mongoid 8.0.13 → 8.1.0

data/spec/mongoid/criteria/queryable/selectable_where_spec.rb

@@ -35,8 +35,6 @@ describe Mongoid::Criteria::Queryable::Selectable do
     it_behaves_like 'requires a non-nil argument'
 
     context "when provided a string" do
-      # String criteria compile to $where, which requires the opt-in.
-      config_override :allow_unsafe_query_operators, true
 
       let(:selection) do
         query.where("this.value = 10")
@@ -588,237 +586,4 @@ describe Mongoid::Criteria::Queryable::Selectable do
       end
     end
   end
-
-  describe 'top-level operator injection guard' do
-    context 'when allow_unsafe_query_operators is true' do
-      config_override :allow_unsafe_query_operators, true
-
-      context 'when passing $where' do
-        it 'does not raise' do
-          expect do
-            query.where('$where' => 'this.name == "admin"')
-          end.not_to raise_error
-        end
-      end
-
-      context 'when passing a string criterion' do
-        it 'does not raise' do
-          expect do
-            query.where('this.name == "admin"')
-          end.not_to raise_error
-        end
-      end
-
-      context 'when passing a string criterion to a negated query' do
-        it 'does not raise' do
-          expect do
-            query.not.where('this.name == "admin"')
-          end.not_to raise_error
-        end
-      end
-
-      context 'when passing $function' do
-        it 'does not raise' do
-          expect do
-            query.where('$function' => { body: 'function() { return true; }', args: [], lang: 'js' })
-          end.not_to raise_error
-        end
-      end
-    end
-
-    context 'when allow_unsafe_query_operators is false' do
-      config_override :allow_unsafe_query_operators, false
-
-      context 'when passing $where' do
-        it 'raises InvalidQuery' do
-          expect do
-            query.where('$where' => 'this.name == "admin"')
-          end.to raise_error(Mongoid::Errors::InvalidQuery, /\$where/)
-        end
-      end
-
-      context 'when passing $function' do
-        it 'raises InvalidQuery' do
-          expect do
-            query.where('$function' => { body: 'function() { return true; }', args: [], lang: 'js' })
-          end.to raise_error(Mongoid::Errors::InvalidQuery, /\$function/)
-        end
-      end
-
-      context 'when the error mentions allow_unsafe_query_operators' do
-        it 'includes the config opt-in in the message' do
-          expect do
-            query.where('$where' => 'true')
-          end.to raise_error(Mongoid::Errors::InvalidQuery, /allow_unsafe_query_operators/)
-        end
-      end
-
-      context 'when passing a string criterion' do
-        it 'raises InvalidQuery' do
-          expect do
-            query.where('this.name == "admin"')
-          end.to raise_error(Mongoid::Errors::InvalidQuery, /\$where/)
-        end
-
-        it 'includes the config opt-in in the message' do
-          expect do
-            query.where('this.name == "admin"')
-          end.to raise_error(Mongoid::Errors::InvalidQuery, /allow_unsafe_query_operators/)
-        end
-      end
-
-      context 'when passing a string criterion to a negated query' do
-        it 'raises InvalidQuery' do
-          expect do
-            query.not.where('this.name == "admin"')
-          end.to raise_error(Mongoid::Errors::InvalidQuery, /\$where/)
-        end
-      end
-
-      %w[$and $or $nor $not $text $comment $expr $jsonSchema $alwaysFalse $alwaysTrue].each do |op|
-        context "when passing #{op} (allowlisted)" do
-          it 'does not raise' do
-            value = case op
-                    when '$and', '$or', '$nor', '$not' then [ { 'x' => 1 } ]
-                    when '$text' then { '$search' => 'hi' }
-                    when '$expr' then { '$gt' => [ '$a', 1 ] }
-                    when '$jsonSchema' then { 'required' => [ 'x' ] }
-                    else true
-                    end
-            expect { query.where(op => value) }.not_to raise_error
-          end
-        end
-      end
-    end
-  end
-
-  describe 'nested operator injection guard' do
-    js = 'this.name == "admin"'
-
-    function_expr = {
-      '$function' => { 'body' => 'function() { return true; }', 'args' => [], 'lang' => 'js' }
-    }.freeze
-
-    accumulator_expr = {
-      '$accumulator' => {
-        'init' => 'function() { return 0; }',
-        'accumulate' => 'function() { return 0; }',
-        'accumulateArgs' => [],
-        'merge' => 'function() { return 0; }',
-        'lang' => 'js'
-      }
-    }.freeze
-
-    # Every path into the selector that does not route through #expr_query,
-    # plus the nested forms that a top-level key check cannot see.
-    unsafe_queries = {
-      'and with a $where key' => ->(query) { query.and('$where' => js) },
-      'or with a $where key' => ->(query) { query.or('$where' => js) },
-      'nor with a $where key' => ->(query) { query.nor('$where' => js) },
-      'not with a $where key' => ->(query) { query.not('$where' => js) },
-      'any_of with a $where key' => ->(query) { query.any_of('$where' => js) },
-      # none_of is not available on this branch; it landed in 8.1 via MONGOID-5453.
-      'elem_match with a nested $where' => ->(query) { query.elem_match(a: { '$where' => js }) },
-      'where with $where inside $or' => ->(query) { query.where('$or' => [ { '$where' => js } ]) },
-      'where with $function inside $expr' => ->(query) { query.where('$expr' => function_expr) },
-      'where with $accumulator inside $expr' => ->(query) { query.where('$expr' => accumulator_expr) },
-      'where with $where three levels deep' => lambda { |query|
-        query.where('$and' => [ { '$or' => [ { '$where' => js } ] } ])
-      },
-      'where with a symbol $where key inside $or' => ->(query) { query.where('$or' => [ { :$where => js } ]) }
-    }.freeze
-
-    context 'when allow_unsafe_query_operators is false' do
-      config_override :allow_unsafe_query_operators, false
-
-      unsafe_queries.each do |description, builder|
-        context "when querying with #{description}" do
-          it 'raises InvalidQuery' do
-            expect do
-              builder.call(query)
-            end.to raise_error(Mongoid::Errors::InvalidQuery, /\$where|\$function|\$accumulator/)
-          end
-        end
-      end
-
-      it 'includes the config opt-in in the message' do
-        expect do
-          query.or('$where' => js)
-        end.to raise_error(Mongoid::Errors::InvalidQuery, /allow_unsafe_query_operators/)
-      end
-
-      context 'when the nested expression is safe' do
-        it 'permits $or with field expressions' do
-          expect do
-            query.where('$or' => [ { 'a' => 1 }, { 'b' => { '$gt' => 2 } } ])
-          end.not_to raise_error
-        end
-
-        it 'permits $expr with aggregation operators' do
-          expect do
-            query.where('$expr' => { '$gt' => [ '$a', '$b' ] })
-          end.not_to raise_error
-        end
-
-        it 'permits a field whose name resembles a javascript operator' do
-          expect do
-            query.where('where' => js)
-          end.not_to raise_error
-        end
-
-        it 'permits a value that resembles a javascript operator' do
-          expect do
-            query.where('name' => '$where')
-          end.not_to raise_error
-        end
-      end
-    end
-
-    context 'when allow_unsafe_query_operators is true' do
-      config_override :allow_unsafe_query_operators, true
-
-      unsafe_queries.each do |description, builder|
-        context "when querying with #{description}" do
-          it 'does not raise' do
-            expect { builder.call(query) }.not_to raise_error
-          end
-        end
-      end
-    end
-  end
-
-  describe 'operator guard on chained override methods' do
-    # On this branch overwrite_chained_operators defaults to false, which
-    # routes elem_match through the guarded and_with_operator funnel. Force
-    # the override path so the guard in Mergeable#__override__ is exercised.
-    config_override :overwrite_chained_operators, true
-
-    let(:js) { 'this.name == "admin"' }
-
-    context 'when allow_unsafe_query_operators is false' do
-      config_override :allow_unsafe_query_operators, false
-
-      it 'rejects a $where nested in elem_match' do
-        expect do
-          query.elem_match(a: { '$where' => js })
-        end.to raise_error(Mongoid::Errors::InvalidQuery, /executes server-side JavaScript/)
-      end
-
-      it 'permits an ordinary elem_match value' do
-        expect do
-          query.elem_match(a: { name: 'x' })
-        end.not_to raise_error
-      end
-    end
-
-    context 'when allow_unsafe_query_operators is true' do
-      config_override :allow_unsafe_query_operators, true
-
-      it 'permits a $where nested in elem_match' do
-        expect do
-          query.elem_match(a: { '$where' => js })
-        end.not_to raise_error
-      end
-    end
-  end
 end

data/spec/mongoid/criteria/queryable/selector_spec.rb

@@ -44,7 +44,7 @@ describe Mongoid::Criteria::Queryable::Selector do
       end
     end
 
-    context "when selector contains a $nin string" do
+    context "when selector contains a $nin" do
 
       let(:initial) do
         { "$nin" => ["foo"] }
@@ -72,35 +72,7 @@ describe Mongoid::Criteria::Queryable::Selector do
       end
     end
 
-    context "when selector contains a $nin symbol" do
-
-      let(:initial) do
-        { :$nin => ["foo"] }
-      end
-
-      before do
-        selector["field"] = initial
-      end
-
-      context "when merging in a new $nin" do
-
-        let(:other) do
-          { "field" => { :$nin => ["bar"] } }
-        end
-
-        before do
-          selector.merge!(other)
-        end
-
-        it "combines the two $nin queries into one" do
-          expect(selector).to eq({
-            "field" => { :$nin => ["foo", "bar"] }
-          })
-        end
-      end
-    end
-
-    context "when selector contains a $in string" do
+    context "when selector contains a $in" do
 
       let(:initial) do
         { "$in" => [1, 2] }
@@ -145,51 +117,6 @@ describe Mongoid::Criteria::Queryable::Selector do
       end
     end
 
-    context "when selector contains a $in symbol" do
-
-      let(:initial) do
-        { :$in => [1, 2] }
-      end
-
-      before do
-        selector["field"] = initial
-      end
-
-      context "when merging in a new $in with an intersecting value" do
-
-        let(:other) do
-          { "field" => { :$in => [1] } }
-        end
-
-        before do
-          selector.merge!(other)
-        end
-
-        it "intersects the $in values" do
-          expect(selector).to eq({
-                                     "field" => { :$in => [1] }
-                                 })
-        end
-      end
-
-      context "when merging in a new $in with no intersecting values" do
-
-        let(:other) do
-          { "field" => { :$in => [3] } }
-        end
-
-        before do
-          selector.merge!(other)
-        end
-
-        it "intersects the $in values" do
-          expect(selector).to eq({
-                                     "field" => { :$in => [] }
-                                 })
-        end
-      end
-    end
-
     context "when selector is not nested" do
 
       before do
@@ -681,6 +608,7 @@ describe Mongoid::Criteria::Queryable::Selector do
         end
 
         context "when the serializer is localized" do
+          with_default_i18n_configs
 
           before(:all) do
             class Field
@@ -696,7 +624,6 @@ describe Mongoid::Criteria::Queryable::Selector do
 
           after(:all) do
             Object.send(:remove_const, :Field)
-            ::I18n.locale = :en
           end
 
           let(:selector) do

data/spec/mongoid/criteria/queryable/storable_spec.rb

@@ -210,79 +210,7 @@ describe Mongoid::Criteria::Queryable::Storable do
         }
       end
     end
-
-    context 'when value is a hash combine values with different operator keys' do
-      let(:base) do
-        query.add_field_expression('foo', {'$in' => ['bar']})
-      end
-
-      let(:modified) do
-        base.add_field_expression('foo', {'$nin' => ['zoom']})
-      end
-
-      it 'combines the conditions using $and' do
-        modified.selector.should == {
-          'foo' => {
-            '$in' => ['bar'],
-            '$nin' => ['zoom']
-          }
-        }
-      end
-    end
-
-    context 'when value is a hash with symbol operator key combine values with different operator keys' do
-      let(:base) do
-        query.add_field_expression('foo', {:$in => ['bar']})
-      end
-
-      let(:modified) do
-        base.add_field_expression('foo', {:$nin => ['zoom']})
-      end
-
-      it 'combines the conditions using $and' do
-        modified.selector.should == {
-          'foo' => {
-            :$in => ['bar'],
-            :$nin => ['zoom']
-          }
-        }
-      end
-    end
-
-    context 'when value is a hash add values with same operator keys using $and' do
-      let(:base) do
-        query.add_field_expression('foo', {'$in' => ['bar']})
-      end
-
-      let(:modified) do
-        base.add_field_expression('foo', {'$in' => ['zoom']})
-      end
-
-      it 'adds the new condition using $and' do
-        modified.selector.should == {
-          'foo' => {'$in' => ['bar']},
-          '$and' => ['foo' => {'$in' => ['zoom']}]
-        }
-      end
-    end
-
-  context 'when value is a hash with symbol operator key add values with same operator keys using $and' do
-    let(:base) do
-      query.add_field_expression('foo', {:$in => ['bar']})
-    end
-
-    let(:modified) do
-      base.add_field_expression('foo', {:$in => ['zoom']})
-    end
-
-    it 'adds the new condition using $and' do
-      modified.selector.should == {
-        'foo' => {:$in => ['bar']},
-        '$and' => ['foo' => {:$in => ['zoom']}]
-      }
-    end
   end
-end
 
   describe '#add_operator_expression' do
     let(:query_method) { :add_operator_expression }

data/spec/mongoid/criteria_projection_spec.rb

@@ -154,6 +154,7 @@ describe Mongoid::Criteria do
     end
 
     context 'when the field is localized' do
+      with_default_i18n_configs
 
       before do
         I18n.locale = :en
@@ -163,10 +164,6 @@ describe Mongoid::Criteria do
         d.save!
       end
 
-      after do
-        I18n.locale = :en
-      end
-
       context 'when entire field is included' do
 
         let(:dictionary) do

data/spec/mongoid/criteria_spec.rb

@@ -1953,6 +1953,7 @@ describe Mongoid::Criteria do
     end
 
     context 'when plucking a localized field' do
+      with_default_i18n_configs
 
       before do
         I18n.locale = :en
@@ -1962,10 +1963,6 @@ describe Mongoid::Criteria do
         d.save!
       end
 
-      after do
-        I18n.locale = :en
-      end
-
       context 'when plucking the entire field' do
         let(:plucked) do
           Dictionary.all.pluck(:description)
@@ -2059,13 +2056,10 @@ describe Mongoid::Criteria do
       end
 
       context 'when fallbacks are enabled with a locale list' do
-        with_i18n_fallbacks
+        require_fallbacks
 
-        around(:all) do |example|
-          prev_fallbacks = I18n.fallbacks.dup
+        before do
           I18n.fallbacks[:he] = [ :en ]
-          example.run
-          I18n.fallbacks = prev_fallbacks
         end
 
         let(:plucked) do
@@ -2093,6 +2087,8 @@ describe Mongoid::Criteria do
       end
 
       context "when the localized field is embedded" do
+        with_default_i18n_configs
+
         before do
           p = Passport.new
           I18n.locale = :en
@@ -2663,8 +2659,6 @@ describe Mongoid::Criteria do
       end
 
       context "when the criteria is not embedded" do
-        # String criteria compile to $where, which requires the opt-in.
-        config_override :allow_unsafe_query_operators, true
 
         let(:criteria) do
           Band.where("this.name == 'Depeche Mode'")

data/spec/mongoid/document_spec.rb

@@ -591,33 +591,6 @@ describe Mongoid::Document do
       expect(person.as_document["addresses"].first).to have_key(:locations)
     end
 
-    context 'when modifying the returned object' do
-      let(:record) do
-        RootCategory.create(categories: [{ name: 'tests' }]).reload
-      end
-
-      shared_examples_for 'an object with protected internal state' do
-        it 'does not expose internal state' do
-          before_change = record.as_document.dup
-          record.categories.first.name = 'things'
-          after_change = record.as_document
-          expect(before_change['categories'].first['name']).not_to eq('things')
-        end
-      end
-
-      context 'when legacy_attributes is true' do
-        config_override :legacy_attributes, true
-
-        it_behaves_like 'an object with protected internal state'
-      end
-
-      context 'when legacy_attributes is false' do
-        config_override :legacy_attributes, false
-
-        it_behaves_like 'an object with protected internal state'
-      end
-    end
-
     context "with relation define store_as option in embeded_many" do
 
       let!(:phone) do

data/spec/mongoid/errors/readonly_document_spec.rb

@@ -12,13 +12,13 @@ describe Mongoid::Errors::ReadonlyDocument do
 
     it "contains the problem in the message" do
       expect(error.message).to include(
-        "Attempted to persist the readonly document 'Band'."
+        "Attempted to persist a readonly document of class 'Band'."
       )
     end
 
     it "contains the summary in the message" do
       expect(error.message).to include(
-        "Documents loaded from the database using #only"
+        "Documents that are marked readonly cannot be persisted"
       )
     end