propel_api 0.2.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fda016a4637d6921f4cbd7c1739aa12b652453b68f2bf00e627adda7a0384086
-  data.tar.gz: bee75517d7fee3d5f04536be44f5dba602bc5525076814a87e7b6f743a467913
+  metadata.gz: 8fb51b38b12561c709712a339a39cf3639cd1e8a16149f72c00f1566ee37bdcf
+  data.tar.gz: a90352463962e6385b895cf339195b6860f0d5e98ccf1c4e6e3237957f6895cf
 SHA512:
-  metadata.gz: a19fc6c6f6c4d12773081adc7a856d7f4fcb1977c56cb3686334d8e316bb29ef540829f0f25adcd61ae6285f10a010691f063b0003bad463bc8b8624afd05974
-  data.tar.gz: 65349f86faa2e171c64b20d6699f90dc56649ae1b8c888f64ac8c3b76f147bbd301689ac79a0032c71cc134e3d1c3e380f0f5a1fbb7a35c46ea0adaebd63fb44
+  metadata.gz: a2d01e1bcc8f7a749e8de4101d6f7be9dc5c4a7b2b0f2b7d5dc78e630dbba0102cedee82ff957cd210bde487a66c0b936a546b50c75f38e45db84dabcc74e6d0
+  data.tar.gz: 94dad0a33d4fd5af9327d42b21faa0a69bcdd7a018d914293db3643e68496b4b4f979d99cb14f8683b0df3040f6f15b55b6c4ff47c72015da9eaf6d336d5fb83

data/CHANGELOG.md

@@ -10,19 +10,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Planned Features
 - GraphQL adapter support
 
-## [0.2.0] - 2025-09-02
+## [0.2.1] - 2025-01-14
+
+### Fixed
+- **Dependency update**: Improved compatibility with PropelFacets 0.2.1
+  - API controllers now work correctly with fixed `for_organization` scope installation
+  - Resolves `NoMethodError` when using generated controllers in fresh Rails installations
 
-### BREAKING CHANGES
-- **Security-first API architecture**: Complete redesign of tenancy validation flow
-  - Invalid tenancy context (organization_id, agency_id) now returns 403 Forbidden instead of 422 Unprocessable Entity
-  - Security validation occurs before business validation (prevents information disclosure)
-  - Error response structure changed from `{"errors": {...}}` to `{"error": "...", "message": "...", "code": "..."}`
-- **Controller generation format**: Generated controllers now use foreign key format in permitted_params
-  - `permitted_params :organization` → `permitted_params :organization_id`
-  - Ensures proper strong parameter filtering for security validation
-- **Configuration dependency**: `agency_tenancy` configuration moved to PropelAuthentication
-  - Remove `PropelApi.configuration.agency_tenancy` from config files
-  - Agency tenancy now controlled entirely by PropelAuthentication
+## [0.2.0] - 2025-09-02
 
 ### Added
 - **Organization-level multi-tenancy security** - Complete data isolation between organizations
@@ -31,19 +26,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - `for_organization(org_id)` scope added to ApplicationRecord base class
   - Cross-organization data access completely blocked (show, update, delete return 404)
   - New records automatically assigned to authenticated user's organization
-  - Comprehensive security test suite covering all attack vectors
+  - Comprehensive security test suite with 12 tests covering all attack vectors
   - Zero impact on existing single-tenant applications
-- **Configurable auto-assignment**: Integration with PropelAuthentication tenancy configuration
-  - Respects `require_organization_id` and `require_user_id` settings from PropelAuthentication
-  - Helper methods: `require_organization_id?`, `require_user_id?` for configuration access
-- **Enhanced security validation**: Comprehensive unauthorized access protection
-  - Organization access validation with detailed error codes
-  - User assignment validation for admin delegation scenarios  
-  - Agency access validation with proper user permission checking
-- **Conditional test generation**: Tests now adapt behavior based on PropelAuthentication configuration
-  - Auto-assignment mode: Tests expect 201 Created with proper context assignment
-  - Strict mode: Tests expect 422 Unprocessable Entity when required fields missing
-  - Security tests: Tests expect 403 Forbidden for unauthorized access attempts
 
 ### Fixed
 - **Authentication namespace conflict resolved** - Renamed authentication concern to prevent module name collision
@@ -53,14 +37,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - Updated PropelFacets and Graphiti API controller templates
   - Improved method visibility: `authenticate_user`, `current_user`, and `extract_jwt_token` are now public methods
   - Enhanced flexibility for custom authentication scenarios (email notifications, audit logging, token refresh)
-- **Attribute introspection**: Fixed foreign key detection for User and other models with associations
-  - Database column introspection now properly generates foreign key format for permitted_params
-  - Association detection preserved for model relationship generation
-  - JSON field handling improved with proper `field: {}` syntax for nested objects
-- **Test data generation**: Enhanced User model test data generation
-  - Unique email and username generation to prevent fixture conflicts
-  - Proper field names for User model tests (email_address, username, password vs generic title)
-  - Model-specific test data patterns for comprehensive validation coverage
 
 ### Security
 - **Multi-tenant data isolation** - Zero-trust organization scoping prevents data leaks
@@ -71,17 +47,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - Database-level enforcement via ActiveRecord scopes
 
 ### Improved
-- **Multi-step security validation**: Three-phase validation for robust security
-  1. Security validation (403 for unauthorized access) 
-  2. Auto-assignment (based on configuration)
-  3. Final validation (422 for missing required fields)
 - **Authentication concern API design** - Better method organization and access patterns
   - `authenticate_user` - Public method for `before_action` callbacks
   - `current_user` - Public method for accessing authenticated user  
   - `current_organization_id` - Public method for accessing organization context
   - `extract_jwt_token` - Public method for custom authentication scenarios
   - Clean separation between public API and internal implementation
-- **Template reliability**: Attribute detection using generator attributes instead of database queries during generation
 
 ## [0.1.4] - 2025-08-15
 

data/lib/propel_api.rb

@@ -1,3 +1,3 @@
 module PropelApi
-  VERSION = "0.2.0"
+  VERSION = "0.2.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: propel_api
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
 platform: ruby
 authors:
 - Ryan Martin, Rafael Pivato, Chi Putera