mongoid 8.1.13 → 9.0.0

data/lib/mongoid/criteria/queryable/pipeline.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+# rubocop:todo all
 
 module Mongoid
   class Criteria

data/lib/mongoid/criteria/queryable/selectable.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+# rubocop:todo all
 
 module Mongoid
   class Criteria
@@ -155,7 +156,7 @@ module Mongoid
             raise Errors::CriteriaArgumentRequired, :elem_match
           end
 
-          and_or_override(criterion, "$elemMatch")
+          and_with_operator(criterion, "$elemMatch")
         end
         key :elem_match, :override, "$elemMatch"
 
@@ -258,7 +259,7 @@ module Mongoid
             raise Errors::CriteriaArgumentRequired, :eq
           end
 
-          and_or_override(criterion, "$eq")
+          and_with_operator(criterion, "$eq")
         end
         key :eq, :override, "$eq"
 
@@ -278,7 +279,7 @@ module Mongoid
             raise Errors::CriteriaArgumentRequired, :gt
           end
 
-          and_or_override(criterion, "$gt")
+          and_with_operator(criterion, "$gt")
         end
         key :gt, :override, "$gt"
 
@@ -298,7 +299,7 @@ module Mongoid
             raise Errors::CriteriaArgumentRequired, :gte
           end
 
-          and_or_override(criterion, "$gte")
+          and_with_operator(criterion, "$gte")
         end
         key :gte, :override, "$gte"
 
@@ -354,7 +355,7 @@ module Mongoid
             raise Errors::CriteriaArgumentRequired, :lt
           end
 
-          and_or_override(criterion, "$lt")
+          and_with_operator(criterion, "$lt")
         end
         key :lt, :override, "$lt"
 
@@ -374,7 +375,7 @@ module Mongoid
             raise Errors::CriteriaArgumentRequired, :lte
           end
 
-          and_or_override(criterion, "$lte")
+          and_with_operator(criterion, "$lte")
         end
         key :lte, :override, "$lte"
 
@@ -411,7 +412,7 @@ module Mongoid
             raise Errors::CriteriaArgumentRequired, :mod
           end
 
-          and_or_override(criterion, "$mod")
+          and_with_operator(criterion, "$mod")
         end
         key :mod, :override, "$mod"
 
@@ -431,7 +432,7 @@ module Mongoid
             raise Errors::CriteriaArgumentRequired, :ne
           end
 
-          and_or_override(criterion, "$ne")
+          and_with_operator(criterion, "$ne")
         end
         alias :excludes :ne
         key :ne, :override, "$ne"
@@ -452,7 +453,7 @@ module Mongoid
             raise Errors::CriteriaArgumentRequired, :near
           end
 
-          and_or_override(criterion, "$near")
+          and_with_operator(criterion, "$near")
         end
         key :near, :override, "$near"
 
@@ -472,7 +473,7 @@ module Mongoid
             raise Errors::CriteriaArgumentRequired, :near_sphere
           end
 
-          and_or_override(criterion, "$nearSphere")
+          and_with_operator(criterion, "$nearSphere")
         end
         key :near_sphere, :override, "$nearSphere"
 
@@ -552,7 +553,7 @@ module Mongoid
         # @return [ Selectable ] The new selectable.
         def not(*criteria)
           if criteria.empty?
-            dup.tap { |query| query.negating = !query.negating }
+            dup.tap { |query| query.negating = true }
           else
             criteria.compact.inject(self.clone) do |c, new_s|
               if new_s.is_a?(Selectable)
@@ -822,12 +823,6 @@ module Mongoid
             # only ever specify one criterion to #where.
             @criterion = criterion
             if criterion.is_a?(String)
-              unless Mongoid.allow_unsafe_query_operators?
-                raise Errors::InvalidQuery,
-                      "String criteria are not allowed because they compile to the '$where' operator, " \
-                      'which is not allowed in a query expression. Set Mongoid.allow_unsafe_query_operators = true ' \
-                      'to permit all operators.'
-              end
               js_query(criterion)
             else
               expr_query(criterion)
@@ -837,19 +832,6 @@ module Mongoid
 
         private
 
-        # Operators permitted at the top level of a query expression without
-        # opt-in. Excludes $where (JS execution) and other operators not needed
-        # for ordinary application queries.
-        ALLOWED_QUERY_OPERATORS = %w[
-          $and $or $nor $not $text $comment $expr $jsonSchema $alwaysFalse $alwaysTrue
-        ].freeze
-
-        # Operators that execute server-side JavaScript. These are rejected at
-        # any depth, not just at the top level: the allowlist above permits
-        # $expr and the logical operators, and their values are arbitrary
-        # nested expressions that can carry $function or $where.
-        JAVASCRIPT_QUERY_OPERATORS = %w[$where $function $accumulator].freeze
-
         # Adds the specified expression to the query.
         #
         # Criterion must be a hash in one of the following forms:
@@ -875,8 +857,6 @@ module Mongoid
             raise Errors::InvalidQuery, "Expression must be a Hash: #{Errors::InvalidQuery.truncate_expr(criterion)}"
           end
 
-          # The operator guard is applied by _mongoid_expand_keys, which every
-          # query method that accepts a user-supplied expression passes through.
           normalized = _mongoid_expand_keys(criterion)
           clone.tap do |query|
             normalized.each do |field, value|
@@ -892,94 +872,6 @@ module Mongoid
           end
         end
 
-        # Enforces the operator rules governed by the
-        # +allow_unsafe_query_operators+ configuration option against a
-        # normalized query expression.
-        #
-        # Two rules apply, and both are skipped when the option is true:
-        #
-        # - An operator at the top level of the expression must appear in
-        #   ALLOWED_QUERY_OPERATORS.
-        # - An operator in JAVASCRIPT_QUERY_OPERATORS is rejected at any depth.
-        #
-        # This is called from #_mongoid_expand_keys rather than from the
-        # individual query methods, because that is the one point every query
-        # method taking a user-supplied expression passes through on its way to
-        # the selector.
-        #
-        # It deliberately does not cover the APIs that ask for JavaScript
-        # outright, such as #js_query and Criteria#for_js: there the developer
-        # has chosen server-side JavaScript, so there is nothing to guard
-        # against. The same goes for the low-level Storable methods
-        # (#add_field_expression, #add_operator_expression), which write to the
-        # selector directly.
-        #
-        # @param [ Hash ] expr A normalized query expression.
-        #
-        # @raise [ Errors::InvalidQuery ] If a disallowed operator is present.
-        #
-        # @api private
-        def _mongoid_validate_operators!(expr)
-          return if Mongoid.allow_unsafe_query_operators?
-
-          expr.each_key do |field|
-            field_s = field.to_s
-            next unless field_s.start_with?('$')
-            next if ALLOWED_QUERY_OPERATORS.include?(field_s)
-
-            raise Errors::InvalidQuery,
-                  "Operator '#{field_s}' is not allowed in a query expression. " \
-                  'Set Mongoid.allow_unsafe_query_operators = true to permit all operators.'
-          end
-
-          _mongoid_validate_no_javascript!(expr)
-        end
-
-        # Walks a query expression looking for operators that execute
-        # server-side JavaScript, descending through both hashes and arrays so
-        # that nested forms such as {'$expr' => {'$function' => ...}} and
-        # {'$or' => [ {'$where' => ...} ]} are caught.
-        #
-        # The walk does not distinguish operator position from value position,
-        # so it also rejects queries where a JavaScript operator name appears as
-        # data rather than as an operator. Server 5.0+ permits $-prefixed field
-        # names in stored documents, which makes this reachable:
-        #
-        #   Doc.where(payload: { '$eq' => { '$function' => 'abc' } })
-        #
-        # Here the $eq marks its argument as a literal value to compare, so the
-        # server never evaluates it, but the guard raises anyway. The only
-        # workaround today is the global allow_unsafe_query_operators flag.
-        #
-        # TODO: discuss whether to track operator position (skipping the subtree
-        # under $eq, $ne, $in, $nin, and $elemMatch values) in a future
-        # iteration. It removes the false positive but adds exactly the kind of
-        # state that a real bypass could hide in, so it was left out for now.
-        #
-        # @param [ Object ] object A fragment of a query expression.
-        #
-        # @raise [ Errors::InvalidQuery ] If a JavaScript operator is present.
-        #
-        # @api private
-        def _mongoid_validate_no_javascript!(object)
-          case object
-          when Hash
-            object.each do |key, value|
-              key_s = key.to_s
-              if JAVASCRIPT_QUERY_OPERATORS.include?(key_s)
-                raise Errors::InvalidQuery,
-                      "Operator '#{key_s}' executes server-side JavaScript and is not allowed " \
-                      'anywhere in a query expression. Set Mongoid.allow_unsafe_query_operators = true ' \
-                      'to permit all operators.'
-              end
-
-              _mongoid_validate_no_javascript!(value)
-            end
-          when Array
-            object.each { |value| _mongoid_validate_no_javascript!(value) }
-          end
-        end
-
         # Force the values of the criterion to be evolved.
         #
         # @api private
@@ -1042,22 +934,6 @@ module Mongoid
           end
         end
 
-        # Combine operator expessions onto a Criteria using either
-        # an override or ands depending on the status of the
-        # Mongoid.overwrite_chained_operators feature flag.
-        #
-        # @param [ Hash ] The criterion to add to the criteria.
-        # @param [ String ] operator The MongoDB operator.
-        #
-        # @return [ Criteria ] The resulting criteria.
-        def and_or_override(criterion, operator)
-          if Mongoid.overwrite_chained_operators
-            __override__(criterion, operator)
-          else
-            and_with_operator(criterion, operator)
-          end
-        end
-
         class << self
 
           # Get the methods on the selectable that can be forwarded to from a model.

data/lib/mongoid/criteria/queryable/selector.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+# rubocop:todo all
 
 module Mongoid
   class Criteria
@@ -75,7 +76,7 @@ module Mongoid
 
         # Get the store name and store value. If the value is of type range,
         # we need may need to change the store_name as well as the store_value,
-        # therefore, we cannot just use the evole method.
+        # therefore, we cannot just use the evolve method.
         #
         # @param [ String ] name The name of the field.
         # @param [ Object ] serializer The optional serializer for the field.
@@ -151,6 +152,8 @@ module Mongoid
         # @return [ Object ] The serialized object.
         def evolve(serializer, value)
           case value
+          when Mongoid::RawValue
+            value.raw_value
           when Hash
             evolve_hash(serializer, value)
           when Array
@@ -228,7 +231,7 @@ module Mongoid
         #
         # @api private
         #
-        # @param [ String ] key The to store the range for.
+        # @param [ String ] key The key at which to store the range.
         # @param [ Object ] serializer The optional serializer for the field.
         # @param [ Range ] value The Range to serialize.
         #

data/lib/mongoid/criteria/queryable/smash.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+# rubocop:todo all
 
 module Mongoid
   class Criteria

data/lib/mongoid/criteria/queryable/storable.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+# rubocop:todo all
 
 module Mongoid
   class Criteria
@@ -82,7 +83,7 @@ module Mongoid
         #
         #     {'$or' => [{'hello' => 'world'}]}
         #
-        # ... and operator is '$or' and op_expr is `[{'test' => 123'}]`,
+        # ... and operator is '$or' and op_expr is +[{'test' => 123'}]+,
         # the resulting selector will be:
         #
         #     {'$or' => [{'hello' => 'world'}, {'test' => 123}]}
@@ -123,7 +124,7 @@ module Mongoid
           elsif operator == '$and' || selector.empty?
             # $and can always be added to top level and it will be combined
             # with whatever other conditions exist.
-            if !Mongoid.broken_and && current_value = selector[operator]
+            if current_value = selector[operator]
               new_value = current_value + op_expr
               selector.store(operator, new_value)
             else
@@ -158,7 +159,7 @@ module Mongoid
         #
         #     {'foo' => 'bar', '$or' => [{'hello' => 'world'}]}
         #
-        # ... and operator is '$or' and op_expr is `{'test' => 123'}`,
+        # ... and operator is '$or' and op_expr is +{'test' => 123'}+,
         # the resulting selector will be:
         #
         #     {'foo' => 'bar', '$or' => [{'hello' => 'world'}, {'test' => 123}]}

data/lib/mongoid/criteria/queryable.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+# rubocop:todo all
 
 require "mongoid/criteria/queryable/expandable"
 require "mongoid/criteria/queryable/extensions"

data/lib/mongoid/criteria/scopable.rb

@@ -1,7 +1,12 @@
 # frozen_string_literal: true
+# rubocop:todo all
 
 module Mongoid
   class Criteria
+
+    # Mixin module included in Mongoid::Criteria which adds
+    # functionality related to default query scopes and named
+    # scopes.
     module Scopable
 
       # Applies the default scope to the criteria.

data/lib/mongoid/criteria/translator.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+# rubocop:todo all
 
 module Mongoid
   class Criteria

data/lib/mongoid/criteria.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+# rubocop:todo all
 
 require "mongoid/criteria/findable"
 require "mongoid/criteria/includable"
@@ -40,6 +41,26 @@ module Mongoid
     include Clients::Sessions
     include Options
 
+    class << self
+      # Convert the given hash to a criteria. Will iterate over each keys in the
+      # hash which must correspond to method on a criteria object. The hash
+      # must also include a "klass" key.
+      #
+      # @example Convert the hash to a criteria.
+      #   Criteria.from_hash({ klass: Band, where: { name: "Depeche Mode" })
+      #
+      # @param [ Hash ] hash The hash to convert.
+      #
+      # @return [ Criteria ] The criteria.
+      def from_hash(hash)
+        criteria = Criteria.new(hash.delete(:klass) || hash.delete('klass'))
+        hash.each_pair do |method, args|
+          criteria = criteria.__send__(method, args)
+        end
+        criteria
+      end
+    end
+
     # Static array used to check with method missing - we only need to ever
     # instantiate once.
     CHECK = []
@@ -90,7 +111,8 @@ module Mongoid
     #   enumerator = criteria.find(-> { "Default Band" })
     #
     # @param [ [ Object | Array<Object> ]... ] *args The id(s).
-    # @param [ Proc ] block Optional block to pass.
+    # @param &block Optional block to pass.
+    # @yield [ Object ] Yields each enumerable element to the block.
     #
     # @return [ Document | Array<Document> | nil ] A document or matching documents.
     #
@@ -158,7 +180,7 @@ module Mongoid
     #
     # @return [ Object ] The id.
     def extract_id
-      selector.extract_id
+      selector['_id'] || selector[:_id] || selector['id'] || selector[:id]
     end
 
     # Adds a criterion to the +Criteria+ that specifies additional options
@@ -221,7 +243,7 @@ module Mongoid
     # may be desired.
     #
     # @example Merge the criteria with another criteria.
-    #   criteri.merge(other_criteria)
+    #   criteria.merge(other_criteria)
     #
     # @example Merge the criteria with a hash. The hash must contain a klass
     #   key and the key/value pairs correspond to method names/args.
@@ -246,16 +268,16 @@ module Mongoid
     # @example Merge another criteria into this criteria.
     #   criteria.merge(Person.where(name: "bob"))
     #
-    # @param [ Criteria ] other The criteria to merge in.
+    # @param [ Criteria | Hash ] other The criteria to merge in.
     #
     # @return [ Criteria ] The merged criteria.
     def merge!(other)
-      criteria = other.to_criteria
-      selector.merge!(criteria.selector)
-      options.merge!(criteria.options)
-      self.documents = criteria.documents.dup unless criteria.documents.empty?
-      self.scoping_options = criteria.scoping_options
-      self.inclusions = (inclusions + criteria.inclusions).uniq
+      other = self.class.from_hash(other) if other.is_a?(Hash)
+      selector.merge!(other.selector)
+      options.merge!(other.options)
+      self.documents = other.documents.dup unless other.documents.empty?
+      self.scoping_options = other.scoping_options
+      self.inclusions = (inclusions + other.inclusions).uniq
       self
     end
 
@@ -348,9 +370,11 @@ module Mongoid
     #   criteria.to_criteria
     #
     # @return [ Criteria ] self.
+    # @deprecated
     def to_criteria
       self
     end
+    Mongoid.deprecate(self, :to_criteria)
 
     # Convert the criteria to a proc.
     #
@@ -437,6 +461,8 @@ module Mongoid
     # @param [ Hash ] scope The scope for the code.
     #
     # @return [ Criteria ] The criteria.
+    #
+    # @deprecated
     def for_js(javascript, scope = {})
       code = if scope.empty?
         # CodeWithScope is not supported for $where as of MongoDB 4.4
@@ -446,6 +472,7 @@ module Mongoid
       end
       js_query(code)
     end
+    Mongoid.deprecate(self, :for_js)
 
     private
 

data/lib/mongoid/deprecable.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+# rubocop:todo all
 
 require "mongoid/deprecation"
 

data/lib/mongoid/deprecation.rb

@@ -1,19 +1,23 @@
 # frozen_string_literal: true
+# rubocop:todo all
 
 module Mongoid
 
   # Utility class for logging deprecation warnings.
   class Deprecation < ::ActiveSupport::Deprecation
 
-    @gem_name = 'Mongoid'
+    def initialize
+      # Per change policy, deprecations will be removed in the next major version.
+      deprecation_horizon = "#{Mongoid::VERSION.split('.').first.to_i + 1}.0".freeze
+      gem_name = 'Mongoid'
+      super(deprecation_horizon, gem_name)
+    end
 
-    # Per change policy, deprecations will be removed in the next major version.
-    @deprecation_horizon = "#{Mongoid::VERSION.split('.').first.to_i + 1}.0".freeze
 
     # Overrides default ActiveSupport::Deprecation behavior
     # to use Mongoid's logger.
     #
-    # @return Array<Proc> The deprecation behavior.
+    # @return [ Array<Proc> ] The deprecation behavior.
     def behavior
       @behavior ||= Array(->(*args) {
         logger = Mongoid.logger