end
+end

data/app/controllers/iron_admin/concerns/searchable.rb

@@ -29,38 +29,35 @@ module IronAdmin
       end
 
       def apply_field_search(scope, field, value)
-        return scope unless @resource_class.model.column_names.include?(field)
+        return scope unless adapter.has_column?(field)
         return scope unless field_visible?(field.to_sym)
 
-        conn = @resource_class.model.connection
-        table = conn.quote_table_name(@resource_class.model.table_name)
-        column = conn.quote_column_name(field)
-        like_op = conn.adapter_name.downcase.include?("postgresql") ? "ILIKE" : "LIKE"
-
-        if value.include?("..")
+        if value.include?("..") && range_search_column?(field)
           from_str, to_str = value.split("..", 2)
           from_date = parse_date(from_str)
           to_date = parse_date(to_str)
 
-          return scope.where(field => from_date..to_date) if from_date && to_date
-          return scope.where("#{table}.#{column} >= ?", from_date) if from_date
-          return scope.where("#{table}.#{column} <= ?", to_date) if to_date
+          return adapter.filter(scope, field, from_date..to_date) if from_date && to_date
+          return adapter.filter(scope, field, from_date..) if from_date
+          return adapter.filter(scope, field, ..to_date) if to_date
 
           return scope
         end
 
-        scope.where("#{table}.#{column} #{like_op} ?", "%#{value}%")
+        adapter.search_column(scope, field, value)
+      end
+
+      def range_search_column?(field)
+        adapter.columns.any? do |column|
+          column.name.to_s == field.to_s && column.type.in?(%i[date datetime])
+        end
       end
 
       def apply_general_search(scope, query)
         columns = visible_searchable_columns
         return scope if columns.empty?
 
-        conn = @resource_class.model.connection
-        table = conn.quote_table_name(@resource_class.model.table_name)
-        like_operator = conn.adapter_name.downcase.include?("postgresql") ? "ILIKE" : "LIKE"
-        conditions = columns.map { |col| "#{table}.#{conn.quote_column_name(col)} #{like_operator} :q" }
-        scope.where(conditions.join(" OR "), q: "%#{query}%")
+        adapter.search_columns(scope, columns, query)
       end
 
       def visible_searchable_columns

data/app/controllers/iron_admin/exports_controller.rb

@@ -9,13 +9,17 @@ module IronAdmin
   # @see IronAdmin::Resource#exports
   # @see IronAdmin::Resource#export_fields
   class ExportsController < ApplicationController
+    include Concerns::Filterable
+    include Concerns::Scopeable
+    include Concerns::Searchable
+
     before_action :set_resource_class
 
     # Exports resource data in the requested format.
     #
     # @return [void] Sends CSV file or renders JSON
     def show
-      records = base_scope
+      records = collection_scope
       fields = export_fields
 
       respond_to do |format|
@@ -27,7 +31,7 @@ module IronAdmin
         end
 
         format.json do
-          data = records.map { |r| fields.each_with_object({}) { |f, h| h[f.name] = safe_field_value(r, f) } }
+          data = records.map { |r| fields.each_with_object({}) { |f, h| h[f.name] = safe_field_value(r, f, :json) } }
           render json: data
         end
       end
@@ -40,10 +44,8 @@ module IronAdmin
       head(:not_found) and return unless @resource_class
     end
 
-    def base_scope
-      scope = @resource_class.model.all
-      scope = IronAdmin.configuration.tenant_scope_block.call(scope) if IronAdmin.configuration.tenant_scope_block
-      scope
+    def adapter
+      @resource_class.adapter
     end
 
     def export_fields
@@ -61,23 +63,25 @@ module IronAdmin
       require "csv"
       CSV.generate do |csv|
         csv << fields.map { |f| f.name.to_s.humanize }
-        records.find_each do |record|
-          csv << fields.map { |f| safe_field_value(record, f) }
+        adapter.find_each(records) do |record|
+          csv << fields.map { |f| safe_field_value(record, f, :csv) }
         end
       end
     end
 
-    def safe_field_value(record, field)
+    def safe_field_value(record, field, format)
       return "[Error: field not found]" unless record.respond_to?(field.name)
 
       value = record.public_send(field.name)
-      format_for_export(value, field)
+      format_for_export(value, field, format)
     rescue StandardError => e
       "[Error: #{e.message}]"
     end
 
-    def format_for_export(value, field)
+    def format_for_export(value, field, format)
       return "" if value.nil?
+      return value if format == :json && value.is_a?(Hash)
+      return value if format == :json && value.is_a?(Array)
 
       case field.type
       when :datetime, :date then value.iso8601

data/app/controllers/iron_admin/imports_controller.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+require "ostruct"
+
+module IronAdmin
+  class ImportsController < ApplicationController
+    before_action :set_resource_class
+    before_action :ensure_import_enabled
+    before_action :ensure_create_allowed
+
+    def new
+      @formats = @resource_class.import_formats
+      @fields = @resource_class.importable_fields(iron_admin_current_user)
+    end
+
+    def preview
+      return redirect_missing_file unless uploaded_file
+
+      @preview = importer.preview
+      @resource_name = @resource_class.resource_name
+      render :preview, formats: :html
+    rescue StandardError => e
+      redirect_to resource_import_path(@resource_class.resource_name), alert: e.message
+    end
+
+    def create
+      return redirect_missing_file unless uploaded_file
+
+      result = importer.execute!
+      redirect_to resources_path(@resource_class.resource_name),
+                  notice: I18n.t(
+                    "iron_admin.imports.create.success",
+                    created: result.created_count,
+                    updated: result.updated_count,
+                    failed: result.failed_count
+                  )
+    rescue StandardError => e
+      redirect_to resource_import_path(@resource_class.resource_name), alert: e.message
+    end
+
+    private
+
+    def set_resource_class
+      @resource_class = ResourceRegistry.find(params[:resource_name])
+      head(:not_found) and return unless @resource_class
+    end
+
+    def ensure_import_enabled
+      head(:not_found) and return unless @resource_class&.import_enabled?
+    end
+
+    def ensure_create_allowed
+      head(:forbidden) and return unless @resource_class.action_allowed?(:create)
+    end
+
+    def uploaded_file
+      params[:file]
+    end
+
+    def importer
+      Import::Importer.new(@resource_class, file: uploaded_file, format: import_format, context: import_context)
+    end
+
+    def import_format
+      params[:import_format].presence || params[:format].presence || uploaded_file_extension
+    end
+
+    def uploaded_file_extension
+      filename = uploaded_file&.original_filename
+      return unless filename
+
+      filename.split(".").last
+    end
+
+    def import_context
+      OpenStruct.new(current_user: iron_admin_current_user, controller: self)
+    end
+
+    def redirect_missing_file
+      redirect_to resource_import_path(@resource_class.resource_name), alert: I18n.t("iron_admin.imports.errors.missing_file")
+    end
+  end
+end

data/app/controllers/iron_admin/live_controller.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module IronAdmin
+  class LiveController < ApplicationController
+    def show
+      return head(:not_found) unless IronAdmin::Live.polling?
+
+      render plain: IronAdmin::Live.poll_cache.fetch(params[:stream]).join,
+             content_type: Mime[:turbo_stream]
+    end
+  end
+end

data/app/controllers/iron_admin/resources_controller.rb

@@ -20,6 +20,11 @@ module IronAdmin
   #
   # @see IronAdmin::Resource
   class ResourcesController < ApplicationController
+    include Concerns::ActionExecutable
+    include Concerns::Filterable
+    include Concerns::JsonParamsCoercion
+    include Concerns::NestedPermittable
+    include Concerns::Scopeable
     include Concerns::Searchable
 
     before_action :set_resource_class
@@ -29,12 +34,7 @@ module IronAdmin
     #
     # @return [void]
     def index
-      scope = apply_scopes(apply_filters(base_scope))
-      scope = apply_search(scope)
-      scope = apply_sorting(scope)
-      scope = apply_preloading(scope)
-
-      @pagy, @records = pagy(scope, limit: IronAdmin.configuration.per_page)
+      @pagy, @records = pagy(collection_scope, limit: IronAdmin.configuration.per_page)
       @fields = index_fields
       @current_scope = current_scope_name
     end
@@ -42,9 +42,9 @@ module IronAdmin
     # Shows a single record.
     #
     # @return [void]
-    # @raise [ActiveRecord::RecordNotFound] if record doesn't exist
+    # @raise [IronAdmin::RecordNotFound] if record doesn't exist
     def show
-      @record = record_scope.find(params[:id])
+      @record = find_record(record_scope, params[:id])
       @fields = @resource_class.resolved_fields
     end
 
@@ -52,16 +52,16 @@ module IronAdmin
     #
     # @return [void]
     def new
-      @record = @resource_class.model.new
+      @record = adapter.build
       @fields = form_fields
     end
 
     # Renders the edit form for an existing record.
     #
     # @return [void]
-    # @raise [ActiveRecord::RecordNotFound] if record doesn't exist
+    # @raise [IronAdmin::RecordNotFound] if record doesn't exist
     def edit
-      @record = record_scope.find(params[:id])
+      @record = find_record(record_scope, params[:id])
       @fields = form_fields
     end
 
@@ -69,12 +69,12 @@ module IronAdmin
     #
     # @return [void]
     def create
-      @record = @resource_class.model.new(resource_params)
+      @record = adapter.build(resource_params)
 
-      if @record.save
+      if adapter.save(@record)
         emit_event(:create, @record)
         redirect_to resource_path(@resource_class.resource_name, @record),
-                    notice: I18n.t("iron_admin.resources.create.success", model: @resource_class.model.model_name.human)
+                    notice: I18n.t("iron_admin.resources.create.success", model: adapter.human_name)
       else
         @fields = form_fields
         render :new, status: :unprocessable_content
@@ -84,15 +84,15 @@ module IronAdmin
     # Updates an existing record.
     #
     # @return [void]
-    # @raise [ActiveRecord::RecordNotFound] if record doesn't exist
+    # @raise [IronAdmin::RecordNotFound] if record doesn't exist
     def update
-      @record = record_scope.find(params[:id])
+      @record = find_record(record_scope, params[:id])
       purge_attachments(@record)
 
-      if @record.update(resource_params)
+      if adapter.update(@record, resource_params)
         emit_event(:update, @record)
         redirect_to resource_path(@resource_class.resource_name, @record),
-                    notice: I18n.t("iron_admin.resources.update.success", model: @resource_class.model.model_name.human)
+                    notice: I18n.t("iron_admin.resources.update.success", model: adapter.human_name)
       else
         @fields = form_fields
         render :edit, status: :unprocessable_content
@@ -102,34 +102,63 @@ module IronAdmin
     # Deletes a record.
     #
     # @return [void]
-    # @raise [ActiveRecord::RecordNotFound] if record doesn't exist
+    # @raise [IronAdmin::RecordNotFound] if record doesn't exist
     def destroy
-      @record = record_scope.find(params[:id])
-      @record.destroy!
+      @record = find_record(record_scope, params[:id])
+      adapter.destroy!(@record)
       emit_event(:destroy, @record)
       redirect_to resources_path(@resource_class.resource_name),
-                  notice: I18n.t("iron_admin.resources.destroy.success", model: @resource_class.model.model_name.human)
+                  notice: I18n.t("iron_admin.resources.destroy.success", model: adapter.human_name)
     end
 
-    # Executes a custom action on a single record.
+    # Renders the action form for a single record action with form_fields.
     #
     # @return [void]
-    def execute_action
-      action = @resource_class.defined_actions.find { |a| a[:name].to_s == params[:action_name] }
+    def action_form
+      @action = find_single_record_action
+      return unless @action
+
+      return unless prepare_action_record?(@action)
+
+      @form_fields = @action[:form_fields]
+      @form_url = resource_action_path(@resource_class.resource_name, @record, @action[:name])
+    end
+
+    # Renders the action form for a bulk action with form_fields.
+    #
+    # @return [void]
+    def bulk_action_form
+      action = find_bulk_action
       return head(:not_found) unless action
       return head(:forbidden) unless action_authorized?(action[:name])
 
-      @record = record_scope.find(params[:id])
+      @action = action
+      @form_fields = action[:form_fields]
+      @form_url = resource_bulk_action_path(@resource_class.resource_name, action[:name])
+    end
+
+    # Executes a custom action on a single record.
+    #
+    # @return [void]
+    def execute_action
+      action = find_single_record_action
+      return unless action
+
+      return unless prepare_action_record?(action)
 
-      ActiveRecord::Base.transaction do
-        result = action[:block].call(@record)
-        emit_event(params[:action_name], @record)
-        raise ActiveRecord::Rollback if result == false
+      collected = action_form_params(action)
+
+      adapter.transaction do
+        adapter.wrap_rollback do
+          result = call_action_block(action[:block], @record, collected)
+          emit_event(params[:action_name], @record)
+          raise IronAdmin::Rollback if result == false
+        end
       end
 
       redirect_to resource_path(@resource_class.resource_name, @record),
                   notice: I18n.t("iron_admin.resources.action.success")
-    rescue ActiveRecord::RecordNotFound
+    rescue IronAdmin::RecordNotFound
       head(:not_found)
     rescue StandardError => e
       redirect_to resources_path(@resource_class.resource_name),
@@ -146,7 +175,7 @@ module IronAdmin
       ids = bulk_action_ids
       return redirect_bulk(:alert, I18n.t("iron_admin.resources.bulk_action.no_records")) if ids.empty?
 
-      records = base_scope.where(id: ids)
+      records = adapter.filter(base_scope, :id, ids)
       action = find_bulk_action
 
       return head(:not_found) unless action
@@ -169,31 +198,20 @@ module IronAdmin
       return render json: [] if query.blank?
 
       display = @resource_class.display_attribute
-      conn = @resource_class.model.connection
-      table = conn.quote_table_name(@resource_class.model.table_name)
-      column = conn.quote_column_name(display)
-      like_operator = conn.adapter_name.downcase.include?("postgresql") ? "ILIKE" : "LIKE"
+      display = searchable_display_attribute unless adapter.has_column?(display)
+      return render json: [] unless display
 
-      records = base_scope
-        .where("#{table}.#{column} #{like_operator} ?", "%#{query}%")
-        .limit(20)
-        .map { |r| { id: r.id, label: r.public_send(display) } }
+      scope = adapter.search_column(base_scope, display, query)
+      records = adapter.limit(scope, 20)
+        .map { |record| { id: record.to_param.to_s, label: record.public_send(display).to_s } }
 
       render json: records
     end
 
     private
 
-    def base_scope
-      scope = @resource_class.model.all
-      scope = IronAdmin.configuration.tenant_scope_block.call(scope) if IronAdmin.configuration.tenant_scope_block
-      scope
-    end
-
-    def record_scope
-      scope = base_scope
-      scope = scope.unscope(where: @resource_class.soft_delete_column.to_sym) if @resource_class.soft_delete?
-      scope
+    def adapter
+      @resource_class.adapter
     end
 
     def set_resource_class
@@ -229,7 +247,21 @@ module IronAdmin
     end
 
     def bulk_action_ids
-      Array(params[:ids]).map(&:to_i).reject(&:zero?)
+      Array(params[:ids]).compact_blank
+    end
+
+    def find_single_record_action
+      action = @resource_class.defined_actions.find { |defined| defined[:name].to_s == params[:action_name] }
+      unless action
+        head(:not_found)
+        return nil
+      end
+      unless action_authorized?(action[:name])
+        head(:forbidden)
+        return nil
+      end
+
+      action
     end
 
     def find_bulk_action
@@ -245,12 +277,34 @@ module IronAdmin
     end
 
     def run_bulk_action_in_transaction(action, records)
-      ActiveRecord::Base.transaction do
-        result = action[:block].call(records)
-        raise ActiveRecord::Rollback if result == false
+      collected = action_form_params(action)
+      adapter.transaction do
+        adapter.wrap_rollback do
+          result = call_action_block(action[:block], records, collected)
+          raise IronAdmin::Rollback if result == false
+        end
       end
     end
 
+    def searchable_display_attribute
+      @resource_class.searchable_columns.find { |column| adapter.has_column?(column) }
+    end
+
+    def action_condition_met?(action, record)
+      condition = action[:condition]
+      return true unless condition
+
+      condition.call(record)
+    end
+
+    def prepare_action_record?(action)
+      @record = find_record(record_scope, params[:id])
+      return true if action_condition_met?(action, @record)
+
+      head(:forbidden)
+      false
+    end
+
     def index_fields
       base_fields = if @resource_class.index_field_names
                       fields_by_name = @resource_class.resolved_fields.index_by(&:name)
@@ -274,7 +328,7 @@ module IronAdmin
 
     def purge_attachments(record)
       form_fields.select { |f| f.type == :file }.each do |field|
-        next unless params.dig(:record, :"#{field.name}_purge") == "1" && record.respond_to?(field.name)
+        next unless iron_admin_param_dig(params[:record], :"#{field.name}_purge") == "1" && record.respond_to?(field.name)
 
         record.public_send(field.name).then { |a| a.purge if a.attached? }
       end
@@ -291,70 +345,17 @@ module IronAdmin
       end
 
       @resource_class.habtm_associations.each { |a| permitted << { "#{a[:name].to_s.singularize}_ids": [] } }
-      params.require(:record).permit(*permitted) # rubocop:disable Rails/StrongParametersExpect
-    end
-
-    def apply_filters(scope)
-      @resource_class.all_filters.each do |filter|
-        if filter[:type] == :date_range
-          from = params.dig(:filters, "#{filter[:name]}_from")
-          to = params.dig(:filters, "#{filter[:name]}_to")
-          scope = scope.where(filter[:name] => parse_date(from)..) if from.present? && parse_date(from)
-          scope = scope.where(filter[:name] => ..parse_date(to)&.end_of_day) if to.present? && parse_date(to)
-          next
-        end
-
-        value = params.dig(:filters, filter[:name])
-        next if value.blank?
-        next unless value.is_a?(String)
 
-        value = ActiveModel::Type::Boolean.new.cast(value) if filter[:type] == :boolean
-
-        scope = if filter[:scope]
-                  filter[:scope].call(value, scope)
-                else
-                  scope.where(filter[:name] => value)
-                end
+      @resource_class.nested_associations.each do |nested|
+        permitted << { "#{nested.name}_attributes": build_nested_permit_list(nested) }
       end
-      scope
-    end
-
-    def parse_date(value)
-      return nil if value.blank?
-
-      Date.parse(value)
-    rescue ArgumentError, TypeError
-      nil
-    end
-
-    def current_scope_name
-      scope_name = params[:scope]
-      defined_scope = @resource_class.all_scopes.find { |s| s[:name].to_s == scope_name }
-      defined_scope ||= @resource_class.all_scopes.find { |s| s[:default] }
-      defined_scope&.dig(:name)&.to_s
-    end
-
-    def apply_scopes(scope)
-      defined_scope = @resource_class.all_scopes.find { |s| s[:name].to_s == params[:scope] }
-      defined_scope ||= @resource_class.all_scopes.find { |s| s[:default] }
-
-      return scope unless defined_scope
 
-      scope.merge(defined_scope[:scope])
-    end
-
-    def apply_sorting(scope)
-      sort_col = params[:sort].to_s
-      valid_columns = @resource_class.model.column_names
-      sort_col = IronAdmin.configuration.default_sort.to_s unless valid_columns.include?(sort_col)
-      valid_dir = %w[asc desc].include?(params[:direction].to_s.downcase)
-      sort_dir = valid_dir ? params[:direction] : IronAdmin.configuration.default_sort_direction
-      scope.order(sort_col => sort_dir)
-    end
+      record_params = params.require(:record)
+      raise ActionController::ParameterMissing, :record unless record_params.respond_to?(:permit)
 
-    def apply_preloading(scope)
-      preloads = @resource_class.preload_associations
-      preloads.any? ? scope.includes(*preloads) : scope
+      parsed = record_params.permit(*permitted)
+      coerce_json_field_params!(parsed)
+      parsed
     end
 
     def emit_event(action, record)
@@ -362,8 +363,8 @@ module IronAdmin
         user: iron_admin_current_user,
         action: action,
         resource: @resource_class.name,
-        record_id: record.id,
-        changes: record.saved_changes,
+        record_id: record.id.to_s,
+        changes: adapter.record_changes(record),
         ip_address: request.remote_ip
       )