layered-resource-rails 0.4.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 403ad781bad901c2882718ad739de8346faa81dcce400046aa2092de5c235ab3
-  data.tar.gz: a78bb873e92d3b814c87a1d989febe815baf67fdb8b74bab8c7193a53d29a7f7
+  metadata.gz: dd456a360f63f94c4c38e833251b2d4b22a20c7df76b2b78612d9baf55135e9c
+  data.tar.gz: 783f255e36a42959f5565862cf2354d5a57cb1ec5e2d98fbf281477613446c43
 SHA512:
-  metadata.gz: 16d28757cc081b902fad287938d6668893b12cc17e9e39d6c0419ef79ea6908ad796236796725dadfc3c14e3540fad66bd85e579f7c0b6308d361cc654131524
-  data.tar.gz: 59cbe7172af51a80c7107792e9109d5fb4b41a2934933462ee39543b2e7e6807daa012cbdc6d3d82a220681ab913b27c6652fdabaaf51555fdfc4e5920ed3dd8
+  metadata.gz: e29f1a82da384c20cf1d2b99793fedd5079d129a3767cd0c18ba81a55b41b4cf7621c9d0528d992239dc75480607ec0702bb6c70f2562660bb5a063d4faa33d6
+  data.tar.gz: 6b144d42bb808d4ef5cab32ed5119ec6a976046e4dd82b9d3fac221c2aacfd2015985f0428f1011493a2bd46289e75876b44bce62e1c69b2f22cb42f0c2e1ff7

data/.claude/skills/layered-resource-rails/SKILL.md

@@ -178,7 +178,7 @@ Inference by column type: `enum`/`belongs_to` -> multi-select (`_in`; `multiple:
 
 **Long option lists switch control.** A select-type filter renders as the plain list (multi-select: checkboxes + Apply; single-choice: instant-apply links) up to `Layered::Resource.filter_combobox_threshold` options (10), and as a type-ahead **combobox** past it — a checkbox list of every user is no way to pick one. A single-choice combobox posts a scalar (no `[]`), so `_eq` gets the value rather than an array. The count is taken per request, after a `collection:` callable resolves, so the control follows the data; the decision lives in `layered_filter_control` (the view helper), not in `resolved_filters`, for exactly that reason. Declaring `as:` pins the control and opts out: `as: :select` keeps the list however long, `as: :combobox` uses the combobox however short.
 
-**Remote options.** `url:` fetches the options from an endpoint as the user types instead of rendering a collection — such a filter is always a combobox (nothing to render or count). Give it as a callable (`-> { user_options_path }`) so it resolves per request in the view, where route helpers exist. The endpoint is an ordinary host-app action including `Layered::Ui::ComboboxOptions` and returning `l_ui_combobox_options(scope, label:, search:)` — the gem never routes it, so it's authorised however any index is. Since the browser has no collection to look a label up in, an active remote filter's values are labelled server-side from the records (same `name`/`title`/`label`/`email` fallbacks), so the tag reads "User: Alice" not "User: 12"; a `url:` over a plain column has no records and its values label themselves. The label lookup is confined to records the resource's `scope(controller)` references (via the foreign key), so a hand-edited id outside it - e.g. another tenant's user - labels itself instead of leaking a name; the cost is that an in-scope option with no matching records also shows its raw id. `min_chars:` and `text:` pass through too; the write-side options (`create:`, `create_name:`, `reorder:`) deliberately don't — a filter picks among values that already exist.
+**Remote options.** `url:` fetches the options from an endpoint as the user types instead of rendering a collection — such a filter is always a combobox (nothing to render or count). Give it as a callable (`-> { user_options_path }`) so it resolves per request in the view, where route helpers exist. The endpoint is an ordinary host-app action including `Layered::Ui::ComboboxOptions` and returning `l_ui_combobox_options(scope, label:, search:)` — the gem never routes it, so it's authorised however any index is. It searches outside any resource, so the model needs its own `ransackable_attributes` covering the `search:` fields. Since the browser has no collection to look a label up in, an active remote filter's values are labelled server-side from the records (same `name`/`title`/`label`/`email` fallbacks), so the tag reads "User: Alice" not "User: 12"; a `url:` over a plain column has no records and its values label themselves. The label lookup is confined to records the resource's `scope(controller)` references (via the foreign key), so a hand-edited id outside it - e.g. another tenant's user - labels itself instead of leaking a name; the cost is that an in-scope option with no matching records also shows its raw id. `min_chars:` and `text:` pass through too; the write-side options (`create:`, `create_name:`, `reorder:`) deliberately don't — a filter picks among values that already exist.
 
 **The blank a combobox posts.** `l_ui_combobox` emits a leading blank hidden input so clearing every token submits an empty collection rather than omitting the key. Ransack prunes blanks from an `_in` array itself, and `layered_filter_query_params` prunes them too — an array left with nothing becomes an explicit `""`, the same shape the Clear link writes, so the tag reads as inactive *and* a `default:` doesn't immediately re-apply.
 
@@ -444,7 +444,7 @@ columns [
 
 `as: :badge, rounded: true` gives the rounded count pill; `link:` (optional) makes it link to the children's nested index. If the parent doesn't already carry a counter-cache column, add the migration and `counter_cache: true` rather than reaching for `.size`.
 
-To make an association searchable, add a Ransack-walk-shaped entry to `search_fields` - e.g. `search_fields [:title, :user_name]` resolves `:user_name` against `belongs_to :user` + `users.name` and joins into the association. The gem scopes the Ransack allowlists per resource: it only responds when the resource class is the auth object (on both the parent and the associated model), so host-app Ransack config is preserved. A walked search field is also *sortable* (`q[s]=user_name asc` orders by `users.name`) because Ransack derives its sort allowlist from the search allowlist. Cross-model sort/filter on associations *not* declared in `search_fields` remains off; to opt in, define `ransackable_associations` on the parent model yourself and allowlist the attributes on the child model - the gem detects the host-defined override and unions with it. The search box placeholder labels a walk as "<association> <attribute>" via each model's `human_attribute_name` - translate `activerecord.attributes.<model>.<attr>` to rename a half, or set `search_placeholder` on the resource to replace the whole string.
+To make an association searchable, add a Ransack-walk-shaped entry to `search_fields` - e.g. `search_fields [:title, :user_name]` resolves `:user_name` against `belongs_to :user` + `users.name` and joins into the association. The gem scopes the Ransack allowlists per resource: it only responds when the resource class is the auth object (on both the parent and the associated model), so host-app Ransack config is preserved. A host-app `Model.ransack` call outside a resource still needs the model's own allowlist: with none defined, the gem's patch raises a "needs explicitly allowlisted" error, as Ransack does for an unconfigured model, rather than allowlisting everything. A walked search field is also *sortable* (`q[s]=user_name asc` orders by `users.name`) because Ransack derives its sort allowlist from the search allowlist. Cross-model sort/filter on associations *not* declared in `search_fields` remains off; to opt in, define `ransackable_associations` on the parent model yourself and allowlist the attributes on the child model - the gem detects the host-defined override and unions with it. The search box placeholder labels a walk as "<association> <attribute>" via each model's `human_attribute_name` - translate `activerecord.attributes.<model>.<attr>` to rename a half, or set `search_placeholder` on the resource to replace the whole string.
 
 ## Common issues
 

data/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 All notable changes to this project will be documented in this file. This project follows [Semantic Versioning](https://semver.org/).
 
+## [0.5.0] - 2026-11-11
+
+### Fixed
+
+- The "needs explicitly allowlisted" error raised for a configured model with no allowlist of its own now names the class being searched. An STI subclass of a configured model was reported as its parent
+
+### Changed
+
+- Refresh the development/test bundle to Rails 8.1.4, layered-ui-rails 0.28.1, Pagy 43.8.1, concurrent-ruby 1.3.8, SQLite 2.10.2, and compatible transitive updates.
+- Raise runtime and development dependency minimums to the versions verified by the suite, retaining their current major-version ranges. Ruby >= 3.3 and Rails ~> 8.0 support are unchanged; Rails keeps its existing minimum so Rails 8.0 apps remain supported.
+
+### Security
+
+- Require Ransack >= 4.4.4 within the existing 4.x range, including the sort-link reflected XSS and open redirect fix for GHSA-58rx-96gf-w92x.
+- A model the gem configures for Ransack no longer becomes fully searchable by the rest of the app. The scoped `ransackable_attributes`/`ransackable_associations` fell through to Ransack's builtin for any other caller. Because the override counted as an explicit definition, Ransack logged a deprecation warning and allowlisted every column and association, including fields like `encrypted_password`. Where the host app hasn't defined its own allowlist, another layered resource now gets an empty list, and any other caller gets the same "needs explicitly allowlisted" error Ransack raises for an unconfigured model. A host app that searched such a model outside a resource, and relied on the accidental widening, now needs to define `ransackable_attributes`/`ransackable_associations` on it
+
 ## [0.4.0] - 2026-10-04
 
 ### Added

data/README.md

@@ -45,9 +45,9 @@ curl -fsSL https://raw.githubusercontent.com/layered-ai-public/layered-resource-
 ## Requirements
 
 - Ruby on Rails >= 8.0
-- [layered-ui-rails](https://github.com/layered-ai-public/layered-ui-rails) ~> 0.27
-- Ransack ~> 4.0
-- Pagy ~> 43.2
+- [layered-ui-rails](https://github.com/layered-ai-public/layered-ui-rails) ~> 0.28, >= 0.28.1
+- Ransack ~> 4.4, >= 4.4.4
+- Pagy ~> 43.8, >= 43.8.1
 
 ## Getting started
 
@@ -386,7 +386,7 @@ class PostResource < Layered::Resource::Base
 end
 ```
 
-The Ransack allowlists are scoped to the resource: the association and the associated model's attribute are only ransackable when this resource is the one searching, so nothing else gains access to the associated model and any host-app Ransack config is preserved.
+The Ransack allowlists are scoped to the resource: the association and the associated model's attribute are only ransackable when this resource is the one searching, so nothing else gains access to the associated model and any host-app Ransack config is preserved. A model the gem configures isn't opened up for anything else either: other Ransack calls still go through the model's own `ransackable_attributes`/`ransackable_associations`, and if it doesn't define them, the gem raises a "needs explicitly allowlisted" error, as Ransack does for a model with no allowlist.
 
 A walked search field is also sortable — `q[s]=user_name asc` orders the index by `users.name` — because Ransack derives its sort allowlist from the search allowlist. Associations not declared in `search_fields` stay unsearchable and unsortable.
 
@@ -562,7 +562,7 @@ class PostResource < Layered::Resource::Base
 end
 ```
 
-Give `url:` as a callable so it resolves per request in the view, where route helpers are available. The endpoint is an ordinary action in your app — the gem never routes it — so it's authorised however any index is:
+Give `url:` as a callable so it resolves per request in the view, where route helpers are available. The endpoint is an ordinary action in your app — the gem never routes it — so it's authorised however any index is. It searches with Ransack outside any resource, so the model it searches needs its own `ransackable_attributes` covering the `search:` fields:
 
 ```ruby
 class UserOptionsController < ApplicationController

data/lib/layered/resource/base.rb

@@ -401,24 +401,46 @@ module Layered
         # `m`. The overrides only answer when the `auth_object` is a layered
         # resource that references `m` — either as its own model, or via an
         # association-walking search field. Every other caller falls through
-        # to the methods captured below (whether host-defined or the framework
-        # default), so any allowlist the host app has set up is preserved.
+        # to the host's own allowlist when it has one. When it doesn't, a
+        # layered resource gets nothing and anyone else gets the error Ransack
+        # raises for an unconfigured model. Delegating to Ransack's builtin
+        # instead would be deprecated, and since these overrides count as an
+        # explicit definition it would allowlist every column — so patching a
+        # model must not widen what the rest of the app can search.
         def patch_ransack(m)
           return if m.instance_variable_get(:@_layered_resource_ransack_configured)
 
           original_attributes = m.method(:ransackable_attributes)
           original_associations = m.method(:ransackable_associations)
           # Detect a host-defined override anywhere in the model's singleton
-          # ancestry (Post, ApplicationRecord, ActiveRecord::Base, etc.).
-          # Ransack supplies the default via a regular Module mixin, so its
-          # `owner` is a Module but not a Class; an explicit `def self.x` in
-          # any host class produces a singleton-class owner, which is a Class.
-          host_attributes_defined = original_attributes.owner.is_a?(Class)
-          host_associations_defined = original_associations.owner.is_a?(Class)
+          # ancestry: a `def self.x` in Post or ApplicationRecord, or a module
+          # brought in with `extend` or a concern's `class_methods`. Only
+          # Ransack's own default (the module it extends ActiveRecord::Base
+          # with) counts as "no allowlist".
+          host_attributes_defined = original_attributes.owner != ::Ransack::Adapters::ActiveRecord::Base
+          host_associations_defined = original_associations.owner != ::Ransack::Adapters::ActiveRecord::Base
+          fallback_attributes = ->(klass, auth_object) do
+            if host_attributes_defined
+              original_attributes.call(auth_object)
+            elsif auth_object.is_a?(Class) && auth_object < Layered::Resource::Base
+              []
+            else
+              Layered::Resource::Base.send(:raise_unconfigured_ransack, klass, :ransackable_attributes)
+            end
+          end
+          fallback_associations = ->(klass, auth_object) do
+            if host_associations_defined
+              original_associations.call(auth_object)
+            elsif auth_object.is_a?(Class) && auth_object < Layered::Resource::Base
+              []
+            else
+              Layered::Resource::Base.send(:raise_unconfigured_ransack, klass, :ransackable_associations)
+            end
+          end
 
           m.define_singleton_method(:ransackable_attributes) do |auth_object = nil|
             unless auth_object.is_a?(Class) && auth_object < Layered::Resource::Base
-              next original_attributes.call(auth_object)
+              next fallback_attributes.call(self, auth_object)
             end
 
             if auth_object.model == self
@@ -452,12 +474,7 @@ module Layered
               declared = auth_object.association_search_fields
                                     .select { |a| a[:klass] == self }
                                     .map { |a| a[:attribute] }
-              if declared.any?
-                base = host_attributes_defined ? original_attributes.call(auth_object) : []
-                base | declared
-              else
-                original_attributes.call(auth_object)
-              end
+              fallback_attributes.call(self, auth_object) | declared
             end
           end
 
@@ -468,16 +485,26 @@ module Layered
           # rather than 500ing.
           m.define_singleton_method(:ransackable_associations) do |auth_object = nil|
             if auth_object.is_a?(Class) && auth_object < Layered::Resource::Base && auth_object.model == self
-              base = host_associations_defined ? original_associations.call(auth_object) : []
-              base | auth_object.association_search_fields.map { |a| a[:association] }
+              fallback_associations.call(self, auth_object) | auth_object.association_search_fields.map { |a| a[:association] }
             else
-              original_associations.call(auth_object)
+              fallback_associations.call(self, auth_object)
             end
           end
 
           m.instance_variable_set(:@_layered_resource_ransack_configured, true)
         end
 
+        # Mirrors Ransack 4's refusal to search a model that hasn't
+        # allowlisted anything, for callers outside the gem.
+        def raise_unconfigured_ransack(m, method)
+          raise <<~MESSAGE.squish
+            Ransack needs #{m.name} #{method.to_s.delete_prefix("ransackable_")} explicitly
+            allowlisted as searchable. Define `#{m.name}.#{method}(auth_object = nil)`,
+            leaving out anything you don't want searchable. layered-resource-rails
+            only allowlists for its own resources.
+          MESSAGE
+        end
+
         # Walks the resource class ancestry to find the first ancestor that
         # has the given ivar set. Class-level ivars are not inherited in Ruby,
         # so we explicitly walk to give subclasses access to a parent's

data/lib/layered/resource/version.rb

@@ -1,5 +1,5 @@
 module Layered
   module Resource
-    VERSION = "0.4.0"
+    VERSION = "0.5.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: layered-resource-rails
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
 platform: ruby
 authors:
 - layered.ai
@@ -13,44 +13,62 @@ dependencies:
   name: concurrent-ruby
   requirement: !ruby/object:Gem::Requirement
     requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: 1.3.8
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: 1.3.8
 - !ruby/object:Gem::Dependency
   name: layered-ui-rails
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.27'
+        version: '0.28'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.28.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.27'
+        version: '0.28'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.28.1
 - !ruby/object:Gem::Dependency
   name: pagy
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '43.2'
+        version: '43.8'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 43.8.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '43.2'
+        version: '43.8'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 43.8.1
 - !ruby/object:Gem::Dependency
   name: rails
   requirement: !ruby/object:Gem::Requirement
@@ -71,14 +89,20 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '4.0'
+        version: '4.4'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 4.4.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '4.0'
+        version: '4.4'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 4.4.4
 - !ruby/object:Gem::Dependency
   name: devise
   requirement: !ruby/object:Gem::Requirement
@@ -86,6 +110,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '5.0'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 5.0.4
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -93,90 +120,129 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '5.0'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 5.0.4
 - !ruby/object:Gem::Dependency
   name: importmap-rails
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '2.2'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.2.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '2.2'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.2.3
 - !ruby/object:Gem::Dependency
   name: propshaft
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '1.3'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.3.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '1.3'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.3.2
 - !ruby/object:Gem::Dependency
   name: pundit
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.4'
+        version: '2.5'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.5.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.4'
+        version: '2.5'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.5.2
 - !ruby/object:Gem::Dependency
   name: puma
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '7.0'
+        version: '7.2'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 7.2.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '7.0'
+        version: '7.2'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 7.2.1
 - !ruby/object:Gem::Dependency
   name: sqlite3
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '2.10'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.10.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '2.10'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.10.2
 - !ruby/object:Gem::Dependency
   name: stimulus-rails
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '1.3'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.3.4
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '1.3'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.3.4
 - !ruby/object:Gem::Dependency
   name: turbo-rails
   requirement: !ruby/object:Gem::Requirement
@@ -184,6 +250,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.0'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.0.23
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -191,6 +260,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.0'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.0.23
 description: A convention-over-configuration CRUD engine for Rails 8+, built on the
   layered-ui-rails gem. Declare a resource class, mount it in routes.rb, and get index,
   new/create, edit/update, and destroy actions with clean default views, Ransack-powered