mongoid 7.6.2 → 8.0.1

data/lib/mongoid/criteria/queryable/selectable.rb

@@ -227,19 +227,6 @@ module Mongoid
           __merge__(criterion)
         end
 
-        # Alias for +geo_spatial+.
-        #
-        # @deprecated
-        def geo_spacial(criterion)
-          # Duplicate method body so that we can raise this exception with
-          # geo_spacial as the indicated operator rather than geo_spatial.
-          if criterion.nil?
-            raise Errors::CriteriaArgumentRequired, :geo_spacial
-          end
-
-          __merge__(criterion)
-        end
-
         key :intersects_line, :override, "$geoIntersects", "$geometry" do |value|
           { "type" => LINE_STRING, "coordinates" => value }
         end
@@ -679,16 +666,7 @@ module Mongoid
                 end]
               end
             end
-            # Should be able to do:
-            #where('$or' => exprs)
-            # But since that is broken do instead:
-            clone.tap do |query|
-              if query.selector['$or']
-                query.selector.store('$or', query.selector['$or'] + exprs)
-              else
-                query.selector.store('$or', exprs)
-              end
-            end
+            self.and('$or' => exprs)
           end
         end
 
@@ -813,12 +791,6 @@ module Mongoid
             # only ever specify one criterion to #where.
             @criterion = criterion
             if criterion.is_a?(String)
-              unless Mongoid.allow_unsafe_query_operators?
-                raise Errors::InvalidQuery,
-                      "String criteria are not allowed because they compile to the '$where' operator, " \
-                      'which is not allowed in a query expression. Set Mongoid.allow_unsafe_query_operators = true ' \
-                      'to permit all operators.'
-              end
               js_query(criterion)
             else
               expr_query(criterion)
@@ -828,19 +800,6 @@ module Mongoid
 
         private
 
-        # Operators permitted at the top level of a query expression without
-        # opt-in. Excludes $where (JS execution) and other operators not needed
-        # for ordinary application queries.
-        ALLOWED_QUERY_OPERATORS = %w[
-          $and $or $nor $not $text $comment $expr $jsonSchema $alwaysFalse $alwaysTrue
-        ].freeze
-
-        # Operators that execute server-side JavaScript. These are rejected at
-        # any depth, not just at the top level: the allowlist above permits
-        # $expr and the logical operators, and their values are arbitrary
-        # nested expressions that can carry $function or $where.
-        JAVASCRIPT_QUERY_OPERATORS = %w[$where $function $accumulator].freeze
-
         # Adds the specified expression to the query.
         #
         # Criterion must be a hash in one of the following forms:
@@ -866,8 +825,6 @@ module Mongoid
             raise Errors::InvalidQuery, "Expression must be a Hash: #{Errors::InvalidQuery.truncate_expr(criterion)}"
           end
 
-          # The operator guard is applied by _mongoid_expand_keys, which every
-          # query method that accepts a user-supplied expression passes through.
           normalized = _mongoid_expand_keys(criterion)
           clone.tap do |query|
             normalized.each do |field, value|
@@ -883,94 +840,6 @@ module Mongoid
           end
         end
 
-        # Enforces the operator rules governed by the
-        # +allow_unsafe_query_operators+ configuration option against a
-        # normalized query expression.
-        #
-        # Two rules apply, and both are skipped when the option is true:
-        #
-        # - An operator at the top level of the expression must appear in
-        #   ALLOWED_QUERY_OPERATORS.
-        # - An operator in JAVASCRIPT_QUERY_OPERATORS is rejected at any depth.
-        #
-        # This is called from #_mongoid_expand_keys rather than from the
-        # individual query methods, because that is the one point every query
-        # method taking a user-supplied expression passes through on its way to
-        # the selector.
-        #
-        # It deliberately does not cover the APIs that ask for JavaScript
-        # outright, such as #js_query and Criteria#for_js: there the developer
-        # has chosen server-side JavaScript, so there is nothing to guard
-        # against. The same goes for the low-level Storable methods
-        # (#add_field_expression, #add_operator_expression), which write to the
-        # selector directly.
-        #
-        # @param [ Hash ] expr A normalized query expression.
-        #
-        # @raise [ Errors::InvalidQuery ] If a disallowed operator is present.
-        #
-        # @api private
-        def _mongoid_validate_operators!(expr)
-          return if Mongoid.allow_unsafe_query_operators?
-
-          expr.each_key do |field|
-            field_s = field.to_s
-            next unless field_s.start_with?('$')
-            next if ALLOWED_QUERY_OPERATORS.include?(field_s)
-
-            raise Errors::InvalidQuery,
-                  "Operator '#{field_s}' is not allowed in a query expression. " \
-                  'Set Mongoid.allow_unsafe_query_operators = true to permit all operators.'
-          end
-
-          _mongoid_validate_no_javascript!(expr)
-        end
-
-        # Walks a query expression looking for operators that execute
-        # server-side JavaScript, descending through both hashes and arrays so
-        # that nested forms such as {'$expr' => {'$function' => ...}} and
-        # {'$or' => [ {'$where' => ...} ]} are caught.
-        #
-        # The walk does not distinguish operator position from value position,
-        # so it also rejects queries where a JavaScript operator name appears as
-        # data rather than as an operator. Server 5.0+ permits $-prefixed field
-        # names in stored documents, which makes this reachable:
-        #
-        #   Doc.where(payload: { '$eq' => { '$function' => 'abc' } })
-        #
-        # Here the $eq marks its argument as a literal value to compare, so the
-        # server never evaluates it, but the guard raises anyway. The only
-        # workaround today is the global allow_unsafe_query_operators flag.
-        #
-        # TODO: discuss whether to track operator position (skipping the subtree
-        # under $eq, $ne, $in, $nin, and $elemMatch values) in a future
-        # iteration. It removes the false positive but adds exactly the kind of
-        # state that a real bypass could hide in, so it was left out for now.
-        #
-        # @param [ Object ] object A fragment of a query expression.
-        #
-        # @raise [ Errors::InvalidQuery ] If a JavaScript operator is present.
-        #
-        # @api private
-        def _mongoid_validate_no_javascript!(object)
-          case object
-          when Hash
-            object.each do |key, value|
-              key_s = key.to_s
-              if JAVASCRIPT_QUERY_OPERATORS.include?(key_s)
-                raise Errors::InvalidQuery,
-                      "Operator '#{key_s}' executes server-side JavaScript and is not allowed " \
-                      'anywhere in a query expression. Set Mongoid.allow_unsafe_query_operators = true ' \
-                      'to permit all operators.'
-              end
-
-              _mongoid_validate_no_javascript!(value)
-            end
-          when Array
-            object.each { |value| _mongoid_validate_no_javascript!(value) }
-          end
-        end
-
         # Force the values of the criterion to be evolved.
         #
         # @api private
@@ -983,7 +852,7 @@ module Mongoid
         # @param [ Hash ] criterion The criterion.
         def typed_override(criterion, operator)
           if criterion
-            criterion.update_values do |value|
+            criterion.transform_values! do |value|
               yield(value)
             end
           end

data/lib/mongoid/criteria/queryable/selector.rb

@@ -20,7 +20,7 @@ module Mongoid
           other.each_pair do |key, value|
             if value.is_a?(Hash) && self[key.to_s].is_a?(Hash)
               value = self[key.to_s].merge(value) do |_key, old_val, new_val|
-                case _key.to_s
+                case _key
                 when '$in'
                   new_val & old_val
                 when '$nin'
@@ -53,8 +53,7 @@ module Mongoid
             store_name = name
             store_value = evolve_multi(value)
           else
-            store_name = localized_key(name, serializer)
-            store_value = evolve(serializer, value)
+            store_name, store_value = store_creds(name, serializer, value)
           end
           super(store_name, store_value)
         end
@@ -74,6 +73,24 @@ module Mongoid
 
         private
 
+        # Get the store name and store value. If the value is of type range,
+        # we need may need to change the store_name as well as the store_value,
+        # therefore, we cannot just use the evole method.
+        #
+        # @param [ String ] name The name of the field.
+        # @param [ Object ] serializer The optional serializer for the field.
+        # @param [ Object ] value The value to serialize.
+        #
+        # @return [ Array<String, String> ] The store name and store value.
+        def store_creds(name, serializer, value)
+          store_name = localized_key(name, serializer)
+          if Range === value
+            evolve_range(store_name, serializer, value)
+          else
+            [ store_name, evolve(serializer, value) ]
+          end
+        end
+
         # Evolves a multi-list selection, like an $and or $or criterion, and
         # performs the necessary serialization.
         #
@@ -103,11 +120,10 @@ module Mongoid
               # some reason, although per its documentation Smash supposedly
               # owns both.
               name, serializer = storage_pair(key)
-              final_key = localized_key(name, serializer)
               # This performs type conversions on the value and transformations
               # that depend on the type of the field that the value is stored
               # in, but not transformations that have to do with query shape.
-              evolved_value = evolve(serializer, value)
+              final_key, evolved_value = store_creds(name, serializer, value)
 
               # This builds a query shape around the value, when the query
               # involves complex keys. For example, {:foo.lt => 5} produces
@@ -139,6 +155,8 @@ module Mongoid
             evolve_hash(serializer, value)
           when Array
             evolve_array(serializer, value)
+          when Range
+            value.__evolve_range__(serializer: serializer)
           else
             (serializer || value.class).evolve(value)
           end
@@ -182,6 +200,73 @@ module Mongoid
           end
         end
 
+        # Evolve a single key selection with range values. This method traverses
+        # the association tree to build a query for the given value and
+        # serializer. There are three parts to the query here:
+        #
+        # (1) "klass.child.gchild" => {
+        #       "$elemMatch" => {
+        #     (2) "ggchild.field" => (3) { "$gte" => 6, "$lte" => 10 }
+        #       }
+        #     }
+        # (1) The first n fields are dotted together until the last
+        #     embeds_many or field of type array. In the above case, gchild
+        #     would be an embeds_many or Array, and ggchild would be an
+        #     embeds_one or a hash.
+        # (2) The last fields are used inside the $elemMatch. This one is
+        #     actually optional, and will be ignored if the last field is an
+        #     array or embeds_many. If the last field is an array (1), (2) and
+        #     (3) will look like:
+        #
+        #       "klass.child.gchild.ggchild.field" => {
+        #         { "$elemMatch" => { "$gte" => 6, "$lte" => 10 } }
+        #       }
+        #
+        # (3) This is calculated by:
+        #
+        #       value.__evolve_range__(serializer: serializer).
+        #
+        # @api private
+        #
+        # @param [ String ] key The to store the range for.
+        # @param [ Object ] serializer The optional serializer for the field.
+        # @param [ Range ] value The Range to serialize.
+        #
+        # @return [ Array<String, Hash> ] The store name and serialized Range.
+        def evolve_range(key, serializer, value)
+          v = value.__evolve_range__(serializer: serializer)
+          assocs = []
+          Fields.traverse_association_tree(key, serializers, associations, aliased_associations) do |meth, obj, is_field|
+            assocs.push([meth, obj, is_field])
+          end
+
+          # Iterate backwards until you get a field with type
+          # Array or an embeds_many association.
+          inner_key = ""
+          loop do
+            # If there are no arrays or embeds_many associations, just return
+            # the key and value without $elemMatch.
+            return [ key, v ] if assocs.empty?
+
+            meth, obj, is_field = assocs.last
+            break if (is_field && obj.type == Array) || (!is_field && obj.is_a?(Association::Embedded::EmbedsMany))
+
+            assocs.pop
+            inner_key = "#{meth}.#{inner_key}"
+          end
+
+          # If the last array or embeds_many association is the last field,
+          # the inner key (2) is ignored, and the outer key (1) is the original
+          # key.
+          if inner_key.blank?
+            [ key, { "$elemMatch" => v }]
+          else
+            store_key = assocs.map(&:first).join('.')
+            store_value = { "$elemMatch" => { inner_key.chop => v } }
+            [ store_key,  store_value ]
+          end
+        end
+
         # Determines if the selection is a multi-select, like an $and or $or or $nor
         # selection.
         #

data/lib/mongoid/criteria/queryable/smash.rb

@@ -8,8 +8,16 @@ module Mongoid
       class Smash < Hash
 
         # @attribute [r] aliases The aliases.
+        attr_reader :aliases
+
         # @attribute [r] serializers The serializers.
-        attr_reader :aliases, :serializers
+        attr_reader :serializers
+
+        # @attribute [r] associations The associations.
+        attr_reader :associations
+
+        # @attribute [r] aliased_associations The aliased_associations.
+        attr_reader :aliased_associations
 
         # Perform a deep copy of the smash.
         #
@@ -18,7 +26,7 @@ module Mongoid
         #
         # @return [ Smash ] The copied hash.
         def __deep_copy__
-          self.class.new(aliases, serializers) do |copy|
+          self.class.new(aliases, serializers, associations, aliased_associations) do |copy|
             each_pair do |key, value|
               copy.store(key, value.__deep_copy__)
             end
@@ -36,8 +44,15 @@ module Mongoid
         #   responsible for serializing values. The keys of the hash must be
         #   strings that match the field name, and the values must respond to
         #   #localized? and #evolve(object).
-        def initialize(aliases = {}, serializers = {})
-          @aliases, @serializers = aliases, serializers
+        # @param [ Hash ] associations An optional hash of names to association
+        #   objects.
+        # @param [ Hash ] aliased_associations An optional hash of mappings from
+        #   aliases for associations to their actual field names in the database.
+        def initialize(aliases = {}, serializers = {}, associations = {}, aliased_associations = {})
+          @aliases = aliases
+          @serializers = serializers
+          @associations = associations
+          @aliased_associations = aliased_associations
           yield(self) if block_given?
         end
 
@@ -86,8 +101,26 @@ module Mongoid
         #   serializer.
         def storage_pair(key)
           field = key.to_s
-          name = aliases[field] || field
-          [ name, serializers[name] ]
+          name = Fields.database_field_name(field, associations, aliases, aliased_associations)
+          [ name, get_serializer(name) ]
+        end
+
+        private
+
+        # Retrieves the serializer for the given name. If the name exists in
+        # the serializers hash then return that immediately, otherwise
+        # recursively look through the associations and find the appropriate
+        # field.
+        #
+        # @param [ String ] name The name of the db field.
+        #
+        # @return [ Object ] The serializer.
+        def get_serializer(name)
+          if s = serializers[name]
+            s
+          else
+            Fields.traverse_association_tree(name, serializers, associations, aliased_associations)
+          end
         end
       end
     end

data/lib/mongoid/criteria/queryable/storable.rb

@@ -47,7 +47,7 @@ module Mongoid
             if value.is_a?(Hash) && selector[field].is_a?(Hash) &&
               value.keys.all? { |key|
                 key_s = key.to_s
-                key_s.start_with?('$') && !selector[field].keys.map(&:to_s).include?(key_s)
+                key_s.start_with?('$') && !selector[field].key?(key_s)
               }
             then
               # Multiple operators can be combined on the same field by

data/lib/mongoid/criteria/queryable.rb

@@ -33,9 +33,10 @@ module Mongoid
       include Optional
 
       # @attribute [r] aliases The aliases.
-      # @attribute [r] driver The Mongo driver being used.
+      attr_reader :aliases
+
       # @attribute [r] serializers The serializers.
-      attr_reader :aliases, :driver, :serializers
+      attr_reader :serializers
 
       # Is this queryable equal to another object? Is true if the selector and
       # options are equal.
@@ -59,11 +60,15 @@ module Mongoid
       #
       # @param [ Hash ] aliases The optional field aliases.
       # @param [ Hash ] serializers The optional field serializers.
+      # @param [ Hash ] associations The optional associations.
+      # @param [ Hash ] aliased_associations The optional aliased associations.
       # @param [ Symbol ] driver The driver being used.
-      def initialize(aliases = {}, serializers = {}, driver = :mongo)
-        @aliases, @driver, @serializers = aliases, driver.to_sym, serializers
-        @options = Options.new(aliases, serializers)
-        @selector = Selector.new(aliases, serializers)
+      #
+      # @api private
+      def initialize(aliases = {}, serializers = {}, associations = {}, aliased_associations = {})
+        @aliases, @serializers = aliases, serializers
+        @options = Options.new(aliases, serializers, associations, aliased_associations)
+        @selector = Selector.new(aliases, serializers, associations, aliased_associations)
         @pipeline = Pipeline.new(aliases)
         @aggregating = nil
         yield(self) if block_given?

data/lib/mongoid/criteria.rb

@@ -112,33 +112,6 @@ module Mongoid
       entries.as_json(options)
     end
 
-    # Tells the criteria that the cursor that gets returned needs to be
-    # cached. This is so multiple iterations don't hit the database multiple
-    # times, however this is not advisable when working with large data sets
-    # as the entire results will get stored in memory.
-    #
-    # @example Flag the criteria as cached.
-    #   criteria.cache
-    #
-    # @return [ Criteria ] The cloned criteria.
-    def cache
-      Mongoid::Warnings.warn_criteria_cache_deprecated
-      crit = clone
-      crit.options.merge!(cache: true)
-      crit
-    end
-
-    # Will return true if the cache option has been set.
-    #
-    # @example Is the criteria cached?
-    #   criteria.cached?
-    #
-    # @return [ true, false ] If the criteria is flagged as cached.
-    def cached?
-      Mongoid::Warnings.warn_criteria_cache_deprecated
-      options[:cache] == true
-    end
-
     # Get the documents from the embedded criteria.
     #
     # @example Get the documents.
@@ -232,7 +205,7 @@ module Mongoid
       @klass = klass
       @embedded = nil
       @none = nil
-      klass ? super(klass.aliased_fields, klass.fields) : super({}, {})
+      klass ? super(klass.aliased_fields, klass.fields, klass.relations, klass.aliased_associations) : super({}, {}, {}, {})
     end
 
     # Merges another object with this +Criteria+ and returns a new criteria.

data/lib/mongoid/deprecable.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+require "mongoid/deprecation"
+
+module Mongoid
+
+  # Adds ability to declare Mongoid-specific deprecations.
+  #
+  # @api private
+  module Deprecable
+
+    # Declares method(s) as deprecated.
+    #
+    # @example Deprecate a method.
+    #   Mongoid.deprecate(Cat, :meow); Cat.new.meow
+    #   #=> Mongoid.logger.warn("meow is deprecated and will be removed from Mongoid 8.0")
+    #
+    # @example Deprecate a method and declare the replacement method.
+    #   Mongoid.deprecate(Cat, meow: :speak); Cat.new.meow
+    #   #=> Mongoid.logger.warn("meow is deprecated and will be removed from Mongoid 8.0 (use speak instead)")
+    #
+    # @example Deprecate a method and give replacement instructions.
+    #   Mongoid.deprecate(Cat, meow: 'eat :catnip instead'); Cat.new.meow
+    #   #=> Mongoid.logger.warn("meow is deprecated and will be removed from Mongoid 8.0 (eat :catnip instead)")
+    #
+    # @param [ Module ] target_module The parent which contains the method.
+    # @param [ Symbol | Hash<Symbol, [Symbol|String]> ] method_descriptors
+    #   The methods to deprecate, with optional replacement instructions.
+    def deprecate(target_module, *method_descriptors)
+      Mongoid::Deprecation.deprecate_methods(target_module, *method_descriptors)
+    end
+  end
+end
+
+# Ensure Mongoid.deprecate can be used during initialization
+Mongoid.extend(Mongoid::Deprecable)

data/lib/mongoid/deprecation.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module Mongoid
+
+  # Utility class for logging deprecation warnings.
+  class Deprecation < ::ActiveSupport::Deprecation
+
+    @gem_name = 'Mongoid'
+
+    # Per change policy, deprecations will be removed in the next major version.
+    @deprecation_horizon = "#{Mongoid::VERSION.split('.').first.to_i + 1}.0".freeze
+
+    # Overrides default ActiveSupport::Deprecation behavior
+    # to use Mongoid's logger.
+    #
+    # @return Array<Proc> The deprecation behavior.
+    def behavior
+      @behavior ||= Array(->(message, callstack, _deprecation_horizon, _gem_name) {
+        logger = Mongoid.logger
+        logger.warn(message)
+        logger.debug(callstack.join("\n  ")) if debug
+      })
+    end
+  end
+end