mongoid 9.0.11 → 9.0.12

data/spec/mongoid/association/referenced/has_many/proxy_spec.rb

@@ -1832,6 +1832,151 @@ describe Mongoid::Association::Referenced::HasMany::Proxy do
             expect(person.posts).to eq([])
           end
         end
+
+        context 'when a document is appended with an id that is already loaded' do
+          # Iterating the association moves an appended document out of _added
+          # without adding it to _loaded, so the scan for matches and the
+          # removal that follows see different instances for the same id.
+          let(:person) { Person.create! }
+          let!(:post) { person.posts.create!(title: 'Testing') }
+          let(:reloaded) { Person.find(person._id) }
+
+          before do
+            reloaded.posts.to_a
+            reloaded.posts._target.push(
+              Post.new(_id: post._id, title: 'Testing', person_id: reloaded._id)
+            )
+          end
+
+          shared_examples 'removes the document once' do
+            it 'sets the association locally' do
+              reloaded.posts.send(method, conditions)
+              expect(reloaded.posts).to eq([])
+            end
+
+            it 'deletes the documents from the database' do
+              reloaded.posts.send(method, conditions)
+              expect(Post.count).to eq(0)
+            end
+          end
+
+          context 'when the conditions carry no regular expression' do
+            let(:conditions) { { title: 'Testing' } }
+
+            it_behaves_like 'removes the document once'
+          end
+
+          context 'when the conditions carry a regular expression' do
+            let(:conditions) { { title: /Testing/ } }
+
+            it_behaves_like 'removes the document once'
+          end
+        end
+
+        context 'when an appended document disagrees with the loaded one' do
+          # Only the appended instance matches, so the removal has to drop that
+          # id from both _loaded and _added. Removing by id and stopping at the
+          # first hash that has it would take the loaded instance instead and
+          # leave the unbound one behind.
+          let(:person) { Person.create! }
+          let!(:post) { person.posts.create!(title: 'Other') }
+          let(:reloaded) { Person.find(person._id) }
+
+          before do
+            reloaded.posts.to_a
+            reloaded.posts._target.push(
+              Post.new(_id: post._id, title: 'Testing', person_id: reloaded._id)
+            )
+          end
+
+          it 'deletes nothing from the database' do
+            expect(reloaded.posts.send(method, { title: /Testing/ })).to eq(0)
+            expect(Post.where(title: 'Other').count).to eq(1)
+          end
+
+          it 'leaves no unbound document in the association' do
+            reloaded.posts.send(method, { title: /Testing/ })
+            expect(reloaded.posts._target.in_memory.map(&:person_id)).not_to include(nil)
+          end
+        end
+
+        context 'when a nested selector is evaluated while the association loads' do
+          # Loading the association runs find callbacks, and application code in
+          # one of those can evaluate a selector of its own. A scope opened
+          # around the load would mark it as having nothing to bound, and that
+          # suppresses the decision for the nested selector too, leaving any
+          # pattern in it unguarded.
+          config_override :in_memory_regexp_time_limit, 5.0
+
+          let(:person) { Person.create! }
+          let(:reloaded) { Person.find(person._id) }
+
+          before do
+            person.posts.create!(title: 'Testing')
+            person.posts.create!(title: 'Keep')
+            reloaded
+          end
+
+          it 'leaves the nested scope free to establish its own budget' do
+            seen = []
+            allow(Mongoid::Factory).to receive(:from_db).and_wrap_original do |original, *args|
+              Mongoid::Matcher::RegexpBudget.open('title' => /Testing/) do
+                seen << Mongoid::Matcher::RegexpBudget.remaining
+              end
+              original.call(*args)
+            end
+
+            reloaded.posts.send(method, { title: 'Testing' })
+
+            expect(seen).not_to be_empty
+            expect(seen).not_to include(nil)
+          end
+        end
+
+        if method == :delete_all
+          context 'when the association has not been loaded' do
+            let(:person) { Person.create! }
+            let(:reloaded) { Person.find(person._id) }
+            let(:subscriber) { Mrss::EventSubscriber.new }
+
+            before do
+              person.posts.create!(title: 'Testing')
+              person.posts.create!(title: 'Test')
+              reloaded
+            end
+
+            def commands_for(conditions)
+              Person.collection.client.subscribe(Mongo::Monitoring::COMMAND, subscriber)
+              reloaded.posts.delete_all(conditions)
+              subscriber.started_events.map(&:command_name)
+            ensure
+              Person.collection.client.unsubscribe(Mongo::Monitoring::COMMAND, subscriber)
+            end
+
+            context 'when the conditions carry no regular expression' do
+              # Nothing to bound, so the scan for matches stays where it was,
+              # after the delete, where the association it loads comes back
+              # empty. Moving it ahead of the delete would transfer the whole
+              # association for an operation that need send nothing over the
+              # wire.
+              it 'deletes before loading the association' do
+                expect(commands_for(nil)).to eq(%w[ delete find ])
+              end
+            end
+
+            context 'when the conditions carry a regular expression' do
+              # The scan has to run under a budget, and before anything is
+              # deleted, so that a budget which runs out leaves the database
+              # untouched. What it scans is what is already in memory: loading
+              # would trade the matching cost the budget exists to bound for an
+              # unbounded amount of memory, since /.*/ is both cheap to supply
+              # and matches every document in the association.
+              it 'deletes without loading the association' do
+                expect(commands_for({ title: /Test/ })).to eq(%w[ delete ])
+              end
+            end
+          end
+        end
       end
 
       context 'when the association is polymorphic' do

data/spec/mongoid/attributes/nested_spec.rb

@@ -8,11 +8,38 @@ require_relative '../association/referenced/has_and_belongs_to_many_models'
 require_relative './nested_spec_models'
 
 describe Mongoid::Attributes::Nested do
+  # Expects the enclosing context to define `build_with_id`, taking an id
+  # value and returning the document built with it in nested attributes.
+  shared_examples 'rejects non-scalar ids' do |klass_name|
+    not_found = /not found for class #{klass_name}/
+
+    context 'when the id is an operator hash' do
+      it 'raises a document not found error' do
+        expect { build_with_id({ '$ne' => nil }) }
+          .to raise_error(Mongoid::Errors::DocumentNotFound, not_found)
+      end
+    end
+
+    context 'when the id is an array' do
+      it 'raises a document not found error' do
+        expect { build_with_id([ BSON::ObjectId.new ]) }
+          .to raise_error(Mongoid::Errors::DocumentNotFound, not_found)
+      end
+    end
+
+    context 'when the id is a malformed object id hash' do
+      it 'raises a document not found error' do
+        expect { build_with_id({ '$oid' => 'junk' }) }
+          .to raise_error(Mongoid::Errors::DocumentNotFound, not_found)
+      end
+    end
+  end
 
   describe ".accepts_nested_attributes_for" do
 
     context "when the autosave option is not defined" do
 
+
       let(:person) do
         Person.new
       end
@@ -202,6 +229,30 @@ describe Mongoid::Attributes::Nested do
           end
         end
       end
+
+      context 'when the id in the attributes is not a scalar' do
+        let(:person) { Person.create! }
+
+        def build_with_id(id)
+          person.update!(posts_attributes: { '0' => { id: id, title: 'Crafted' } })
+        end
+
+        context 'when the association is empty' do
+          include_examples 'rejects non-scalar ids', 'Post'
+        end
+
+        context 'when the association is not empty' do
+          before { person.posts.create!(title: 'Existing') }
+
+          include_examples 'rejects non-scalar ids', 'Post'
+        end
+
+        context 'when allow_reparenting_via_nested_attributes is true' do
+          config_override :allow_reparenting_via_nested_attributes, true
+
+          include_examples 'rejects non-scalar ids', 'Post'
+        end
+      end
     end
 
     context 'when the relation is a has-and-belongs-to-many' do
@@ -226,16 +277,100 @@ describe Mongoid::Attributes::Nested do
           )
         end
 
-        it "sets the nested attributes" do
-          expect(person.preferences.map(&:name)).to eq([preference.name])
+        context 'when allow_reparenting_via_nested_attributes is false' do
+          config_override :allow_reparenting_via_nested_attributes, false
+
+          it 'raises a document not found error' do
+            expect { person }.to raise_error(Mongoid::Errors::DocumentNotFound,
+                                             /Document\(s\) not found for class Preference/)
+          end
         end
 
-        it "updates attributes of existing document which is added to relation" do
-          preference_name = 'updated preference'
-          person = Person.new(
-            preferences_attributes: { 0 => { id: preference.id, name: preference_name } }
-          )
-          expect(person.preferences.map(&:name)).to eq([preference_name])
+        context 'when allow_reparenting_via_nested_attributes is true' do
+          config_override :allow_reparenting_via_nested_attributes, true
+
+          it 'sets the nested attributes' do
+            expect(person.preferences.map(&:name)).to eq([ preference.name ])
+          end
+
+          it 'updates attributes of existing document which is added to relation' do
+            preference_name = 'updated preference'
+            person = Person.new(
+              preferences_attributes: { 0 => { id: preference.id, name: preference_name } }
+            )
+            expect(person.preferences.map(&:name)).to eq([ preference_name ])
+          end
+
+          context 'when the id does not correspond to an existing document' do
+            let(:person) do
+              Person.new(
+                preferences_attributes: { 0 => { id: BSON::ObjectId.new, name: 'Ghost' } }
+              )
+            end
+
+            context 'when raise_not_found_error is true' do
+              config_override :raise_not_found_error, true
+
+              it 'raises a document not found error' do
+                expect { person }.to raise_error(Mongoid::Errors::DocumentNotFound,
+                                                 /Document\(s\) not found for class Preference/)
+              end
+            end
+
+            context 'when raise_not_found_error is false' do
+              config_override :raise_not_found_error, false
+
+              it 'raises a document not found error' do
+                expect { person }.to raise_error(Mongoid::Errors::DocumentNotFound,
+                                                 /Document\(s\) not found for class Preference/)
+              end
+            end
+          end
+        end
+
+        context 'when _destroy is true for a document not in the relation' do
+          before do
+            Person.send(:undef_method, :preferences_attributes=)
+            Person.accepts_nested_attributes_for :preferences, allow_destroy: true
+          end
+
+          let(:person) do
+            Person.new(
+              preferences_attributes: { 0 => { id: preference.id, _destroy: '1' } }
+            )
+          end
+
+          it 'does not raise UnknownAttribute' do
+            expect { person }.not_to raise_error
+          end
+
+          it 'does not add the document to the relation' do
+            expect(person.preferences).to be_empty
+          end
+        end
+      end
+
+      context 'when the id in the attributes is not a scalar' do
+        let(:target) { Person.create! }
+
+        def build_with_id(id)
+          target.update!(preferences_attributes: { 0 => { id: id, name: 'Crafted' } })
+        end
+
+        context 'when the association is empty' do
+          include_examples 'rejects non-scalar ids', 'Preference'
+        end
+
+        context 'when the association is not empty' do
+          before { target.preferences.create!(name: 'Existing') }
+
+          include_examples 'rejects non-scalar ids', 'Preference'
+        end
+
+        context 'when allow_reparenting_via_nested_attributes is true' do
+          config_override :allow_reparenting_via_nested_attributes, true
+
+          include_examples 'rejects non-scalar ids', 'Preference'
         end
       end
     end
@@ -3041,7 +3176,7 @@ describe Mongoid::Attributes::Nested do
                       { '0' =>
                         { 'id' => BSON::ObjectId.new.to_s, 'title' => 'Rogue' } }
                   end.to raise_error(Mongoid::Errors::DocumentNotFound,
-                                     /Document\(s\) not found for class Post/)
+                                     /Document not found for class Post/)
                 end
               end
             end
@@ -3076,7 +3211,7 @@ describe Mongoid::Attributes::Nested do
                   person.posts_attributes =
                     { 'foo' => { 'id' => 'test', 'title' => 'Test' } }
                 end.to raise_error(Mongoid::Errors::DocumentNotFound,
-                                   /Document\(s\) not found for class Post/)
+                                   /Document not found for class Post/)
               end
             end
           end
@@ -5025,4 +5160,63 @@ describe Mongoid::Attributes::Nested do
       end
     end
   end
+
+  context 'when an id in nested attributes belongs to another parent' do
+    let(:victim) { Person.create! }
+    let(:attacker) { Person.create! }
+
+    context 'when the association is a has-many' do
+      before do
+        Person.send(:undef_method, :posts_attributes=)
+        Person.accepts_nested_attributes_for :posts
+      end
+
+      let!(:victim_post) { victim.posts.create!(title: 'Private') }
+
+      it 'does not update the other parent\'s document' do
+        expect { attacker.update!(posts_attributes: { '0' => { id: victim_post.id, title: 'Overwritten' } }) }
+          .to raise_error(Mongoid::Errors::DocumentNotFound)
+        expect(victim_post.reload.title).to eq('Private')
+      end
+
+      it 'does not add the other parent\'s document to the association' do
+        expect { attacker.update!(posts_attributes: { '0' => { id: victim_post.id, title: 'Overwritten' } }) }
+          .to raise_error(Mongoid::Errors::DocumentNotFound)
+        expect(attacker.reload.posts).to be_empty
+      end
+
+      it 'does not update via a direct association assignment' do
+        expect { attacker.update!(posts: { '0' => { id: victim_post.id, title: 'Overwritten' } }) }
+          .to raise_error(Mongoid::Errors::DocumentNotFound)
+        expect(victim_post.reload.title).to eq('Private')
+      end
+    end
+
+    context 'when the association is a has-and-belongs-to-many' do
+      before do
+        Person.send(:undef_method, :preferences_attributes=)
+        Person.accepts_nested_attributes_for :preferences
+      end
+
+      let!(:victim_preference) { victim.preferences.create!(name: 'Private') }
+
+      it 'does not update the other parent\'s document' do
+        expect { attacker.update!(preferences_attributes: { '0' => { id: victim_preference.id, name: 'Overwritten' } }) }
+          .to raise_error(Mongoid::Errors::DocumentNotFound)
+        expect(victim_preference.reload.name).to eq('Private')
+      end
+
+      it 'does not add the other parent\'s document to the association' do
+        expect { attacker.update!(preferences_attributes: { '0' => { id: victim_preference.id, name: 'Overwritten' } }) }
+          .to raise_error(Mongoid::Errors::DocumentNotFound)
+        expect(attacker.reload.preferences).to be_empty
+      end
+
+      it 'does not update via a direct association assignment' do
+        expect { attacker.update!(preferences: { '0' => { id: victim_preference.id, name: 'Overwritten' } }) }
+          .to raise_error(Mongoid::Errors::DocumentNotFound)
+        expect(victim_preference.reload.name).to eq('Private')
+      end
+    end
+  end
 end

data/spec/mongoid/config/defaults_spec.rb

@@ -41,6 +41,18 @@ describe Mongoid::Config::Defaults do
       end
     end
 
+    shared_examples 'uses settings for 9.0' do
+      it 'uses settings for 9.0' do
+        expect(Mongoid.autosave_saves_unchanged_documents).to be true
+      end
+    end
+
+    shared_examples 'never allows reparenting via nested attributes' do
+      it 'leaves allow_reparenting_via_nested_attributes false' do
+        expect(Mongoid.allow_reparenting_via_nested_attributes).to be false
+      end
+    end
+
     context "when giving a valid version" do
 
       before do
@@ -57,6 +69,8 @@ describe Mongoid::Config::Defaults do
 
         it_behaves_like "uses settings for 8.0"
         it_behaves_like "uses settings for 8.1"
+        it_behaves_like 'uses settings for 9.0'
+        it_behaves_like 'never allows reparenting via nested attributes'
       end
 
       context "when the given version is 8.1" do
@@ -65,6 +79,8 @@ describe Mongoid::Config::Defaults do
 
         it_behaves_like "does not use settings for 8.0"
         it_behaves_like "uses settings for 8.1"
+        it_behaves_like 'uses settings for 9.0'
+        it_behaves_like 'never allows reparenting via nested attributes'
       end
 
       context "when the given version is 9.0" do
@@ -73,6 +89,8 @@ describe Mongoid::Config::Defaults do
 
         it_behaves_like "does not use settings for 8.0"
         it_behaves_like "does not use settings for 8.1"
+        it_behaves_like 'uses settings for 9.0'
+        it_behaves_like 'never allows reparenting via nested attributes'
       end
     end