rails_admin 3.3.0 → 3.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 88dd830859396863dc21eab6dec1f7a63f1461e15b73a72affe62a9a869bf1c2
-  data.tar.gz: 71fd4db63b36b2b74963811c83fb1daed9a58df33a5f5d23aa4491895217fa43
+  metadata.gz: a18178de7305b2be5286d22268d911c84952d779d46210548887cf220f5c052d
+  data.tar.gz: d0f6a162ca88c76b4be204608f5d265843c8bb59a55d93fe0b5fd65575e7c36e
 SHA512:
-  metadata.gz: 162243c834a4170045a43debd41e8d87ba27c81130770243cbd659af4077f46e2c8557667638c40608de9d0f765cebfd415556f4fd610cd884968837a8d28fc6
-  data.tar.gz: cec35b0c4b4ab71d967ac933b7eb15f51170742ce978996f913873c4f180d069bb680682eb658f571c4641ff351217d9f8c7744b998e5f3d8933636cb1b40f64
+  metadata.gz: f93d7e8d4cab0ac54b62db959da642a0a83267234c92f7394cb2eb2ad44e821804fe7bd11a0a34eeb090eec10265dbe6abd06b0d3ce17c8992525976af513ba8
+  data.tar.gz: 2abe7c0eaca1c5ea064408bf389d7e108df43808e6551418c25945578e1d4d611a799a786b8de851b99ce86010f2615aa36a64b5d3b259c32f704f1b6ce627b9

data/Gemfile

@@ -2,7 +2,7 @@
 
 source 'https://rubygems.org'
 
-gem 'appraisal', '>= 2.0'
+gem 'appraisal', '>= 2.0', require: false
 gem 'devise', '~> 4.7'
 gem 'net-smtp', require: false
 gem 'rails'
@@ -18,12 +18,13 @@ end
 
 group :test do
   gem 'cancancan', '~> 3.0'
-  gem 'carrierwave', ['>= 2.0.0.rc', '< 3']
+  gem 'carrierwave', ['>= 2.2.1', '< 3']
   gem 'cuprite', '!= 0.15.1'
   gem 'database_cleaner-active_record', '>= 2.0', require: false
   gem 'dragonfly', '~> 1.0'
   gem 'factory_bot', '>= 4.2', '!= 6.4.5'
   gem 'generator_spec', '>= 0.8'
+  gem 'json', '< 3' # Workaround for json 3.0 quirks_mode removal
   gem 'kt-paperclip'
   gem 'launchy', '>= 2.2'
   gem 'mini_magick', '>= 3.4'

data/app/controllers/rails_admin/main_controller.rb

@@ -94,6 +94,17 @@ module RailsAdmin
       model_config.send(action).with(controller: self, view: view_context, object: @object).visible_fields
     end
 
+    # Memoized, as export renders through index, which switches @action
+    def serialization_schema
+      @serialization_schema ||= begin
+        section = %i[export show].include?(@action.key) ? @model_config.send(@action.key) : @model_config.list
+        RailsAdmin::SerializationSchema.new(
+          section.with(controller: self, view: view_context, object: @object || @abstract_model.model.new),
+          include_associations: @action.key == :export,
+        )
+      end
+    end
+
     def sanitize_params_for!(action, model_config = @model_config, target_params = params[@abstract_model.param_key])
       return unless target_params.present?
 

data/app/helpers/rails_admin/form_builder.rb

@@ -149,9 +149,10 @@ module RailsAdmin
   private
 
     def nested_field_association?(field, nested_in)
-      field.inverse_of.presence && nested_in.presence && field.inverse_of == nested_in.name &&
-        (@template.instance_variable_get(:@model_config).abstract_model == field.abstract_model ||
-         field.name == nested_in.inverse_of)
+      nested_in.presence &&
+        (field.name == nested_in.inverse_of ||
+         (field.inverse_of.presence && field.inverse_of == nested_in.name &&
+          @template.instance_variable_get(:@model_config).abstract_model == field.abstract_model))
     end
   end
 end

data/lib/generators/rails_admin/importmap_formatter.rb

@@ -12,6 +12,7 @@ module RailsAdmin
 
     def format
       imports = packager.import("rails_admin@#{RailsAdmin::Version.js}", from: 'jspm.io')
+      imports = imports[:imports] if imports.key?(:imports)
 
       # Use ESM compatible version to work around https://github.com/cljsjs/packages/issues/1579
       imports['@popperjs/core'].gsub!('lib/index.js', 'dist/esm/popper.js')

data/lib/rails_admin/adapters/active_record/association.rb

@@ -105,7 +105,7 @@ module RailsAdmin
         end
 
         def inverse_of
-          options[:inverse_of].try :to_sym
+          options[:inverse_of].try(:to_sym) || as
         end
 
         def read_only?

data/lib/rails_admin/adapters/active_record.rb

@@ -25,6 +25,10 @@ module RailsAdmin
         model.all
       end
 
+      def none
+        model.none
+      end
+
       def first(options = {}, scope = nil)
         all(options, scope).first
       end

data/lib/rails_admin/adapters/mongoid/association.rb

@@ -111,7 +111,7 @@ module RailsAdmin
         end
 
         def inverse_of
-          association.inverse_of.try :to_sym
+          association.inverse_of.try(:to_sym) || as
         end
 
         def read_only?

data/lib/rails_admin/adapters/mongoid.rb

@@ -39,6 +39,11 @@ module RailsAdmin
         model.scoped
       end
 
+      # Criteria#none is lost when merged into another criteria
+      def none
+        scoped.in(_id: [])
+      end
+
       def first(options = {}, scope = nil)
         all(options, scope).first
       end

data/lib/rails_admin/config/actions/export.rb

@@ -19,7 +19,8 @@ module RailsAdmin
             format = params[:json] && :json || params[:csv] && :csv || params[:xml] && :xml
             if format
               request.format = format
-              @schema = HashHelper.symbolize(params[:schema].slice(:except, :include, :methods, :only).permit!.to_h) if params[:schema] # to_json and to_xml expect symbols for keys AND values.
+              serialization_schema # built while @action is still export
+              @schema = serialization_schema.sanitize(params[:schema].slice(:include, :methods, :only).permit!.to_h) if params[:schema]
               @objects = list_entries(@model_config, :export)
               index
             else

data/lib/rails_admin/config/actions/index.rb

@@ -56,7 +56,7 @@ module RailsAdmin
                       @objects.collect { |object| {id: object.id.to_s, label: object.send(@model_config.object_label_method).to_s} }
                     end
                   else
-                    @objects.to_json(@schema)
+                    @objects.to_json(@schema || serialization_schema.default)
                   end
 
                 if params[:send_data]
@@ -67,7 +67,7 @@ module RailsAdmin
               end
 
               format.xml do
-                output = @objects.to_xml(@schema)
+                output = @objects.to_xml(@schema || serialization_schema.default)
                 if params[:send_data]
                   send_data output, filename: "#{params[:model_name]}_#{DateTime.now.strftime('%Y-%m-%d_%Hh%Mm%S')}.xml"
                 else

data/lib/rails_admin/config/actions/show.rb

@@ -21,7 +21,7 @@ module RailsAdmin
         register_instance_option :controller do
           proc do
             respond_to do |format|
-              format.json { render json: @object }
+              format.json { render json: @object.to_json(serialization_schema.default) }
               format.html { render @action.template_name }
             end
           end

data/lib/rails_admin/config/configurable.rb

@@ -9,7 +9,7 @@ module RailsAdmin
         base.send :extend, ClassMethods
       end
 
-      def has_option?(name) # rubocop:disable Naming/PredicateName
+      def has_option?(name) # rubocop:disable Naming/PredicatePrefix
         options = self.class.instance_variable_get('@config_options')
         options&.key?(name)
       end

data/lib/rails_admin/extensions/pundit/authorization_adapter.rb

@@ -44,7 +44,8 @@ module RailsAdmin
         def query(_action, abstract_model)
           @controller.send(:policy_scope, abstract_model.model.all)
         rescue ::Pundit::NotDefinedError
-          abstract_model.model.all
+          # Fail closed: a missing policy scope must not be treated as "no restriction".
+          abstract_model.none
         end
 
         # This is called in the new/create actions to determine the initial attributes for new

data/lib/rails_admin/support/serialization_schema.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+require 'rails_admin/support/hash_helper'
+
+module RailsAdmin
+  # The options passed to to_json/to_xml, limited to what a section exposes.
+  # It mirrors what the export form offers, as the form is what builds them.
+  class SerializationSchema
+    def initialize(section, include_associations:)
+      @section = section
+      @include_associations = include_associations
+    end
+
+    def default
+      sanitize(allowed)
+    end
+
+    # Anything not allowed is dropped, and `only` is always set, since leaving
+    # it out makes to_json/to_xml serialize every attribute.
+    def sanitize(requested)
+      requested = HashHelper.symbolize(requested)
+      schema = filter(requested, allowed)
+      if @include_associations && requested[:include].is_a?(Hash)
+        schema[:include] = requested[:include].each_with_object({}) do |(name, value), included|
+          next unless value.is_a?(Hash) && allowed[:include].key?(name)
+
+          included[name] = filter(value, allowed[:include][name])
+        end
+      end
+      schema
+    end
+
+  private
+
+    def allowed
+      @allowed ||= begin
+        fields = @section.visible_fields
+        names = field_names(fields.select { |f| !f.association? || f.association.polymorphic? })
+        if @include_associations
+          names[:include] = fields.select { |f| f.association? && !f.association.polymorphic? }.to_h do |field|
+            associated = field.associated_model_config.export.with(@section.bindings.merge(object: field.associated_model_config.abstract_model.model.new))
+            [field.name, field_names(associated.visible_fields.reject(&:association?))]
+          end
+        else
+          # The list shows these associations already, so their keys expose nothing more
+          names[:only].concat(fields.select { |f| f.association? && f.association.type == :belongs_to && !f.association.polymorphic? }.
+            flat_map { |f| Array(f.association.foreign_key) })
+        end
+        names
+      end
+    end
+
+    def field_names(fields)
+      fields.each_with_object({only: [], methods: []}) do |field, names|
+        list = field.virtual? ? names[:methods] : names[:only]
+        if field.association?
+          list << field.method_name.to_sym << field.association.foreign_type.to_sym
+        else
+          list << field.name
+        end
+      end
+    end
+
+    def filter(requested, permitted)
+      only = Array(requested[:only]) & permitted[:only]
+      # Mongoid serializes every attribute for an empty `only`
+      schema = {only: only.presence || [:__none__]}
+      schema[:methods] = Array(requested[:methods]) & permitted[:methods] if requested.key?(:methods)
+      schema
+    end
+  end
+end

data/lib/rails_admin/version.rb

@@ -4,7 +4,7 @@ module RailsAdmin
   class Version
     MAJOR = 3
     MINOR = 3
-    PATCH = 0
+    PATCH = 1
     PRE = nil
 
     class << self

data/lib/rails_admin.rb

@@ -10,6 +10,7 @@ require 'rails_admin/extensions/pundit'
 require 'rails_admin/extensions/paper_trail'
 require 'rails_admin/support/csv_converter'
 require 'rails_admin/support/hash_helper'
+require 'rails_admin/support/serialization_schema'
 require 'yaml'
 
 module RailsAdmin

data/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rails_admin",
-  "version": "3.3.0",
+  "version": "3.3.1",
   "description": "RailsAdmin is a Rails engine that provides an easy-to-use interface for managing your data.",
   "homepage": "https://github.com/railsadminteam/rails_admin",
   "license": "MIT",

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails_admin
 version: !ruby/object:Gem::Version
-  version: 3.3.0
+  version: 3.3.1
 platform: ruby
 authors:
 - Erik Michaels-Ober
@@ -9,10 +9,9 @@ authors:
 - Petteri Kaapa
 - Benoit Benezech
 - Mitsuhiro Shibuya
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-12-08 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activemodel-serializers-xml
@@ -216,7 +215,6 @@ files:
 - lib/rails_admin.rb
 - lib/rails_admin/abstract_model.rb
 - lib/rails_admin/adapters/active_record.rb
-- lib/rails_admin/adapters/active_record.rb.bak
 - lib/rails_admin/adapters/active_record/association.rb
 - lib/rails_admin/adapters/active_record/object_extension.rb
 - lib/rails_admin/adapters/active_record/property.rb
@@ -338,6 +336,7 @@ files:
 - lib/rails_admin/support/datetime.rb
 - lib/rails_admin/support/es_module_processor.rb
 - lib/rails_admin/support/hash_helper.rb
+- lib/rails_admin/support/serialization_schema.rb
 - lib/rails_admin/version.rb
 - lib/tasks/rails_admin.rake
 - package.json
@@ -491,8 +490,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 1.8.11
 requirements: []
-rubygems_version: 3.4.10
-signing_key:
+rubygems_version: 4.0.19
 specification_version: 4
 summary: Admin for Rails
 test_files: []

data/lib/rails_admin/adapters/active_record.rb.bak

@@ -1,348 +0,0 @@
-# frozen_string_literal: true
-
-require 'active_record'
-require 'rails_admin/adapters/active_record/association'
-require 'rails_admin/adapters/active_record/model_extension'
-require 'rails_admin/adapters/active_record/property'
-
-module RailsAdmin
-  module Adapters
-    module ActiveRecord
-      DISABLED_COLUMN_TYPES = %i[tsvector blob binary spatial hstore geometry].freeze
-
-      def model_with_extension
-        @model_with_extension ||=
-          begin
-            klass = Class.new(model) do
-              include ModelExtension
-            end
-            klass.instance_eval <<-RUBY, __FILE__, __LINE__+1
-              def name
-                "#{@model_name.to_s}"
-              end
-            RUBY
-            klass
-          end
-      end
-
-      def new(params = {})
-        model_with_extension.new(params)
-      end
-
-      def get(id, scope = nil)
-        scope = model_with_extension.merge(scope || scoped)
-        scope.where(primary_key => id).first
-      end
-
-      def scoped
-        model_with_extension.all
-      end
-
-      def first(options = {}, scope = nil)
-        all(options, scope).first
-      end
-
-      def all(options = {}, scope = nil)
-        scope = model_with_extension.merge(scope || scoped)
-        scope = scope.includes(options[:include]) if options[:include]
-        scope = scope.limit(options[:limit]) if options[:limit]
-        scope = bulk_scope(scope, options) if options[:bulk_ids]
-        scope = query_scope(scope, options[:query]) if options[:query]
-        scope = filter_scope(scope, options[:filters]) if options[:filters]
-        scope = scope.send(Kaminari.config.page_method_name, options[:page]).per(options[:per]) if options[:page] && options[:per]
-        scope = sort_scope(scope, options) if options[:sort]
-        scope
-      end
-
-      def count(options = {}, scope = nil)
-        all(options.merge(limit: false, page: false), scope).count(:all)
-      end
-
-      def destroy(objects)
-        Array.wrap(objects).each(&:destroy)
-      end
-
-      def associations
-        model.reflect_on_all_associations.collect do |association|
-          Association.new(association, model)
-        end
-      end
-
-      def properties
-        columns = model.columns.reject do |c|
-          c.type.blank? ||
-            DISABLED_COLUMN_TYPES.include?(c.type.to_sym) ||
-            c.try(:array)
-        end
-        columns.collect do |property|
-          Property.new(property, model)
-        end
-      end
-
-      def base_class
-        model.base_class
-      end
-
-      delegate :primary_key, :table_name, to: :model, prefix: false
-
-      def quoted_table_name
-        model.quoted_table_name
-      end
-
-      def quote_column_name(name)
-        model.connection.quote_column_name(name)
-      end
-
-      def encoding
-        adapter =
-          if ::ActiveRecord::Base.respond_to?(:connection_db_config)
-            ::ActiveRecord::Base.connection_db_config.configuration_hash[:adapter]
-          else
-            ::ActiveRecord::Base.connection_config[:adapter]
-          end
-        case adapter
-        when 'postgresql'
-          ::ActiveRecord::Base.connection.select_one("SELECT ''::text AS str;").values.first.encoding
-        when 'mysql2'
-          if RUBY_ENGINE == 'jruby'
-            ::ActiveRecord::Base.connection.select_one("SELECT '' AS str;").values.first.encoding
-          else
-            ::ActiveRecord::Base.connection.raw_connection.encoding
-          end
-        when 'oracle_enhanced'
-          ::ActiveRecord::Base.connection.select_one('SELECT dummy FROM DUAL').values.first.encoding
-        else
-          ::ActiveRecord::Base.connection.select_one("SELECT '' AS str;").values.first.encoding
-        end
-      end
-
-      def embedded?
-        false
-      end
-
-      def cyclic?
-        false
-      end
-
-      def adapter_supports_joins?
-        true
-      end
-
-    private
-
-      def bulk_scope(scope, options)
-        scope.where(primary_key => options[:bulk_ids])
-      end
-
-      def sort_scope(scope, options)
-        direction = options[:sort_reverse] ? :asc : :desc
-        case options[:sort]
-        when String, Symbol
-          scope.reorder("#{options[:sort]} #{direction}")
-        when Array
-          scope.reorder(options[:sort].zip(Array.new(options[:sort].size) { direction }).to_h)
-        when Hash
-          scope.reorder(options[:sort].map { |table_name, column| "#{table_name}.#{column}" }.
-            zip(Array.new(options[:sort].size) { direction }).to_h)
-        else
-          raise ArgumentError.new("Unsupported sort value: #{options[:sort]}")
-        end
-      end
-
-      class WhereBuilder
-        def initialize(scope)
-          @statements = []
-          @values = []
-          @tables = []
-          @scope = scope
-        end
-
-        def add(field, value, operator)
-          field.searchable_columns.flatten.each do |column_infos|
-            statement, value1, value2 = StatementBuilder.new(column_infos[:column], column_infos[:type], value, operator, @scope.connection.adapter_name).to_statement
-            @statements << statement if statement.present?
-            @values << value1 unless value1.nil?
-            @values << value2 unless value2.nil?
-            table, column = column_infos[:column].split('.')
-            @tables.push(table) if column
-          end
-        end
-
-        def build
-          scope = @scope.where(@statements.join(' OR '), *@values)
-          scope = scope.references(*@tables.uniq) if @tables.any?
-          scope
-        end
-      end
-
-      def query_scope(scope, query, fields = config.list.fields.select(&:queryable?))
-        if config.list.search_by
-          scope.send(config.list.search_by, query)
-        else
-          wb = WhereBuilder.new(scope)
-          fields.each do |field|
-            value = parse_field_value(field, query)
-            wb.add(field, value, field.search_operator)
-          end
-          # OR all query statements
-          wb.build
-        end
-      end
-
-      # filters example => {"string_field"=>{"0055"=>{"o"=>"like", "v"=>"test_value"}}, ...}
-      # "0055" is the filter index, no use here. o is the operator, v the value
-      def filter_scope(scope, filters, fields = config.list.fields.select(&:filterable?))
-        filters.each_pair do |field_name, filters_dump|
-          filters_dump.each_value do |filter_dump|
-            wb = WhereBuilder.new(scope)
-            field = fields.detect { |f| f.name.to_s == field_name }
-            value = parse_field_value(field, filter_dump[:v])
-
-            wb.add(field, value, (filter_dump[:o] || RailsAdmin::Config.default_search_operator))
-            # AND current filter statements to other filter statements
-            scope = wb.build
-          end
-        end
-        scope
-      end
-
-      def build_statement(column, type, value, operator)
-        StatementBuilder.new(column, type, value, operator, model.connection.adapter_name).to_statement
-      end
-
-      class StatementBuilder < RailsAdmin::AbstractModel::StatementBuilder
-        def initialize(column, type, value, operator, adapter_name)
-          super column, type, value, operator
-          @adapter_name = adapter_name
-        end
-
-      protected
-
-        def unary_operators
-          case @type
-          when :boolean
-            boolean_unary_operators
-          when :uuid
-            uuid_unary_operators
-          when :integer, :decimal, :float
-            numeric_unary_operators
-          else
-            generic_unary_operators
-          end
-        end
-
-      private
-
-        def generic_unary_operators
-          {
-            '_blank' => ["(#{@column} IS NULL OR #{@column} = '')"],
-            '_present' => ["(#{@column} IS NOT NULL AND #{@column} != '')"],
-            '_null' => ["(#{@column} IS NULL)"],
-            '_not_null' => ["(#{@column} IS NOT NULL)"],
-            '_empty' => ["(#{@column} = '')"],
-            '_not_empty' => ["(#{@column} != '')"],
-          }
-        end
-
-        def boolean_unary_operators
-          generic_unary_operators.merge(
-            '_blank' => ["(#{@column} IS NULL)"],
-            '_empty' => ["(#{@column} IS NULL)"],
-            '_present' => ["(#{@column} IS NOT NULL)"],
-            '_not_empty' => ["(#{@column} IS NOT NULL)"],
-          )
-        end
-        alias_method :numeric_unary_operators, :boolean_unary_operators
-        alias_method :uuid_unary_operators, :boolean_unary_operators
-
-        def range_filter(min, max)
-          if min && max && min == max
-            ["(#{@column} = ?)", min]
-          elsif min && max
-            ["(#{@column} BETWEEN ? AND ?)", min, max]
-          elsif min
-            ["(#{@column} >= ?)", min]
-          elsif max
-            ["(#{@column} <= ?)", max]
-          end
-        end
-
-        def build_statement_for_type
-          case @type
-          when :boolean                   then build_statement_for_boolean
-          when :integer, :decimal, :float then build_statement_for_integer_decimal_or_float
-          when :string, :text, :citext    then build_statement_for_string_or_text
-          when :enum                      then build_statement_for_enum
-          when :belongs_to_association    then build_statement_for_belongs_to_association
-          when :uuid                      then build_statement_for_uuid
-          end
-        end
-
-        def build_statement_for_boolean
-          case @value
-          when 'false', 'f', '0'
-            ["(#{@column} IS NULL OR #{@column} = ?)", false]
-          when 'true', 't', '1'
-            ["(#{@column} = ?)", true]
-          end
-        end
-
-        def column_for_value(value)
-          ["(#{@column} = ?)", value]
-        end
-
-        def build_statement_for_belongs_to_association
-          return if @value.blank?
-
-          ["(#{@column} = ?)", @value.to_i] if @value.to_i.to_s == @value
-        end
-
-        def build_statement_for_string_or_text
-          return if @value.blank?
-
-          return ["(#{@column} = ?)", @value] if ['is', '='].include?(@operator)
-
-          @value = @value.mb_chars.downcase unless %w[postgresql postgis].include? ar_adapter
-
-          @value =
-            case @operator
-            when 'default', 'like', 'not_like'
-              "%#{@value}%"
-            when 'starts_with'
-              "#{@value}%"
-            when 'ends_with'
-              "%#{@value}"
-            else
-              return
-            end
-
-          if %w[postgresql postgis].include? ar_adapter
-            if @operator == 'not_like'
-              ["(#{@column} NOT ILIKE ?)", @value]
-            else
-              ["(#{@column} ILIKE ?)", @value]
-            end
-          elsif @operator == 'not_like'
-            ["(LOWER(#{@column}) NOT LIKE ?)", @value]
-          else
-            ["(LOWER(#{@column}) LIKE ?)", @value]
-          end
-        end
-
-        def build_statement_for_enum
-          return if @value.blank?
-
-          ["(#{@column} IN (?))", Array.wrap(@value)]
-        end
-
-        def build_statement_for_uuid
-          column_for_value(@value) if /\A[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}\z/.match?(@value.to_s)
-        end
-
-        def ar_adapter
-          @adapter_name.downcase
-        end
-      end
-    end
-  end
-end