mongoid 7.6.1 → 7.6.2

data/spec/mongoid/attributes/nested_spec.rb

@@ -4,6 +4,33 @@ require "spec_helper"
 
 describe Mongoid::Attributes::Nested do
 
+  # Expects the enclosing context to define `build_with_id`, taking an id
+  # value and returning the document built with it in nested attributes.
+  shared_examples 'rejects non-scalar ids' do |klass_name|
+    not_found = /not found for class #{klass_name}/
+
+    context 'when the id is an operator hash' do
+      it 'raises a document not found error' do
+        expect { build_with_id({ '$ne' => nil }) }
+          .to raise_error(Mongoid::Errors::DocumentNotFound, not_found)
+      end
+    end
+
+    context 'when the id is an array' do
+      it 'raises a document not found error' do
+        expect { build_with_id([BSON::ObjectId.new]) }
+          .to raise_error(Mongoid::Errors::DocumentNotFound, not_found)
+      end
+    end
+
+    context 'when the id is a malformed object id hash' do
+      it 'raises a document not found error' do
+        expect { build_with_id({ '$oid' => 'junk' }) }
+          .to raise_error(Mongoid::Errors::DocumentNotFound, not_found)
+      end
+    end
+  end
+
   describe ".accepts_nested_attributes_for" do
 
     context "when the autosave option is not defined" do
@@ -175,6 +202,30 @@ describe Mongoid::Attributes::Nested do
       end
     end
 
+    context 'when the id in the attributes is not a scalar' do
+      let(:person) { Person.create! }
+
+      def build_with_id(id)
+        person.update!(posts_attributes: { '0' => { id: id, title: 'Crafted' } })
+      end
+
+      context 'when the association is empty' do
+        include_examples 'rejects non-scalar ids', 'Post'
+      end
+
+      context 'when the association is not empty' do
+        before { person.posts.create!(title: 'Existing') }
+
+        include_examples 'rejects non-scalar ids', 'Post'
+      end
+
+      context 'when allow_reparenting_via_nested_attributes is true' do
+        config_override :allow_reparenting_via_nested_attributes, true
+
+        include_examples 'rejects non-scalar ids', 'Post'
+      end
+    end
+
     context "when the relation is a references and referenced in many" do
 
       before do
@@ -198,16 +249,100 @@ describe Mongoid::Attributes::Nested do
           )
         end
 
-        it "sets the nested attributes" do
-          expect(person.preferences.map(&:name)).to eq([preference.name])
+        context 'when allow_reparenting_via_nested_attributes is false' do
+          config_override :allow_reparenting_via_nested_attributes, false
+
+          it 'raises a document not found error' do
+            expect { person }.to raise_error(Mongoid::Errors::DocumentNotFound,
+                                             /Document\(s\) not found for class Preference/)
+          end
         end
 
-        it "updates attributes of existing document which is added to relation" do
-          preference_name = 'updated preference'
-          person = Person.new(
-            preferences_attributes: { 0 => { id: preference.id, name: preference_name } }
-          )
-          expect(person.preferences.map(&:name)).to eq([preference_name])
+        context 'when allow_reparenting_via_nested_attributes is true' do
+          config_override :allow_reparenting_via_nested_attributes, true
+
+          it 'sets the nested attributes' do
+            expect(person.preferences.map(&:name)).to eq([preference.name])
+          end
+
+          it 'updates attributes of existing document which is added to relation' do
+            preference_name = 'updated preference'
+            person = Person.new(
+              preferences_attributes: { 0 => { id: preference.id, name: preference_name } }
+            )
+            expect(person.preferences.map(&:name)).to eq([preference_name])
+          end
+
+          context 'when the id does not correspond to an existing document' do
+            let(:person) do
+              Person.new(
+                preferences_attributes: { 0 => { id: BSON::ObjectId.new, name: 'Ghost' } }
+              )
+            end
+
+            context 'when raise_not_found_error is true' do
+              config_override :raise_not_found_error, true
+
+              it 'raises a document not found error' do
+                expect { person }.to raise_error(Mongoid::Errors::DocumentNotFound,
+                                                 /Document\(s\) not found for class Preference/)
+              end
+            end
+
+            context 'when raise_not_found_error is false' do
+              config_override :raise_not_found_error, false
+
+              it 'raises a document not found error' do
+                expect { person }.to raise_error(Mongoid::Errors::DocumentNotFound,
+                                                 /Document\(s\) not found for class Preference/)
+              end
+            end
+          end
+        end
+
+        context 'when _destroy is true for a document not in the relation' do
+          before do
+            Person.send(:undef_method, :preferences_attributes=)
+            Person.accepts_nested_attributes_for :preferences, allow_destroy: true
+          end
+
+          let(:person) do
+            Person.new(
+              preferences_attributes: { 0 => { id: preference.id, _destroy: '1' } }
+            )
+          end
+
+          it 'does not raise UnknownAttribute' do
+            expect { person }.not_to raise_error
+          end
+
+          it 'does not add the document to the relation' do
+            expect(person.preferences).to be_empty
+          end
+        end
+      end
+
+      context 'when the id in the attributes is not a scalar' do
+        let(:target) { Person.create! }
+
+        def build_with_id(id)
+          target.update!(preferences_attributes: { 0 => { id: id, name: 'Crafted' } })
+        end
+
+        context 'when the association is empty' do
+          include_examples 'rejects non-scalar ids', 'Preference'
+        end
+
+        context 'when the association is not empty' do
+          before { target.preferences.create!(name: 'Existing') }
+
+          include_examples 'rejects non-scalar ids', 'Preference'
+        end
+
+        context 'when allow_reparenting_via_nested_attributes is true' do
+          config_override :allow_reparenting_via_nested_attributes, true
+
+          include_examples 'rejects non-scalar ids', 'Preference'
         end
       end
     end
@@ -4928,4 +5063,63 @@ describe Mongoid::Attributes::Nested do
       end
     end
   end
+
+  context 'when an id in nested attributes belongs to another parent' do
+    let(:victim) { Person.create! }
+    let(:attacker) { Person.create! }
+
+    context 'when the association is a has-many' do
+      before do
+        Person.send(:undef_method, :posts_attributes=)
+        Person.accepts_nested_attributes_for :posts
+      end
+
+      let!(:victim_post) { victim.posts.create!(title: 'Private') }
+
+      it 'does not update the other parent\'s document' do
+        expect { attacker.update!(posts_attributes: { '0' => { id: victim_post.id, title: 'Overwritten' } }) }
+          .to raise_error(Mongoid::Errors::DocumentNotFound)
+        expect(victim_post.reload.title).to eq('Private')
+      end
+
+      it 'does not add the other parent\'s document to the association' do
+        expect { attacker.update!(posts_attributes: { '0' => { id: victim_post.id, title: 'Overwritten' } }) }
+          .to raise_error(Mongoid::Errors::DocumentNotFound)
+        expect(attacker.reload.posts).to be_empty
+      end
+
+      it 'does not update via a direct association assignment' do
+        expect { attacker.update!(posts: { '0' => { id: victim_post.id, title: 'Overwritten' } }) }
+          .to raise_error(Mongoid::Errors::DocumentNotFound)
+        expect(victim_post.reload.title).to eq('Private')
+      end
+    end
+
+    context 'when the association is a has-and-belongs-to-many' do
+      before do
+        Person.send(:undef_method, :preferences_attributes=)
+        Person.accepts_nested_attributes_for :preferences
+      end
+
+      let!(:victim_preference) { victim.preferences.create!(name: 'Private') }
+
+      it 'does not update the other parent\'s document' do
+        expect { attacker.update!(preferences_attributes: { '0' => { id: victim_preference.id, name: 'Overwritten' } }) }
+          .to raise_error(Mongoid::Errors::DocumentNotFound)
+        expect(victim_preference.reload.name).to eq('Private')
+      end
+
+      it 'does not add the other parent\'s document to the association' do
+        expect { attacker.update!(preferences_attributes: { '0' => { id: victim_preference.id, name: 'Overwritten' } }) }
+          .to raise_error(Mongoid::Errors::DocumentNotFound)
+        expect(attacker.reload.preferences).to be_empty
+      end
+
+      it 'does not update via a direct association assignment' do
+        expect { attacker.update!(preferences: { '0' => { id: victim_preference.id, name: 'Overwritten' } }) }
+          .to raise_error(Mongoid::Errors::DocumentNotFound)
+        expect(victim_preference.reload.name).to eq('Private')
+      end
+    end
+  end
 end

data/spec/mongoid/contextual/aggregable/memory_spec.rb

@@ -4,6 +4,10 @@ require "spec_helper"
 
 describe Mongoid::Contextual::Aggregable::Memory do
 
+  let(:context) do
+    Mongoid::Contextual::Memory.new(criteria)
+  end
+
   describe "#aggregates" do
     let(:context) do
       Mongoid::Contextual::Memory.new(criteria)
@@ -332,4 +336,98 @@ describe Mongoid::Contextual::Aggregable::Memory do
       end
     end
   end
+
+  context "when the field name is a method name" do
+
+    let!(:depeche) do
+      Band.create!(name: "Depeche Mode", likes: 1000)
+    end
+
+    let(:criteria) do
+      Band.all.tap do |crit|
+        crit.documents = [ depeche ]
+      end
+    end
+
+    it "does not call the method for sum" do
+      expect(depeche).not_to receive(:delete)
+      expect(context.sum(:delete)).to eq(0)
+    end
+
+    it "does not call the method for min" do
+      expect(depeche).not_to receive(:delete)
+      expect(context.min(:delete)).to be_nil
+    end
+
+    it "does not call the method for max" do
+      expect(depeche).not_to receive(:delete)
+      expect(context.max(:delete)).to be_nil
+    end
+
+    it "does not call the method for avg" do
+      expect(depeche).not_to receive(:delete)
+      expect(context.avg(:delete)).to eq(0.0)
+    end
+
+    it "does not call the method for aggregates" do
+      expect(depeche).not_to receive(:delete)
+      expect(context.aggregates(:delete))
+        .to eq("count" => 0, "avg" => 0.0, "max" => nil, "min" => nil, "sum" => 0)
+    end
+
+    it "does not call a private method for avg" do
+      expect(depeche).not_to receive(:exit)
+      expect(context.avg(:exit)).to eq(0.0)
+    end
+  end
+
+  context "when the field is not defined" do
+
+    let!(:depeche) do
+      Band.create!(name: "Depeche Mode", likes: 1000)
+    end
+
+    let(:criteria) do
+      Band.all.tap do |crit|
+        crit.documents = [ depeche ]
+      end
+    end
+
+    it "returns zero for sum" do
+      expect(context.sum(:not_a_field)).to eq(0)
+    end
+
+    it "returns nil for min" do
+      expect(context.min(:not_a_field)).to be_nil
+    end
+
+    it "returns nil for max" do
+      expect(context.max(:not_a_field)).to be_nil
+    end
+
+    it "returns zero for avg" do
+      expect(context.avg(:not_a_field)).to eq(0.0)
+    end
+  end
+
+  context "when the field is the foreign key of a many to many association" do
+
+    let!(:preference) do
+      Preference.create!(name: "nature")
+    end
+
+    let!(:person) do
+      Person.new(preferences: [ preference ])
+    end
+
+    let(:criteria) do
+      Person.all.tap do |crit|
+        crit.documents = [ person ]
+      end
+    end
+
+    it "aggregates the stored ids" do
+      expect(context.max(:preference_ids)).to eq([ preference.id ])
+    end
+  end
 end

data/spec/mongoid/contextual/memory_spec.rb

@@ -438,6 +438,32 @@ describe Mongoid::Contextual::Memory do
           }.to raise_exception(Mongoid::Errors::InMemoryCollationNotSupported)
         end
       end
+
+      context "when the field name is a method name" do
+
+        let!(:person) do
+          Person.create!(ssn: "secret-ssn")
+        end
+
+        let!(:address) do
+          person.addresses.create!(street: "hobrecht")
+        end
+
+        let(:criteria) do
+          Address.all.tap do |crit|
+            crit.documents = [ address ]
+          end
+        end
+
+        let(:context) do
+          described_class.new(criteria)
+        end
+
+        it "does not call the method" do
+          expect(address).not_to receive(:destroy)
+          expect(context.distinct(:destroy)).to eq([ nil ])
+        end
+      end
     end
 
     context "when legacy_pluck_distinct is false" do
@@ -632,6 +658,28 @@ describe Mongoid::Contextual::Memory do
           expect(context.distinct("label.sales")).to eq([ BigDecimal("1E2") ])
         end
       end
+
+      context "when the field name is a method name" do
+
+        let!(:person) do
+          Person.create!(ssn: "secret-ssn")
+        end
+
+        let!(:address) do
+          person.addresses.create!(street: "hobrecht")
+        end
+
+        let(:criteria) do
+          Address.all.tap do |crit|
+            crit.documents = [ address ]
+          end
+        end
+
+        it "does not call the method" do
+          expect(address).not_to receive(:destroy)
+          expect(context.distinct(:destroy)).to eq([ nil ])
+        end
+      end
     end
   end
 
@@ -1747,6 +1795,121 @@ describe Mongoid::Contextual::Memory do
           ])
         end
       end
+
+      context "when plucking a dynamic attribute" do
+
+        let(:criteria) do
+          Band.all.tap do |crit|
+            crit.documents = [ Band.create!(name: "Depeche Mode", mood: "dark") ]
+          end
+        end
+
+        it "returns the value from the attributes" do
+          expect(context.pluck(:mood)).to eq([ "dark" ])
+        end
+      end
+
+      context "when the field name is a method name" do
+
+        let!(:person) do
+          Person.create!(ssn: "secret-ssn")
+        end
+
+        let!(:address) do
+          person.addresses.create!(street: "hobrecht")
+        end
+
+        let(:criteria) do
+          Address.all.tap do |crit|
+            crit.documents = [ address ]
+          end
+        end
+
+        it "does not call the method" do
+          expect(address).not_to receive(:destroy)
+          expect(context.pluck(:destroy)).to eq([ nil ])
+        end
+
+        it "does not return the attributes hash" do
+          expect(context.pluck(:attributes)).to eq([ nil ])
+        end
+
+        it "does not traverse to the parent document" do
+          expect(context.pluck("_root.ssn")).to eq([ nil ])
+        end
+
+        it "does not destroy the parent document" do
+          expect(context.pluck("_root.destroy")).to eq([ nil ])
+          expect(Person.where(_id: person.id).count).to eq(1)
+        end
+      end
+
+      context "when plucking a belongs_to association" do
+
+        let!(:band) do
+          Band.create!(name: "Depeche Mode")
+        end
+
+        let!(:artist) do
+          Artist.create!(band: band)
+        end
+
+        let(:criteria) do
+          Artist.all.tap do |crit|
+            crit.documents = [ artist ]
+          end
+        end
+
+        it "traverses to the associated document" do
+          expect(context.pluck("band.name")).to eq([ "Depeche Mode" ])
+        end
+
+        it "returns the document for the association name" do
+          expect(context.pluck(:band)).to eq([ band ])
+        end
+
+        it "returns the id for the foreign key" do
+          expect(context.pluck(:band_id)).to eq([ band.id ])
+        end
+      end
+
+      context "when plucking the foreign key of a many to many association" do
+
+        let!(:preference) do
+          Preference.create!(name: "nature")
+        end
+
+        let!(:person) do
+          Person.create!(preferences: [ preference ])
+        end
+
+        let(:criteria) do
+          Person.all.tap do |crit|
+            crit.documents = [ person ]
+          end
+        end
+
+        it "returns the stored ids" do
+          expect(context.pluck(:preference_ids)).to eq([ [ preference.id ] ])
+        end
+      end
+
+      context "when the field path has an empty segment" do
+
+        let!(:band) do
+          Band.create!(name: "Depeche Mode", label: Label.new(name: "Mute"))
+        end
+
+        let(:criteria) do
+          Band.all.tap do |crit|
+            crit.documents = [ band ]
+          end
+        end
+
+        it "returns nil" do
+          expect(context.pluck("label..name")).to eq([ nil ])
+        end
+      end
     end
   end
 
@@ -1769,6 +1932,39 @@ describe Mongoid::Contextual::Memory do
     end
   end
 
+  describe "#tally" do
+
+    let(:context) do
+      described_class.new(criteria)
+    end
+
+    context "when the field name is a method name" do
+
+      let!(:person) do
+        Person.create!(ssn: "secret-ssn")
+      end
+
+      let!(:address) do
+        person.addresses.create!(street: "hobrecht")
+      end
+
+      let(:criteria) do
+        Address.all.tap do |crit|
+          crit.documents = [ address ]
+        end
+      end
+
+      it "does not call the method" do
+        expect(address).not_to receive(:destroy)
+        expect(context.tally(:destroy)).to eq(nil => 1)
+      end
+
+      it "does not disclose the parent document fields" do
+        expect(context.tally("_root.ssn")).to eq(nil => 1)
+      end
+    end
+  end
+
   describe "#skip" do
 
     let(:hobrecht) do

data/spec/mongoid/criteria/queryable/selectable_logical_spec.rb

@@ -1801,6 +1801,8 @@ describe Mongoid::Criteria::Queryable::Selectable do
       end
 
       context 'when the following criteria uses string were form' do
+        # String criteria compile to $where, which requires the opt-in.
+        config_override :allow_unsafe_query_operators, true
 
         let(:selection) do
           query.not.where('hello world')