layered-resource-rails 0.4.0 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 403ad781bad901c2882718ad739de8346faa81dcce400046aa2092de5c235ab3
-  data.tar.gz: a78bb873e92d3b814c87a1d989febe815baf67fdb8b74bab8c7193a53d29a7f7
+  metadata.gz: 4560cdb00f90fd031ddb92e6a472e8b72e375c929864a36f013206f59abfa21a
+  data.tar.gz: b9b93f938d7448c751e9a78b66ff9f23ea174f72e6feec1c67752309bf3f8acb
 SHA512:
-  metadata.gz: 16d28757cc081b902fad287938d6668893b12cc17e9e39d6c0419ef79ea6908ad796236796725dadfc3c14e3540fad66bd85e579f7c0b6308d361cc654131524
-  data.tar.gz: 59cbe7172af51a80c7107792e9109d5fb4b41a2934933462ee39543b2e7e6807daa012cbdc6d3d82a220681ab913b27c6652fdabaaf51555fdfc4e5920ed3dd8
+  metadata.gz: 2e49ac83a4e70bcb16a51eee140652eb9331c856bd5664bad52955474cbb523ee2d78faf7146ef80aa66b78f2ae6e312ac9d733a099deb34dea4b0b2ccb6be76
+  data.tar.gz: 34c074eb474d6aa7aac0c0e9bc24f2feb334023ec6787fc11ea6d7a2c357147a72c258348244051fb60aeff0965b7be1cec0b4693994e52371b0ed96d06334f8

data/.claude/skills/layered-resource-rails/SKILL.md

@@ -178,7 +178,7 @@ Inference by column type: `enum`/`belongs_to` -> multi-select (`_in`; `multiple:
 
 **Long option lists switch control.** A select-type filter renders as the plain list (multi-select: checkboxes + Apply; single-choice: instant-apply links) up to `Layered::Resource.filter_combobox_threshold` options (10), and as a type-ahead **combobox** past it — a checkbox list of every user is no way to pick one. A single-choice combobox posts a scalar (no `[]`), so `_eq` gets the value rather than an array. The count is taken per request, after a `collection:` callable resolves, so the control follows the data; the decision lives in `layered_filter_control` (the view helper), not in `resolved_filters`, for exactly that reason. Declaring `as:` pins the control and opts out: `as: :select` keeps the list however long, `as: :combobox` uses the combobox however short.
 
-**Remote options.** `url:` fetches the options from an endpoint as the user types instead of rendering a collection — such a filter is always a combobox (nothing to render or count). Give it as a callable (`-> { user_options_path }`) so it resolves per request in the view, where route helpers exist. The endpoint is an ordinary host-app action including `Layered::Ui::ComboboxOptions` and returning `l_ui_combobox_options(scope, label:, search:)` — the gem never routes it, so it's authorised however any index is. Since the browser has no collection to look a label up in, an active remote filter's values are labelled server-side from the records (same `name`/`title`/`label`/`email` fallbacks), so the tag reads "User: Alice" not "User: 12"; a `url:` over a plain column has no records and its values label themselves. The label lookup is confined to records the resource's `scope(controller)` references (via the foreign key), so a hand-edited id outside it - e.g. another tenant's user - labels itself instead of leaking a name; the cost is that an in-scope option with no matching records also shows its raw id. `min_chars:` and `text:` pass through too; the write-side options (`create:`, `create_name:`, `reorder:`) deliberately don't — a filter picks among values that already exist.
+**Remote options.** `url:` fetches the options from an endpoint as the user types instead of rendering a collection — such a filter is always a combobox (nothing to render or count). Give it as a callable (`-> { user_options_path }`) so it resolves per request in the view, where route helpers exist. The endpoint is an ordinary host-app action including `Layered::Ui::ComboboxOptions` and returning `l_ui_combobox_options(scope, label:, search:)` — the gem never routes it, so it's authorised however any index is. It searches outside any resource, so the model needs its own `ransackable_attributes` covering the `search:` fields. Since the browser has no collection to look a label up in, an active remote filter's values are labelled server-side from the records (same `name`/`title`/`label`/`email` fallbacks), so the tag reads "User: Alice" not "User: 12"; a `url:` over a plain column has no records and its values label themselves. The label lookup is confined to records the resource's `scope(controller)` references (via the foreign key), so a hand-edited id outside it - e.g. another tenant's user - labels itself instead of leaking a name; the cost is that an in-scope option with no matching records also shows its raw id. `min_chars:` and `text:` pass through too; the write-side options (`create:`, `create_name:`, `reorder:`) deliberately don't — a filter picks among values that already exist.
 
 **The blank a combobox posts.** `l_ui_combobox` emits a leading blank hidden input so clearing every token submits an empty collection rather than omitting the key. Ransack prunes blanks from an `_in` array itself, and `layered_filter_query_params` prunes them too — an array left with nothing becomes an explicit `""`, the same shape the Clear link writes, so the tag reads as inactive *and* a `default:` doesn't immediately re-apply.
 
@@ -309,7 +309,7 @@ When enabled:
 
 - `scope(controller)` defaults to the controller's `policy_scope(model)` helper, so apps that override `pundit_user` (e.g. `current_account`) get the same identity used by `authorize`.
 - The controller calls `authorize(@record)` after loading a member record (show/edit/update/destroy and any custom member action).
-- The `New`/`Edit`/`Delete` actions in the default views (inline buttons on show, a per-row actions popover menu on index, in a column pinned to the right edge via `l_ui_table`'s `floating_actions:`) hide for users whose policy denies the action - the views call a `resource_can?(action, record = nil)` helper that ANDs the route-exposure flag with `policy(record).<action>?`.
+- The `New`/`Edit`/`Delete` actions in the default views (inline buttons on show, a per-row actions popover menu on index, in a column pinned to the right edge via `l_ui_table`'s `floating_actions:`) hide for users whose policy denies the action - the views call a `resource_can?(action, record = nil)` helper that ANDs the route-exposure flag with `policy(record).<action>?`. A resource's own `_row_actions` partial replaces the index menu's checks, so it must call `resource_can?` itself (see Row actions).
 
 `owned_by` composes with `use_pundit`: Pundit's `Policy::Scope#resolve` wins for the read filter; `owned_by` still drives owner assignment on create. Stack both when needed.
 
@@ -344,6 +344,17 @@ end
 
 Drop a partial at `app/views/layered/<resource>/_introduction.html.erb` to render content above the search area on that resource's index page. The partial is rendered when present and skipped otherwise — no DSL, no configuration. It uses the same per-resource view path as ejected templates and column overrides.
 
+## Row actions
+
+Each index row's popover menu holds whatever the `_row_actions` partial renders for that record. The default renders `Edit`/`Delete`, gated by `resource_can?(action, record)`. For a menu that varies per record or per user (a role-dependent "Members"/"Settings"/"Leave", say), drop `app/views/layered/<resource>/_row_actions.html.erb` - **don't eject the whole index for this**; the override keeps search, filters, sort and pagination.
+
+- Locals: `record`. Full view context: `current_user`, host path helpers, `layered_member_path`, `resource_can?`.
+- Render items only (the index wraps them in the popover): class `l-ui-popover__menu-item` (`--danger` for destructive), `<hr class="l-ui-popover__menu-divider">` between groups, `data: { turbo_frame: "_top" }` on each. Use `button_to ..., method: :delete` for non-GET actions.
+- Empty output for a row means no menu on that row.
+- The override replaces the default's gating - wrap any kept Edit/Delete in `resource_can?` so `only:` and Pundit still apply.
+- The index renders every row's menu before the table and adds the actions column only when at least one row has one - so an index-only route gets a column only if its partial renders items, and an ejected copy of the default adds no empty column.
+- The partial is keyed by the route's resource name, so every route for that name (e.g. `/team_posts` and `/browse/team_posts`) shares it.
+
 ## Ejection
 
 Take over presentation or controller logic without giving up the rest:
@@ -444,7 +455,7 @@ columns [
 
 `as: :badge, rounded: true` gives the rounded count pill; `link:` (optional) makes it link to the children's nested index. If the parent doesn't already carry a counter-cache column, add the migration and `counter_cache: true` rather than reaching for `.size`.
 
-To make an association searchable, add a Ransack-walk-shaped entry to `search_fields` - e.g. `search_fields [:title, :user_name]` resolves `:user_name` against `belongs_to :user` + `users.name` and joins into the association. The gem scopes the Ransack allowlists per resource: it only responds when the resource class is the auth object (on both the parent and the associated model), so host-app Ransack config is preserved. A walked search field is also *sortable* (`q[s]=user_name asc` orders by `users.name`) because Ransack derives its sort allowlist from the search allowlist. Cross-model sort/filter on associations *not* declared in `search_fields` remains off; to opt in, define `ransackable_associations` on the parent model yourself and allowlist the attributes on the child model - the gem detects the host-defined override and unions with it. The search box placeholder labels a walk as "<association> <attribute>" via each model's `human_attribute_name` - translate `activerecord.attributes.<model>.<attr>` to rename a half, or set `search_placeholder` on the resource to replace the whole string.
+To make an association searchable, add a Ransack-walk-shaped entry to `search_fields` - e.g. `search_fields [:title, :user_name]` resolves `:user_name` against `belongs_to :user` + `users.name` and joins into the association. The gem scopes the Ransack allowlists per resource: it only responds when the resource class is the auth object (on both the parent and the associated model), so host-app Ransack config is preserved. A host-app `Model.ransack` call outside a resource still needs the model's own allowlist: with none defined, the gem's patch raises a "needs explicitly allowlisted" error, as Ransack does for an unconfigured model, rather than allowlisting everything. A walked search field is also *sortable* (`q[s]=user_name asc` orders by `users.name`) because Ransack derives its sort allowlist from the search allowlist. Cross-model sort/filter on associations *not* declared in `search_fields` remains off; to opt in, define `ransackable_associations` on the parent model yourself and allowlist the attributes on the child model - the gem detects the host-defined override and unions with it. The search box placeholder labels a walk as "<association> <attribute>" via each model's `human_attribute_name` - translate `activerecord.attributes.<model>.<attr>` to rename a half, or set `search_placeholder` on the resource to replace the whole string.
 
 ## Common issues
 

data/CHANGELOG.md

@@ -2,6 +2,36 @@
 
 All notable changes to this project will be documented in this file. This project follows [Semantic Versioning](https://semver.org/).
 
+## [0.6.0] - 2026-11-11
+
+### Added
+
+- A resource can supply its own index row actions with a `_row_actions` partial at `app/views/layered/<resource>/_row_actions.html.erb`, rendered once per row with `record` as a local. It replaces the default `Edit`/`Delete` menu for that resource, keeping the index's search, filters, sorting and pagination, so menus that vary per record or per user no longer mean ejecting the whole index. A row whose partial renders nothing gets no menu, and the actions column appears only when at least one row on the page has one, so an index-only route can have row actions too. The default menu is now this partial too, and `rails g layered:resource:views` copies it
+
+### Changed
+
+- The index leaves out the actions column when no row on the page has a menu, such as a page where the policy denies every row. It used to show an empty column whenever edit or destroy was routed
+
+### Fixed
+
+- A partial the default views render by bare name, such as `_search` or `_filters`, is now picked up from `app/views/layered/<resource>/` when overridden there. The lookup context could be built before the resource was known, so its prefixes left out the per-resource directory and the gem's own partial always won
+
+## [0.5.0] - 2026-11-11
+
+### Fixed
+
+- The "needs explicitly allowlisted" error raised for a configured model with no allowlist of its own now names the class being searched. An STI subclass of a configured model was reported as its parent
+
+### Changed
+
+- Refresh the development/test bundle to Rails 8.1.4, layered-ui-rails 0.28.1, Pagy 43.8.1, concurrent-ruby 1.3.8, SQLite 2.10.2, and compatible transitive updates.
+- Raise runtime and development dependency minimums to the versions verified by the suite, retaining their current major-version ranges. Ruby >= 3.3 and Rails ~> 8.0 support are unchanged; Rails keeps its existing minimum so Rails 8.0 apps remain supported.
+
+### Security
+
+- Require Ransack >= 4.4.4 within the existing 4.x range, including the sort-link reflected XSS and open redirect fix for GHSA-58rx-96gf-w92x.
+- A model the gem configures for Ransack no longer becomes fully searchable by the rest of the app. The scoped `ransackable_attributes`/`ransackable_associations` fell through to Ransack's builtin for any other caller. Because the override counted as an explicit definition, Ransack logged a deprecation warning and allowlisted every column and association, including fields like `encrypted_password`. Where the host app hasn't defined its own allowlist, another layered resource now gets an empty list, and any other caller gets the same "needs explicitly allowlisted" error Ransack raises for an unconfigured model. A host app that searched such a model outside a resource, and relied on the accidental widening, now needs to define `ransackable_attributes`/`ransackable_associations` on it
+
 ## [0.4.0] - 2026-10-04
 
 ### Added

data/README.md

@@ -45,9 +45,9 @@ curl -fsSL https://raw.githubusercontent.com/layered-ai-public/layered-resource-
 ## Requirements
 
 - Ruby on Rails >= 8.0
-- [layered-ui-rails](https://github.com/layered-ai-public/layered-ui-rails) ~> 0.27
-- Ransack ~> 4.0
-- Pagy ~> 43.2
+- [layered-ui-rails](https://github.com/layered-ai-public/layered-ui-rails) ~> 0.28, >= 0.28.1
+- Ransack ~> 4.4, >= 4.4.4
+- Pagy ~> 43.8, >= 43.8.1
 
 ## Getting started
 
@@ -133,7 +133,7 @@ That's it. You now have a full CRUD interface with search and pagination for `Po
 
 The index table's primary column (`primary: true`, or the first column) links to each record's edit page - or, for read-only resources without an edit action, to its show page.
 
-Row actions (`Edit`/`Delete`) live in a popover menu in the table's last column. That column is pinned to the right-hand edge of the table's scroll container, so the actions menu stays reachable when a wide table scrolls horizontally.
+Row actions (`Edit`/`Delete`, or [your own](#row-actions)) live in a popover menu in the table's last column. That column is pinned to the right-hand edge of the table's scroll container, so the actions menu stays reachable when a wide table scrolls horizontally.
 
 Each action also sets `@page_title` for use by the layout's `<title>` tag - `"Posts"` on index, `"New Post"` on new, the record's primary column value on show, and `"Edit <record label>"` on edit. Override after `super` in a custom action if you need something different.
 
@@ -291,7 +291,8 @@ When enabled:
   `Edit`/`Delete` items in the index row's actions popover, and the
   `Edit`/`Delete` buttons on the show page check
   `policy(record).new?/update?/destroy?` so users only see actions they
-  can perform.
+  can perform. A resource's own [`_row_actions`](#row-actions) partial
+  replaces the row menu's checks, so it calls `resource_can?` itself.
 
 > **`verify_authorized` / `verify_policy_scoped`**: if your
 > `ApplicationController` runs Pundit's `after_action :verify_authorized`
@@ -386,7 +387,7 @@ class PostResource < Layered::Resource::Base
 end
 ```
 
-The Ransack allowlists are scoped to the resource: the association and the associated model's attribute are only ransackable when this resource is the one searching, so nothing else gains access to the associated model and any host-app Ransack config is preserved.
+The Ransack allowlists are scoped to the resource: the association and the associated model's attribute are only ransackable when this resource is the one searching, so nothing else gains access to the associated model and any host-app Ransack config is preserved. A model the gem configures isn't opened up for anything else either: other Ransack calls still go through the model's own `ransackable_attributes`/`ransackable_associations`, and if it doesn't define them, the gem raises a "needs explicitly allowlisted" error, as Ransack does for a model with no allowlist.
 
 A walked search field is also sortable — `q[s]=user_name asc` orders the index by `users.name` — because Ransack derives its sort allowlist from the search allowlist. Associations not declared in `search_fields` stay unsearchable and unsortable.
 
@@ -562,7 +563,7 @@ class PostResource < Layered::Resource::Base
 end
 ```
 
-Give `url:` as a callable so it resolves per request in the view, where route helpers are available. The endpoint is an ordinary action in your app — the gem never routes it — so it's authorised however any index is:
+Give `url:` as a callable so it resolves per request in the view, where route helpers are available. The endpoint is an ordinary action in your app — the gem never routes it — so it's authorised however any index is. It searches with Ransack outside any resource, so the model it searches needs its own `ransackable_attributes` covering the `search:` fields:
 
 ```ruby
 class UserOptionsController < ApplicationController
@@ -684,6 +685,34 @@ To render an introduction above the search area on a resource's index page, drop
 
 The partial sits inside the resource's view directory, so it follows the same per-resource override path as ejected views and column partials.
 
+## Row actions
+
+Each index row's actions menu holds whatever the `_row_actions` partial renders for that record. The gem's default renders `Edit` and `Delete`, each shown only when `resource_can?` allows it for the record. To give a resource its own menu, drop a partial at `app/views/layered/<resource>/_row_actions.html.erb`. It replaces the default for that resource only, and the index keeps its search, filters, sorting and pagination.
+
+The partial renders once per row with `record` as a local, in the normal view context, so `current_user`, your app's path helpers, `layered_member_path` and `resource_can?` are all available. Render the menu items only; the index wraps them in the popover. A row whose partial renders nothing gets no menu.
+
+```erb
+<%# app/views/layered/accounts/_row_actions.html.erb %>
+<% role = record.role_for(current_user) %>
+<% if role.in?(%w[owner admin]) %>
+  <%= link_to "Members", account_members_path(record),
+        class: "l-ui-popover__menu-item", data: { turbo_frame: "_top" } %>
+<% end %>
+<% if role == "owner" %>
+  <%= link_to "Settings", edit_account_path(record),
+        class: "l-ui-popover__menu-item", data: { turbo_frame: "_top" } %>
+<% end %>
+<hr class="l-ui-popover__menu-divider">
+<%= button_to "Leave", leave_account_path(record), method: :delete,
+      class: "l-ui-popover__menu-item l-ui-popover__menu-item--danger",
+      data: { turbo_confirm: "Leave this account?", turbo_frame: "_top" } %>
+```
+
+- **Item classes.** Give links and buttons `l-ui-popover__menu-item`, add `l-ui-popover__menu-item--danger` for destructive ones, and separate groups with `<hr class="l-ui-popover__menu-divider">`. Add `data: { turbo_frame: "_top" }` so the action leaves the index's Turbo frame.
+- **Gating is yours.** Your partial replaces the default's `resource_can?` checks. Call `resource_can?(:edit, record)` / `resource_can?(:destroy, record)` around any built-in actions you keep, so they still respect the route's `only:` and your Pundit policy. Actions on your own routes are authorised by their own controllers, as usual.
+- **When the column shows.** The actions column appears only when at least one row on the page has a menu. So an index-only route using the default gets none, while a resource whose own partial renders items gets the column on any route.
+- **Ejected views.** `rails g layered:resource:views` copies the default `_row_actions.html.erb` along with the other templates; edit it in place.
+
 ## Record pickers
 
 A field naming a `belongs_to`'s **foreign key** is a record picker, so it renders as a single-select [combobox](https://github.com/layered-ai-public/layered-ui-rails) - a type-ahead input whose selection becomes a removable token - over the associated records, rather than as the number the column happens to hold:

data/app/controllers/layered/resource/controller.rb

@@ -189,6 +189,12 @@ module Layered
         @columns = @resource.columns
         @layered_route_key = route_key
         @layered_resource_name = @_route_entry[:resource_name].presence || route_key
+        # The lookup context may already exist (an earlier before_action can
+        # build it), holding prefixes from before the resource name was
+        # known. Partials rendered by bare name - `render "row_actions"` -
+        # search those prefixes, so refresh them or a per-resource override
+        # in app/views/layered/<name>/ is never found.
+        lookup_context.prefixes = _prefixes
         @fields = @resource.resolved_fields
         @crud_enabled = @fields.any?
 

data/app/views/layered/resource/resources/_row_actions.html.erb

@@ -0,0 +1,19 @@
+<%# The items in an index row's actions menu, rendered once per record with
+    `record` as a local. The index wraps whatever this outputs in the row's
+    popover, and leaves the row without a menu when it outputs nothing.
+    Override per resource at app/views/layered/<resource>/_row_actions.html.erb. %>
+<% can_edit = resource_can?(:edit, record) %>
+<% if can_edit %>
+  <%= link_to "Edit", layered_member_path(record, action: :edit),
+        class: "l-ui-popover__menu-item",
+        data: { turbo_frame: "_top" } %>
+<% end %>
+<% if resource_can?(:destroy, record) %>
+  <% if can_edit %>
+    <hr class="l-ui-popover__menu-divider">
+  <% end %>
+  <%= button_to "Delete", layered_member_path(record),
+        method: :delete,
+        class: "l-ui-popover__menu-item l-ui-popover__menu-item--danger",
+        data: { turbo_confirm: "Are you sure?", turbo_frame: "_top" } %>
+<% end %>

data/app/views/layered/resource/resources/index.html.erb

@@ -39,22 +39,19 @@
     <%= render "filters", turbo_frame_name: turbo_frame_name %>
   <% end %>
 
-  <% actions_proc = if @resource_can_edit || @resource_can_destroy
+  <%# Each row's menu holds whatever the _row_actions partial renders for it:
+      Edit and Delete by default, or a resource's own override. Rendering
+      them up front means the actions column only appears when at least one
+      row on the page has a menu - not on an index-only route, nor on a page
+      where the policy denies every row. %>
+  <% row_menus = @records.each_with_object({}.compare_by_identity) do |record, menus|
+       items = render("row_actions", record: record)
+       menus[record] = items if items.present?
+     end %>
+  <% actions_proc = if row_menus.any?
     ->(record) do
-      items = []
-      if resource_can?(:edit, record)
-        items << link_to("Edit", layered_member_path(record, action: :edit),
-                  class: "l-ui-popover__menu-item",
-                  data: { turbo_frame: "_top" })
-      end
-      if resource_can?(:destroy, record)
-        items << tag.hr(class: "l-ui-popover__menu-divider") if items.any?
-        items << button_to("Delete", layered_member_path(record),
-                    method: :delete,
-                    class: "l-ui-popover__menu-item l-ui-popover__menu-item--danger",
-                    data: { turbo_confirm: "Are you sure?", turbo_frame: "_top" })
-      end
-      next if items.empty?
+      items = row_menus[record]
+      next unless items
 
       l_ui_popover(align: :end) do |p|
         p.trigger(class: "l-ui-button l-ui-button--outline l-ui-button--icon l-ui-button--small",
@@ -62,7 +59,7 @@
           image_tag("layered_ui/icon_more.svg", alt: "",
             class: "l-ui-icon l-ui-icon--sm", aria: { hidden: true })
         end
-        tag.div(safe_join(items), class: "l-ui-popover__menu")
+        tag.div(items, class: "l-ui-popover__menu")
       end
     end
   end %>

data/lib/generators/layered/resource/views/views_generator.rb

@@ -16,7 +16,8 @@ module Layered
         desc "Copy the gem's view templates into app/views/layered/<name>/ for full customisation."
 
         VIEWS = %w[index.html.erb show.html.erb new.html.erb edit.html.erb
-                   _search.html.erb _filters.html.erb _filter_control.html.erb].freeze
+                   _search.html.erb _filters.html.erb _filter_control.html.erb
+                   _row_actions.html.erb].freeze
 
         def copy_views
           VIEWS.each do |view|

data/lib/layered/resource/base.rb

@@ -401,24 +401,46 @@ module Layered
         # `m`. The overrides only answer when the `auth_object` is a layered
         # resource that references `m` — either as its own model, or via an
         # association-walking search field. Every other caller falls through
-        # to the methods captured below (whether host-defined or the framework
-        # default), so any allowlist the host app has set up is preserved.
+        # to the host's own allowlist when it has one. When it doesn't, a
+        # layered resource gets nothing and anyone else gets the error Ransack
+        # raises for an unconfigured model. Delegating to Ransack's builtin
+        # instead would be deprecated, and since these overrides count as an
+        # explicit definition it would allowlist every column — so patching a
+        # model must not widen what the rest of the app can search.
         def patch_ransack(m)
           return if m.instance_variable_get(:@_layered_resource_ransack_configured)
 
           original_attributes = m.method(:ransackable_attributes)
           original_associations = m.method(:ransackable_associations)
           # Detect a host-defined override anywhere in the model's singleton
-          # ancestry (Post, ApplicationRecord, ActiveRecord::Base, etc.).
-          # Ransack supplies the default via a regular Module mixin, so its
-          # `owner` is a Module but not a Class; an explicit `def self.x` in
-          # any host class produces a singleton-class owner, which is a Class.
-          host_attributes_defined = original_attributes.owner.is_a?(Class)
-          host_associations_defined = original_associations.owner.is_a?(Class)
+          # ancestry: a `def self.x` in Post or ApplicationRecord, or a module
+          # brought in with `extend` or a concern's `class_methods`. Only
+          # Ransack's own default (the module it extends ActiveRecord::Base
+          # with) counts as "no allowlist".
+          host_attributes_defined = original_attributes.owner != ::Ransack::Adapters::ActiveRecord::Base
+          host_associations_defined = original_associations.owner != ::Ransack::Adapters::ActiveRecord::Base
+          fallback_attributes = ->(klass, auth_object) do
+            if host_attributes_defined
+              original_attributes.call(auth_object)
+            elsif auth_object.is_a?(Class) && auth_object < Layered::Resource::Base
+              []
+            else
+              Layered::Resource::Base.send(:raise_unconfigured_ransack, klass, :ransackable_attributes)
+            end
+          end
+          fallback_associations = ->(klass, auth_object) do
+            if host_associations_defined
+              original_associations.call(auth_object)
+            elsif auth_object.is_a?(Class) && auth_object < Layered::Resource::Base
+              []
+            else
+              Layered::Resource::Base.send(:raise_unconfigured_ransack, klass, :ransackable_associations)
+            end
+          end
 
           m.define_singleton_method(:ransackable_attributes) do |auth_object = nil|
             unless auth_object.is_a?(Class) && auth_object < Layered::Resource::Base
-              next original_attributes.call(auth_object)
+              next fallback_attributes.call(self, auth_object)
             end
 
             if auth_object.model == self
@@ -452,12 +474,7 @@ module Layered
               declared = auth_object.association_search_fields
                                     .select { |a| a[:klass] == self }
                                     .map { |a| a[:attribute] }
-              if declared.any?
-                base = host_attributes_defined ? original_attributes.call(auth_object) : []
-                base | declared
-              else
-                original_attributes.call(auth_object)
-              end
+              fallback_attributes.call(self, auth_object) | declared
             end
           end
 
@@ -468,16 +485,26 @@ module Layered
           # rather than 500ing.
           m.define_singleton_method(:ransackable_associations) do |auth_object = nil|
             if auth_object.is_a?(Class) && auth_object < Layered::Resource::Base && auth_object.model == self
-              base = host_associations_defined ? original_associations.call(auth_object) : []
-              base | auth_object.association_search_fields.map { |a| a[:association] }
+              fallback_associations.call(self, auth_object) | auth_object.association_search_fields.map { |a| a[:association] }
             else
-              original_associations.call(auth_object)
+              fallback_associations.call(self, auth_object)
             end
           end
 
           m.instance_variable_set(:@_layered_resource_ransack_configured, true)
         end
 
+        # Mirrors Ransack 4's refusal to search a model that hasn't
+        # allowlisted anything, for callers outside the gem.
+        def raise_unconfigured_ransack(m, method)
+          raise <<~MESSAGE.squish
+            Ransack needs #{m.name} #{method.to_s.delete_prefix("ransackable_")} explicitly
+            allowlisted as searchable. Define `#{m.name}.#{method}(auth_object = nil)`,
+            leaving out anything you don't want searchable. layered-resource-rails
+            only allowlists for its own resources.
+          MESSAGE
+        end
+
         # Walks the resource class ancestry to find the first ancestor that
         # has the given ivar set. Class-level ivars are not inherited in Ruby,
         # so we explicitly walk to give subclasses access to a parent's

data/lib/layered/resource/version.rb

@@ -1,5 +1,5 @@
 module Layered
   module Resource
-    VERSION = "0.4.0"
+    VERSION = "0.6.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: layered-resource-rails
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.6.0
 platform: ruby
 authors:
 - layered.ai
@@ -13,44 +13,62 @@ dependencies:
   name: concurrent-ruby
   requirement: !ruby/object:Gem::Requirement
     requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: 1.3.8
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: 1.3.8
 - !ruby/object:Gem::Dependency
   name: layered-ui-rails
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.27'
+        version: '0.28'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.28.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.27'
+        version: '0.28'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.28.1
 - !ruby/object:Gem::Dependency
   name: pagy
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '43.2'
+        version: '43.8'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 43.8.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '43.2'
+        version: '43.8'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 43.8.1
 - !ruby/object:Gem::Dependency
   name: rails
   requirement: !ruby/object:Gem::Requirement
@@ -71,14 +89,20 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '4.0'
+        version: '4.4'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 4.4.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '4.0'
+        version: '4.4'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 4.4.4
 - !ruby/object:Gem::Dependency
   name: devise
   requirement: !ruby/object:Gem::Requirement
@@ -86,6 +110,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '5.0'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 5.0.4
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -93,90 +120,129 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '5.0'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 5.0.4
 - !ruby/object:Gem::Dependency
   name: importmap-rails
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '2.2'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.2.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '2.2'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.2.3
 - !ruby/object:Gem::Dependency
   name: propshaft
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '1.3'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.3.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '1.3'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.3.2
 - !ruby/object:Gem::Dependency
   name: pundit
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.4'
+        version: '2.5'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.5.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.4'
+        version: '2.5'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.5.2
 - !ruby/object:Gem::Dependency
   name: puma
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '7.0'
+        version: '7.2'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 7.2.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '7.0'
+        version: '7.2'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 7.2.1
 - !ruby/object:Gem::Dependency
   name: sqlite3
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '2.10'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.10.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '2.10'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.10.2
 - !ruby/object:Gem::Dependency
   name: stimulus-rails
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '1.3'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.3.4
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '1.3'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.3.4
 - !ruby/object:Gem::Dependency
   name: turbo-rails
   requirement: !ruby/object:Gem::Requirement
@@ -184,6 +250,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.0'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.0.23
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -191,6 +260,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.0'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.0.23
 description: A convention-over-configuration CRUD engine for Rails 8+, built on the
   layered-ui-rails gem. Declare a resource class, mount it in routes.rb, and get index,
   new/create, edit/update, and destroy actions with clean default views, Ransack-powered
@@ -225,6 +297,7 @@ files:
 - app/views/layered/resource/columns/_text.html.erb
 - app/views/layered/resource/resources/_filter_control.html.erb
 - app/views/layered/resource/resources/_filters.html.erb
+- app/views/layered/resource/resources/_row_actions.html.erb
 - app/views/layered/resource/resources/_search.html.erb
 - app/views/layered/resource/resources/edit.html.erb
 - app/views/layered/resource/resources/index.html.erb