jpie 4.1.2 → 4.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7cb5c150e4da0f0608aa5b97534e2239b8b80900054c984ca2aed3c24e747198
-  data.tar.gz: 83558900f75be4e9a4b8ea5997f7551963ee1406359b9fd30903d39fe9ad78bb
+  metadata.gz: e210d214edcde88211f1fad82af9fa2dfcc2bb67053e8592d7a7d271995d99b3
+  data.tar.gz: e8e81eacff5269a4f66cadc93ee496b9b7746f7016f9a68a48cdffb21fc3d64e
 SHA512:
-  metadata.gz: 1fdbf06edc4419def82b3719d3cd419e84bc76f3ebb9af0e64650c8eea9856d0d0a20c688a8c291c491fddaed0f28a417b506391dc63e3987ab8594a34126f4f
-  data.tar.gz: cfa30d1e5be610419135bcd16b13752a9eab3792c8082fe95d4a8cc6272103c6ea62c6315bdfc3e46b68b2d7ffe8467b1231e37980e8872b0f3f3781ba71b3d0
+  metadata.gz: 1725977eb3a852b9b131453bbca28d25ab5495faf06862b439bf65572455be2d1a97cbf8de18ad65e855d3e51c349e6ac06af3644201436fc7d00b52919ae6bd
+  data.tar.gz: f17962764401488d7986f9da451d26bc3a68a037135713169ad76b2b7be9ec86533b66e17c2d0c3e0fa36d290d67575b03818675fbb3e07f22ac89c8d2fc3916

data/CHANGELOG.md

@@ -7,6 +7,27 @@ at release time.
 
 ## [Unreleased]
 
+## [4.1.3] - 2026-10-10
+
+### Fixed
+
+- **Filter a polymorphic hop on the model that owns it.** A path such as
+  `filter[user.profile.id_eq]` on `/posts` passed validation and answered 500.
+  `PolymorphicFilters` read the foreign key and type columns from the root
+  table of the query, and `posts` holds no `profile_id`. A root table that
+  holds a column of the same name answered 200 with rows filtered on the wrong
+  table. The filter now joins the hops before the polymorphic one and reads
+  the columns of the owner's table. A polymorphic hop on the root model
+  behaves as before. Regression spec:
+  `nested_filter_polymorphic_hop_below_root_spec.rb`.
+- **Ignore an empty nested filter value.** `filter[comments.author.email_eq]=`
+  added the inner join before it checked the value, so the answer held only
+  the posts that have a comment. `filter[profile.type]=` matched the empty
+  string and answered no rows. An empty nested value now adds no join and no
+  condition, as an empty top-level filter does. A nested filter that adds no
+  condition adds no join either. Regression spec:
+  `nested_filter_empty_value_spec.rb`.
+
 ## [4.1.2] - 2026-10-10
 
 ### Fixed

data/lib/json_api/support/concerns/nested_filters.rb

@@ -19,23 +19,25 @@ module JSONAPI
       def apply_filter_for_path(scope, filter_name, filter_value)
         *relationship_chain, leaf_filter = filter_name.split(".")
         return scope if relationship_chain.empty?
+        # An empty value filters nothing, so it adds no join. An inner join
+        # drops each row that has no related record.
+        return scope if empty_filter_value?(filter_value)
 
         # The walk filter validation takes. A path it refuses filters nothing.
         target = filter_path.resolve(filter_name)
         return scope unless target
 
-        if target.association
-          attributes = { leaf_filter => filter_value }
-          return apply_polymorphic_nested_filters(scope, target.association, relationship_chain.last, attributes)
-        end
-
-        apply_joined_filter(scope, target.model, relationship_chain:, leaf_filter:, filter_value:)
+        # The foreign key and type columns of a polymorphic hop sit on the model
+        # that owns the association. Only the hops before it need a join.
+        joined = join_chain(scope, target.association ? relationship_chain[0..-2] : relationship_chain)
+        filtered = apply_filter_on_target(joined, target, leaf_filter, filter_value)
+        # A filter that adds no condition adds no join either.
+        filtered.equal?(joined) ? scope : filtered
       end
 
-      def apply_joined_filter(scope, target_model, relationship_chain:, leaf_filter:, filter_value:)
-        join_hash = build_join_hash_for_chain(relationship_chain)
-        scope = scope.joins(join_hash) if join_hash.present?
-        apply_filter_on_model(scope, target_model, leaf_filter, filter_value)
+      def join_chain(scope, chain)
+        join_hash = build_join_hash_for_chain(chain)
+        join_hash.present? ? scope.joins(join_hash) : scope
       end
 
       def build_join_hash_for_chain(chain)
@@ -50,11 +52,14 @@ module JSONAPI
         end
       end
 
-      def apply_filter_on_model(scope, target_model, filter_name, filter_value)
-        return scope if empty_filter_value?(filter_value)
+      def apply_filter_on_target(scope, target, filter_name, filter_value)
+        if target.association
+          attributes = { filter_name => filter_value }
+          return apply_polymorphic_nested_filters(scope, target.association, target.model, attributes)
+        end
 
-        apply_column_filter(scope, target_model, filter_name, filter_value) ||
-          apply_scope_method_filter(scope, target_model, filter_name, filter_value) ||
+        apply_column_filter(scope, target.model, filter_name, filter_value) ||
+          apply_scope_method_filter(scope, target.model, filter_name, filter_value) ||
           scope
       end
 

data/lib/json_api/support/concerns/polymorphic_filters.rb

@@ -3,8 +3,10 @@
 module JSONAPI
   module Support
     module PolymorphicFilters
-      def apply_polymorphic_nested_filters(scope, association, _relationship_name, attributes)
-        context = build_polymorphic_filter_context(association, attributes)
+      # `owner` is the model that holds the association. Its table carries the
+      # foreign key and type columns, and the scope must already join it.
+      def apply_polymorphic_nested_filters(scope, association, owner, attributes)
+        context = build_polymorphic_filter_context(association, owner, attributes)
 
         attributes.each do |attr_name, attr_value|
           scope = apply_polymorphic_attribute_filter(scope, attr_name, attr_value, context)
@@ -15,18 +17,18 @@ module JSONAPI
 
       private
 
-      def build_polymorphic_filter_context(association, attributes)
+      def build_polymorphic_filter_context(association, owner, attributes)
         {
+          owner:,
           foreign_key: association.foreign_key,
           foreign_type: association.foreign_type,
-          fk_column: model_class.column_for_attribute(association.foreign_key),
+          fk_column: owner.column_for_attribute(association.foreign_key),
           type_value: attributes["type"] || attributes["type_eq"],
           class_name: association.options[:class_name],
         }
       end
 
       def apply_polymorphic_attribute_filter(scope, attr_name, attr_value, context)
-        return scope if empty_filter_value?(attr_value)
         return scope if attr_name == "type"
 
         scope = apply_polymorphic_id_filter(scope, attr_name, attr_value, context)
@@ -38,7 +40,7 @@ module JSONAPI
         return apply_polymorphic_fk_filter(scope, attr_value, column_filter, context) if polymorphic_fk_filter?(
           column_filter, context,
         )
-        return scope.where(context[:foreign_key] => attr_value) if attr_name == "id"
+        return where_owner_column(scope, context, :foreign_key, attr_value) if attr_name == "id"
 
         scope
       end
@@ -48,17 +50,17 @@ module JSONAPI
       end
 
       def apply_polymorphic_fk_filter(scope, attr_value, column_filter, context)
-        value = normalize_filter_value_for_model(model_class, context[:fk_column], attr_value)
+        value = normalize_filter_value_for_model(context[:owner], context[:fk_column], attr_value)
         return scope unless value
 
-        condition = build_condition(model_class, context[:fk_column], value, column_filter[:operator])
+        condition = build_condition(context[:owner], context[:fk_column], value, column_filter[:operator])
         condition ? apply_condition(scope, condition) : scope
       end
 
       def apply_polymorphic_type_filter(scope, context)
         return scope unless context[:foreign_type]
-        return scope.where(context[:foreign_type] => context[:class_name]) if context[:class_name]
-        return scope.where(context[:foreign_type] => context[:type_value]) if context[:type_value]
+        return where_owner_column(scope, context, :foreign_type, context[:class_name]) if context[:class_name]
+        return where_owner_column(scope, context, :foreign_type, context[:type_value]) if context[:type_value]
 
         scope
       end
@@ -68,7 +70,13 @@ module JSONAPI
         return scope if context[:class_name]
         return scope unless context[:type_value]
 
-        scope.where(context[:foreign_type] => context[:type_value])
+        where_owner_column(scope, context, :foreign_type, context[:type_value])
+      end
+
+      # Names the owner's table, so the condition reads the joined table when
+      # the owner sits below the root of the query.
+      def where_owner_column(scope, context, column_key, value)
+        scope.where(context[:owner].table_name => { context[column_key] => value })
       end
     end
   end

data/lib/json_api/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module JSONAPI
-  VERSION = "4.1.2"
+  VERSION = "4.1.3"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jpie
 version: !ruby/object:Gem::Version
-  version: 4.1.2
+  version: 4.1.3
 platform: ruby
 authors:
 - Emil Kampp