rails_admin_next 1.0.0 → 1.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 41aa74e3b01539b9fc293ce040bdc60801e0d9708d22447276c88dad216d6a51
-  data.tar.gz: fa571294625b43664ae466e5c62aae7fb6e88a0c55a487562392c1670ddb4a36
+  metadata.gz: a47ededbcad2a173ee6e0d77e581ef0e4e7649458a7bf0e659592726299c6ae2
+  data.tar.gz: bded3ecf250c69185107635e6877b4d9467f678fb12919b08146a3e67fdb7842
 SHA512:
-  metadata.gz: d43b9c62e232c5a6e37fae047f4712af5021b8263fcdb22034d18dea4550bc10e7c01e8b379f39cf356279248ace2f08b22ffb3abccdc05e8975338b323c9a7c
-  data.tar.gz: 432b7fb059543a084a73b99dacf2d817c83f500bc3cc7af6335fc8c96d6883b7250f95470e4b2d9906a2677087feb8be80179658d36cc297cee9f417f553f917
+  metadata.gz: 88379320dc12d64a6311ed451b82a685862b7c7c3ea4449c44fc391a6b1cdad8beed31623a7d4709cc8bef210779cdfe41593e24b7a6688fdf7dcbdd101a6bbb
+  data.tar.gz: 6baf5beb0080b57a8f1fe08ccd6407872b1bec576fb43a493f58fefc76d5883c04f74c3d66e674756684c224038f6235c6f7e54b97483aa9d073a45c7dde8294

data/Gemfile

@@ -7,40 +7,39 @@ gem "rails"
 gem "turbo-rails"
 
 group :development, :test do
-  gem "pry", ">= 0.9"
+  gem "pry"
 end
 
 group :test do
   gem "brakeman", require: false
-  gem "bundler-audit", require: false
   gem "cancancan", "~> 3.0"
-  gem "cuprite", "!= 0.15.1"
-  gem "database_cleaner-active_record", ">= 2.0", require: false
-  gem "factory_bot", ">= 4.2", "!= 6.4.5"
-  gem "generator_spec", ">= 0.8"
-  gem "image_processing", ">= 1.2"
+  gem "cuprite"
+  gem "database_cleaner-active_record", require: false
+  gem "factory_bot"
+  gem "generator_spec"
+  gem "image_processing"
   gem "pundit"
-  gem "rspec-expectations", "!= 3.8.3"
-  gem "rspec-rails", ">= 4.0.0.beta2"
+  gem "rspec-rails"
   gem "rspec-retry"
-  gem "ruby-vips", ">= 2.1"
-  gem "simplecov", ">= 0.9", require: false
-  gem "simplecov-lcov", require: false
-  gem "standard", ">= 1.35.1", require: false
-
-  # Windows does not include zoneinfo files, so bundle the tzinfo-data gem
-  gem "tzinfo-data", platforms: %i[mingw mswin x64_mingw jruby]
+  gem "ruby-vips"
+  gem "standard", require: false
   gem "warden"
+  # Capybara's own default server is puma, which is not in this bundle; spec_helper selects
+  # webrick instead. It arrives as a transitive of ferrum, so declare what the suite runs on
+  # rather than borrowing someone else's dependency.
+  gem "webrick"
+
+  # Windows does not ship zoneinfo files.
+  gem "tzinfo-data", platforms: %i[windows]
 end
 
+# The dummy app boots with `Bundler.require(*Rails.groups, :active_record)`, so this group is
+# loaded in every environment — that is what puts the adapter on the load path outside :test.
 group :active_record do
-  gem "paper_trail", ">= 12.0"
-
-  platforms :ruby, :mswin, :mingw, :x64_mingw do
-    gem "mysql2", ">= 0.3.14"
-    gem "pg", ">= 1.0.0"
-    gem "sqlite3", ">= 1.3.0"
-  end
+  gem "mysql2"
+  gem "paper_trail"
+  gem "pg"
+  gem "sqlite3"
 end
 
 gemspec

data/app/controllers/rails_admin_next/main_controller.rb

@@ -108,10 +108,17 @@ module RailsAdminNext
       model_config.send(action).with(controller: self, view: view_context, object: @object).visible_fields
     end
 
-    def sanitize_params_for!(action, model_config = @model_config, target_params = params[@abstract_model.param_key])
+    def sanitize_params_for!(action, model_config = @model_config, target_params = params[@abstract_model.param_key], nested_in = nil)
       return unless target_params.present?
 
-      fields = visible_fields(action, model_config)
+      # A subform never draws the child's link back to the record being edited — the parent
+      # association names it, and FormBuilder#nested_field_association? skips it on that name.
+      # Deriving the allowlist from visible_fields alone would keep permitting keys no form of
+      # ours submits, so drop that one field here too. Only at nested depth: editing a Comment
+      # on its own is a legitimate way to set its commentable.
+      fields = visible_fields(action, model_config).reject do |field|
+        nested_in && field.is_a?(Config::Fields::Association) && field.name == nested_in.inverse_of
+      end
       allowed_methods = fields.collect(&:allowed_methods).flatten.uniq.collect(&:to_s) << "id" << "_destroy"
       fields.each { |field| field.parse_input(target_params) }
       target_params.slice!(*allowed_methods)
@@ -132,7 +139,7 @@ module RailsAdminNext
             []
           end
         children_params.each do |children_param|
-          sanitize_params_for!(:nested, association.associated_model_config, children_param) if children_param.respond_to?(:values)
+          sanitize_params_for!(:nested, association.associated_model_config, children_param, association) if children_param.respond_to?(:values)
         end
       end
     end

data/app/helpers/rails_admin_next/form_builder.rb

@@ -164,10 +164,17 @@ module RailsAdminNext
 
     private
 
+    # A field the parent association names as its inverse is the child's link back to
+    # the record being edited, so the user is never asked to fill it. That name match
+    # stands on its own: a polymorphic child such as Comment#commentable declares no
+    # inverse_of, so gating it on the child's own inverse_of would never let it fire.
+    # It stays limited to association fields because a polymorphic `as:` is never checked
+    # against the child class, and a plain column could otherwise match it by name.
     def nested_field_association?(field, nested_in)
-      field.inverse_of.presence && nested_in.presence && field.inverse_of == nested_in.name &&
-        (@template.instance_variable_get(:@model_config).abstract_model == field.abstract_model ||
-         field.name == nested_in.inverse_of)
+      nested_in.presence &&
+        ((field.is_a?(Config::Fields::Association) && field.name == nested_in.inverse_of) ||
+         (field.inverse_of.presence && field.inverse_of == nested_in.name &&
+          @template.instance_variable_get(:@model_config).abstract_model == field.abstract_model))
     end
   end
 end

data/app/views/layouts/rails_admin_next/_head.html.erb

@@ -10,17 +10,19 @@
     CSP out of the picture and lets :light/:dark pins override the OS preference. %>
 <meta content="<%= {auto: 'light dark', light: 'light', dark: 'dark'}.fetch(RailsAdminNext.config.color_scheme) %>" name="color-scheme">
 <%# The entry stylesheet pulls tokens/framework/skin via @import, which the browser only discovers
-    after fetching and parsing the entry file. Preload the three targets so all four fetch in parallel. %>
-<link rel="preload" as="style" href="<%= asset_path('rails_admin/tokens.css') %>">
-<link rel="preload" as="style" href="<%= asset_path('rails_admin/framework.css') %>">
-<link rel="preload" as="style" href="<%= asset_path('rails_admin/skin.css') %>">
+    after fetching and parsing the entry file. Preload the three targets so all four fetch in parallel.
+    A nonce-based style-src blocks a preload the same as a stylesheet, so these carry the nonce too;
+    `tag` drops the attribute entirely when no policy is configured and the nonce is nil. %>
+<% %w[tokens framework skin].each do |sheet| %>
+  <%= tag.link rel: "preload", as: "style", href: asset_path("rails_admin/#{sheet}.css"), nonce: content_security_policy_nonce %>
+<% end %>
 <%# Date/time fields use native HTML5 inputs; the picker UI is the browser's. Icons are inline SVG (no icon font). %>
-<%= stylesheet_link_tag "rails_admin", media: :all, data: {'turbo-track': 'reload'} %>
+<%= stylesheet_link_tag "rails_admin", media: :all, nonce: true, data: {'turbo-track': 'reload'} %>
 <%# Rich-text (ActionText) fields render a Trix editor; load its stylesheet so the toolbar is styled.
     trix.css ships with the action_text-trix gem and is on the Propshaft load path when ActionText is used.
     NOTE: trix.css is light-only for now — dark styling for the Trix toolbar/editor is deferred. %>
 <% if defined?(ActionText::Engine) %>
-  <%= stylesheet_link_tag "trix", media: :all, data: {'turbo-track': 'reload'} %>
+  <%= stylesheet_link_tag "trix", media: :all, nonce: true, data: {'turbo-track': 'reload'} %>
 <% end %>
 <%# Zero-build delivery: browser-native ESM pinned by the engine-owned importmap, served by Propshaft.
     The importmap-rails helpers thread the request CSP nonce onto every inline <script> they emit. %>

data/config/locales/rails_admin_next.en.yml

@@ -53,6 +53,7 @@ en:
     flash:
       successful: "%{name} successfully %{action}"
       error: "%{name} failed to be %{action}"
+      delete_restricted: "%{name} failed to be deleted: %{reason}"
       noaction: "No actions were taken"
       model_not_found: "Model '%{model}' could not be found"
       object_not_found: "%{model} with id '%{id}' could not be found"

data/lib/rails_admin_next/adapters/active_record/association.rb

@@ -104,8 +104,31 @@ module RailsAdminNext
           options[:polymorphic] || false
         end
 
+        # A polymorphic `as:` names the belongs_to on the other side, and Rails resolves
+        # an inverse for conventional pairs that declare nothing — both are the
+        # association's inverse for form-nesting purposes. `inverse_of: false` opts out
+        # of all of it, the way it does in Rails.
+        #
+        # The declared option is read first because it has to be: asking Rails for the
+        # inverse of a polymorphic belongs_to that declares one raises, since there is no
+        # single class to look the name up on.
         def inverse_of
-          options[:inverse_of].try :to_sym
+          return nil if options[:inverse_of] == false
+
+          options[:inverse_of].try(:to_sym) || association.inverse_of&.name || as
+        end
+
+        # Rails guards the presence validator it adds for a required belongs_to with
+        # an `if:` condition, and the validator scan in Fields::Base#required? skips
+        # conditional validators, so required-ness has to come from the reflection.
+        def required?
+          return false unless type == :belongs_to
+          # A `default:` association is filled by a before_validation callback, so the
+          # record validates without the user choosing anything.
+          return false if options[:default]
+
+          optional = options[:optional]
+          optional.nil? ? model.belongs_to_required_by_default : !optional
         end
 
         def read_only?

data/lib/rails_admin_next/config/actions/bulk_delete.rb

@@ -34,9 +34,14 @@ module RailsAdminNext
               unless params[:bulk_ids].blank?
                 @objects = list_entries(@model_config, :destroy)
                 unless @objects.blank?
-                  processed_objects = @abstract_model.destroy(@objects)
-                  destroyed = processed_objects.select(&:destroyed?)
-                  not_destroyed = processed_objects - destroyed
+                  # Rescue per record: dependent: :restrict_with_exception raises, and an
+                  # escaping raise would abandon every record behind it in the batch.
+                  destroyed, not_destroyed = Array.wrap(@objects).partition do |object|
+                    object.destroy
+                    object.destroyed?
+                  rescue ActiveRecord::DeleteRestrictionError
+                    false
+                  end
                   destroyed.each do |object|
                     @auditing_adapter&.delete_object(object, @abstract_model, _current_user)
                   end

data/lib/rails_admin_next/config/actions/delete.rb

@@ -33,12 +33,20 @@ module RailsAdminNext
 
             elsif request.delete? # DESTROY
 
-              @auditing_adapter&.delete_object(@object, @abstract_model, _current_user)
-              if @object.destroy
-                flash[:success] = t("admin.flash.successful", name: @model_config.label, action: t("admin.actions.delete.done"))
-                redirect_to index_path
-              else
-                handle_save_error :delete
+              begin
+                if @object.destroy
+                  @auditing_adapter&.delete_object(@object, @abstract_model, _current_user)
+                  flash[:success] = t("admin.flash.successful", name: @model_config.label, action: t("admin.actions.delete.done"))
+                  redirect_to index_path
+                else
+                  handle_save_error :delete
+                end
+              rescue ActiveRecord::DeleteRestrictionError => e
+                # dependent: :restrict_with_exception raises instead of adding an error to the
+                # record, so there is nothing for handle_save_error to render — report the
+                # association the exception names and send the admin back where they came from.
+                flash[:error] = t("admin.flash.delete_restricted", name: @model_config.label, reason: e.message)
+                redirect_to back_or_index, status: :see_other
               end
 
             end

data/lib/rails_admin_next/config/configurable.rb

@@ -55,9 +55,13 @@ module RailsAdminNext
           option_name = option_name.to_s
           options[option_name] = nil
 
-          # If it's a boolean create an alias for it and remove question mark
+          # If it's a boolean create an alias for it and remove question mark. The
+          # rebinding is what the rest of the method reads: the getter, the setter, the
+          # @<name>_registered variable and the recursion key all want the chopped name,
+          # while @config_options keeps the un-chopped one it was registered under.
           if option_name.end_with?("?")
-            scope.send(:define_method, "#{option_name.chop!}?") do
+            option_name = option_name.chop
+            scope.send(:define_method, "#{option_name}?") do
               send(option_name)
             end
           end

data/lib/rails_admin_next/config/fields/base.rb

@@ -215,7 +215,9 @@ module RailsAdminNext
               :nil
             end
 
-          (@required ||= {})[context] ||= !!([name] + children_fields).uniq.detect do |column_name|
+          # An association Rails treats as optional can still be required by a validator on its
+          # foreign key, so the reflection answer widens the validator scan instead of replacing it.
+          (@required ||= {})[context] ||= (association? && properties.try(:required?)) || !!([name] + children_fields).uniq.detect do |column_name|
             abstract_model.model.validators_on(column_name).detect do |v|
               !(v.options[:allow_nil] || v.options[:allow_blank]) &&
                 %i[presence numericality attachment_presence].include?(v.kind) &&

data/lib/rails_admin_next/version.rb

@@ -2,9 +2,12 @@
 
 module RailsAdminNext
   class Version
+    # Releases are cut by publishing a Release-Drafter draft: the gem-push workflow stamps
+    # the tag's version over these constants at build time, so the in-repo values are only
+    # the floor a local `gem build` produces.
     MAJOR = 1
     MINOR = 0
-    PATCH = 0
+    PATCH = 2
     PRE = nil
 
     class << self

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails_admin_next
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.0.2
 platform: ruby
 authors:
 - Daniel López Prat
@@ -340,7 +340,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 1.8.11
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.16
 specification_version: 4
 summary: Admin for Rails
 test_files: []