prefixed_ids 1.8.1 → 1.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4a8f6545b87098d1b31cc7b509e962f5ffb1e57ab21a883905440d565dd0bcc8
-  data.tar.gz: 9e8d4a6413d67a47c64983207ef9c18b9132320174eeb7d0020512330eb9165e
+  metadata.gz: 1bac5b304f58877aefa5452f7e1532a65071b7f2eeadd6347a144326d86737cd
+  data.tar.gz: 91facf11c39db364b50ca88138429308436328f22446b19d8d6a6e2c835c51d8
 SHA512:
-  metadata.gz: b158bb40a94f3a6a0fc131cb5b5e7bc462d8ee6d5c08c0b74e760ea5e52ee56180fd447a5a7fb2dbca07de8f3f4f8d09ea0fdfb8ee50c3a16849760c6c01cf74
-  data.tar.gz: 2cd81c409ee3ef5b258de3ccd1344bdcfa1677afe92c3fcece799d4ad2c758efc43990111ca584fc955d1dd558d2102f9f3f39fd058379132493389bf8148bb8
+  metadata.gz: 48048178e689a688bae0f048a8b08fe246dc2b60de2a339e3458117d2945b15757b1c1888b655e2306883a78e345256cf23f565b29a94f72972cf4b8c7043883
+  data.tar.gz: 5ae3f646bd1df6a314e15c12a732257b1eb242058ec7775d75a60f9862ff5034e20d2eed190d88e4190456109d76754e4d56e7c970ef2a0e229d2d4aea9a1156

data/README.md

@@ -18,6 +18,7 @@ This gem works by hashing the record's original `:id` attribute using [`Hashids`
 Inspired by [Stripe's prefixed IDs](https://stripe.com/docs/api) in their API.
 
 ## 🚀 Installation
+
 Add this line to your application's Gemfile:
 
 ```ruby
@@ -34,39 +35,50 @@ class User < ApplicationRecord
 end
 ```
 
-This will generate a value like `user_1234abcd`.
+> [!NOTE]
+> Add `has_prefix_id` _before_ associations because it overrides `has_many` to include prefix ID helpers.
 
-Note: You should add `has_prefix_id` before associations because it overrides `has_many` to add prefix ID lookups.
+### Prefix ID Param
 
-##### Prefix ID Param
+By default, Prefixed IDs overrides `to_param` in the model to use prefix IDs.
 
-To retrieve the prefix ID, simply call:
+To get the prefix ID for a record:
 
 ```ruby
 @user.to_param
+#=> "user_12345abcd"
 ```
 
 If `to_param` override is disabled:
 
 ```ruby
 @user.prefix_id
+#=> "user_12345abcd"
 ```
 
 ##### Query by Prefixed ID
 
-To query using the prefixed ID, you can use either `find`, `find_by_prefix_id`, or `find_by_prefix_id!`:
+By default, prefixed_ids overrides `find` and `to_param` to seamlessly URLs automatically.
 
 ```ruby
+User.first.to_param
+#=> "user_5vJjbzXq9KrLEMm32iAnOP0xGDYk6dpe"
+
 User.find("user_5vJjbzXq9KrLEMm32iAnOP0xGDYk6dpe")
-User.find_by_prefix_id("user_5vJjbzXq9KrLEMm32iAnOP0xGDYk6dpe")
+#=> #<User>
 ```
 
-⚠️ Note that `find` still finds records by the primary key. Eg. `localhost/users/1` still works.
-If you're targeting security issues by masking the ID, make sure to use `find_by_prefix_id` and [add a salt](#salt).
+> [!NOTE]
+> `find` still finds records by primary key. For example, `User.find(1)` still works.
 
-We also override `to_param` by default so it'll be used in URLs automatically.
+You can also use `find_by_prefix_id` or `find_by_prefix_id!` when the `find` override is disabled:
+
+```ruby
+User.find_by_prefix_id("user_5vJjbzXq9KrLEMm32iAnOP0xGDYk6dpe") # Returns a User or nil
+User.find_by_prefix_id!("user_5vJjbzXq9KrLEMm32iAnOP0xGDYk6dpe") # Raises an exception if not found
+```
 
-To disable find and to_param overrides, simply pass in the options:
+To disable `find` and `to_param` overrides, pass the following options:
 
 ```ruby
 class User < ApplicationRecord
@@ -74,9 +86,12 @@ class User < ApplicationRecord
 end
 ```
 
+> [!NOTE]
+> If you're aiming to mask primary key IDs, make sure to use `find_by_prefix_id` and [add a salt](#salt). Prefix IDs are not a replacement for authorization, so always scope lookups to records the user is allowed to access.
+
 ##### Salt
 
-A salt is a secret value that makes it impossible to reverse engineer IDs. We recommend adding a salt to make your Prefix IDs unguessable.
+Without a salt, anyone can decode your Prefix IDs since they're only based on the table name. Adding a secret salt makes them much harder to decode or guess, but this is obfuscation, not encryption.
 
 ###### Global Salt
 
@@ -93,36 +108,19 @@ class User
 end
 ```
 
-### Generic Lookup By Prefix ID
+### Find Any Model By Prefix ID
 
-Imagine you have a prefixed ID but you don't know which model it belongs to.
+Imagine you have a prefixed ID but you don't know which model it belongs to:
 
 ```ruby
 PrefixedIds.find("user_5vJjbzXq9KrLEMm3")
 #=> #<User>
+
 PrefixedIds.find("acct_2iAnOP0xGDYk6dpe")
 #=> #<Account>
 ```
 
-### Exists
-
-You can check if a record exists by its prefixed ID:
-
-```ruby
-User.exists?("user_5vJjbzXq9KrLEMm3")
-#=> true
-```
-
-If given anything other than a prefixed ID, or `override_exists` is set to false, it will fall back to its original `exists?` method.
-
-```ruby
-class User < ApplicationRecord
-  has_prefix_id :user, override_exists: false
-end
-
-User.exists?("user_5vJjbzXq9KrLEMm3")
-#=> false
-```
+This works similarly to GlobalIDs.
 
 ### Customizing Prefix IDs
 
@@ -138,7 +136,7 @@ By default, `find` will accept both Prefix IDs and regular IDs. Setting `fallbac
 
 ## Development
 
-After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake test` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
+After checking out the repo, run `bundle install` to install dependencies. Then, run `rake test` to run the tests. You can also run `bin/rails console` for an interactive prompt that will allow you to experiment.
 
 To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and the created tag, and push the `.gem` file to [rubygems.org](https://rubygems.org).
 

data/Rakefile

@@ -3,8 +3,6 @@ require "bundler/setup"
 APP_RAKEFILE = File.expand_path("test/dummy/Rakefile", __dir__)
 load "rails/tasks/engine.rake"
 
-load "rails/tasks/statistics.rake"
-
 require "bundler/gem_tasks"
 
 require "rake/testtask"

data/lib/prefixed_ids/prefix_id.rb

@@ -19,8 +19,12 @@ module PrefixedIds
     # decode returns an array
     def decode(id, fallback: false)
       fallback_value = fallback ? id : nil
-      _, id_without_prefix = PrefixedIds.split_id(id, @delimiter)
-      decoded_hashid = @hashids.decode(id_without_prefix)
+      prefix, id_without_prefix = PrefixedIds.split_id(id, @delimiter)
+
+      # Reject IDs whose prefix isn't ours, even if the hash would decode
+      return fallback_value unless prefix == @prefix
+
+      decoded_hashid = decode_hashid(id_without_prefix)
 
       if !valid?(decoded_hashid)
         fallback_value
@@ -32,6 +36,13 @@ module PrefixedIds
 
     private
 
+    # Bad characters from user input shouldn't blow up finders
+    def decode_hashid(hashid)
+      @hashids.decode(hashid)
+    rescue Hashids::InputError
+      []
+    end
+
     def valid?(decoded_hashid)
       decoded_hashid.size >= 2 && decoded_hashid.first == TOKEN
     end

data/lib/prefixed_ids/version.rb

@@ -1,3 +1,3 @@
 module PrefixedIds
-  VERSION = "1.8.1"
+  VERSION = "1.9.0"
 end

data/lib/prefixed_ids.rb

@@ -16,18 +16,37 @@ module PrefixedIds
   mattr_accessor :models, default: {}
 
   def self.find(prefix_id)
-    prefix, _ = split_id(prefix_id)
+    prefix, = split_id(prefix_id)
     models.fetch(prefix).find_by_prefix_id(prefix_id)
   rescue KeyError
     raise Error, "Unable to find model with prefix `#{prefix}`. Available prefixes are: #{models.keys.join(", ")}"
   end
 
+  # Returns a decoded ID from a prefix_id
+  def self.decode_prefix_id(prefix_id)
+    return prefix_id if prefix_id.nil? || prefix_id.is_a?(Integer)
+    return prefix_id unless models.keys.any? { |key| prefix_id.to_s.start_with?("#{key}#{delimiter}") }
+
+    model_name, _ = split_id(prefix_id)
+
+    models.fetch(model_name).decode_prefix_id(prefix_id)
+  end
+
   # Splits a prefixed ID into its prefix and ID
   def self.split_id(prefix_id, delimiter = PrefixedIds.delimiter)
     prefix, _, id = prefix_id.to_s.rpartition(delimiter)
     [prefix, id]
   end
 
+  def self.register_prefix(prefix, model:)
+    # Compare names since code reloading creates a new class for the same model
+    if (existing_model = PrefixedIds.models[prefix]) && existing_model.name != model.name
+      raise Error, "Prefix #{prefix} already defined for model #{existing_model}"
+    end
+
+    PrefixedIds.models[prefix] = model
+  end
+
   # Adds `has_prefix_id` method
   module Rails
     extend ActiveSupport::Concern
@@ -35,6 +54,7 @@ module PrefixedIds
     included do
       class_attribute :_prefix_id
       class_attribute :_prefix_id_fallback
+      class_attribute :_prefix_id_override_exists
     end
 
     class_methods do
@@ -42,20 +62,46 @@ module PrefixedIds
         include Attribute
         include Finder if override_find
         include ToParam if override_param
-        include Exists if override_exists
+
         self._prefix_id = PrefixId.new(self, prefix, **options)
         self._prefix_id_fallback = fallback
+        self._prefix_id_override_exists = override_exists
 
         # Register with PrefixedIds to support PrefixedIds#find
-        PrefixedIds.models[prefix.to_s] = self
+        PrefixedIds.register_prefix(prefix.to_s, model: self)
       end
     end
   end
 
+  # Decodes prefix IDs passed to `exists?` unless disabled with `override_exists: false`
+  module Exists
+    # Only Strings are decoded. Rails calls exists? internally with Integer IDs and conditions, so those pass through
+    def exists?(conditions = :none)
+      return super unless _prefix_id_override_exists && _prefix_id.present? && conditions.is_a?(String)
+
+      id = _prefix_id.decode(conditions, fallback: _prefix_id_fallback)
+      id.nil? ? false : super(id)
+    end
+  end
+
   # Included when a module uses `has_prefix_id`
   module Attribute
     extend ActiveSupport::Concern
 
+    included do
+      extend Exists
+    end
+
+    # Methods added to relations and has_many associations
+    module RelationMethods
+      include Exists
+
+      # Without arguments, returns prefix IDs for the records in the relation
+      def prefix_ids(ids = nil)
+        klass.prefix_ids(ids || pluck(:id))
+      end
+    end
+
     class_methods do
       def find_by_prefix_id(id)
         find_by(id: _prefix_id.decode(id))
@@ -80,6 +126,16 @@ module PrefixedIds
       def decode_prefix_ids(ids)
         ids.map { |id| decode_prefix_id(id) }
       end
+
+      def relation
+        super.tap { |r| r.extend RelationMethods }
+      end
+
+      def has_many(*args, &block)
+        options = args.extract_options!
+        options[:extend] = Array(options[:extend]).push(RelationMethods)
+        super(*args, **options, &block)
+      end
     end
 
     def prefix_id
@@ -98,6 +154,7 @@ module PrefixedIds
         prefix_ids = ids.flatten.map do |id|
           prefix_id = _prefix_id.decode(id, fallback: _prefix_id_fallback)
           raise Error, "#{id} is not a valid prefix_id" if !_prefix_id_fallback && prefix_id.nil?
+
           prefix_id
         end
         prefix_ids = [prefix_ids] if ids.first.is_a?(Array)
@@ -109,6 +166,36 @@ module PrefixedIds
         super.tap { |r| r.extend ClassMethods }
       end
 
+      def belongs_to(*args, **options, &block)
+        association = super
+
+        name = args.first
+        reflection = association[name] || association[name.to_s]
+
+        return association if reflection.polymorphic?
+
+        # Skip helpers if the associated class can't be loaded yet, so Rails only raises when the association is used
+        klass = begin
+          reflection.klass
+        rescue NameError
+          nil
+        end
+        return association if klass.nil? || klass._prefix_id.blank?
+
+        generated_association_methods.class_eval <<-CODE, __FILE__, __LINE__ + 1
+          def #{name}_prefix_id
+            #{klass}._prefix_id.encode(#{reflection.foreign_key})
+          end
+
+          def #{name}_prefix_id=(prefix_id)
+            decoded_id = #{klass}._prefix_id.decode(prefix_id, fallback: #{klass}._prefix_id_fallback)
+            send("#{reflection.foreign_key}=", decoded_id)
+          end
+        CODE
+
+        association
+      end
+
       def has_many(*args, &block)
         options = args.extract_options!
         options[:extend] = Array(options[:extend]).push(ClassMethods)
@@ -124,18 +211,4 @@ module PrefixedIds
       _prefix_id.encode(id)
     end
   end
-
-  module Exists
-    extend ActiveSupport::Concern
-
-    class_methods do
-      def exists?(id)
-        if _prefix_id.present? && id.is_a?(String)
-          super(_prefix_id.decode(id))
-        else
-          super
-        end
-      end
-    end
-  end
 end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: prefixed_ids
 version: !ruby/object:Gem::Version
-  version: 1.8.1
+  version: 1.9.0
 platform: ruby
 authors:
 - Chris Oliver
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-08-01 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -65,7 +64,6 @@ metadata:
   homepage_uri: https://github.com/excid3/prefixed_ids
   source_code_uri: https://github.com/excid3/prefixed_ids
   changelog_uri: https://github.com/excid3/prefixed_ids
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -80,8 +78,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.13
-signing_key:
+rubygems_version: 4.0.20
 specification_version: 4
 summary: Prefixed IDs generates IDs with friendly prefixes for your models
 test_files: []