madmin 3.4.0 → 3.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1cc585ef796e1b69307c5d7c7de6d439a863560598c48a66c3cbba7adeb9d112
-  data.tar.gz: 13dd04b5044f612acb2b86369cd21d21b4806a358cd7b15e6f79721cb2a24514
+  metadata.gz: bd82191abecdc838bfce22f4ce0ee425c76bb90e4b2d7dbc84c9ef67300e87ad
+  data.tar.gz: 021edea5d8d473665fc7e7a8d4f7329fbf538d80bc7dbb8ba3ea501d63522888
 SHA512:
-  metadata.gz: 66f3e4e692af87ef13f6561cffae41903789cc51b31f6355e4e4f9c322896679987133531b3bfc13f16e3a4f02ca01b6ec56cf752ba8bbb0abaae474fefdb6a6
-  data.tar.gz: 6967d527507a21b521237f5c5810810069708fd637538b04602415f37aad157f408300fdc57d571e48c87be4058d00c839fb58decc9de6daa6170d2285429356
+  metadata.gz: aca73d8097279751ad80464a78b5622a0e561b0d0c092f3ad87ef1fc76aa14d00b77585e037777b2a822d756551c893045856d7140a50f388e659b9f2d6ef4b1
+  data.tar.gz: b2f109c4bdae4bdb28f69b84bf2881bebbbcaf70ebe33ee3b4142b280ae83df81fc3c22e0bbb3b3788d80b7c00c308bcd00b0bf38895c85bd7658cf6b16c3580

data/README.md

@@ -73,7 +73,7 @@ class AuditLogResource < Madmin::Resource
 end
 ```
 
-The new, edit, and delete links are hidden for read-only resources, and any write actions redirect back to the index.
+The new, edit, and delete links are hidden for read-only resources, and any write actions redirect back to the referring page. An attachment belongs to its record, so writes to it are refused when either resource is read-only.
 
 ### Large Tables
 

data/app/controllers/madmin/resource_controller.rb

@@ -147,7 +147,9 @@ module Madmin
     helper_method :filters
 
     def enforce_readonly
-      redirect_to resource.index_path, alert: t("madmin.flash.readonly", name: resource.friendly_name) if resource.readonly?
+      if resource.readonly_for?(@record)
+        redirect_back_or_to resource.index_path, alert: t("madmin.flash.readonly", name: resource.friendly_name), status: :see_other
+      end
     end
 
     ActiveSupport.run_load_hooks(:madmin_resource_controller, self)

data/app/views/madmin/fields/attachment/_index.html.erb

@@ -1,7 +1,7 @@
-<% if (attachment = field.value(record)) && attachment.attached? %>
-  <% if attachment.variable? %>
-    <%= image_tag main_app.url_for(attachment), class: "max-h-8" %>
+<% if (attached = field.value(record)) && attached.attached? %>
+  <% if attached.variable? %>
+    <%= image_tag main_app.url_for(attached), class: "max-h-8" %>
   <% else %>
-    <%= attachment.filename %>
+    <%= attached.filename %>
   <% end %>
 <% end %>

data/app/views/madmin/fields/attachment/_show.html.erb

@@ -1,11 +1,11 @@
-<% if (attachment = field.value(record)) && attachment.attached? %>
-  <% if attachment.variable? %>
-    <%= image_tag main_app.url_for(attachment), class: "max-h-32" %>
+<% if (attached = field.value(record)) && attached.attached? %>
+  <% if attached.variable? %>
+    <%= image_tag main_app.url_for(attached), class: "max-h-32" %>
   <% else %>
-    <%= link_to attachment.filename, main_app.url_for(attachment), target: :_blank, class: "text-blue-500 underline" %>
+    <%= link_to attached.filename, main_app.url_for(attached), target: :_blank, class: "text-blue-500 underline" %>
   <% end %>
 
-  <% if (remove_path = field.remove_path(attachment)) %>
-    <%= link_to t("madmin.actions.remove"), remove_path, data: { turbo_method: :delete, turbo_confirm: t("madmin.confirmations.remove_with_changes", name: attachment.filename.to_s) } %>
+  <% if (remove_path = field.remove_path(attached)) %>
+    <%= link_to t("madmin.actions.remove"), remove_path, data: { turbo_method: :delete, turbo_confirm: t("madmin.confirmations.remove_with_changes", name: attached.filename.to_s) } %>
   <% end %>
 <% end %>

data/lib/madmin/fields/attachment.rb

@@ -3,11 +3,13 @@
 module Madmin
   module Fields
     class Attachment < Field
-      # Path for removing the attachment, or nil when the attachment resource
-      # or its destroy route has been removed from the app
-      def remove_path(attachment)
-        resource = Madmin.resource_for(attachment)
-        resource.show_path(attachment) if resource.route?(:destroy)
+      # Path for removing the attachment, or nil when it can't be removed
+      def remove_path(attached)
+        attachment_resource = Madmin.resource_for(attached)
+
+        if attachment_resource.route?(:destroy) && !attachment_resource.readonly_for?(attached.attachment)
+          attachment_resource.show_path(attached)
+        end
       rescue MissingResource
       end
     end

data/lib/madmin/resource.rb

@@ -169,6 +169,13 @@ module Madmin
         false
       end
 
+      # Whether a write to `record` through this resource is refused. Attachments
+      # defer to the resource of the record they belong to, and that check lives
+      # here because ActiveStorage::AttachmentResource is generated into the host app
+      def readonly_for?(record)
+        readonly? || (record.is_a?(::ActiveStorage::Attachment) && Madmin.resource_for(record.record).readonly?)
+      end
+
       # Override to return true for tables too large to count. Index and has many
       # pages then page with Previous and Next links and no page numbers or total
       def countless?
@@ -271,29 +278,30 @@ module Madmin
         }[type]
       end
 
+      # Plain ActiveModel classes have no columns or associations to ask, so their unknown attributes default to a String field
       def infer_type(name)
         name_string = name.to_s
 
-        if model.attribute_types.include?(name_string)
-          column_type = model.attribute_types[name_string]
+        if model_attribute_types.include?(name_string)
+          column_type = model_attribute_types[name_string]
           if column_type.is_a? ::ActiveRecord::Enum::EnumType
             :enum
-          elsif model.columns_hash[name_string].try(:array?)
+          elsif model_column(name_string).try(:array?)
             :array
           else
             column_type.type || :string
           end
-        elsif (association = model.reflect_on_association(name))
+        elsif (association = model.try(:reflect_on_association, name))
           type_for_association(association)
-        elsif model.reflect_on_association(:"rich_text_#{name_string}")
+        elsif model.try(:reflect_on_association, :"rich_text_#{name_string}")
           :rich_text
-        elsif model.reflect_on_association(:"#{name_string}_attachment")
+        elsif model.try(:reflect_on_association, :"#{name_string}_attachment")
           :attachment
-        elsif model.reflect_on_association(:"#{name_string}_attachments")
+        elsif model.try(:reflect_on_association, :"#{name_string}_attachments")
           :attachments
 
         # has_secure_password
-        elsif model.attribute_types.include?("#{name_string}_digest") || name_string.ends_with?("_confirmation")
+        elsif model_attribute_types.include?("#{name_string}_digest") || name_string.ends_with?("_confirmation")
           :password
 
           # ActiveRecord Store
@@ -370,6 +378,14 @@ module Madmin
 
       private
 
+      def model_attribute_types
+        model.try(:attribute_types) || {}
+      end
+
+      def model_column(name)
+        model.columns_hash[name] if model.respond_to?(:columns_hash)
+      end
+
       def translated_name(count: 1)
         model.model_name.human(count: count, default: "").presence
       end

data/lib/madmin/search.rb

@@ -13,7 +13,10 @@ module Madmin
       @filters = filters
     end
 
+    # Search and filters are SQL, so collections without a table pass through for `scoped_resources` to search
     def run
+      return @scoped_resource unless @scoped_resource.respond_to?(:table_name)
+
       results = query.blank? ? @scoped_resource.all : search_results(@scoped_resource)
       filters.reduce(results) { |scope, filter| filter.apply(scope) }
     end

data/lib/madmin/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Madmin
-  VERSION = "3.4.0"
+  VERSION = "3.4.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: madmin
 version: !ruby/object:Gem::Version
-  version: 3.4.0
+  version: 3.4.1
 platform: ruby
 authors:
 - Chris Oliver