mongoid 9.1.0 → 9.1.2

data/spec/mongoid/attributes/nested_spec.rb

@@ -7,6 +7,33 @@ require_relative '../association/referenced/has_and_belongs_to_many_models'
 require_relative 'nested_spec_models'
 
 describe Mongoid::Attributes::Nested do
+  # Expects the enclosing context to define `build_with_id`, taking an id
+  # value and returning the document built with it in nested attributes.
+  shared_examples 'rejects non-scalar ids' do |klass_name|
+    not_found = /not found for class #{klass_name}/
+
+    context 'when the id is an operator hash' do
+      it 'raises a document not found error' do
+        expect { build_with_id({ '$ne' => nil }) }
+          .to raise_error(Mongoid::Errors::DocumentNotFound, not_found)
+      end
+    end
+
+    context 'when the id is an array' do
+      it 'raises a document not found error' do
+        expect { build_with_id([ BSON::ObjectId.new ]) }
+          .to raise_error(Mongoid::Errors::DocumentNotFound, not_found)
+      end
+    end
+
+    context 'when the id is a malformed object id hash' do
+      it 'raises a document not found error' do
+        expect { build_with_id({ '$oid' => 'junk' }) }
+          .to raise_error(Mongoid::Errors::DocumentNotFound, not_found)
+      end
+    end
+  end
+
   describe '.accepts_nested_attributes_for' do
     context 'when the autosave option is not defined' do
       let(:person) do
@@ -188,10 +215,110 @@ describe Mongoid::Attributes::Nested do
           it 'sets the nested attributes' do
             expect(person2.posts.map(&:title)).to eq([ 'Reparented!' ])
           end
+
+          context 'when the id does not correspond to an existing document' do
+            let(:person2) do
+              Person.create!(posts_attributes: { '0' => { id: BSON::ObjectId.new, title: 'Ghost' } })
+            end
+
+            context 'when raise_not_found_error is true' do
+              config_override :raise_not_found_error, true
+
+              it 'raises a document not found error' do
+                expect { person2 }.to raise_error(Mongoid::Errors::DocumentNotFound,
+                                                  /Document\(s\) not found for class Post/)
+              end
+            end
+
+            context 'when raise_not_found_error is false' do
+              config_override :raise_not_found_error, false
+
+              it 'raises a document not found error' do
+                expect { person2 }.to raise_error(Mongoid::Errors::DocumentNotFound,
+                                                  /Document\(s\) not found for class Post/)
+              end
+            end
+          end
+        end
+
+        context 'when _destroy is true for a document not in the relation' do
+          config_override :allow_reparenting_via_nested_attributes, true
+
+          before do
+            Person.send(:undef_method, :posts_attributes=)
+            Person.accepts_nested_attributes_for :posts, allow_destroy: true
+          end
+
+          let(:person3) do
+            Person.create!(
+              posts_attributes: { '0' => { id: post.id, _destroy: '1' } }
+            )
+          end
+
+          it 'does not raise UnknownAttribute' do
+            expect { person3 }.not_to raise_error
+          end
+
+          it 'does not add the document to the relation' do
+            expect(person3.posts).to be_empty
+          end
+        end
+      end
+
+      context 'when the id in the attributes is not a scalar' do
+        let(:person) { Person.create! }
+
+        def build_with_id(id)
+          person.update!(posts_attributes: { '0' => { id: id, title: 'Crafted' } })
+        end
+
+        context 'when the association is empty' do
+          include_examples 'rejects non-scalar ids', 'Post'
+        end
+
+        context 'when the association is not empty' do
+          before { person.posts.create!(title: 'Existing') }
+
+          include_examples 'rejects non-scalar ids', 'Post'
+        end
+
+        context 'when allow_reparenting_via_nested_attributes is true' do
+          config_override :allow_reparenting_via_nested_attributes, true
+
+          include_examples 'rejects non-scalar ids', 'Post'
         end
       end
     end
 
+    context 'when a has-many association uses a custom primary key' do
+      # A throwaway class, so that accepts_nested_attributes_for does not
+      # leave autosave callbacks and nested attributes on a shared model.
+      let(:company_class) do
+        stub_const('NestedSpecCompany', Class.new do
+          include Mongoid::Document
+
+          store_in collection: 'hmm_companies'
+          field :p, type: Integer
+          has_many :emails, primary_key: :p, foreign_key: :f, class_name: 'HmmEmail', inverse_of: nil
+          accepts_nested_attributes_for :emails
+        end)
+      end
+
+      after do
+        Mongoid.deregister_model(company_class)
+      end
+
+      it 'reports the parent primary key value in the error params' do
+        company = company_class.create!(p: 42)
+
+        expect do
+          company.emails_attributes = { '0' => { 'id' => 'missing', 'f' => 42 } }
+        end.to raise_error(Mongoid::Errors::DocumentNotFound) { |error|
+          expect(error.params).to eq({ _id: 'missing', 'f' => 42 })
+        }
+      end
+    end
+
     context 'when the relation is a has-and-belongs-to-many' do
       before do
         Person.send(:undef_method, :preferences_attributes=)
@@ -214,16 +341,100 @@ describe Mongoid::Attributes::Nested do
           )
         end
 
-        it 'sets the nested attributes' do
-          expect(person.preferences.map(&:name)).to eq([ preference.name ])
+        context 'when allow_reparenting_via_nested_attributes is false' do
+          config_override :allow_reparenting_via_nested_attributes, false
+
+          it 'raises a document not found error' do
+            expect { person }.to raise_error(Mongoid::Errors::DocumentNotFound,
+                                             /Document\(s\) not found for class Preference/)
+          end
         end
 
-        it 'updates attributes of existing document which is added to relation' do
-          preference_name = 'updated preference'
-          person = Person.new(
-            preferences_attributes: { 0 => { id: preference.id, name: preference_name } }
-          )
-          expect(person.preferences.map(&:name)).to eq([ preference_name ])
+        context 'when allow_reparenting_via_nested_attributes is true' do
+          config_override :allow_reparenting_via_nested_attributes, true
+
+          it 'sets the nested attributes' do
+            expect(person.preferences.map(&:name)).to eq([ preference.name ])
+          end
+
+          it 'updates attributes of existing document which is added to relation' do
+            preference_name = 'updated preference'
+            person = Person.new(
+              preferences_attributes: { 0 => { id: preference.id, name: preference_name } }
+            )
+            expect(person.preferences.map(&:name)).to eq([ preference_name ])
+          end
+
+          context 'when the id does not correspond to an existing document' do
+            let(:person) do
+              Person.new(
+                preferences_attributes: { 0 => { id: BSON::ObjectId.new, name: 'Ghost' } }
+              )
+            end
+
+            context 'when raise_not_found_error is true' do
+              config_override :raise_not_found_error, true
+
+              it 'raises a document not found error' do
+                expect { person }.to raise_error(Mongoid::Errors::DocumentNotFound,
+                                                 /Document\(s\) not found for class Preference/)
+              end
+            end
+
+            context 'when raise_not_found_error is false' do
+              config_override :raise_not_found_error, false
+
+              it 'raises a document not found error' do
+                expect { person }.to raise_error(Mongoid::Errors::DocumentNotFound,
+                                                 /Document\(s\) not found for class Preference/)
+              end
+            end
+          end
+        end
+
+        context 'when _destroy is true for a document not in the relation' do
+          before do
+            Person.send(:undef_method, :preferences_attributes=)
+            Person.accepts_nested_attributes_for :preferences, allow_destroy: true
+          end
+
+          let(:person) do
+            Person.new(
+              preferences_attributes: { 0 => { id: preference.id, _destroy: '1' } }
+            )
+          end
+
+          it 'does not raise UnknownAttribute' do
+            expect { person }.not_to raise_error
+          end
+
+          it 'does not add the document to the relation' do
+            expect(person.preferences).to be_empty
+          end
+        end
+      end
+
+      context 'when the id in the attributes is not a scalar' do
+        let(:target) { Person.create! }
+
+        def build_with_id(id)
+          target.update!(preferences_attributes: { 0 => { id: id, name: 'Crafted' } })
+        end
+
+        context 'when the association is empty' do
+          include_examples 'rejects non-scalar ids', 'Preference'
+        end
+
+        context 'when the association is not empty' do
+          before { target.preferences.create!(name: 'Existing') }
+
+          include_examples 'rejects non-scalar ids', 'Preference'
+        end
+
+        context 'when allow_reparenting_via_nested_attributes is true' do
+          config_override :allow_reparenting_via_nested_attributes, true
+
+          include_examples 'rejects non-scalar ids', 'Preference'
         end
       end
     end
@@ -4552,4 +4763,63 @@ describe Mongoid::Attributes::Nested do
       end
     end
   end
+
+  context 'when an id in nested attributes belongs to another parent' do
+    let(:victim) { Person.create! }
+    let(:attacker) { Person.create! }
+
+    context 'when the association is a has-many' do
+      before do
+        Person.send(:undef_method, :posts_attributes=)
+        Person.accepts_nested_attributes_for :posts
+      end
+
+      let!(:victim_post) { victim.posts.create!(title: 'Private') }
+
+      it 'does not update the other parent\'s document' do
+        expect { attacker.update!(posts_attributes: { '0' => { id: victim_post.id, title: 'Overwritten' } }) }
+          .to raise_error(Mongoid::Errors::DocumentNotFound)
+        expect(victim_post.reload.title).to eq('Private')
+      end
+
+      it 'does not add the other parent\'s document to the association' do
+        expect { attacker.update!(posts_attributes: { '0' => { id: victim_post.id, title: 'Overwritten' } }) }
+          .to raise_error(Mongoid::Errors::DocumentNotFound)
+        expect(attacker.reload.posts).to be_empty
+      end
+
+      it 'does not update via a direct association assignment' do
+        expect { attacker.update!(posts: { '0' => { id: victim_post.id, title: 'Overwritten' } }) }
+          .to raise_error(Mongoid::Errors::DocumentNotFound)
+        expect(victim_post.reload.title).to eq('Private')
+      end
+    end
+
+    context 'when the association is a has-and-belongs-to-many' do
+      before do
+        Person.send(:undef_method, :preferences_attributes=)
+        Person.accepts_nested_attributes_for :preferences
+      end
+
+      let!(:victim_preference) { victim.preferences.create!(name: 'Private') }
+
+      it 'does not update the other parent\'s document' do
+        expect { attacker.update!(preferences_attributes: { '0' => { id: victim_preference.id, name: 'Overwritten' } }) }
+          .to raise_error(Mongoid::Errors::DocumentNotFound)
+        expect(victim_preference.reload.name).to eq('Private')
+      end
+
+      it 'does not add the other parent\'s document to the association' do
+        expect { attacker.update!(preferences_attributes: { '0' => { id: victim_preference.id, name: 'Overwritten' } }) }
+          .to raise_error(Mongoid::Errors::DocumentNotFound)
+        expect(attacker.reload.preferences).to be_empty
+      end
+
+      it 'does not update via a direct association assignment' do
+        expect { attacker.update!(preferences: { '0' => { id: victim_preference.id, name: 'Overwritten' } }) }
+          .to raise_error(Mongoid::Errors::DocumentNotFound)
+        expect(victim_preference.reload.name).to eq('Private')
+      end
+    end
+  end
 end

data/spec/mongoid/clients/factory_spec.rb

@@ -331,6 +331,42 @@ describe Mongoid::Clients::Factory do
           end
         end
       end
+
+      context 'when bypass_auto_encryption is set' do
+        it 'warns that encryption is bypassed' do
+          expect(Mongoid::Warnings).to receive(:warn_bypass_auto_encryption)
+
+          described_class.send(
+            :build_auto_encryption_options,
+            { auto_encryption_options: { bypass_auto_encryption: true, schema_map: {} } },
+            database_id
+          )
+        end
+      end
+
+      context 'when bypass_auto_encryption is not set' do
+        it 'does not warn' do
+          expect(Mongoid::Warnings).not_to receive(:warn_bypass_auto_encryption)
+
+          described_class.send(
+            :build_auto_encryption_options,
+            { auto_encryption_options: { schema_map: {} } },
+            database_id
+          )
+        end
+      end
+
+      context 'when bypass_auto_encryption is false' do
+        it 'does not warn' do
+          expect(Mongoid::Warnings).not_to receive(:warn_bypass_auto_encryption)
+
+          described_class.send(
+            :build_auto_encryption_options,
+            { auto_encryption_options: { bypass_auto_encryption: false, schema_map: {} } },
+            database_id
+          )
+        end
+      end
     end
 
     context 'when no name is provided' do

data/spec/mongoid/config/defaults_spec.rb

@@ -38,6 +38,24 @@ describe Mongoid::Config::Defaults do
       end
     end
 
+    shared_examples 'uses settings for 9.0' do
+      it 'uses settings for 9.0' do
+        expect(Mongoid.autosave_saves_unchanged_documents).to be true
+      end
+    end
+
+    shared_examples 'does not use settings for 9.0' do
+      it 'does not use settings for 9.0' do
+        expect(Mongoid.autosave_saves_unchanged_documents).to be false
+      end
+    end
+
+    shared_examples 'never allows reparenting via nested attributes' do
+      it 'leaves allow_reparenting_via_nested_attributes false' do
+        expect(Mongoid.allow_reparenting_via_nested_attributes).to be false
+      end
+    end
+
     context 'when giving a valid version' do
       before do
         config.load_defaults(version)
@@ -52,6 +70,8 @@ describe Mongoid::Config::Defaults do
 
         it_behaves_like 'uses settings for 8.0'
         it_behaves_like 'uses settings for 8.1'
+        it_behaves_like 'uses settings for 9.0'
+        it_behaves_like 'never allows reparenting via nested attributes'
       end
 
       context 'when the given version is 8.1' do
@@ -59,6 +79,8 @@ describe Mongoid::Config::Defaults do
 
         it_behaves_like 'does not use settings for 8.0'
         it_behaves_like 'uses settings for 8.1'
+        it_behaves_like 'uses settings for 9.0'
+        it_behaves_like 'never allows reparenting via nested attributes'
       end
 
       context 'when the given version is 9.0' do
@@ -66,6 +88,17 @@ describe Mongoid::Config::Defaults do
 
         it_behaves_like 'does not use settings for 8.0'
         it_behaves_like 'does not use settings for 8.1'
+        it_behaves_like 'uses settings for 9.0'
+        it_behaves_like 'never allows reparenting via nested attributes'
+      end
+
+      context 'when the given version is 9.1' do
+        let(:version) { 9.1 }
+
+        it_behaves_like 'does not use settings for 8.0'
+        it_behaves_like 'does not use settings for 8.1'
+        it_behaves_like 'does not use settings for 9.0'
+        it_behaves_like 'never allows reparenting via nested attributes'
       end
     end