mongoid 8.1.13 → 9.0.0

data/spec/mongoid/criteria/queryable/selectable_where_spec.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+# rubocop:todo all
 
 require "spec_helper"
 require_relative './selectable_shared_examples'
@@ -35,8 +36,6 @@ describe Mongoid::Criteria::Queryable::Selectable do
     it_behaves_like 'requires a non-nil argument'
 
     context "when provided a string" do
-      # String criteria compile to $where, which requires the opt-in.
-      config_override :allow_unsafe_query_operators, true
 
       let(:selection) do
         query.where("this.value = 10")
@@ -588,237 +587,4 @@ describe Mongoid::Criteria::Queryable::Selectable do
       end
     end
   end
-
-  describe 'top-level operator injection guard' do
-    context 'when allow_unsafe_query_operators is true' do
-      config_override :allow_unsafe_query_operators, true
-
-      context 'when passing $where' do
-        it 'does not raise' do
-          expect do
-            query.where('$where' => 'this.name == "admin"')
-          end.not_to raise_error
-        end
-      end
-
-      context 'when passing a string criterion' do
-        it 'does not raise' do
-          expect do
-            query.where('this.name == "admin"')
-          end.not_to raise_error
-        end
-      end
-
-      context 'when passing a string criterion to a negated query' do
-        it 'does not raise' do
-          expect do
-            query.not.where('this.name == "admin"')
-          end.not_to raise_error
-        end
-      end
-
-      context 'when passing $function' do
-        it 'does not raise' do
-          expect do
-            query.where('$function' => { body: 'function() { return true; }', args: [], lang: 'js' })
-          end.not_to raise_error
-        end
-      end
-    end
-
-    context 'when allow_unsafe_query_operators is false' do
-      config_override :allow_unsafe_query_operators, false
-
-      context 'when passing $where' do
-        it 'raises InvalidQuery' do
-          expect do
-            query.where('$where' => 'this.name == "admin"')
-          end.to raise_error(Mongoid::Errors::InvalidQuery, /\$where/)
-        end
-      end
-
-      context 'when passing $function' do
-        it 'raises InvalidQuery' do
-          expect do
-            query.where('$function' => { body: 'function() { return true; }', args: [], lang: 'js' })
-          end.to raise_error(Mongoid::Errors::InvalidQuery, /\$function/)
-        end
-      end
-
-      context 'when the error mentions allow_unsafe_query_operators' do
-        it 'includes the config opt-in in the message' do
-          expect do
-            query.where('$where' => 'true')
-          end.to raise_error(Mongoid::Errors::InvalidQuery, /allow_unsafe_query_operators/)
-        end
-      end
-
-      context 'when passing a string criterion' do
-        it 'raises InvalidQuery' do
-          expect do
-            query.where('this.name == "admin"')
-          end.to raise_error(Mongoid::Errors::InvalidQuery, /\$where/)
-        end
-
-        it 'includes the config opt-in in the message' do
-          expect do
-            query.where('this.name == "admin"')
-          end.to raise_error(Mongoid::Errors::InvalidQuery, /allow_unsafe_query_operators/)
-        end
-      end
-
-      context 'when passing a string criterion to a negated query' do
-        it 'raises InvalidQuery' do
-          expect do
-            query.not.where('this.name == "admin"')
-          end.to raise_error(Mongoid::Errors::InvalidQuery, /\$where/)
-        end
-      end
-
-      %w[$and $or $nor $not $text $comment $expr $jsonSchema $alwaysFalse $alwaysTrue].each do |op|
-        context "when passing #{op} (allowlisted)" do
-          it 'does not raise' do
-            value = case op
-                    when '$and', '$or', '$nor', '$not' then [ { 'x' => 1 } ]
-                    when '$text' then { '$search' => 'hi' }
-                    when '$expr' then { '$gt' => [ '$a', 1 ] }
-                    when '$jsonSchema' then { 'required' => [ 'x' ] }
-                    else true
-                    end
-            expect { query.where(op => value) }.not_to raise_error
-          end
-        end
-      end
-    end
-  end
-
-  describe 'nested operator injection guard' do
-    js = 'this.name == "admin"'
-
-    function_expr = {
-      '$function' => { 'body' => 'function() { return true; }', 'args' => [], 'lang' => 'js' }
-    }.freeze
-
-    accumulator_expr = {
-      '$accumulator' => {
-        'init' => 'function() { return 0; }',
-        'accumulate' => 'function() { return 0; }',
-        'accumulateArgs' => [],
-        'merge' => 'function() { return 0; }',
-        'lang' => 'js'
-      }
-    }.freeze
-
-    # Every path into the selector that does not route through #expr_query,
-    # plus the nested forms that a top-level key check cannot see.
-    unsafe_queries = {
-      'and with a $where key' => ->(query) { query.and('$where' => js) },
-      'or with a $where key' => ->(query) { query.or('$where' => js) },
-      'nor with a $where key' => ->(query) { query.nor('$where' => js) },
-      'not with a $where key' => ->(query) { query.not('$where' => js) },
-      'any_of with a $where key' => ->(query) { query.any_of('$where' => js) },
-      'none_of with a $where key' => ->(query) { query.none_of('$where' => js) },
-      'elem_match with a nested $where' => ->(query) { query.elem_match(a: { '$where' => js }) },
-      'where with $where inside $or' => ->(query) { query.where('$or' => [ { '$where' => js } ]) },
-      'where with $function inside $expr' => ->(query) { query.where('$expr' => function_expr) },
-      'where with $accumulator inside $expr' => ->(query) { query.where('$expr' => accumulator_expr) },
-      'where with $where three levels deep' => lambda { |query|
-        query.where('$and' => [ { '$or' => [ { '$where' => js } ] } ])
-      },
-      'where with a symbol $where key inside $or' => ->(query) { query.where('$or' => [ { :$where => js } ]) }
-    }.freeze
-
-    context 'when allow_unsafe_query_operators is false' do
-      config_override :allow_unsafe_query_operators, false
-
-      unsafe_queries.each do |description, builder|
-        context "when querying with #{description}" do
-          it 'raises InvalidQuery' do
-            expect do
-              builder.call(query)
-            end.to raise_error(Mongoid::Errors::InvalidQuery, /\$where|\$function|\$accumulator/)
-          end
-        end
-      end
-
-      it 'includes the config opt-in in the message' do
-        expect do
-          query.or('$where' => js)
-        end.to raise_error(Mongoid::Errors::InvalidQuery, /allow_unsafe_query_operators/)
-      end
-
-      context 'when the nested expression is safe' do
-        it 'permits $or with field expressions' do
-          expect do
-            query.where('$or' => [ { 'a' => 1 }, { 'b' => { '$gt' => 2 } } ])
-          end.not_to raise_error
-        end
-
-        it 'permits $expr with aggregation operators' do
-          expect do
-            query.where('$expr' => { '$gt' => [ '$a', '$b' ] })
-          end.not_to raise_error
-        end
-
-        it 'permits a field whose name resembles a javascript operator' do
-          expect do
-            query.where('where' => js)
-          end.not_to raise_error
-        end
-
-        it 'permits a value that resembles a javascript operator' do
-          expect do
-            query.where('name' => '$where')
-          end.not_to raise_error
-        end
-      end
-    end
-
-    context 'when allow_unsafe_query_operators is true' do
-      config_override :allow_unsafe_query_operators, true
-
-      unsafe_queries.each do |description, builder|
-        context "when querying with #{description}" do
-          it 'does not raise' do
-            expect { builder.call(query) }.not_to raise_error
-          end
-        end
-      end
-    end
-  end
-
-  describe 'operator guard on chained override methods' do
-    # On this branch overwrite_chained_operators defaults to false, which
-    # routes elem_match through the guarded and_with_operator funnel. Force
-    # the override path so the guard in Mergeable#__override__ is exercised.
-    config_override :overwrite_chained_operators, true
-
-    let(:js) { 'this.name == "admin"' }
-
-    context 'when allow_unsafe_query_operators is false' do
-      config_override :allow_unsafe_query_operators, false
-
-      it 'rejects a $where nested in elem_match' do
-        expect do
-          query.elem_match(a: { '$where' => js })
-        end.to raise_error(Mongoid::Errors::InvalidQuery, /executes server-side JavaScript/)
-      end
-
-      it 'permits an ordinary elem_match value' do
-        expect do
-          query.elem_match(a: { name: 'x' })
-        end.not_to raise_error
-      end
-    end
-
-    context 'when allow_unsafe_query_operators is true' do
-      config_override :allow_unsafe_query_operators, true
-
-      it 'permits a $where nested in elem_match' do
-        expect do
-          query.elem_match(a: { '$where' => js })
-        end.not_to raise_error
-      end
-    end
-  end
 end

data/spec/mongoid/criteria/queryable/selector_spec.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+# rubocop:todo all
 
 require "spec_helper"
 
@@ -476,6 +477,43 @@ describe Mongoid::Criteria::Queryable::Selector do
             end
           end
         end
+
+        context "when providing a Mongoid::RawValue" do
+
+          context "and raw_value is a string" do
+
+            before do
+              selector.send(method, "key", Mongoid::RawValue("Foo"))
+            end
+
+            it "returns the raw_value" do
+              expect(selector["key"]).to eq("Foo")
+            end
+          end
+
+          context "and raw_value cannot be converted by bson-ruby" do
+
+            before do
+              selector.send(method, "key", Mongoid::RawValue(4..5))
+            end
+
+            it "returns the raw_value without conversion" do
+              expect(selector["key"]).to eq(4..5)
+            end
+          end
+
+          context "and raw_value is a complex type" do
+            config_override :map_big_decimal_to_decimal128, true
+
+            before do
+              selector.send(method, "key", Mongoid::RawValue([{ foo: 1, "Bar" => [/baz/, BigDecimal('2'), 4..5] }, 3]))
+            end
+
+            it "returns the raw_value" do
+              expect(selector["key"]).to eq([{ foo: 1, "Bar" => [/baz/, BigDecimal('2'), 4..5] }, 3])
+            end
+          end
+        end
       end
 
       context "when serializers are provided" do
@@ -676,6 +714,64 @@ describe Mongoid::Criteria::Queryable::Selector do
                   end
                 end
               end
+
+              context "when the criterion is a Mongoid::RawValue" do
+
+                context "and raw_value is a serializable string" do
+
+                  before do
+                    selector.send(method, "key", Mongoid::RawValue("1"))
+                  end
+
+                  it "returns the raw_value" do
+                    expect(selector["key"]).to eq("1")
+                  end
+                end
+
+                context "and raw_value is a serializable type" do
+
+                  before do
+                    selector.send(method, "key", Mongoid::RawValue(BigDecimal('2')))
+                  end
+
+                  it "returns the raw_value" do
+                    expect(selector["key"]).to eq(BigDecimal('2'))
+                  end
+                end
+
+                context "and raw_value is a non-serializable string" do
+
+                  before do
+                    selector.send(method, "key", Mongoid::RawValue("Foo"))
+                  end
+
+                  it "returns the raw_value" do
+                    expect(selector["key"]).to eq("Foo")
+                  end
+                end
+
+                context "and raw_value cannot be converted by bson-ruby" do
+
+                  before do
+                    selector.send(method, "key", Mongoid::RawValue(4..5))
+                  end
+
+                  it "returns the raw_value without conversion" do
+                    expect(selector["key"]).to eq(4..5)
+                  end
+                end
+
+                context "and raw_value is a complex type" do
+
+                  before do
+                    selector.send(method, "key", Mongoid::RawValue([{ foo: "1", "Bar" => [/baz/, BigDecimal('2'), 4..5] }, 3]))
+                  end
+
+                  it "returns the raw_value" do
+                    expect(selector["key"]).to eq([{ foo: "1", "Bar" => [/baz/, BigDecimal('2'), 4..5] }, 3])
+                  end
+                end
+              end
             end
           end
         end

data/spec/mongoid/criteria/queryable/smash_spec.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+# rubocop:todo all
 
 require "spec_helper"
 

data/spec/mongoid/criteria/queryable/storable_spec.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+# rubocop:todo all
 
 require "spec_helper"
 
@@ -67,41 +68,18 @@ describe Mongoid::Criteria::Queryable::Storable do
         end
       end
 
-      context "when broken_and feature flag is not set" do
-        config_override :broken_and, false
-
-        context '$and to query with $and onto query whose first one is not $and' do
-          let(:query) do
-            Mongoid::Query.new.where({'foo' => 'baz'}).where('$and' => [{zoom: 'zoom'}])
-          end
-
-          let(:modified) do
-            query.send(query_method, '$and', [{'foo' => 'bar'}])
-          end
-
-          it 'adds to existing $and' do
-            modified.selector.should == {
-              '$and' => [{'zoom' => 'zoom'}, {'foo' => 'bar'}], 'foo' => 'baz'}
-          end
+      context '$and to query with $and onto query whose first one is not $and' do
+        let(:query) do
+          Mongoid::Query.new.where({'foo' => 'baz'}).where('$and' => [{zoom: 'zoom'}])
         end
-      end
-
-      context "when broken_and feature flag is set" do
-        config_override :broken_and, true
 
-        context '$and to query with $and onto query whose first one is not $and' do
-          let(:query) do
-            Mongoid::Query.new.where({'foo' => 'baz'}).where('$and' => [{zoom: 'zoom'}])
-          end
-
-          let(:modified) do
-            query.send(query_method, '$and', [{'foo' => 'bar'}])
-          end
+        let(:modified) do
+          query.send(query_method, '$and', [{'foo' => 'bar'}])
+        end
 
-          it 'does not add to existing $and' do
-            modified.selector.should == {
-              '$and' => [{'foo' => 'bar'}], 'foo' => 'baz'}
-          end
+        it 'adds to existing $and' do
+          modified.selector.should == {
+            '$and' => [{'zoom' => 'zoom'}, {'foo' => 'bar'}], 'foo' => 'baz'}
         end
       end
     end

data/spec/mongoid/criteria/scopable_spec.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+# rubocop:todo all
 
 require "spec_helper"
 

data/spec/mongoid/criteria/translator_spec.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+# rubocop:todo all
 
 require "spec_helper"
 

data/spec/mongoid/criteria_projection_spec.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+# rubocop:todo all
 
 require "spec_helper"
 
@@ -21,7 +22,7 @@ describe Mongoid::Criteria do
         it "limits the returned fields" do
           expect {
             criteria.first.name
-          }.to raise_error(ActiveModel::MissingAttributeError)
+          }.to raise_error(Mongoid::Errors::AttributeNotLoaded, /Attempted to access attribute 'name' on Band which was not loaded/)
         end
 
         it "does not add _type to the fields" do
@@ -55,7 +56,7 @@ describe Mongoid::Criteria do
         it "excludes the non included fields" do
           expect {
             criteria.first.active
-          }.to raise_error(ActiveModel::MissingAttributeError)
+          }.to raise_error(Mongoid::Errors::AttributeNotLoaded, /Attempted to access attribute 'active' on Band which was not loaded/)
         end
 
         it "does not add _type to the fields" do
@@ -211,8 +212,8 @@ describe Mongoid::Criteria do
           expect(dictionary.description_translations.keys).to_not include('de', 'en')
         end
 
-        it 'raises an ActiveModel::MissingAttributeError when attempting to access the field' do
-          expect{dictionary.description}.to raise_error ActiveModel::MissingAttributeError
+        it 'raises an Mongoid::Errors::AttributeNotLoaded when attempting to access the field' do
+          expect{dictionary.description}.to raise_error Mongoid::Errors::AttributeNotLoaded
         end
       end
 
@@ -356,7 +357,7 @@ describe Mongoid::Criteria do
         it 'does not return id' do
           lambda do
             instance.id
-          end.should raise_error(ActiveModel::MissingAttributeError)
+          end.should raise_error(Mongoid::Errors::AttributeNotLoaded, /Attempted to access attribute 'id' on Shirt which was not loaded/)
         end
       end