rails_admin 1.4.2 → 3.1.2

data/lib/rails_admin/engine.rb

@@ -1,66 +1,79 @@
-require 'font-awesome-rails'
-require 'jquery-rails'
-require 'jquery-ui-rails'
+# frozen_string_literal: true
+
 require 'kaminari'
 require 'nested_form'
-require 'rack-pjax'
 require 'rails'
 require 'rails_admin'
-require 'remotipart'
+require 'rails_admin/version'
+require 'turbo-rails'
 
 module RailsAdmin
   class Engine < Rails::Engine
     isolate_namespace RailsAdmin
 
+    attr_accessor :importmap
+
     config.action_dispatch.rescue_responses['RailsAdmin::ActionNotAllowed'] = :forbidden
 
-    initializer 'RailsAdmin precompile hook', group: :all do |app|
-      app.config.assets.precompile += %w(
-        rails_admin/rails_admin.js
-        rails_admin/rails_admin.css
-        rails_admin/jquery.colorpicker.js
-        rails_admin/jquery.colorpicker.css
-      )
-    end
+    initializer 'RailsAdmin reload config in development' do |app|
+      config.initializer_path = app.root.join('config/initializers/rails_admin.rb')
 
-    initializer 'RailsAdmin setup middlewares' do |app|
-      app.config.middleware.use Rack::Pjax
-    end
+      unless Rails.application.config.cache_classes
+        ActiveSupport::Reloader.before_class_unload do
+          RailsAdmin::Config.reload!
+        end
 
-    initializer 'RailsAdmin reload config in development' do
-      if Rails.application.config.cache_classes
-        if defined?(ActiveSupport::Reloader)
-          ActiveSupport::Reloader.before_class_unload do
-            RailsAdmin::Config.reset_all_models
-          end
-          # else
-          # For Rails 4 not implemented
+        reloader = app.config.file_watcher.new([config.initializer_path], []) do
+          # Do nothing, ActiveSupport::Reloader will trigger class_unload! anyway
         end
+
+        app.reloaders << reloader
+        app.reloader.to_run do
+          reloader.execute_if_updated { require_unload_lock! }
+        end
+        reloader.execute
       end
     end
 
-    rake_tasks do
-      Dir[File.join(File.dirname(__FILE__), '../tasks/*.rake')].each { |f| load f }
+    initializer 'RailsAdmin precompile hook', group: :all do |app|
+      case RailsAdmin.config.asset_source
+      when :sprockets
+        app.config.assets.precompile += %w[
+          rails_admin/application.js
+          rails_admin/application.css
+        ]
+        app.config.assets.paths << RailsAdmin::Engine.root.join('src')
+        require 'rails_admin/support/es_module_processor'
+        Sprockets.register_bundle_processor 'application/javascript', RailsAdmin::Support::ESModuleProcessor
+      when :importmap
+        self.importmap = Importmap::Map.new.draw(app.root.join('config/importmap.rails_admin.rb'))
+      end
     end
 
-    # Check for required middlewares, can be missing in Rails API mode
+    # Check for required middlewares, users may forget to use them in Rails API mode
     config.after_initialize do |app|
-      has_session_store = app.config.middleware.to_a.any? { |m| m.klass.try(:<=, ActionDispatch::Session::AbstractStore) } || ::Rails.version < '5.0'
+      has_session_store = app.config.middleware.to_a.any? do |m|
+        m.klass.try(:<=, ActionDispatch::Session::AbstractStore) ||
+          m.klass.try(:<=, ActionDispatch::Session::AbstractSecureStore) ||
+          m.klass.name =~ /^ActionDispatch::Session::/
+      end
       loaded = app.config.middleware.to_a.map(&:name)
-      required = %w(ActionDispatch::Cookies ActionDispatch::Flash Rack::MethodOverride)
+      required = %w[ActionDispatch::Cookies ActionDispatch::Flash Rack::MethodOverride]
       missing = required - loaded
       unless missing.empty? && has_session_store
         configs = missing.map { |m| "config.middleware.use #{m}" }
         configs << "config.middleware.use #{app.config.session_store.try(:name) || 'ActionDispatch::Session::CookieStore'}, #{app.config.session_options}" unless has_session_store
-        raise <<-EOM
-Required middlewares for RailsAdmin are not added
-To fix tihs, add
+        raise <<~ERROR
+          Required middlewares for RailsAdmin are not added
+          To fix this, add
 
-  #{configs.join("\n  ")}
+            #{configs.join("\n  ")}
 
-to config/application.rb.
-        EOM
+          to config/application.rb.
+        ERROR
       end
+
+      RailsAdmin::Version.warn_with_js_version
     end
   end
 end

data/lib/rails_admin/extension.rb

@@ -1,9 +1,12 @@
+# frozen_string_literal: true
+
+require 'rails_admin/extensions/controller_extension'
 
 module RailsAdmin
-  EXTENSIONS = [] # rubocop:disable MutableConstant
-  AUTHORIZATION_ADAPTERS = {} # rubocop:disable MutableConstant
-  AUDITING_ADAPTERS = {} # rubocop:disable MutableConstant
-  CONFIGURATION_ADAPTERS = {} # rubocop:disable MutableConstant
+  EXTENSIONS = [] # rubocop:disable Style/MutableConstant
+  AUTHORIZATION_ADAPTERS = {} # rubocop:disable Style/MutableConstant
+  AUDITING_ADAPTERS = {} # rubocop:disable Style/MutableConstant
+  CONFIGURATION_ADAPTERS = {} # rubocop:disable Style/MutableConstant
 
   # Extend RailsAdmin
   #
@@ -14,16 +17,19 @@ module RailsAdmin
 
     EXTENSIONS << extension_key
 
-    if options[:authorization]
-      AUTHORIZATION_ADAPTERS[extension_key] = extension_definition::AuthorizationAdapter
-    end
+    AUTHORIZATION_ADAPTERS[extension_key] = extension_definition::AuthorizationAdapter if options[:authorization]
 
-    if options[:configuration]
-      CONFIGURATION_ADAPTERS[extension_key] = extension_definition::ConfigurationAdapter
-    end
+    CONFIGURATION_ADAPTERS[extension_key] = extension_definition::ConfigurationAdapter if options[:configuration]
+
+    AUDITING_ADAPTERS[extension_key] = extension_definition::AuditingAdapter if options[:auditing]
+  end
 
-    if options[:auditing]
-      AUDITING_ADAPTERS[extension_key] = extension_definition::AuditingAdapter
+  # Setup all extensions for testing
+  def self.setup_all_extensions
+    (AUTHORIZATION_ADAPTERS.values + AUDITING_ADAPTERS.values).each do |klass|
+      klass.setup if klass.respond_to? :setup
+    rescue # rubocop:disable Style/RescueStandardError
+      # ignore errors
     end
   end
 end

data/lib/rails_admin/extensions/cancancan/authorization_adapter.rb

@@ -1,39 +1,82 @@
+# frozen_string_literal: true
+
 module RailsAdmin
   module Extensions
     module CanCanCan
       # This adapter is for the CanCanCan[https://github.com/CanCanCommunity/cancancan] authorization library.
-      class AuthorizationAdapter < RailsAdmin::Extensions::CanCan::AuthorizationAdapter
+      class AuthorizationAdapter
+        module ControllerExtension
+          def current_ability
+            # use _current_user instead of default current_user so it works with
+            # whatever current user method is defined with RailsAdmin
+            @current_ability ||= ability_class.new(_current_user)
+          end
+        end
+
+        include RailsAdmin::Config::Configurable
+
+        def self.setup
+          RailsAdmin::Extensions::ControllerExtension.include ControllerExtension
+        end
+
+        # See the +authorize_with+ config method for where the initialization happens.
+        def initialize(controller, ability = nil, &block)
+          @controller = controller
+          ability_class { ability } if ability
+          instance_eval(&block) if block
+
+          adapter = self
+          ControllerExtension.define_method(:ability_class) do
+            adapter.ability_class
+          end
+          @controller.current_ability.authorize! :access, :rails_admin
+        end
+
+        register_instance_option :ability_class do
+          Ability
+        end
+
+        # This method is called in every controller action and should raise an exception
+        # when the authorization fails. The first argument is the name of the controller
+        # action as a symbol (:create, :bulk_delete, etc.). The second argument is the
+        # AbstractModel instance that applies. The third argument is the actual model
+        # instance if it is available.
         def authorize(action, abstract_model = nil, model_object = nil)
           return unless action
-          subject = model_object || abstract_model && abstract_model.model
-          if authorized_for_dashboard_in_legacy_way?(action)
-            subject
-          else
-            @controller.current_ability.authorize!(*resolve_with_compatibility(action, subject))
-          end
+
+          action, subject = resolve_action_and_subject(action, abstract_model, model_object)
+          @controller.current_ability.authorize!(action, subject)
         end
 
+        # This method is called primarily from the view to determine whether the given user
+        # has access to perform the action on a given model. It should return true when authorized.
+        # This takes the same arguments as +authorize+. The difference is that this will
+        # return a boolean whereas +authorize+ will raise an exception when not authorized.
         def authorized?(action, abstract_model = nil, model_object = nil)
           return unless action
-          subject = model_object || abstract_model && abstract_model.model
-          authorized_for_dashboard_in_legacy_way?(action, true) ||
-            @controller.current_ability.can?(*resolve_with_compatibility(action, subject))
+
+          action, subject = resolve_action_and_subject(action, abstract_model, model_object)
+          @controller.current_ability.can?(action, subject)
         end
 
-      private
+        # This is called when needing to scope a database query. It is called within the list
+        # and bulk_delete/destroy actions and should return a scope which limits the records
+        # to those which the user can perform the given action on.
+        def query(action, abstract_model)
+          abstract_model.model.accessible_by(@controller.current_ability, action)
+        end
 
-        def authorized_for_dashboard_in_legacy_way?(action, silent = false)
-          return false unless action == :dashboard
-          legacy_ability = @controller.current_ability.permissions[:can][:dashboard]
-          if legacy_ability && (legacy_ability.empty? || legacy_ability.all?(&:empty?))
-            ActiveSupport::Deprecation.warn('RailsAdmin CanCanCan Ability with `can :dashboard` is old and support will be removed in the next major release, use `can :read, :dashboard` instead. See https://github.com/sferik/rails_admin/issues/2901') unless silent
-            true
-          else
-            false
-          end
+        # This is called in the new/create actions to determine the initial attributes for new
+        # records. It should return a hash of attributes which match what the user
+        # is authorized to create.
+        def attributes_for(action, abstract_model)
+          @controller.current_ability.attributes_for(action, abstract_model&.model)
         end
 
-        def resolve_with_compatibility(action, subject)
+      private
+
+        def resolve_action_and_subject(action, abstract_model, model_object)
+          subject = model_object || abstract_model&.model
           if subject
             [action, subject]
           else

data/lib/rails_admin/extensions/cancancan.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'rails_admin/extensions/cancancan/authorization_adapter'
 
 RailsAdmin.add_extension(:cancancan, RailsAdmin::Extensions::CanCanCan, authorization: true)

data/lib/rails_admin/extensions/controller_extension.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+module RailsAdmin
+  module Extensions
+    module ControllerExtension
+    end
+  end
+end

data/lib/rails_admin/extensions/paper_trail/auditing_adapter.rb

@@ -1,3 +1,7 @@
+# frozen_string_literal: true
+
+require 'active_support/core_ext/string/strip'
+
 module RailsAdmin
   module Extensions
     module PaperTrail
@@ -9,7 +13,7 @@ module RailsAdmin
 
         def message
           @message = @version.event
-          @version.respond_to?(:changeset) && @version.changeset.present? ? @message + ' [' + @version.changeset.to_a.collect { |c| c[0] + ' = ' + c[1][1].to_s }.join(', ') + ']' : @message
+          @version.respond_to?(:changeset) && @version.changeset.present? ? @message + ' [' + @version.changeset.to_a.collect { |c| "#{c[0]} = #{c[1][1]}" }.join(', ') + ']' : @message
         end
 
         def created_at
@@ -21,7 +25,11 @@ module RailsAdmin
         end
 
         def username
-          @user_class.find(@version.whodunnit).try(:email) rescue nil || @version.whodunnit
+          begin
+            @user_class.find(@version.whodunnit).try(:email)
+          rescue StandardError
+            nil
+          end || @version.whodunnit
         end
 
         def item
@@ -29,6 +37,12 @@ module RailsAdmin
         end
       end
 
+      module ControllerExtension
+        def user_for_paper_trail
+          _current_user.try(:id) || _current_user
+        end
+      end
+
       class AuditingAdapter
         COLUMN_MAPPING = {
           table: :item_type,
@@ -37,46 +51,63 @@ module RailsAdmin
           created_at: :created_at,
           message: :event,
         }.freeze
-        E_VERSION_MODEL_NOT_SET = <<-EOS.strip_heredoc.freeze
+        E_USER_CLASS_NOT_SET = <<~ERROR
+          Please set up PaperTrail's user class explicitly.
+
+              config.audit_with :paper_trail do
+                user_class { User }
+              end
+        ERROR
+        E_VERSION_MODEL_NOT_SET = <<~ERROR
           Please set up PaperTrail's version model explicitly.
 
-              config.audit_with :paper_trail, 'User', 'PaperTrail::Version'
+              config.audit_with :paper_trail do
+                version_class { PaperTrail::Version }
+              end
 
           If you have configured a model to use a custom version class
           (https://github.com/paper-trail-gem/paper_trail#6a-custom-version-classes)
-          that configuration will take precedence over what you specify in
-          `audit_with`.
-        EOS
+          that configuration will take precedence over what you specify in `audit_with`.
+        ERROR
+
+        include RailsAdmin::Config::Configurable
 
         def self.setup
-          raise('PaperTrail not found') unless defined?(::PaperTrail)
-          RailsAdmin::ApplicationController.class_eval do
-            def user_for_paper_trail
-              _current_user.try(:id) || _current_user
-            end
-          end
+          raise 'PaperTrail not found' unless defined?(::PaperTrail)
+
+          RailsAdmin::Extensions::ControllerExtension.include ControllerExtension
         end
 
-        def initialize(controller, user_class = 'User', version_class = '::Version')
+        def initialize(controller, user_class_name = nil, version_class_name = nil, &block)
           @controller = controller
-          @controller.send(:set_paper_trail_whodunnit) if @controller
-          begin
-            @user_class = user_class.to_s.constantize
-          rescue NameError
-            raise "Please set up Papertrail's user model explicitly. Ex: config.audit_with :paper_trail, 'User'"
-          end
+          @controller&.send(:set_paper_trail_whodunnit)
 
-          begin
-            @version_class = version_class.to_s.constantize
-          rescue NameError
-            raise E_VERSION_MODEL_NOT_SET
-          end
+          user_class { user_class_name.to_s.constantize } if user_class_name
+          version_class { version_class_name.to_s.constantize } if version_class_name
+
+          instance_eval(&block) if block
+        end
+
+        register_instance_option :user_class do
+          User
+        rescue NameError
+          raise E_USER_CLASS_NOT_SET
+        end
+
+        register_instance_option :version_class do
+          PaperTrail::Version
+        rescue NameError
+          raise E_VERSION_MODEL_NOT_SET
+        end
+
+        register_instance_option :sort_by do
+          {id: :desc}
         end
 
         def latest(count = 100)
-          @version_class.
-            order(id: :desc).includes(:item).limit(count).
-            collect { |version| VersionProxy.new(version, @user_class) }
+          version_class.
+            order(sort_by).includes(:item).limit(count).
+            collect { |version| VersionProxy.new(version, user_class) }
         end
 
         def delete_object(_object, _model, _user)
@@ -103,37 +134,52 @@ module RailsAdmin
 
         # - model - a RailsAdmin::AbstractModel
         def listing_for_model_or_object(model, object, query, sort, sort_reverse, all, page, per_page)
-          if sort.present?
-            sort = COLUMN_MAPPING[sort.to_sym]
-          else
-            sort = :created_at
-            sort_reverse = 'true'
-          end
+          sort =
+            if sort.present?
+              {COLUMN_MAPPING[sort.to_sym] => sort_reverse ? :desc : :asc}
+            else
+              sort_by
+            end
 
-          ar_model = model.model
           current_page = page.presence || '1'
 
-          versions = version_class_for(ar_model).where item_type: ar_model.name
-          versions = versions.where item_id: object.id if object
+          versions = object.nil? ? versions_for_model(model) : object.public_send(model.model.versions_association_name)
           versions = versions.where('event LIKE ?', "%#{query}%") if query.present?
-          versions = versions.order(sort_reverse == 'true' ? "#{sort} DESC" : sort)
+          versions = versions.order(sort)
           versions = all ? versions : versions.send(Kaminari.config.page_method_name, current_page).per(per_page)
           paginated_proxies = Kaminari.paginate_array([], total_count: versions.try(:total_count) || versions.count)
-          paginated_proxies = paginated_proxies.page(current_page).per(per_page)
+          paginated_proxies = paginated_proxies.send(
+            paginated_proxies.respond_to?(Kaminari.config.page_method_name) ? Kaminari.config.page_method_name : :page,
+            current_page,
+          ).per(per_page)
           versions.each do |version|
-            paginated_proxies << VersionProxy.new(version, @user_class)
+            paginated_proxies << VersionProxy.new(version, user_class)
           end
           paginated_proxies
         end
 
+        def versions_for_model(model)
+          model_name = model.model.name
+          base_class_name = model.model.base_class.name
+
+          options =
+            if base_class_name == model_name
+              {item_type: model_name}
+            else
+              {item_type: base_class_name, item_id: model.model.all}
+            end
+
+          version_class_for(model.model).where(options)
+        end
+
         # PT can be configured to use [custom version
         # classes](https://github.com/paper-trail-gem/paper_trail#6a-custom-version-classes)
         #
         # ```ruby
-        # has_paper_trail class_name: 'MyVersion'
+        # has_paper_trail versions: { class_name: 'MyVersion' }
         # ```
         def version_class_for(model)
-          model.paper_trail_options[:class_name].try(:constantize) || @version_class
+          model.paper_trail.version_class
         end
       end
     end

data/lib/rails_admin/extensions/paper_trail.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'rails_admin/extensions/paper_trail/auditing_adapter'
 
 RailsAdmin.add_extension(:paper_trail, RailsAdmin::Extensions::PaperTrail, auditing: true)

data/lib/rails_admin/extensions/pundit/authorization_adapter.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module RailsAdmin
   module Extensions
     module Pundit
@@ -7,9 +9,7 @@ module RailsAdmin
       class AuthorizationAdapter
         # This method is called first time only and used for setup
         def self.setup
-          RailsAdmin::ApplicationController.class_eval do
-            include ::Pundit
-          end unless RailsAdmin::ApplicationController.ancestors.include? 'Pundit'
+          RailsAdmin::Extensions::ControllerExtension.include defined?(::Pundit::Authorization) ? ::Pundit::Authorization : ::Pundit
         end
 
         # See the +authorize_with+ config method for where the initialization happens.
@@ -23,10 +23,9 @@ module RailsAdmin
         # AbstractModel instance that applies. The third argument is the actual model
         # instance if it is available.
         def authorize(action, abstract_model = nil, model_object = nil)
-          record = model_object || abstract_model && abstract_model.model
-          if action && !policy(record).send(action_for_pundit(action))
-            raise ::Pundit::NotAuthorizedError.new("not allowed to #{action} this #{record}")
-          end
+          record = model_object || abstract_model&.model
+          raise ::Pundit::NotAuthorizedError.new("not allowed to #{action} this #{record}") if action && !policy(record).send(action_for_pundit(action))
+
           @controller.instance_variable_set(:@_pundit_policy_authorized, true)
         end
 
@@ -35,7 +34,7 @@ module RailsAdmin
         # This takes the same arguments as +authorize+. The difference is that this will
         # return a boolean whereas +authorize+ will raise an exception when not authorized.
         def authorized?(action, abstract_model = nil, model_object = nil)
-          record = model_object || abstract_model && abstract_model.model
+          record = model_object || abstract_model&.model
           policy(record).send(action_for_pundit(action)) if action
         end
 
@@ -52,7 +51,7 @@ module RailsAdmin
         # records. It should return a hash of attributes which match what the user
         # is authorized to create.
         def attributes_for(action, abstract_model)
-          record = abstract_model && abstract_model.model
+          record = abstract_model&.model
           policy(record).try(:attributes_for, action) || {}
         end
 

data/lib/rails_admin/extensions/pundit.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'rails_admin/extensions/pundit/authorization_adapter'
 
 RailsAdmin.add_extension(:pundit, RailsAdmin::Extensions::Pundit, authorization: true)

data/lib/rails_admin/support/csv_converter.rb

@@ -1,11 +1,13 @@
-# encoding: UTF-8
+# frozen_string_literal: true
+
 require 'csv'
 
 module RailsAdmin
   class CSVConverter
-    def initialize(objects = [], schema = {})
+    def initialize(objects = [], schema = nil)
       @fields = []
       @associations = []
+      schema ||= {}
 
       return self if (@objects = objects).blank?
 
@@ -13,12 +15,14 @@ module RailsAdmin
       @abstract_model = RailsAdmin::AbstractModel.new(@model)
       @model_config = @abstract_model.config
       @methods = [(schema[:only] || []) + (schema[:methods] || [])].flatten.compact
-      @fields = @methods.collect { |m| export_fields_for(m).first }
+      @fields = @methods.collect { |m| export_field_for(m) }.compact
       @empty = ::I18n.t('admin.export.empty_value_for_associated_objects')
       schema_include = schema.delete(:include) || {}
 
       @associations = schema_include.each_with_object({}) do |(key, values), hash|
-        association = association_for(key)
+        association = export_field_for(key)
+        next unless association&.association?
+
         model_config = association.associated_model_config
         abstract_model = model_config.abstract_model
         methods = [(values[:only] || []) + (values[:methods] || [])].flatten.compact
@@ -28,20 +32,25 @@ module RailsAdmin
           model: abstract_model.model,
           abstract_model: abstract_model,
           model_config: model_config,
-          fields: methods.collect { |m| export_fields_for(m, model_config).first },
+          fields: methods.collect { |m| export_field_for(m, model_config) }.compact,
         }
         hash
       end
     end
 
     def to_csv(options = {})
+      if CSV::VERSION == '3.0.2'
+        raise <<~MSG
+          CSV library bundled with Ruby 2.6.0 has encoding issue, please upgrade Ruby to 2.6.1 or later.
+          https://github.com/ruby/csv/issues/62
+        MSG
+      end
+
       options = HashWithIndifferentAccess.new(options)
       encoding_to = Encoding.find(options[:encoding_to]) if options[:encoding_to].present?
 
       csv_string = generate_csv_string(options)
-      if encoding_to
-        csv_string = csv_string.encode(encoding_to, invalid: :replace, undef: :replace, replace: '?')
-      end
+      csv_string = csv_string.encode(encoding_to, invalid: :replace, undef: :replace, replace: '?') if encoding_to
 
       # Add a BOM for utf8 encodings, helps with utf8 auto-detect for some versions of Excel.
       # Don't add if utf8 but user don't want to touch input encoding:
@@ -55,19 +64,15 @@ module RailsAdmin
 
   private
 
-    def association_for(key)
-      export_fields_for(key).detect(&:association?)
-    end
-
-    def export_fields_for(method, model_config = @model_config)
-      model_config.export.fields.select { |f| f.name == method }
+    def export_field_for(method, model_config = @model_config)
+      model_config.export.fields.detect { |f| f.name == method }
     end
 
     def generate_csv_string(options)
       generator_options = (options[:generator] || {}).symbolize_keys.delete_if { |_, value| value.blank? }
       method = @objects.respond_to?(:find_each) ? :find_each : :each
 
-      CSV.generate(generator_options) do |csv|
+      CSV.generate(**generator_options) do |csv|
         csv << generate_csv_header unless options[:skip_header]
 
         @objects.send(method) do |object|