layered-resource-rails 0.3.1 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8bc9f9c8cd7248c93dcfe75e5af6c62e73f15e12f7a6a2092b213bbf3c5ffaf3
-  data.tar.gz: bc8992afbc303af01d63f9a0d86e01e3141e5cff9b47b4f6d61db7b7d68c560a
+  metadata.gz: dd456a360f63f94c4c38e833251b2d4b22a20c7df76b2b78612d9baf55135e9c
+  data.tar.gz: 783f255e36a42959f5565862cf2354d5a57cb1ec5e2d98fbf281477613446c43
 SHA512:
-  metadata.gz: 91a5a65b3a8b3ac9108046f040e9b38d5ad58e79cd457343cea5d25cedf8c37a16d4077fcaf7d12f5a7da0ecbfa07e293c88169342048f82bc508df47d1606f1
-  data.tar.gz: eaf791793476475fc62b310fe841c186fb23561302aad6e26a06fe0f6f4c975de37e32f1fdc4360af9b3f1eb1ad41a48a34587af9939e5a72603ebed08246ede
+  metadata.gz: e29f1a82da384c20cf1d2b99793fedd5079d129a3767cd0c18ba81a55b41b4cf7621c9d0528d992239dc75480607ec0702bb6c70f2562660bb5a063d4faa33d6
+  data.tar.gz: 6b144d42bb808d4ef5cab32ed5119ec6a976046e4dd82b9d3fac221c2aacfd2015985f0428f1011493a2bd46289e75876b44bce62e1c69b2f22cb42f0c2e1ff7

data/.claude/skills/layered-resource-rails/SKILL.md

@@ -108,6 +108,7 @@ end
 | `search_placeholder "..."` | Replaces the search box placeholder. Default derives from `search_fields` via `human_attribute_name`, so `activerecord.attributes.<model>.<attr>` i18n renames flow through (association walks resolve each half against its own model) |
 | `filters :a, :b, c: {...}` | Structured filter controls on the index — an "Add filter" popover plus removable tags. Control + Ransack predicate inferred per column; trailing hash overrides per attribute. See [Filters](#filters) |
 | `label_attribute :title` | Attribute a record is labelled by (page titles, row action menus, another resource's picker). Defaults to the `primary:` column, else the first. Falls back through `name`/`title`/`label`/`email`, then the model's own `to_s`, then `"Post #12"` |
+| `lookup_attribute :uid` | Attribute a record is looked up by from its URL `:id` (`find_by!(uid:)` within `scope`, so out of scope is still a 404), and that the gem's links put there - primary column, row actions, `link:` columns, parent breadcrumbs. Defaults to `:id` (`scope.find` + `to_param`, so FriendlyId still works). Override `self.find_record(controller, id)` / `self.record_param(record)` for anything else |
 | `default_sort attribute:, direction:` | Default sort order for the index |
 | `per_page n` | Pagination size (default 15) |
 | `root_breadcrumb "Home", "/"` | Static first crumb in the breadcrumb trail (e.g. back to the host app's dashboard). Without it, top-level resources render no trail; nested routes prepend it to the derived parent trail |
@@ -117,7 +118,7 @@ The trail always ends with the current page (collection name on `index`, record
 ### Column options
 
 - `as: :type` - pins the cell to a column partial instead of the type-inferred default. Built in: `:text`, `:datetime`, `:badge`, `:boolean`; an unrecognised type raises `ArgumentError` at render time rather than rendering an empty cell. See [Column rendering](#column-rendering)
-- `primary: true` - marks the cell that links to the record's edit (or show) page (defaults to first column)
+- `primary: true` - marks the cell that links to the record's edit (or show) page (defaults to first column). Add `link: false` to leave it unlinked - for a `render:` proc that links somewhere else itself (e.g. a conversation's own page rather than its edit form)
 - `label: "Custom"` - overrides the humanised attribute name
 - `sortable:` - whether the header renders a sort link. **Defaults to `false` for any attribute that isn't a real DB column** (virtual attributes, delegated association values), because a Ransack sort link on one 500s when clicked. Pass `sortable: true` to opt back in - you then own the associated model's `ransackable_attributes` (see [Associations](#associations))
 - `link: :route_key` - wraps the column's rendered value in a link to a nested route (e.g. `:users_posts`); composes with `as:` (pair with `as: :badge` for a badge link)
@@ -177,7 +178,7 @@ Inference by column type: `enum`/`belongs_to` -> multi-select (`_in`; `multiple:
 
 **Long option lists switch control.** A select-type filter renders as the plain list (multi-select: checkboxes + Apply; single-choice: instant-apply links) up to `Layered::Resource.filter_combobox_threshold` options (10), and as a type-ahead **combobox** past it — a checkbox list of every user is no way to pick one. A single-choice combobox posts a scalar (no `[]`), so `_eq` gets the value rather than an array. The count is taken per request, after a `collection:` callable resolves, so the control follows the data; the decision lives in `layered_filter_control` (the view helper), not in `resolved_filters`, for exactly that reason. Declaring `as:` pins the control and opts out: `as: :select` keeps the list however long, `as: :combobox` uses the combobox however short.
 
-**Remote options.** `url:` fetches the options from an endpoint as the user types instead of rendering a collection — such a filter is always a combobox (nothing to render or count). Give it as a callable (`-> { user_options_path }`) so it resolves per request in the view, where route helpers exist. The endpoint is an ordinary host-app action including `Layered::Ui::ComboboxOptions` and returning `l_ui_combobox_options(scope, label:, search:)` — the gem never routes it, so it's authorised however any index is. Since the browser has no collection to look a label up in, an active remote filter's values are labelled server-side from the records (same `name`/`title`/`label`/`email` fallbacks), so the tag reads "User: Alice" not "User: 12"; a `url:` over a plain column has no records and its values label themselves. The label lookup is confined to records the resource's `scope(controller)` references (via the foreign key), so a hand-edited id outside it - e.g. another tenant's user - labels itself instead of leaking a name; the cost is that an in-scope option with no matching records also shows its raw id. `min_chars:` and `text:` pass through too; the write-side options (`create:`, `create_name:`, `reorder:`) deliberately don't — a filter picks among values that already exist.
+**Remote options.** `url:` fetches the options from an endpoint as the user types instead of rendering a collection — such a filter is always a combobox (nothing to render or count). Give it as a callable (`-> { user_options_path }`) so it resolves per request in the view, where route helpers exist. The endpoint is an ordinary host-app action including `Layered::Ui::ComboboxOptions` and returning `l_ui_combobox_options(scope, label:, search:)` — the gem never routes it, so it's authorised however any index is. It searches outside any resource, so the model needs its own `ransackable_attributes` covering the `search:` fields. Since the browser has no collection to look a label up in, an active remote filter's values are labelled server-side from the records (same `name`/`title`/`label`/`email` fallbacks), so the tag reads "User: Alice" not "User: 12"; a `url:` over a plain column has no records and its values label themselves. The label lookup is confined to records the resource's `scope(controller)` references (via the foreign key), so a hand-edited id outside it - e.g. another tenant's user - labels itself instead of leaking a name; the cost is that an in-scope option with no matching records also shows its raw id. `min_chars:` and `text:` pass through too; the write-side options (`create:`, `create_name:`, `reorder:`) deliberately don't — a filter picks among values that already exist.
 
 **The blank a combobox posts.** `l_ui_combobox` emits a leading blank hidden input so clearing every token submits an empty collection rather than omitting the key. Ransack prunes blanks from an `_in` array itself, and `layered_filter_query_params` prunes them too — an array left with nothing becomes an explicit `""`, the same shape the Clear link writes, so the tag reads as inactive *and* a `default:` doesn't immediately re-apply.
 
@@ -443,7 +444,7 @@ columns [
 
 `as: :badge, rounded: true` gives the rounded count pill; `link:` (optional) makes it link to the children's nested index. If the parent doesn't already carry a counter-cache column, add the migration and `counter_cache: true` rather than reaching for `.size`.
 
-To make an association searchable, add a Ransack-walk-shaped entry to `search_fields` - e.g. `search_fields [:title, :user_name]` resolves `:user_name` against `belongs_to :user` + `users.name` and joins into the association. The gem scopes the Ransack allowlists per resource: it only responds when the resource class is the auth object (on both the parent and the associated model), so host-app Ransack config is preserved. A walked search field is also *sortable* (`q[s]=user_name asc` orders by `users.name`) because Ransack derives its sort allowlist from the search allowlist. Cross-model sort/filter on associations *not* declared in `search_fields` remains off; to opt in, define `ransackable_associations` on the parent model yourself and allowlist the attributes on the child model - the gem detects the host-defined override and unions with it. The search box placeholder labels a walk as "<association> <attribute>" via each model's `human_attribute_name` - translate `activerecord.attributes.<model>.<attr>` to rename a half, or set `search_placeholder` on the resource to replace the whole string.
+To make an association searchable, add a Ransack-walk-shaped entry to `search_fields` - e.g. `search_fields [:title, :user_name]` resolves `:user_name` against `belongs_to :user` + `users.name` and joins into the association. The gem scopes the Ransack allowlists per resource: it only responds when the resource class is the auth object (on both the parent and the associated model), so host-app Ransack config is preserved. A host-app `Model.ransack` call outside a resource still needs the model's own allowlist: with none defined, the gem's patch raises a "needs explicitly allowlisted" error, as Ransack does for an unconfigured model, rather than allowlisting everything. A walked search field is also *sortable* (`q[s]=user_name asc` orders by `users.name`) because Ransack derives its sort allowlist from the search allowlist. Cross-model sort/filter on associations *not* declared in `search_fields` remains off; to opt in, define `ransackable_associations` on the parent model yourself and allowlist the attributes on the child model - the gem detects the host-defined override and unions with it. The search box placeholder labels a walk as "<association> <attribute>" via each model's `human_attribute_name` - translate `activerecord.attributes.<model>.<attr>` to rename a half, or set `search_placeholder` on the resource to replace the whole string.
 
 ## Common issues
 

data/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 All notable changes to this project will be documented in this file. This project follows [Semantic Versioning](https://semver.org/).
 
+## [0.5.0] - 2026-11-11
+
+### Fixed
+
+- The "needs explicitly allowlisted" error raised for a configured model with no allowlist of its own now names the class being searched. An STI subclass of a configured model was reported as its parent
+
+### Changed
+
+- Refresh the development/test bundle to Rails 8.1.4, layered-ui-rails 0.28.1, Pagy 43.8.1, concurrent-ruby 1.3.8, SQLite 2.10.2, and compatible transitive updates.
+- Raise runtime and development dependency minimums to the versions verified by the suite, retaining their current major-version ranges. Ruby >= 3.3 and Rails ~> 8.0 support are unchanged; Rails keeps its existing minimum so Rails 8.0 apps remain supported.
+
+### Security
+
+- Require Ransack >= 4.4.4 within the existing 4.x range, including the sort-link reflected XSS and open redirect fix for GHSA-58rx-96gf-w92x.
+- A model the gem configures for Ransack no longer becomes fully searchable by the rest of the app. The scoped `ransackable_attributes`/`ransackable_associations` fell through to Ransack's builtin for any other caller. Because the override counted as an explicit definition, Ransack logged a deprecation warning and allowlisted every column and association, including fields like `encrypted_password`. Where the host app hasn't defined its own allowlist, another layered resource now gets an empty list, and any other caller gets the same "needs explicitly allowlisted" error Ransack raises for an unconfigured model. A host app that searched such a model outside a resource, and relied on the accidental widening, now needs to define `ransackable_attributes`/`ransackable_associations` on it
+
+## [0.4.0] - 2026-10-04
+
+### Added
+
+- `lookup_attribute :uid` on a resource looks its records up by an attribute other than `id` - an unguessable token, a slug - with `find_by!` inside `scope`, so a record outside it is still a 404. The gem's own links (the primary column, row actions, `link:` columns into a nested resource, and parent breadcrumbs) put the same attribute in the URL. The default stays `:id`, with `scope.find` and `to_param` as before. `find_record(controller, id)` and `record_param(record)` are the override points behind it
+- `link: false` on a column leaves the primary column unlinked, for a `render:` proc that links somewhere other than the edit form itself. Before, the gem wrapped such a proc's link in its own
+
 ## [0.3.1] - 2026-10-04
 
 ### Security

data/README.md

@@ -45,9 +45,9 @@ curl -fsSL https://raw.githubusercontent.com/layered-ai-public/layered-resource-
 ## Requirements
 
 - Ruby on Rails >= 8.0
-- [layered-ui-rails](https://github.com/layered-ai-public/layered-ui-rails) ~> 0.27
-- Ransack ~> 4.0
-- Pagy ~> 43.2
+- [layered-ui-rails](https://github.com/layered-ai-public/layered-ui-rails) ~> 0.28, >= 0.28.1
+- Ransack ~> 4.4, >= 4.4.4
+- Pagy ~> 43.8, >= 43.8.1
 
 ## Getting started
 
@@ -205,6 +205,18 @@ end
 
 When the attribute has no value, the label falls back to the first of `name`/`title`/`label`/`email` that does, then to the model's own `to_s` if it defines one, and finally to `"Post #12"` — never a bare `#<Post:0x...>`.
 
+**Lookup attribute:** records are looked up by the `:id` in their URL, the Rails way: member links use `to_param` and the lookup is `scope.find`. Declare `lookup_attribute` when records are addressed by something else - an unguessable token, say, so ids can't be enumerated:
+
+```ruby
+class ConversationResource < Layered::Resource::Base
+  model Conversation
+
+  lookup_attribute :uid   # /conversations/Xk3…/edit, found with find_by!(uid:)
+end
+```
+
+Every member action (`show`, `edit`, `update`, `destroy`, and custom `member` routes) finds the record by it within `scope`, so one outside the scope is still a 404. The gem's own links - the primary column, the row actions, `link:` columns into a nested resource, and parent breadcrumbs - put the same attribute in the URL. For a lookup the attribute can't express, override `self.find_record(controller, id)` (and `self.record_param(record)`, which produces the URL value).
+
 **Custom scope (e.g. tenant isolation):**
 
 ```ruby
@@ -374,7 +386,7 @@ class PostResource < Layered::Resource::Base
 end
 ```
 
-The Ransack allowlists are scoped to the resource: the association and the associated model's attribute are only ransackable when this resource is the one searching, so nothing else gains access to the associated model and any host-app Ransack config is preserved.
+The Ransack allowlists are scoped to the resource: the association and the associated model's attribute are only ransackable when this resource is the one searching, so nothing else gains access to the associated model and any host-app Ransack config is preserved. A model the gem configures isn't opened up for anything else either: other Ransack calls still go through the model's own `ransackable_attributes`/`ransackable_associations`, and if it doesn't define them, the gem raises a "needs explicitly allowlisted" error, as Ransack does for a model with no allowlist.
 
 A walked search field is also sortable — `q[s]=user_name asc` orders the index by `users.name` — because Ransack derives its sort allowlist from the search allowlist. Associations not declared in `search_fields` stay unsearchable and unsortable.
 
@@ -550,7 +562,7 @@ class PostResource < Layered::Resource::Base
 end
 ```
 
-Give `url:` as a callable so it resolves per request in the view, where route helpers are available. The endpoint is an ordinary action in your app — the gem never routes it — so it's authorised however any index is:
+Give `url:` as a callable so it resolves per request in the view, where route helpers are available. The endpoint is an ordinary action in your app — the gem never routes it — so it's authorised however any index is. It searches with Ransack outside any resource, so the model it searches needs its own `ransackable_attributes` covering the `search:` fields:
 
 ```ruby
 class UserOptionsController < ApplicationController
@@ -639,6 +651,15 @@ column a `render:` proc that produces the value.
 
 A column with a `render:` proc is exempt - the proc decides what to call, and `attribute:` is then just the header and sort key.
 
+The primary column links to the record's edit page (or its show page when the resource isn't editable). Pass `link: false` to leave it unlinked - when its `render:` proc links somewhere more useful itself, say:
+
+```ruby
+columns [
+  { attribute: :name, primary: true, link: false,
+    render: ->(record, view) { view.link_to(record.name, view.conversation_path(record)) } }
+]
+```
+
 ### Sortable headers
 
 A column header renders a sort link only when the attribute is sortable. This defaults to `true` for real DB columns and `false` for anything else - virtual attributes and delegated association values - because Ransack can't sort those without the associated model allowlisting the underlying field, and the sort link would 500 when clicked. Set `sortable: true` on the column to opt back in; you're then responsible for that model's `ransackable_attributes` (see [Associations](#associations)).
@@ -917,17 +938,16 @@ cd test/dummy && bin/rails db:setup && bin/dev
 
 ### Deploying the dummy app
 
-The dummy app can be deployed with [Kamal](https://kamal-deploy.org). Set the required environment variables and deploy from `test/dummy`:
+The dummy app can be deployed with [Kamal](https://kamal-deploy.org). Copy `.env.deploy.example` to `.env.deploy` (gitignored), fill in `KAMAL_DEPLOY_IP`, `KAMAL_DEPLOY_DOMAIN`, and `KAMAL_SSH_KEY`, then run `bin/deploy`:
 
 ```bash
-cd test/dummy
-export KAMAL_DEPLOY_IP=<server-ip>
-export KAMAL_DEPLOY_DOMAIN=<domain>
-export KAMAL_SSH_KEY=<path-to-ssh-key>
-kamal deploy
+cp .env.deploy.example .env.deploy
+bin/deploy setup   # first run on a new server
+bin/deploy         # kamal deploy
+bin/deploy logs    # any other kamal subcommand passes straight through
 ```
 
-`KAMAL_DEPLOY_DOMAIN` defaults to `layered-resource-rails.layered.ai`. `SECRET_KEY_BASE` is read from `test/dummy/.kamal/secrets`, which is gitignored - create it locally before the first deploy.
+`SECRET_KEY_BASE` is read from `test/dummy/.kamal/secrets`, which is gitignored - create it locally before the first deploy.
 
 ## Contributing
 

data/app/controllers/layered/resource/controller.rb

@@ -63,7 +63,7 @@ module Layered
       end
 
       def show
-        @record = @resource.scope(self).find(params[:id])
+        @record = @resource.find_record(self, params[:id])
         authorize_layered_record(@record)
         @page_title = layered_record_label(@record)
       end
@@ -89,14 +89,14 @@ module Layered
       end
 
       def edit
-        @record = @resource.scope(self).find(params[:id])
+        @record = @resource.find_record(self, params[:id])
         authorize_layered_record(@record)
         @form_url = layered_member_path(@record)
         @page_title = "Edit #{layered_record_label(@record)}"
       end
 
       def update
-        @record = @resource.scope(self).find(params[:id])
+        @record = @resource.find_record(self, params[:id])
         authorize_layered_record(@record)
         if @record.update(layered_resource_params)
           redirect_to @resource.after_save_path(self, @record),
@@ -109,7 +109,7 @@ module Layered
       end
 
       def destroy
-        @record = @resource.scope(self).find(params[:id])
+        @record = @resource.find_record(self, params[:id])
         authorize_layered_record(@record)
         redirect_path = @resource.after_save_path(self, @record)
         model_name = @resource.model.model_name.human
@@ -217,7 +217,7 @@ module Layered
 
       # For custom member actions declared in a `layered_resources` block,
       # populate @record from params[:id] so action bodies don't have to
-      # repeat `@resource.scope(self).find(params[:id])`. Skip this with
+      # repeat `@resource.find_record(self, params[:id])`. Skip this with
       # `skip_before_action :load_layered_member_record, only: [:foo]` if
       # the action doesn't need the record (or shouldn't 404 on a missing
       # one).
@@ -228,7 +228,7 @@ module Layered
         member_actions = @_route_entry[:member_actions] || []
         return unless member_actions.include?(action_name.to_sym)
 
-        @record = @resource.scope(self).find(params[:id])
+        @record = @resource.find_record(self, params[:id])
         authorize_layered_record(@record)
       end
 

data/app/controllers/layered/resource/internal/breadcrumbs.rb

@@ -35,9 +35,10 @@ module Layered
               # parent that lives in the same namespace.
               collection_key = parent_collection_keys[key]
               collection_entry = collection_key && Layered::Resource::Routing.lookup(collection_key)
+              parent_resource = collection_entry && collection_entry[:resource].constantize
               model_class =
-                if collection_entry
-                  collection_entry[:resource].constantize.model
+                if parent_resource
+                  parent_resource.model
                 elsif current_namespace
                   "#{current_namespace}::#{model_name.classify}".safe_constantize ||
                     model_name.classify.safe_constantize
@@ -67,11 +68,13 @@ module Layered
 
               # Add the specific record breadcrumb, linked to its own show
               # page when the parent resource has one - a crumb that isn't
-              # the current page shouldn't be a dead end.
-              record = model_class.find_by(id: params[key])
+              # the current page shouldn't be a dead end. The param holds
+              # whatever the parent resource addresses its records by.
+              lookup_attribute = parent_resource ? parent_resource.lookup_attribute : :id
+              record = model_class.find_by(lookup_attribute => params[key])
               if record
                 label = record.try(:name) || record.try(:title) || "#{model_class.model_name.human} ##{record.id}"
-                crumbs << { label: label, path: layered_parent_record_path(collection_entry, collection_key, ancestor_args, record) }
+                crumbs << { label: label, path: layered_parent_record_path(collection_entry, parent_resource, collection_key, ancestor_args, record) }
               end
 
               crumbs
@@ -82,7 +85,7 @@ module Layered
         # The parent record's show path, or nil when the parent isn't a
         # layered resource, doesn't route :show, or can't be addressed
         # from here.
-        def layered_parent_record_path(collection_entry, collection_key, ancestor_args, record)
+        def layered_parent_record_path(collection_entry, parent_resource, collection_key, ancestor_args, record)
           return nil unless collection_entry && ancestor_args
           return nil unless collection_entry[:actions].include?(:show)
 
@@ -90,7 +93,7 @@ module Layered
           helper = :"#{collection_key.to_s.singularize}_path"
           return nil unless rs.url_helpers.method_defined?(helper)
 
-          rs.url_helpers.send(helper, default_url_options.merge(ancestor_args).merge(id: record.to_param))
+          rs.url_helpers.send(helper, default_url_options.merge(ancestor_args).merge(id: parent_resource.record_param(record)))
         end
       end
     end

data/app/controllers/layered/resource/internal/columns.rb

@@ -154,7 +154,8 @@ module Layered
         # and only falls back to show for read-only resources that still
         # expose a detail page. The "primary" column is the one marked
         # primary: true (or the first column if none is). Columns that already
-        # declare a custom link: are left alone.
+        # declare a custom link: are left alone, and `link: false` leaves the
+        # column unlinked - for a `render:` proc that links somewhere else.
         def apply_primary_column_link
           singular = @layered_route_key.singularize
           helper = if @resource_can_edit
@@ -172,13 +173,13 @@ module Layered
 
           @columns = @columns.each_with_index.map do |col, i|
             next col unless i == primary_index
-            next col if col[:link]
+            next col if col.key?(:link)
 
             inner_render = col[:render]
             col.merge(
               render: ->(record) {
                 value = inner_render.call(record)
-                view.link_to value, routes_proxy.send(helper, record), data: { turbo_frame: "_top" }
+                view.link_to value, routes_proxy.send(helper, @resource.record_param(record)), data: { turbo_frame: "_top" }
               }
             )
           end
@@ -224,7 +225,10 @@ module Layered
                 value = inner_render.call(record)
                 args = opts.dup
                 ancestor_params.each { |p| args[p] = record.public_send(p) }
-                args[immediate_parent] = record.id
+                # The parent is this resource's record, so it goes in the URL
+                # the way this resource's own links put it - its id unless
+                # the resource declares a `lookup_attribute`.
+                args[immediate_parent] = @resource.lookup_attribute == :id ? record.id : @resource.record_param(record)
                 path = rs.url_helpers.send(path_helper, args)
                 view.link_to value, path, data: { turbo_frame: "_top" }
               }

data/app/controllers/layered/resource/internal/routing.rb

@@ -52,7 +52,7 @@ module Layered
                   "No #{action || 'member'} route registered for #{@layered_route_key}. " \
                   "Include the matching action in only:."
           end
-          layered_routes.send(helper, record)
+          layered_routes.send(helper, @resource.record_param(record))
         end
       end
     end

data/lib/layered/resource/base.rb

@@ -126,6 +126,40 @@ module Layered
           Layered::Resource.record_label(record, attribute: label_attribute)
         end
 
+        # The attribute a record is looked up by from the `:id` in its URL,
+        # and that the gem's own member links put there. Defaults to `:id`,
+        # which keeps Rails' own behaviour: links use `to_param` and the
+        # lookup is `scope.find`, so a gem that overrides both (FriendlyId,
+        # say) still works. Declare it when records are addressed by
+        # something else - an unguessable token, a slug:
+        #
+        #   lookup_attribute :uid
+        def lookup_attribute(value = nil)
+          if value
+            @lookup_attribute = value.to_sym
+          else
+            inherited_attribute(:@lookup_attribute) || :id
+          end
+        end
+
+        # The record named by `id`, within `scope` - raising
+        # ActiveRecord::RecordNotFound (a 404) when it is outside it. Every
+        # member action looks its record up through here, so override it for
+        # a lookup `lookup_attribute` can't express.
+        def find_record(controller, id)
+          relation = scope(controller)
+          return relation.find(id) if lookup_attribute == :id
+
+          relation.find_by!(lookup_attribute => id)
+        end
+
+        # What a member URL carries for `record`: the inverse of `find_record`.
+        def record_param(record)
+          return record.to_param if lookup_attribute == :id
+
+          record.public_send(lookup_attribute).to_s
+        end
+
         # Declares structured filter controls for the index table. Each entry
         # is either a bare attribute (control + Ransack predicate inferred from
         # the column type, enum, or association) or an attribute with an
@@ -367,24 +401,46 @@ module Layered
         # `m`. The overrides only answer when the `auth_object` is a layered
         # resource that references `m` — either as its own model, or via an
         # association-walking search field. Every other caller falls through
-        # to the methods captured below (whether host-defined or the framework
-        # default), so any allowlist the host app has set up is preserved.
+        # to the host's own allowlist when it has one. When it doesn't, a
+        # layered resource gets nothing and anyone else gets the error Ransack
+        # raises for an unconfigured model. Delegating to Ransack's builtin
+        # instead would be deprecated, and since these overrides count as an
+        # explicit definition it would allowlist every column — so patching a
+        # model must not widen what the rest of the app can search.
         def patch_ransack(m)
           return if m.instance_variable_get(:@_layered_resource_ransack_configured)
 
           original_attributes = m.method(:ransackable_attributes)
           original_associations = m.method(:ransackable_associations)
           # Detect a host-defined override anywhere in the model's singleton
-          # ancestry (Post, ApplicationRecord, ActiveRecord::Base, etc.).
-          # Ransack supplies the default via a regular Module mixin, so its
-          # `owner` is a Module but not a Class; an explicit `def self.x` in
-          # any host class produces a singleton-class owner, which is a Class.
-          host_attributes_defined = original_attributes.owner.is_a?(Class)
-          host_associations_defined = original_associations.owner.is_a?(Class)
+          # ancestry: a `def self.x` in Post or ApplicationRecord, or a module
+          # brought in with `extend` or a concern's `class_methods`. Only
+          # Ransack's own default (the module it extends ActiveRecord::Base
+          # with) counts as "no allowlist".
+          host_attributes_defined = original_attributes.owner != ::Ransack::Adapters::ActiveRecord::Base
+          host_associations_defined = original_associations.owner != ::Ransack::Adapters::ActiveRecord::Base
+          fallback_attributes = ->(klass, auth_object) do
+            if host_attributes_defined
+              original_attributes.call(auth_object)
+            elsif auth_object.is_a?(Class) && auth_object < Layered::Resource::Base
+              []
+            else
+              Layered::Resource::Base.send(:raise_unconfigured_ransack, klass, :ransackable_attributes)
+            end
+          end
+          fallback_associations = ->(klass, auth_object) do
+            if host_associations_defined
+              original_associations.call(auth_object)
+            elsif auth_object.is_a?(Class) && auth_object < Layered::Resource::Base
+              []
+            else
+              Layered::Resource::Base.send(:raise_unconfigured_ransack, klass, :ransackable_associations)
+            end
+          end
 
           m.define_singleton_method(:ransackable_attributes) do |auth_object = nil|
             unless auth_object.is_a?(Class) && auth_object < Layered::Resource::Base
-              next original_attributes.call(auth_object)
+              next fallback_attributes.call(self, auth_object)
             end
 
             if auth_object.model == self
@@ -418,12 +474,7 @@ module Layered
               declared = auth_object.association_search_fields
                                     .select { |a| a[:klass] == self }
                                     .map { |a| a[:attribute] }
-              if declared.any?
-                base = host_attributes_defined ? original_attributes.call(auth_object) : []
-                base | declared
-              else
-                original_attributes.call(auth_object)
-              end
+              fallback_attributes.call(self, auth_object) | declared
             end
           end
 
@@ -434,16 +485,26 @@ module Layered
           # rather than 500ing.
           m.define_singleton_method(:ransackable_associations) do |auth_object = nil|
             if auth_object.is_a?(Class) && auth_object < Layered::Resource::Base && auth_object.model == self
-              base = host_associations_defined ? original_associations.call(auth_object) : []
-              base | auth_object.association_search_fields.map { |a| a[:association] }
+              fallback_associations.call(self, auth_object) | auth_object.association_search_fields.map { |a| a[:association] }
             else
-              original_associations.call(auth_object)
+              fallback_associations.call(self, auth_object)
             end
           end
 
           m.instance_variable_set(:@_layered_resource_ransack_configured, true)
         end
 
+        # Mirrors Ransack 4's refusal to search a model that hasn't
+        # allowlisted anything, for callers outside the gem.
+        def raise_unconfigured_ransack(m, method)
+          raise <<~MESSAGE.squish
+            Ransack needs #{m.name} #{method.to_s.delete_prefix("ransackable_")} explicitly
+            allowlisted as searchable. Define `#{m.name}.#{method}(auth_object = nil)`,
+            leaving out anything you don't want searchable. layered-resource-rails
+            only allowlists for its own resources.
+          MESSAGE
+        end
+
         # Walks the resource class ancestry to find the first ancestor that
         # has the given ivar set. Class-level ivars are not inherited in Ruby,
         # so we explicitly walk to give subclasses access to a parent's

data/lib/layered/resource/version.rb

@@ -1,5 +1,5 @@
 module Layered
   module Resource
-    VERSION = "0.3.1"
+    VERSION = "0.5.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: layered-resource-rails
 version: !ruby/object:Gem::Version
-  version: 0.3.1
+  version: 0.5.0
 platform: ruby
 authors:
 - layered.ai
@@ -13,44 +13,62 @@ dependencies:
   name: concurrent-ruby
   requirement: !ruby/object:Gem::Requirement
     requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: 1.3.8
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: 1.3.8
 - !ruby/object:Gem::Dependency
   name: layered-ui-rails
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.27'
+        version: '0.28'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.28.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.27'
+        version: '0.28'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.28.1
 - !ruby/object:Gem::Dependency
   name: pagy
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '43.2'
+        version: '43.8'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 43.8.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '43.2'
+        version: '43.8'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 43.8.1
 - !ruby/object:Gem::Dependency
   name: rails
   requirement: !ruby/object:Gem::Requirement
@@ -71,14 +89,20 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '4.0'
+        version: '4.4'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 4.4.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '4.0'
+        version: '4.4'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 4.4.4
 - !ruby/object:Gem::Dependency
   name: devise
   requirement: !ruby/object:Gem::Requirement
@@ -86,6 +110,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '5.0'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 5.0.4
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -93,90 +120,129 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '5.0'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 5.0.4
 - !ruby/object:Gem::Dependency
   name: importmap-rails
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '2.2'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.2.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '2.2'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.2.3
 - !ruby/object:Gem::Dependency
   name: propshaft
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '1.3'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.3.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '1.3'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.3.2
 - !ruby/object:Gem::Dependency
   name: pundit
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.4'
+        version: '2.5'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.5.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.4'
+        version: '2.5'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.5.2
 - !ruby/object:Gem::Dependency
   name: puma
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '7.0'
+        version: '7.2'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 7.2.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '7.0'
+        version: '7.2'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 7.2.1
 - !ruby/object:Gem::Dependency
   name: sqlite3
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '2.10'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.10.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '2.10'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.10.2
 - !ruby/object:Gem::Dependency
   name: stimulus-rails
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '1.3'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.3.4
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '1.3'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.3.4
 - !ruby/object:Gem::Dependency
   name: turbo-rails
   requirement: !ruby/object:Gem::Requirement
@@ -184,6 +250,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.0'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.0.23
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -191,6 +260,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.0'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.0.23
 description: A convention-over-configuration CRUD engine for Rails 8+, built on the
   layered-ui-rails gem. Declare a resource class, mount it in routes.rb, and get index,
   new/create, edit/update, and destroy actions with clean default views, Ransack-powered