mongoid 8.1.12 → 8.1.13

data/spec/mongoid/attributes/nested_spec.rb

@@ -7,6 +7,33 @@ require_relative './nested_spec_models'
 
 describe Mongoid::Attributes::Nested do
 
+  # Expects the enclosing context to define `build_with_id`, taking an id
+  # value and returning the document built with it in nested attributes.
+  shared_examples 'rejects non-scalar ids' do |klass_name|
+    not_found = /not found for class #{klass_name}/
+
+    context 'when the id is an operator hash' do
+      it 'raises a document not found error' do
+        expect { build_with_id({ '$ne' => nil }) }
+          .to raise_error(Mongoid::Errors::DocumentNotFound, not_found)
+      end
+    end
+
+    context 'when the id is an array' do
+      it 'raises a document not found error' do
+        expect { build_with_id([BSON::ObjectId.new]) }
+          .to raise_error(Mongoid::Errors::DocumentNotFound, not_found)
+      end
+    end
+
+    context 'when the id is a malformed object id hash' do
+      it 'raises a document not found error' do
+        expect { build_with_id({ '$oid' => 'junk' }) }
+          .to raise_error(Mongoid::Errors::DocumentNotFound, not_found)
+      end
+    end
+  end
+
   describe ".accepts_nested_attributes_for" do
 
     context "when the autosave option is not defined" do
@@ -178,6 +205,30 @@ describe Mongoid::Attributes::Nested do
       end
     end
 
+    context 'when the id in the attributes is not a scalar' do
+      let(:person) { Person.create! }
+
+      def build_with_id(id)
+        person.update!(posts_attributes: { '0' => { id: id, title: 'Crafted' } })
+      end
+
+      context 'when the association is empty' do
+        include_examples 'rejects non-scalar ids', 'Post'
+      end
+
+      context 'when the association is not empty' do
+        before { person.posts.create!(title: 'Existing') }
+
+        include_examples 'rejects non-scalar ids', 'Post'
+      end
+
+      context 'when allow_reparenting_via_nested_attributes is true' do
+        config_override :allow_reparenting_via_nested_attributes, true
+
+        include_examples 'rejects non-scalar ids', 'Post'
+      end
+    end
+
     context "when the relation is a references and referenced in many" do
 
       before do
@@ -201,16 +252,100 @@ describe Mongoid::Attributes::Nested do
           )
         end
 
-        it "sets the nested attributes" do
-          expect(person.preferences.map(&:name)).to eq([preference.name])
+        context 'when allow_reparenting_via_nested_attributes is false' do
+          config_override :allow_reparenting_via_nested_attributes, false
+
+          it 'raises a document not found error' do
+            expect { person }.to raise_error(Mongoid::Errors::DocumentNotFound,
+                                             /Document\(s\) not found for class Preference/)
+          end
         end
 
-        it "updates attributes of existing document which is added to relation" do
-          preference_name = 'updated preference'
-          person = Person.new(
-            preferences_attributes: { 0 => { id: preference.id, name: preference_name } }
-          )
-          expect(person.preferences.map(&:name)).to eq([preference_name])
+        context 'when allow_reparenting_via_nested_attributes is true' do
+          config_override :allow_reparenting_via_nested_attributes, true
+
+          it 'sets the nested attributes' do
+            expect(person.preferences.map(&:name)).to eq([preference.name])
+          end
+
+          it 'updates attributes of existing document which is added to relation' do
+            preference_name = 'updated preference'
+            person = Person.new(
+              preferences_attributes: { 0 => { id: preference.id, name: preference_name } }
+            )
+            expect(person.preferences.map(&:name)).to eq([preference_name])
+          end
+
+          context 'when the id does not correspond to an existing document' do
+            let(:person) do
+              Person.new(
+                preferences_attributes: { 0 => { id: BSON::ObjectId.new, name: 'Ghost' } }
+              )
+            end
+
+            context 'when raise_not_found_error is true' do
+              config_override :raise_not_found_error, true
+
+              it 'raises a document not found error' do
+                expect { person }.to raise_error(Mongoid::Errors::DocumentNotFound,
+                                                 /Document\(s\) not found for class Preference/)
+              end
+            end
+
+            context 'when raise_not_found_error is false' do
+              config_override :raise_not_found_error, false
+
+              it 'raises a document not found error' do
+                expect { person }.to raise_error(Mongoid::Errors::DocumentNotFound,
+                                                 /Document\(s\) not found for class Preference/)
+              end
+            end
+          end
+        end
+
+        context 'when _destroy is true for a document not in the relation' do
+          before do
+            Person.send(:undef_method, :preferences_attributes=)
+            Person.accepts_nested_attributes_for :preferences, allow_destroy: true
+          end
+
+          let(:person) do
+            Person.new(
+              preferences_attributes: { 0 => { id: preference.id, _destroy: '1' } }
+            )
+          end
+
+          it 'does not raise UnknownAttribute' do
+            expect { person }.not_to raise_error
+          end
+
+          it 'does not add the document to the relation' do
+            expect(person.preferences).to be_empty
+          end
+        end
+      end
+
+      context 'when the id in the attributes is not a scalar' do
+        let(:target) { Person.create! }
+
+        def build_with_id(id)
+          target.update!(preferences_attributes: { 0 => { id: id, name: 'Crafted' } })
+        end
+
+        context 'when the association is empty' do
+          include_examples 'rejects non-scalar ids', 'Preference'
+        end
+
+        context 'when the association is not empty' do
+          before { target.preferences.create!(name: 'Existing') }
+
+          include_examples 'rejects non-scalar ids', 'Preference'
+        end
+
+        context 'when allow_reparenting_via_nested_attributes is true' do
+          config_override :allow_reparenting_via_nested_attributes, true
+
+          include_examples 'rejects non-scalar ids', 'Preference'
         end
       end
     end
@@ -3015,7 +3150,7 @@ describe Mongoid::Attributes::Nested do
                       { "0" =>
                         { "id" => BSON::ObjectId.new.to_s, "title" => "Rogue" }
                       }
-                  }.to raise_error(Mongoid::Errors::DocumentNotFound, /Document\(s\) not found for class Post with id\(s\)/)
+                  }.to raise_error(Mongoid::Errors::DocumentNotFound, /Document not found for class Post/)
                 end
               end
             end
@@ -3049,7 +3184,7 @@ describe Mongoid::Attributes::Nested do
                 expect {
                   person.posts_attributes =
                     { "foo" => { "id" => "test", "title" => "Test" } }
-                }.to raise_error(Mongoid::Errors::DocumentNotFound, /Document\(s\) not found for class Post with id\(s\)/)
+                }.to raise_error(Mongoid::Errors::DocumentNotFound, /Document not found for class Post/)
               end
             end
           end
@@ -4997,4 +5132,63 @@ describe Mongoid::Attributes::Nested do
       end
     end
   end
+
+  context 'when an id in nested attributes belongs to another parent' do
+    let(:victim) { Person.create! }
+    let(:attacker) { Person.create! }
+
+    context 'when the association is a has-many' do
+      before do
+        Person.send(:undef_method, :posts_attributes=)
+        Person.accepts_nested_attributes_for :posts
+      end
+
+      let!(:victim_post) { victim.posts.create!(title: 'Private') }
+
+      it 'does not update the other parent\'s document' do
+        expect { attacker.update!(posts_attributes: { '0' => { id: victim_post.id, title: 'Overwritten' } }) }
+          .to raise_error(Mongoid::Errors::DocumentNotFound)
+        expect(victim_post.reload.title).to eq('Private')
+      end
+
+      it 'does not add the other parent\'s document to the association' do
+        expect { attacker.update!(posts_attributes: { '0' => { id: victim_post.id, title: 'Overwritten' } }) }
+          .to raise_error(Mongoid::Errors::DocumentNotFound)
+        expect(attacker.reload.posts).to be_empty
+      end
+
+      it 'does not update via a direct association assignment' do
+        expect { attacker.update!(posts: { '0' => { id: victim_post.id, title: 'Overwritten' } }) }
+          .to raise_error(Mongoid::Errors::DocumentNotFound)
+        expect(victim_post.reload.title).to eq('Private')
+      end
+    end
+
+    context 'when the association is a has-and-belongs-to-many' do
+      before do
+        Person.send(:undef_method, :preferences_attributes=)
+        Person.accepts_nested_attributes_for :preferences
+      end
+
+      let!(:victim_preference) { victim.preferences.create!(name: 'Private') }
+
+      it 'does not update the other parent\'s document' do
+        expect { attacker.update!(preferences_attributes: { '0' => { id: victim_preference.id, name: 'Overwritten' } }) }
+          .to raise_error(Mongoid::Errors::DocumentNotFound)
+        expect(victim_preference.reload.name).to eq('Private')
+      end
+
+      it 'does not add the other parent\'s document to the association' do
+        expect { attacker.update!(preferences_attributes: { '0' => { id: victim_preference.id, name: 'Overwritten' } }) }
+          .to raise_error(Mongoid::Errors::DocumentNotFound)
+        expect(attacker.reload.preferences).to be_empty
+      end
+
+      it 'does not update via a direct association assignment' do
+        expect { attacker.update!(preferences: { '0' => { id: victim_preference.id, name: 'Overwritten' } }) }
+          .to raise_error(Mongoid::Errors::DocumentNotFound)
+        expect(victim_preference.reload.name).to eq('Private')
+      end
+    end
+  end
 end

data/spec/mongoid/contextual/aggregable/memory_spec.rb

@@ -570,4 +570,95 @@ describe Mongoid::Contextual::Aggregable::Memory do
       end
     end
   end
+
+  context 'when the field name is a method name' do
+    let!(:depeche) do
+      Band.create!(name: 'Depeche Mode', likes: 1000)
+    end
+
+    let(:criteria) do
+      Band.all.tap do |crit|
+        crit.documents = [ depeche ]
+      end
+    end
+
+    it 'does not call the method for sum' do
+      expect(depeche).not_to receive(:delete)
+      expect(context.sum(:delete)).to eq(0)
+    end
+
+    it 'does not call the method for min' do
+      expect(depeche).not_to receive(:delete)
+      expect(context.min(:delete)).to be_nil
+    end
+
+    it 'does not call the method for max' do
+      expect(depeche).not_to receive(:delete)
+      expect(context.max(:delete)).to be_nil
+    end
+
+    it 'does not call the method for avg' do
+      expect(depeche).not_to receive(:delete)
+      expect(context.avg(:delete)).to be_nil
+    end
+
+    it 'does not call the method for aggregates' do
+      expect(depeche).not_to receive(:delete)
+      expect(context.aggregates(:delete))
+        .to eq('count' => 0, 'avg' => nil, 'max' => nil, 'min' => nil, 'sum' => 0)
+    end
+
+    it 'does not call a private method for avg' do
+      expect(depeche).not_to receive(:exit)
+      expect(context.avg(:exit)).to be_nil
+    end
+  end
+
+  context 'when the field is not defined' do
+    let!(:depeche) do
+      Band.create!(name: 'Depeche Mode', likes: 1000)
+    end
+
+    let(:criteria) do
+      Band.all.tap do |crit|
+        crit.documents = [ depeche ]
+      end
+    end
+
+    it 'returns zero for sum' do
+      expect(context.sum(:not_a_field)).to eq(0)
+    end
+
+    it 'returns nil for min' do
+      expect(context.min(:not_a_field)).to be_nil
+    end
+
+    it 'returns nil for max' do
+      expect(context.max(:not_a_field)).to be_nil
+    end
+
+    it 'returns nil for avg' do
+      expect(context.avg(:not_a_field)).to be_nil
+    end
+  end
+
+  context 'when the field is the foreign key of a many to many association' do
+    let!(:preference) do
+      Preference.create!(name: 'nature')
+    end
+
+    let!(:person) do
+      Person.new(preferences: [ preference ])
+    end
+
+    let(:criteria) do
+      Person.all.tap do |crit|
+        crit.documents = [ person ]
+      end
+    end
+
+    it 'aggregates the stored ids' do
+      expect(context.max(:preference_ids)).to eq([ preference.id ])
+    end
+  end
 end

data/spec/mongoid/contextual/memory_spec.rb

@@ -653,6 +653,27 @@ describe Mongoid::Contextual::Memory do
         end
       end
     end
+
+    context 'when the field name is a method name' do
+      let!(:person) do
+        Person.create!(ssn: 'secret-ssn')
+      end
+
+      let!(:address) do
+        person.addresses.create!(street: 'hobrecht')
+      end
+
+      let(:criteria) do
+        Address.all.tap do |crit|
+          crit.documents = [ address ]
+        end
+      end
+
+      it 'does not call the method' do
+        expect(address).not_to receive(:destroy)
+        expect(context.distinct(:destroy)).to eq([ nil ])
+      end
+    end
   end
 
   describe "#each" do
@@ -1996,6 +2017,116 @@ describe Mongoid::Contextual::Memory do
         end
       end
     end
+
+    context 'when plucking a dynamic attribute' do
+      let(:criteria) do
+        Band.all.tap do |crit|
+          crit.documents = [ Band.create!(name: 'Depeche Mode', mood: 'dark') ]
+        end
+      end
+
+      it 'returns the value from the attributes' do
+        expect(context.pluck(:mood)).to eq([ 'dark' ])
+      end
+    end
+
+    context 'when the field name is a method name' do
+      let!(:person) do
+        Person.create!(ssn: 'secret-ssn')
+      end
+
+      let!(:address) do
+        person.addresses.create!(street: 'hobrecht')
+      end
+
+      let(:criteria) do
+        Address.all.tap do |crit|
+          crit.documents = [ address ]
+        end
+      end
+
+      it 'does not call the method' do
+        expect(address).not_to receive(:destroy)
+        expect(context.pluck(:destroy)).to eq([ nil ])
+      end
+
+      it 'does not return the attributes hash' do
+        expect(context.pluck(:attributes)).to eq([ nil ])
+      end
+
+      it 'does not traverse to the parent document' do
+        expect(context.pluck('_root.ssn')).to eq([ nil ])
+      end
+
+      it 'does not destroy the parent document' do
+        expect(context.pluck('_root.destroy')).to eq([ nil ])
+        expect(Person.where(_id: person.id).count).to eq(1)
+      end
+    end
+
+    context 'when plucking a belongs_to association' do
+      let!(:band) do
+        Band.create!(name: 'Depeche Mode')
+      end
+
+      let!(:artist) do
+        Artist.create!(band: band)
+      end
+
+      let(:criteria) do
+        Artist.all.tap do |crit|
+          crit.documents = [ artist ]
+        end
+      end
+
+      it 'traverses to the associated document' do
+        expect(context.pluck('band.name')).to eq([ 'Depeche Mode' ])
+      end
+
+      it 'returns the document for the association name' do
+        expect(context.pluck(:band)).to eq([ band ])
+      end
+
+      it 'returns the id for the foreign key' do
+        expect(context.pluck(:band_id)).to eq([ band.id ])
+      end
+    end
+
+    context 'when plucking the foreign key of a many to many association' do
+      let!(:preference) do
+        Preference.create!(name: 'nature')
+      end
+
+      let!(:person) do
+        Person.create!(preferences: [ preference ])
+      end
+
+      let(:criteria) do
+        Person.all.tap do |crit|
+          crit.documents = [ person ]
+        end
+      end
+
+      it 'returns the stored ids' do
+        expect(context.pluck(:preference_ids)).to eq([ [ preference.id ] ])
+      end
+    end
+
+    context 'when the field path has an empty segment' do
+      let!(:band) do
+        Band.create!(name: 'Depeche Mode', label: Label.new(name: 'Mute'))
+      end
+
+      let(:criteria) do
+        Band.all.tap do |crit|
+          crit.documents = [ band ]
+        end
+      end
+
+      it 'returns nil' do
+        expect(context.pluck('label..name')).to eq([ nil ])
+      end
+    end
   end
 
   describe "#pick" do
@@ -2056,6 +2187,27 @@ describe Mongoid::Contextual::Memory do
         expect(picked).to be_nil
       end
     end
+
+    context 'when the field name is a method name' do
+      let!(:person) do
+        Person.create!(ssn: 'secret-ssn')
+      end
+
+      let!(:address) do
+        person.addresses.create!(street: 'hobrecht')
+      end
+
+      let(:criteria) do
+        Address.all.tap do |crit|
+          crit.documents = [ address ]
+        end
+      end
+
+      it 'does not call the method' do
+        expect(address).not_to receive(:destroy)
+        expect(context.pick(:destroy)).to be_nil
+      end
+    end
   end
 
   describe "#tally" do
@@ -2510,6 +2662,31 @@ describe Mongoid::Contextual::Memory do
         )
       end
     end
+
+    context 'when the field name is a method name' do
+      let!(:person) do
+        Person.create!(ssn: 'secret-ssn')
+      end
+
+      let!(:address) do
+        person.addresses.create!(street: 'hobrecht')
+      end
+
+      let(:criteria) do
+        Address.all.tap do |crit|
+          crit.documents = [ address ]
+        end
+      end
+
+      it 'does not call the method' do
+        expect(address).not_to receive(:destroy)
+        expect(context.tally(:destroy)).to eq(nil => 1)
+      end
+
+      it 'does not disclose the parent document fields' do
+        expect(context.tally('_root.ssn')).to eq(nil => 1)
+      end
+    end
   end
 
   describe '#inc' do

data/spec/mongoid/criteria/queryable/selectable_logical_spec.rb

@@ -1829,6 +1829,8 @@ describe Mongoid::Criteria::Queryable::Selectable do
       end
 
       context 'when the following criteria uses string were form' do
+        # String criteria compile to $where, which requires the opt-in.
+        config_override :allow_unsafe_query_operators, true
 
         let(:selection) do
           query.not.where('hello world')