rails_admin 1.4.3 → 2.0.2

data/lib/rails_admin/extensions/cancancan/authorization_adapter.rb

@@ -2,38 +2,62 @@ module RailsAdmin
   module Extensions
     module CanCanCan
       # This adapter is for the CanCanCan[https://github.com/CanCanCommunity/cancancan] authorization library.
-      class AuthorizationAdapter < RailsAdmin::Extensions::CanCan::AuthorizationAdapter
+      class AuthorizationAdapter
+        module ControllerExtension
+          def current_ability
+            # use _current_user instead of default current_user so it works with
+            # whatever current user method is defined with RailsAdmin
+            @current_ability ||= @ability.new(_current_user)
+          end
+        end
+
+        # See the +authorize_with+ config method for where the initialization happens.
+        def initialize(controller, ability = ::Ability)
+          @controller = controller
+          @controller.instance_variable_set '@ability', ability
+          @controller.extend ControllerExtension
+          @controller.current_ability.authorize! :access, :rails_admin
+        end
+
+        # This method is called in every controller action and should raise an exception
+        # when the authorization fails. The first argument is the name of the controller
+        # action as a symbol (:create, :bulk_delete, etc.). The second argument is the
+        # AbstractModel instance that applies. The third argument is the actual model
+        # instance if it is available.
         def authorize(action, abstract_model = nil, model_object = nil)
           return unless action
-          subject = model_object || abstract_model && abstract_model.model
-          if authorized_for_dashboard_in_legacy_way?(action)
-            subject
-          else
-            @controller.current_ability.authorize!(*resolve_with_compatibility(action, subject))
-          end
+          action, subject = resolve_action_and_subject(action, abstract_model, model_object)
+          @controller.current_ability.authorize!(action, subject)
         end
 
+        # This method is called primarily from the view to determine whether the given user
+        # has access to perform the action on a given model. It should return true when authorized.
+        # This takes the same arguments as +authorize+. The difference is that this will
+        # return a boolean whereas +authorize+ will raise an exception when not authorized.
         def authorized?(action, abstract_model = nil, model_object = nil)
           return unless action
-          subject = model_object || abstract_model && abstract_model.model
-          authorized_for_dashboard_in_legacy_way?(action, true) ||
-            @controller.current_ability.can?(*resolve_with_compatibility(action, subject))
+          action, subject = resolve_action_and_subject(action, abstract_model, model_object)
+          @controller.current_ability.can?(action, subject)
         end
 
-      private
+        # This is called when needing to scope a database query. It is called within the list
+        # and bulk_delete/destroy actions and should return a scope which limits the records
+        # to those which the user can perform the given action on.
+        def query(action, abstract_model)
+          abstract_model.model.accessible_by(@controller.current_ability, action)
+        end
 
-        def authorized_for_dashboard_in_legacy_way?(action, silent = false)
-          return false unless action == :dashboard
-          legacy_ability = @controller.current_ability.permissions[:can][:dashboard]
-          if legacy_ability && (legacy_ability.empty? || legacy_ability.all?(&:empty?))
-            ActiveSupport::Deprecation.warn('RailsAdmin CanCanCan Ability with `can :dashboard` is old and support will be removed in the next major release, use `can :read, :dashboard` instead. See https://github.com/sferik/rails_admin/issues/2901') unless silent
-            true
-          else
-            false
-          end
+        # This is called in the new/create actions to determine the initial attributes for new
+        # records. It should return a hash of attributes which match what the user
+        # is authorized to create.
+        def attributes_for(action, abstract_model)
+          @controller.current_ability.attributes_for(action, abstract_model && abstract_model.model)
         end
 
-        def resolve_with_compatibility(action, subject)
+      private
+
+        def resolve_action_and_subject(action, abstract_model, model_object)
+          subject = model_object || abstract_model && abstract_model.model
           if subject
             [action, subject]
           else

data/lib/rails_admin/extensions/controller_extension.rb

@@ -0,0 +1,6 @@
+module RailsAdmin
+  module Extensions
+    module ControllerExtension
+    end
+  end
+end

data/lib/rails_admin/extensions/paper_trail/auditing_adapter.rb

@@ -23,7 +23,7 @@ module RailsAdmin
         end
 
         def username
-          @user_class.find(@version.whodunnit).try(:email) rescue nil || @version.whodunnit
+          (@user_class.find(@version.whodunnit).try(:email) rescue nil) || @version.whodunnit
         end
 
         def item
@@ -31,6 +31,12 @@ module RailsAdmin
         end
       end
 
+      module ControllerExtension
+        def user_for_paper_trail
+          _current_user.try(:id) || _current_user
+        end
+      end
+
       class AuditingAdapter
         COLUMN_MAPPING = {
           table: :item_type,
@@ -52,11 +58,7 @@ module RailsAdmin
 
         def self.setup
           raise('PaperTrail not found') unless defined?(::PaperTrail)
-          RailsAdmin::ApplicationController.class_eval do
-            def user_for_paper_trail
-              _current_user.try(:id) || _current_user
-            end
-          end
+          RailsAdmin::Extensions::ControllerExtension.send(:include, ControllerExtension)
         end
 
         def initialize(controller, user_class = 'User', version_class = '::Version')
@@ -112,22 +114,37 @@ module RailsAdmin
             sort_reverse = 'true'
           end
 
-          ar_model = model.model
           current_page = page.presence || '1'
 
-          versions = version_class_for(ar_model).where item_type: ar_model.name
-          versions = versions.where item_id: object.id if object
+          versions = object.nil? ? versions_for_model(model) : object.versions
           versions = versions.where('event LIKE ?', "%#{query}%") if query.present?
           versions = versions.order(sort_reverse == 'true' ? "#{sort} DESC" : sort)
           versions = all ? versions : versions.send(Kaminari.config.page_method_name, current_page).per(per_page)
           paginated_proxies = Kaminari.paginate_array([], total_count: versions.try(:total_count) || versions.count)
-          paginated_proxies = paginated_proxies.page(current_page).per(per_page)
+          paginated_proxies = paginated_proxies.send(
+            paginated_proxies.respond_to?(Kaminari.config.page_method_name) ? Kaminari.config.page_method_name : :page,
+            current_page,
+          ).per(per_page)
           versions.each do |version|
             paginated_proxies << VersionProxy.new(version, @user_class)
           end
           paginated_proxies
         end
 
+        def versions_for_model(model)
+          model_name = model.model.name
+          base_class_name = model.model.base_class.name
+
+          options =
+            if base_class_name == model_name
+              {item_type: model_name}
+            else
+              {item_type: base_class_name, item_id: model.model.all}
+            end
+
+          version_class_for(model.model).where(options)
+        end
+
         # PT can be configured to use [custom version
         # classes](https://github.com/paper-trail-gem/paper_trail#6a-custom-version-classes)
         #

data/lib/rails_admin/extensions/pundit/authorization_adapter.rb

@@ -7,9 +7,7 @@ module RailsAdmin
       class AuthorizationAdapter
         # This method is called first time only and used for setup
         def self.setup
-          RailsAdmin::ApplicationController.class_eval do
-            include ::Pundit
-          end unless RailsAdmin::ApplicationController.ancestors.include? 'Pundit'
+          RailsAdmin::Extensions::ControllerExtension.send(:include, ::Pundit)
         end
 
         # See the +authorize_with+ config method for where the initialization happens.

data/lib/rails_admin/support/csv_converter.rb

@@ -73,7 +73,7 @@ module RailsAdmin
       generator_options = (options[:generator] || {}).symbolize_keys.delete_if { |_, value| value.blank? }
       method = @objects.respond_to?(:find_each) ? :find_each : :each
 
-      CSV.generate(generator_options) do |csv|
+      CSV.generate(**generator_options) do |csv|
         csv << generate_csv_header unless options[:skip_header]
 
         @objects.send(method) do |object|

data/lib/rails_admin/version.rb

@@ -1,8 +1,8 @@
 module RailsAdmin
   class Version
-    MAJOR = 1
-    MINOR = 4
-    PATCH = 3
+    MAJOR = 2
+    MINOR = 0
+    PATCH = 2
     PRE = nil
 
     class << self

data/lib/rails_admin.rb

@@ -2,7 +2,6 @@ require 'rails_admin/engine'
 require 'rails_admin/abstract_model'
 require 'rails_admin/config'
 require 'rails_admin/extension'
-require 'rails_admin/extensions/cancan'
 require 'rails_admin/extensions/cancancan'
 require 'rails_admin/extensions/pundit'
 require 'rails_admin/extensions/paper_trail'