jpie 3.5.0 → 3.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c54015e01586dd3a4a6f14430928d231e1e6ce8f1e46a9cefa54ab7c93d45226
-  data.tar.gz: 90f24a271244366daf7ff47dd7a20a79740baf72c037b4f9ff428bd7a69bde33
+  metadata.gz: 7afd23e7e9ffb26be73d59ec5776b05d0a1375edc172c8faf8ee8675c1a9e681
+  data.tar.gz: d0b2ac2e8bb3035829524faabc24d2eb787cb0f716e66e3f008043b42a3c31fb
 SHA512:
-  metadata.gz: bd1e8f0ce88654ca8c594f9b58cb4320ecfeba576d5f21062e0136737c0bbabd24a3aef94f899ad0732a7f363f9115e1e602c9079b930aa7159187b90e834a61
-  data.tar.gz: ba4d97f2a60f0b73ca1480de68cdfb05c992e2434bff55ee6569da74447788c7f1c51e7ac2047126976adca6ba1a88a9b8c4fd6e9e60a7b1cddd7aa26ac379e7
+  metadata.gz: de7034c8a695bb8a27501f8c00129a8b4465c3ac7963da3a3327c634b5c85064b29dfbd232841a27a84e15c1b2ef477e1ecf24bae4752ab704f8b76919dba806
+  data.tar.gz: b3474c65fcd26816af5f8f02766f8a52e850112919e29f14b1deff31f5bbc785bbf12dd24d331af4cc321f086f45c06d7ed47b068fd90158d3765b0eda5a631f

data/.claude/skills/writing-discipline/SKILL.md

@@ -0,0 +1,55 @@
+---
+name: writing-discipline
+description: The writing standard for all prose — chat responses, documentation, code comments, commit messages, PR descriptions, Jira and Slack posts. Use BEFORE you write any human-facing text. Enforces ASD-STE100 (Simplified Technical English) plus Orwell's six rules — active voice, short sentences, short everyday words, one instruction per sentence, no idioms, no jargon, cut every word you can.
+---
+
+# Writing discipline
+
+All prose obeys ASD-STE100 (Simplified Technical English) and Orwell's six rules of
+writing. This covers chat responses, documentation, code comments, commit messages,
+PR descriptions, and Jira and Slack posts.
+
+## ASD-STE100
+
+- Use only approved words from the STE dictionary (one word, one meaning). Technical
+  names and technical verbs of this domain are permitted.
+- Write in the active voice. Use the present tense where possible.
+- Keep sentences short: maximum 20 words in an instruction, maximum 25 words in
+  descriptive text.
+- Give one instruction per sentence. Start an instruction with the command form of
+  the verb.
+- Do not make noun clusters of more than three nouns.
+- Do not use slang, idioms, or Latin abbreviations (no "e.g.", "i.e.", "etc.", "via").
+- Use a vertical list when you give more than three facts or steps in sequence.
+- Start a warning or caution with the command, not the explanation.
+
+## Orwell's six rules
+
+1. Never use a metaphor, simile, or other figure of speech which you are used to
+   seeing in print.
+2. Never use a long word where a short one will do.
+3. If it is possible to cut a word out, always cut it out.
+4. Never use the passive where you can use the active.
+5. Never use a foreign phrase, a scientific word, or a jargon word if you can think
+   of an everyday English equivalent.
+6. Break any of these rules sooner than say anything outright barbarous.
+
+## How to apply
+
+- Draft, then cut. Remove every word that does not change the meaning.
+- Break a long sentence at "which", "and", or "but".
+- Prefer a verb to a noun cluster: write "when the job runs", not "at job execution
+  time".
+- Replace idioms with plain statements: write "this shows the cause", not "this is
+  the smoking gun".
+- Replace Latin abbreviations: write "for example", not "e.g."; name the items, or
+  write "and more", instead of "etc.".
+- Keep technical names, commands, and code identifiers as they are. The standard
+  limits prose, not identifiers.
+
+## Self-check before you send
+
+- Is every sentence inside the length limit?
+- Is every verb active?
+- Can any word go?
+- Does a reader who is not an expert know every word that is not a technical name?

data/CLAUDE.md

@@ -0,0 +1,34 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Writing standard: ASD-STE100 + Orwell's six rules
+
+All prose you write — chat responses, documentation, code comments, commit messages,
+PR descriptions, Jira and Slack posts — must obey ASD-STE100 (Simplified Technical
+English) and Orwell's six rules of writing.
+
+ASD-STE100:
+
+- Use only approved words from the STE dictionary (one word, one meaning). Technical
+  names and technical verbs of this domain are permitted.
+- Write in the active voice. Use the present tense where possible.
+- Keep sentences short: maximum 20 words in an instruction, maximum 25 words in
+  descriptive text.
+- Give one instruction per sentence. Start an instruction with the command form of
+  the verb.
+- Do not make noun clusters of more than three nouns.
+- Do not use slang, idioms, or Latin abbreviations (no "e.g.", "i.e.", "etc.", "via").
+- Use a vertical list when you give more than three facts or steps in sequence.
+- Start a warning or caution with the command, not the explanation.
+
+Orwell's six rules:
+
+1. Never use a metaphor, simile, or other figure of speech which you are used to
+   seeing in print.
+2. Never use a long word where a short one will do.
+3. If it is possible to cut a word out, always cut it out.
+4. Never use the passive where you can use the active.
+5. Never use a foreign phrase, a scientific word, or a jargon word if you can think
+   of an everyday English equivalent.
+6. Break any of these rules sooner than say anything outright barbarous.

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    jpie (3.1.6)
+    jpie (3.6.0)
       actionpack (~> 8.1, >= 8.1.0)
       pg_query (>= 4)
       prosopite (>= 1)

data/lib/json_api/controllers/concerns/resource_actions/serialization.rb

@@ -7,7 +7,7 @@ module JSONAPI
       include IncludePreloading
 
       def serialize_resource(resource)
-        JSONAPI::Serializer.new(resource).to_hash(
+        JSONAPI::Serializer.new(resource, authorization_context: self).to_hash(
           include: parse_include_param,
           fields: parse_fields_param,
           document_meta: jsonapi_document_meta,
@@ -42,7 +42,8 @@ module JSONAPI
       end
 
       def serialize_single(resource, includes, fields)
-        JSONAPI::Serializer.new(resource).to_hash(include: includes, fields:, document_meta: nil)
+        JSONAPI::Serializer.new(resource, authorization_context: self).to_hash(include: includes, fields:,
+                                                                               document_meta: nil,)
       end
 
       def collect_included(result, all_included, processed)

data/lib/json_api/serialization/concerns/include_filtering.rb

@@ -7,10 +7,22 @@ module JSONAPI
         loaded_array = association.target.respond_to?(:to_a) ? association.target.to_a : Array(association.target)
         return [] if loaded_array.empty?
 
-        resource_scope = ResourceLoader.find_for_model(related_klass).records
-        return loaded_array if resource_scope.where_clause.empty?
+        base_scope = ResourceLoader.find_for_model(related_klass).records
+        authorized_scope = apply_include_authorization(base_scope, related_klass)
+
+        # When the authorization_scope hook narrows the relation (joins/subqueries a
+        # where-hash can't express), the eager-loaded set — preloaded through acts_as_tenant
+        # alone — must be re-checked against the authorized scope in the database, so a
+        # relationship never surfaces a record the related endpoint denies. An unchanged
+        # scope keeps the in-memory, query-free records-only filtering.
+        return filter_by_query(loaded_array, authorized_scope) if narrowed?(base_scope, authorized_scope)
+        return loaded_array if base_scope.where_clause.empty?
+
+        filter_by_where_hash(loaded_array, base_scope, related_klass)
+      end
 
-        filter_by_where_hash(loaded_array, resource_scope, related_klass)
+      def narrowed?(base_scope, authorized_scope)
+        authorized_scope.to_sql != base_scope.to_sql
       end
 
       def filter_by_where_hash(loaded_array, resource_scope, related_klass)

data/lib/json_api/serialization/concerns/includes_serialization.rb

@@ -96,7 +96,23 @@ module JSONAPI
 
       def build_scoped_relation(related_klass, association)
         related_base_scope = ResourceLoader.find_for_model(related_klass).records
-        association.scope.merge(related_base_scope)
+        association.scope.merge(apply_include_authorization(related_base_scope, related_klass))
+      end
+
+      # A sideloaded `?include=` is loaded through acts_as_tenant alone, bypassing the
+      # related resource's authorization_scope — so a relationship can reach records the
+      # related resource's own collection endpoint denies (e.g. an include that surfaces
+      # rows a Pundit scope hides). Route the related resource's base records through the
+      # configured authorization_scope hook, exactly as the primary collection does, so an
+      # included record can never escape the reader's authorization. No context (serializer
+      # used outside a request) or no configured hook leaves the scope untouched.
+      def apply_include_authorization(scope, model_class)
+        return scope unless authorization_context
+
+        handler = JSONAPI.configuration.authorization_scope
+        return scope unless handler
+
+        handler.call(controller: authorization_context, scope:, action: :index, model_class:)
       end
 
       def get_active_storage_records(current_record, association_name)
@@ -111,7 +127,8 @@ module JSONAPI
         return if ctx.processed.include?(build_record_key(related_record))
 
         requested = include_paths_to_relationship_names(ctx.all_includes, path_to_record)
-        serializer = self.class.new(related_record, parent_record:, association_name:)
+        serializer = self.class.new(related_record, parent_record:, association_name:,
+                                                    authorization_context:,)
         ctx.included_records << serializer.serialize_record(ctx.fields, requested_relationships: requested)
         ctx.processed.add(build_record_key(related_record))
       end

data/lib/json_api/serialization/serializer.rb

@@ -34,12 +34,14 @@ module JSONAPI
       @jsonapi_object = nil
     end
 
-    def initialize(record, definition: nil, base_definition: nil, parent_record: nil, association_name: nil)
+    def initialize(record, definition: nil, base_definition: nil, parent_record: nil, association_name: nil,
+                   authorization_context: nil)
       @record = record
       @definition = definition || ResourceLoader.find_for_model(record.class)
       @base_definition = base_definition
       @parent_record = parent_record
       @association_name = association_name
+      @authorization_context = authorization_context
       @sti_subclass = nil
     end
 
@@ -67,7 +69,7 @@ module JSONAPI
 
     private
 
-    attr_reader :record, :definition, :parent_record, :association_name
+    attr_reader :record, :definition, :parent_record, :association_name, :authorization_context
 
     def base_definition
       @base_definition ||= definition

data/lib/json_api/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module JSONAPI
-  VERSION = "3.5.0"
+  VERSION = "3.7.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jpie
 version: !ruby/object:Gem::Version
-  version: 3.5.0
+  version: 3.7.0
 platform: ruby
 authors:
 - Emil Kampp
@@ -88,6 +88,7 @@ files:
 - ".claude/skills/nasa-power-of-ten-ruby/SKILL.md"
 - ".claude/skills/root-cause-analysis/SKILL.md"
 - ".claude/skills/skills-and-subagents/SKILL.md"
+- ".claude/skills/writing-discipline/SKILL.md"
 - ".cursor/agents/bias-reviewer.md"
 - ".cursor/agents/lint-format.md"
 - ".cursor/agents/nasa-power-of-ten-reviewer.md"
@@ -97,6 +98,7 @@ files:
 - ".gitignore"
 - ".rspec"
 - ".rubocop.yml"
+- CLAUDE.md
 - Gemfile
 - Gemfile.lock
 - PERFORMANCE_BASELINE.md