rails_admin 4.0.0.beta → 4.0.0.beta2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 265b6c74c33bfe7712068b6a22213f0cf0bce3a32bde103dd079551e3545ff50
-  data.tar.gz: 00714d31e5cdb32374e787bbdae8bd8b072284ced7b8528c0341f7dd0cec33ba
+  metadata.gz: 4ac4367d2e50b1a9c0edbfde3e76b5bd8c8e31ece5148117d95fc770fcb55680
+  data.tar.gz: 95822b85925077cb76677ccc514f404f34a4a25b1197a34cf48e56d4e9294445
 SHA512:
-  metadata.gz: 10f275394cb1a715e526fcf04e2df6f1a8e9e3ba3a43aaa7b0f24e5787d6dd37281b882a1672037d584d0e80438eb0cd4545d2fec6bdf8e2b8d89380cf7de9af
-  data.tar.gz: acac945ddc87533cb55225201fb79508f99febbda2f4758fd3ed61f193fca4c736a90a29e3f21386903d978055eb84c224f62932709d6e49c75dc80007025bb1
+  metadata.gz: 502b9d17e9e740a3ae0535e464e20beea25dcf15a790a589c683bd13a03dd7255532f7476b4071f8a6a80d4ac3ddd9942898c47e832d6f0fc4edfd6cb6e5a20a
+  data.tar.gz: 1ea176e0878e1457f3c12410060755ab6aee5b1ee2ca658878253a67f92d30b5f7aa59f732a13d2a0e55f54fd60c6fd101e615c80416394908e1c33f4d603f65

data/app/controllers/rails_admin/main_controller.rb

@@ -94,6 +94,17 @@ module RailsAdmin
       model_config.send(action).with(controller: self, view: view_context, object: @object).visible_fields
     end
 
+    # Memoized, as export renders through index, which switches @action
+    def serialization_schema
+      @serialization_schema ||= begin
+        section = %i[export show].include?(@action.key) ? @model_config.send(@action.key) : @model_config.list
+        RailsAdmin::SerializationSchema.new(
+          section.with(controller: self, view: view_context, object: @object || @abstract_model.dummy_record),
+          include_associations: @action.key == :export,
+        )
+      end
+    end
+
     def sanitize_params_for!(action, model_config = @model_config, target_params = params[@abstract_model.param_key])
       return unless target_params.present?
 

data/lib/rails_admin/abstract_model.rb

@@ -114,7 +114,7 @@ module RailsAdmin
              :attribute_length_options, :attribute_enum_values, :dummy_record,
              to: :reflection
 
-    delegate :new, :get, :first, :all, :count, :destroy, :scoped, :where, :read, :save, :each_record,
+    delegate :new, :get, :first, :all, :count, :destroy, :scoped, :none, :where, :read, :save, :each_record,
              :each_associated_children, :format_id, :parse_id,
              :serialize_attribute, :deserialize_attribute,
              :sort_expression, :search_column, :parse_object_id,

data/lib/rails_admin/adapters/mongoid/repository.rb

@@ -31,6 +31,11 @@ module RailsAdmin
           model.scoped
         end
 
+        # Criteria#none is lost when merged into another criteria
+        def none
+          scoped.in(_id: [])
+        end
+
         # Mongoid's #attributes holds what the document actually carries, so an
         # attribute that was never set is not in there and the method wins.
         def read(record, name)

data/lib/rails_admin/adapters/repository.rb

@@ -19,6 +19,13 @@ module RailsAdmin
       delegate :model, :config, :associations, :primary_key, :primary_keys, :table_name,
                :quoted_table_name, :quote_column_name, to: :abstract_model
 
+      # A scope matching no record, which an authorization adapter returns to
+      # deny all of them. It is merged into the list's scope, so it has to
+      # survive a merge.
+      def none
+        scoped.none
+      end
+
       # Yield the records of a scope one at a time, in the order it is sorted in,
       # without holding all of them at once. What an export walks.
       #

data/lib/rails_admin/config/actions/export.rb

@@ -19,7 +19,8 @@ module RailsAdmin
             format = params[:json] && :json || params[:csv] && :csv || params[:xml] && :xml
             if format
               request.format = format
-              @schema = HashHelper.symbolize(params[:schema].slice(:except, :include, :methods, :only).permit!.to_h) if params[:schema] # to_json and to_xml expect symbols for keys AND values.
+              serialization_schema # built while @action is still export
+              @schema = serialization_schema.sanitize(params[:schema].slice(:include, :methods, :only).permit!.to_h) if params[:schema]
               @objects = list_entries(@model_config, :export)
               index
             else

data/lib/rails_admin/config/actions/index.rb

@@ -56,7 +56,7 @@ module RailsAdmin
                       @objects.collect { |object| {id: object.id.to_s, label: @model_config.object_label(object).to_s} }
                     end
                   else
-                    @objects.to_json(@schema)
+                    @objects.to_json(@schema || serialization_schema.default)
                   end
 
                 if params[:send_data]
@@ -67,7 +67,7 @@ module RailsAdmin
               end
 
               format.xml do
-                output = @objects.to_xml(@schema)
+                output = @objects.to_xml(@schema || serialization_schema.default)
                 if params[:send_data]
                   send_data output, filename: "#{params[:model_name]}_#{DateTime.now.strftime('%Y-%m-%d_%Hh%Mm%S')}.xml"
                 else

data/lib/rails_admin/config/actions/show.rb

@@ -22,7 +22,7 @@ module RailsAdmin
           proc do
             respond_to do |format|
               format.html { render @action.template_name }
-              format.json { render json: @object }
+              format.json { render json: @object.to_json(serialization_schema.default) }
             end
           end
         end

data/lib/rails_admin/extensions/pundit/authorization_adapter.rb

@@ -44,7 +44,8 @@ module RailsAdmin
         def query(_action, abstract_model)
           @controller.send(:policy_scope, abstract_model.scoped)
         rescue ::Pundit::NotDefinedError
-          abstract_model.scoped
+          # Fail closed: a missing policy scope must not be treated as "no restriction".
+          abstract_model.none
         end
 
         # This is called in the new/create actions to determine the initial attributes for new

data/lib/rails_admin/support/serialization_schema.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+require 'rails_admin/support/hash_helper'
+
+module RailsAdmin
+  # The options passed to to_json/to_xml, limited to what a section exposes.
+  # It mirrors what the export form offers, as the form is what builds them.
+  class SerializationSchema
+    def initialize(section, include_associations:)
+      @section = section
+      @include_associations = include_associations
+    end
+
+    def default
+      sanitize(allowed)
+    end
+
+    # Anything not allowed is dropped, and `only` is always set, since leaving
+    # it out makes to_json/to_xml serialize every attribute.
+    def sanitize(requested)
+      requested = HashHelper.symbolize(requested)
+      schema = filter(requested, allowed)
+      if @include_associations && requested[:include].is_a?(Hash)
+        schema[:include] = requested[:include].each_with_object({}) do |(name, value), included|
+          next unless value.is_a?(Hash) && allowed[:include].key?(name)
+
+          included[name] = filter(value, allowed[:include][name])
+        end
+      end
+      schema
+    end
+
+  private
+
+    def allowed
+      @allowed ||= begin
+        fields = @section.visible_fields
+        names = field_names(fields.select { |f| !f.association? || f.association.polymorphic? })
+        if @include_associations
+          names[:include] = fields.select { |f| f.association? && !f.association.polymorphic? }.to_h do |field|
+            associated = field.associated_model_config.export.with(@section.bindings.merge(object: field.associated_model_config.abstract_model.dummy_record))
+            [field.name, field_names(associated.visible_fields.reject(&:association?))]
+          end
+        else
+          # The list shows these associations already, so their keys expose nothing more
+          names[:only].concat(fields.select { |f| f.association? && f.association.type == :belongs_to && !f.association.polymorphic? }.
+            flat_map { |f| Array(f.association.foreign_key) })
+        end
+        names
+      end
+    end
+
+    def field_names(fields)
+      fields.each_with_object({only: [], methods: []}) do |field, names|
+        list = field.virtual? ? names[:methods] : names[:only]
+        if field.association?
+          list << field.method_name.to_sym << field.association.foreign_type.to_sym
+        else
+          list << field.name
+        end
+      end
+    end
+
+    def filter(requested, permitted)
+      only = Array(requested[:only]) & permitted[:only]
+      # Mongoid serializes every attribute for an empty `only`
+      schema = {only: only.presence || [:__none__]}
+      schema[:methods] = Array(requested[:methods]) & permitted[:methods] if requested.key?(:methods)
+      schema
+    end
+  end
+end

data/lib/rails_admin/version.rb

@@ -5,7 +5,7 @@ module RailsAdmin
     MAJOR = 4
     MINOR = 0
     PATCH = 0
-    PRE = 'beta'
+    PRE = 'beta2'
 
     class << self
       # @return [String]

data/lib/rails_admin.rb

@@ -10,6 +10,7 @@ require 'rails_admin/extensions/pundit'
 require 'rails_admin/extensions/paper_trail'
 require 'rails_admin/support/csv_converter'
 require 'rails_admin/support/hash_helper'
+require 'rails_admin/support/serialization_schema'
 require 'yaml'
 
 module RailsAdmin

data/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rails_admin",
-  "version": "4.0.0-beta",
+  "version": "4.0.0-beta2",
   "description": "RailsAdmin is a Rails engine that provides an easy-to-use interface for managing your data.",
   "homepage": "https://github.com/railsadminteam/rails_admin",
   "license": "MIT",

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails_admin
 version: !ruby/object:Gem::Version
-  version: 4.0.0.beta
+  version: 4.0.0.beta2
 platform: ruby
 authors:
 - Erik Michaels-Ober
@@ -341,6 +341,7 @@ files:
 - lib/rails_admin/support/csv_converter.rb
 - lib/rails_admin/support/datetime.rb
 - lib/rails_admin/support/hash_helper.rb
+- lib/rails_admin/support/serialization_schema.rb
 - lib/rails_admin/version.rb
 - lib/tasks/assets.rake
 - lib/tasks/rails_admin.rake