rails_admin_next 1.0.0

data/app/views/rails_admin_next/main/export.html.erb

@@ -0,0 +1,149 @@
+<% params = request.params.except(:action, :controller, :utf8, :page, :per_page, :format, :authenticity_token) %>
+<% visible_fields = @model_config.export.with(view: self, object: @abstract_model.model.new, controller: self.controller).visible_fields %>
+<%= form_tag export_path(params.merge(all: true)), method: 'post', class: "main", data: {turbo: false} do %>
+  <input name="send_data" type="hidden" value="true" />
+  <fieldset id="fields_to_export" class="mb-3">
+    <legend>
+      <%= rails_admin_icon(:collapse) %>
+      <%= t('admin.export.select') %>
+    </legend>
+    <div class="form-group control-group">
+      <div class="col-sm-12">
+        <div class="checkbox">
+          <label for="check_all">
+            <%= check_box_tag 'all', 'all', true, { id: 'check_all' } %>
+            <b>
+              <%= t('admin.export.select_all_fields') %>
+            </b>
+          </label>
+        </div>
+      </div>
+    </div>
+    <div class="control-group row">
+      <div class="col-sm-12">
+        <div class="card bg-light my-2 reverse-selection" rel="tooltip" role="button" title="<%= t('admin.export.click_to_reverse_selection') %>">
+          <div class="card-body p-2">
+            <b><%= t('admin.export.fields_from', name: @model_config.label_plural.downcase) %></b>
+          </div>
+        </div>
+        <div class="controls">
+          <div class="row">
+            <% visible_fields.select{ |f| !f.association? || f.association.polymorphic? }.each do |field| %>
+              <% list = field.virtual? ? 'methods' : 'only' %>
+              <div class="checkbox col-sm-3 my-1">
+                <% if field.association? && field.association.polymorphic? %>
+                  <label for="schema_<%= list %>_<%= field.method_name %>">
+                    <%= check_box_tag "schema[#{list}][]", field.method_name, true, { id: "schema_#{list}_#{field.method_name}" } %>
+                    <%= field.label + " [id]" %>
+                  </label>
+                  <% polymorphic_type_column_name = @abstract_model.properties.detect {|p| field.association.foreign_type == p.name }.name %>
+                  <label for="schema_<%= list %>_<%= polymorphic_type_column_name %>">
+                    <%= check_box_tag "schema[#{list}][]", polymorphic_type_column_name, true, { id: "schema_#{list}_#{polymorphic_type_column_name}" } %>
+                    <%= field.label + " [type]" %>
+                  </label>
+                <% else %>
+                  <label for="schema_<%= list %>_<%= field.name %>">
+                    <%= check_box_tag "schema[#{list}][]", field.name, true, { id: "schema_#{list}_#{field.name}" } %>
+                    <%= field.label %>
+                  </label>
+                <% end %>
+              </div>
+            <% end %>
+          </div>
+        </div>
+      </div>
+    </div>
+    <% visible_fields.select{ |f| f.association? && !f.association.polymorphic? }.each do |field| %>
+      <% fields = field.associated_model_config.export.with(controller: self.controller, view: self, object: (associated_model = field.associated_model_config.abstract_model.model).new).visible_fields.select{ |f| !f.association? } %>
+      <div class="control-group row">
+        <div class="col-sm-12">
+          <div class="card bg-light my-2 reverse-selection" rel="tooltip" role="button" title="<%= t('admin.export.click_to_reverse_selection') %>">
+            <div class="card-body p-2">
+              <b><%= t('admin.export.fields_from_associated', name: field.label.downcase) %></b>
+            </div>
+          </div>
+          <div class="controls">
+            <div class="row">
+              <% fields.each do |associated_model_field| %>
+                <% list = associated_model_field.virtual? ? 'methods' : 'only' %>
+                <div class="checkbox col-sm-3 my-1">
+                  <label for="schema_include_<%= field.name %>_<%= list %>_<%= associated_model_field.name %>">
+                    <%= check_box_tag "schema[include][#{field.name}][#{list}][]", associated_model_field.name, true, { id: "schema_include_#{field.name}_#{list}_#{associated_model_field.name}" } %>
+                    <%= associated_model_field.label %>
+                  </label>
+                </div>
+              <% end %>
+            </div>
+          </div>
+        </div>
+      </div>
+    <% end %>
+  </fieldset>
+  <fieldset>
+    <legend>
+      <%= rails_admin_icon(:collapse) %>
+      <%= t('admin.export.options_for', name: 'csv') %>
+    </legend>
+    <div class="control-group row">
+      <% guessed_encoding = @abstract_model.encoding %>
+      <label class="col-sm-2 col-form-label text-md-end" for="csv_options_encoding_to">
+        <%= t('admin.export.csv.encoding_to') %>
+      </label>
+      <div class="col-sm-10 controls">
+        <div class="w-50">
+          <%= select_tag 'csv_options[encoding_to]', options_for_select(Encoding.name_list.sort), include_blank: true, placeholder: t('admin.misc.search'), data: { controller: 'filtering-select' } %>
+        </div>
+        <p class="form-text">
+          <%= t('admin.export.csv.encoding_to_help', name: guessed_encoding) %>
+        </p>
+      </div>
+    </div>
+    <div class="control-group row">
+      <label class="col-sm-2 col-form-label text-md-end" for="csv_options_skip_header">
+        <%= t('admin.export.csv.skip_header') %>
+      </label>
+      <div class="col-sm-10 controls">
+        <div class="col-form-label">
+          <label>
+            <%= check_box_tag 'csv_options[skip_header]', 'true' %>
+          </label>
+        </div>
+        <p class="form-text">
+          <%= t('admin.export.csv.skip_header_help') %>
+        </p>
+      </div>
+    </div>
+    <div class="control-group row">
+      <label class="col-sm-2 col-form-label text-md-end" for="csv_options_generator_col_sep">
+        <%= t('admin.export.csv.col_sep') %>
+      </label>
+      <div class="col-sm-10 controls">
+        <div class="w-50">
+          <%= select_tag 'csv_options[generator][col_sep]', options_for_select({ '' => t('admin.export.csv.default_col_sep'), "<comma> ','" => ',', "<semicolon> ';'" => ';', '<tabs>' => "'\t'" }), placeholder: t('admin.misc.search'), data: { controller: 'filtering-select' } %>
+        </div>
+        <p class="form-text">
+          <%= t('admin.export.csv.col_sep_help', value: t('admin.export.csv.default_col_sep')) %>
+        </p>
+      </div>
+    </div>
+  </fieldset>
+  <div class="form-actions row justify-content-end mb-3">
+    <div class="col-sm-offset-2 col-sm-10">
+      <input name="return_to" type="<%= :hidden %>" value="<%= (params[:return_to].presence || request.referer) %>" />
+      <button class="btn btn-primary" name="csv" type="submit">
+        <%= rails_admin_icon(:check) %>
+        <%= t("admin.export.confirmation", name: 'csv') %>
+      </button>
+      <button class="btn btn-info" name="json" type="submit">
+        <%= t("admin.export.confirmation", name: 'json') %>
+      </button>
+      <button class="btn btn-info" name="xml" type="submit">
+        <%= t("admin.export.confirmation", name: 'xml') %>
+      </button>
+      <button class="btn btn-light" name="_continue" type="submit">
+        <%= rails_admin_icon(:cancel) %>
+        <%= t("admin.form.cancel") %>
+      </button>
+    </div>
+  </div>
+<% end %>

data/app/views/rails_admin_next/main/history.html.erb

@@ -0,0 +1,80 @@
+<% params = request.params.except(:action, :controller, :model_name) %>
+<% query = params[:query] %>
+<% filter = params[:filter] %>
+<% sort = params[:sort] %>
+<% sort_reverse = params[:sort_reverse] %>
+<% path_method = params[:id] ? "history_show_path" : "history_index_path" %>
+<%= form_tag("", method: "get", class: "search form-inline") do %>
+  <div class="card mb-3 p-3 bg-light">
+    <div class="row">
+      <div class="col-sm-6">
+        <div class="input-group">
+          <input class="form-control" name="query" placeholder="<%= t("admin.misc.filter") %>" type="search" value="<%= query %>" />
+          <button class="btn btn-primary" data-disable-with="<%= RailsAdminNext::Icons.svg(:refresh) + ' ' + t('admin.misc.refresh') %>" type="submit">
+            <%= rails_admin_icon(:refresh) %>
+            <%= t("admin.misc.refresh") %>
+          </button>
+        </div>
+      </div>
+    </div>
+  </div>
+<% end %>
+<table class="table table-condensed table-striped table-hover" id="history">
+  <thead>
+    <tr>
+      <% columns = [] %>
+      <% columns << { property_name: "created_at", css_class: "created_at",link_text: t('admin.table_headers.created_at') } %>
+      <% columns << { property_name: "username",   css_class: "username",  link_text: t('admin.table_headers.username')   } %>
+      <% columns << { property_name: "item",       css_class: "item",      link_text: t('admin.table_headers.item')       } if @general %>
+      <% columns << { property_name: "message",    css_class: "message",   link_text: t('admin.table_headers.message')    } %>
+      <% columns.each do |column| %>
+        <% property_name = column[:property_name] %>
+        <% selected = (sort == property_name) %>
+        <% sort_direction = (sort_reverse ? "headerSortUp" : "headerSortDown" if selected) %>
+        <% sort_location = send(path_method, params.except("sort_reverse").merge(model_name: @abstract_model.to_param, sort: property_name).merge(selected && sort_reverse != "true" ? {sort_reverse: "true"} : {})) %>
+        <th class="header <%= column[:css_class] %> <%= sort_direction if selected %>" data-href="<%= sort_location %>">
+          <%= column[:link_text] %>
+        </th>
+      <% end %>
+    </tr>
+  </thead>
+  <tbody class="table-group-divider">
+    <% @history.each_with_index do |object, index| %>
+      <tr>
+        <% unless object.created_at.nil? %>
+          <td>
+            <%= l(object.created_at, format: :long, default: l(object.created_at, format: :long)) %>
+          </td>
+        <% end %>
+        <td>
+          <%= object.username %>
+        </td>
+        <% if @general %>
+          <% if o = @abstract_model.get(object.item) %>
+            <% label = o.send(@abstract_model.config.object_label_method) %>
+            <% if show_action = action(:show, @abstract_model, o) %>
+              <td>
+                <%= link_to(label, url_for(action: show_action.action_name, model_name: @abstract_model.to_param, id: o.id)) %>
+              </td>
+            <% else %>
+              <td>
+                <%= label %>
+              </td>
+            <% end %>
+          <% else %>
+            <td>
+              <%= "#{@abstract_model.config.label} ##{object.item}" %>
+            </td>
+          <% end %>
+        <% end %>
+        <td>
+          <%= object.message.in?(['delete', 'new']) ? t("admin.actions.#{object.message}.done").capitalize : object.message %>
+        </td>
+      </tr>
+    <% end %>
+  </tbody>
+</table>
+<% unless params[:all] || !@history.respond_to?(:current_page) %>
+  <%= render 'pagination', collection: @history, mode: :numbered, url_proc: ->(page) { send(path_method, params.except('page', :page).merge(page: page)) } %>
+  <%= link_to(t("admin.misc.show_all"), send(path_method, params.merge(all: true)), class: "show-all btn btn-light") unless (tc = @history.total_count) <= @history.size || tc > 100 %>
+<% end %>

data/app/views/rails_admin_next/main/index.html.erb

@@ -0,0 +1,186 @@
+<%
+  query = params[:query]
+  params = request.params.except(:authenticity_token, :action, :controller, :utf8, :bulk_export)
+  params.delete(:query) if params[:query].blank?
+  params.delete(:sort_reverse) unless params[:sort_reverse] == 'true'
+  sort_reverse = params[:sort_reverse]
+  sort = params[:sort]
+  params.delete(:sort) if params[:sort] == @model_config.list.sort_by.to_s
+  export_action = RailsAdminNext::Config::Actions.find(:export, { controller: self.controller, abstract_model: @abstract_model })
+  export_action = nil unless export_action && authorized?(export_action.authorization_key, @abstract_model)
+  description = RailsAdminNext.config(@abstract_model.model_name).description
+  properties = @model_config.list.with(controller: self.controller, view: self, object: @abstract_model.model.new).fields_for_table
+  checkboxes = @model_config.list.checkboxes?
+  table_table_header_count = begin
+    count = checkboxes ? 1 : 0
+    count = count + properties.count
+  end
+%>
+
+<% content_for :contextual_tabs do %>
+  <% if filterable_fields.present? %>
+    <li class="nav-item dropdown">
+      <button type="button" id="filters_toggle" class="nav-link dropdown-toggle" popovertarget="filters" data-controller="dropdown" data-action="keydown->dropdown#onKeydown">
+        <%= t('admin.misc.add_filter') %>
+        <b class="caret"></b>
+      </button>
+      <ul class="dropdown-menu dropdown-menu-end" id="filters" role="menu" popover="auto">
+        <% filterable_fields.each do |field| %>
+          <li role="none">
+            <a
+              href="#"
+              class="dropdown-item"
+              role="menuitem"
+              tabindex="-1"
+              data-options="<%= field.with(view: self).filter_options.to_json %>"
+            >
+              <%= field.label %>
+            </a>
+          </li>
+        <% end %>
+      </ul>
+    </li>
+  <% end %>
+  <% if checkboxes %>
+    <%= bulk_menu %>
+  <% end %>
+<% end %>
+
+<style nonce="<%= content_security_policy_nonce %>">
+  <% properties.select{ |p| p.column_width.present? }.each do |property| %>
+    <%= "#list th.#{property.css_class} { width: #{property.column_width}px; min-width: #{property.column_width}px; }" %>
+    <%= "#list td.#{property.css_class} { max-width: #{property.column_width}px;}" %>
+  <% end %>
+</style>
+
+<div id="list">
+  <%= form_tag(index_path(params.except(*%w[page f query])), method: :get) do %>
+    <div class="card mb-3 p-3 bg-light">
+      <div class="row" data-controller="filter-box" data-options="<%= ordered_filter_options.to_json %>" id="filters_box"></div>
+      <hr class="filters_box"/>
+      <div class="row">
+        <div class="col-sm-6">
+          <div class="input-group">
+            <input class="form-control" name="query" placeholder="<%= t("admin.misc.filter") %>" type="search" value="<%= query %>" />
+            <button class="btn btn-primary" data-disable-with="<%= RailsAdminNext::Icons.svg(:refresh) + t('admin.misc.refresh') %>" type="submit">
+              <%= rails_admin_icon(:refresh) %>
+              <%= t('admin.misc.refresh') %>
+            </button>
+            <button class="btn btn-info" id="remove_filter" title="<%= t('admin.misc.reset_filters') %>">
+              <%= rails_admin_icon(:cancel) %>
+            </button>
+          </div>
+          <% if @model_config.list.search_help.present? %>
+            <div class="form-text"><%= @model_config.list.search_help %></div>
+          <% end %>
+        </div>
+        <div class="col-sm-6 text-end">
+          <% if export_action %>
+            <%= link_to wording_for(:link, export_action), export_path(params.except('page')), class: 'btn btn-info' %>
+          <% end %>
+        </div>
+      </div>
+    </div>
+  <% end %>
+  <% unless @model_config.list.scopes.empty? %>
+    <ul class="nav nav-tabs" id="scope_selector">
+      <% @model_config.list.scopes.each_with_index do |scope, index| %>
+        <% scope = '_all' if scope.nil? %>
+        <li class="nav-item">
+          <a href="<%= index_path(params.merge(scope: scope, page: nil)) %>" class="nav-link <%= 'active' if scope.to_s == params[:scope] || (params[:scope].blank? && index == 0) %>">
+            <%= I18n.t("admin.scopes.#{@abstract_model.to_param}.#{scope}", default: I18n.t("admin.scopes.#{scope}", default: scope.to_s.titleize)) %>
+          </a>
+        </li>
+      <% end %>
+    </ul>
+  <% end %>
+  <%= form_tag bulk_action_path(model_name: @abstract_model.to_param), method: :post, id: "bulk_form", class: ["form", "mb-3"] do %>
+    <%= hidden_field_tag :bulk_action %>
+    <% if description.present? %>
+      <p>
+        <strong>
+          <%= description %>
+        </strong>
+      </p>
+    <% end %>
+    <div id="sidescroll" data-controller="sidescroll">
+      <table class="table table-condensed table-striped table-hover">
+        <thead>
+          <tr>
+            <% if checkboxes %>
+              <th class="shrink sticky">
+                <input class="toggle" type="checkbox" />
+              </th>
+            <% end %>
+            <% properties.each do |property| %>
+              <% selected = (sort == property.name.to_s) %>
+              <% if property.sortable %>
+                <% sort_location = index_path params.except('sort_reverse').except('page').merge(sort: property.name).merge(selected && sort_reverse != "true" ? {sort_reverse: "true"} : {}) %>
+                <% sort_direction = (sort_reverse == 'true' ? "headerSortUp" : "headerSortDown" if selected) %>
+              <% end %>
+              <th class="<%= [property.sortable && "header", property.sortable && sort_direction, property.sticky? && 'sticky', property.css_class, property.type_css_class].select(&:present?).join(' ') %>" data-href="<%= property.sortable && sort_location %>" rel="tooltip" title="<%= property.hint %>">
+                <%= property.label %>
+              </th>
+            <% end %>
+            <th class="last shrink"></th>
+          </tr>
+        </thead>
+        <tbody class="table-group-divider">
+          <% @objects.each do |object| %>
+            <tr class="<%= @abstract_model.param_key %>_row <%= @model_config.list.with(object: object).row_css_class %>">
+              <% if checkboxes %>
+                <td class="sticky">
+                  <%= check_box_tag "bulk_ids[]", object.id.to_s, false %>
+                </td>
+              <% end %>
+              <% properties.map{ |property| property.bind(:object, object) }.each do |property| %>
+                <% value = property.pretty_value %>
+                <%= content_tag(:td, class: [property.sticky? && 'sticky', property.css_class, property.type_css_class].select(&:present?), title: strip_tags(value.to_s)) do %>
+                  <%= value %>
+                <% end %>
+              <% end %>
+              <td class="last links ra-sidescroll-frozen">
+                <ul class="nav d-inline list-inline">
+                  <%= menu_for :member, @abstract_model, object, true %>
+                </ul>
+              </td>
+            </tr>
+          <% end %>
+          <% if @objects.empty? %>
+            <tr class="empty_row">
+              <td colspan="<%= table_table_header_count %>">
+                <%= I18n.t('admin.actions.index.no_records') %>
+              </td>
+            </tr>
+          <% end %>
+        </tbody>
+      </table>
+    </div>
+    <% if @model_config.list.limited_pagination %>
+      <div class="row">
+        <div class="col-md-6">
+          <%= render 'pagination', collection: @objects, mode: :limited, url_proc: ->(page) { index_path(params.except('page', :page).merge(page: page)) } %>
+        </div>
+      </div>
+    <% elsif @objects.respond_to?(:total_count) %>
+      <% total_count = @objects.total_count.to_i %>
+      <div class="row">
+        <div class="col-md-6">
+          <%= render 'pagination', collection: @objects, mode: :numbered, url_proc: ->(page) { index_path(params.except('page', :page).merge(page: page)) } %>
+        </div>
+      </div>
+      <div class="row">
+        <div class="col-md-6">
+          <%= link_to(t("admin.misc.show_all"), index_path(params.merge(all: true)), class: "show-all btn btn-light clearfix") unless total_count > 100 || total_count <= @objects.to_a.size %>
+        </div>
+      </div>
+      <div class="clearfix total-count">
+        <%= "#{total_count} #{@model_config.pluralize(total_count).downcase}" %>
+      </div>
+    <% else %>
+      <div class="clearfix total-count">
+        <%= "#{@objects.size} #{@model_config.pluralize(@objects.size).downcase}" %>
+      </div>
+    <% end %>
+  <% end %>
+</div>

data/app/views/rails_admin_next/main/new.html.erb

@@ -0,0 +1,3 @@
+<%= rails_admin_form_for @object, url: new_path(model_name: @abstract_model.to_param), as: @abstract_model.param_key, html: { multipart: true, class: "main", data: { title: @page_name } } do |form| %>
+  <%= form.generate action: :create %>
+<% end %>

data/app/views/rails_admin_next/main/show.html.erb

@@ -0,0 +1,30 @@
+<% @model_config.show.with(object: @object, view: self, controller: self.controller).visible_groups.each do |fieldset| %>
+  <% unless (fields = fieldset.with(object: @object, view: self, controller: self.controller).visible_fields).empty? %>
+    <% unless (fields = fields.reject{ |f| RailsAdminNext::config.compact_show_view && (f.formatted_value.nil? || f.formatted_value == '') }).empty? %>
+      <div class="fieldset">
+        <h4>
+          <%= fieldset.label %>
+        </h4>
+        <% if fieldset.help %>
+          <p>
+            <%= fieldset.help %>
+          </p>
+        <% end %>
+        <div class="list-group">
+          <% fields.each_with_index do |field, index| %>
+            <div class="list-group-item border-0 <%= field.type_css_class %> <%= field.css_class %>">
+              <div class="card">
+                <h5 class="card-header bg-light">
+                  <%= field.label %>
+                </h5>
+                <div class="card-body">
+                  <%= field.pretty_value %>
+                </div>
+              </div>
+            </div>
+          <% end %>
+        </dl>
+      </div>
+    <% end %>
+  <% end %>
+<% end %>

data/config/brakeman.ignore

@@ -0,0 +1,145 @@
+{
+  "ignored_warnings": [
+    {
+      "warning_type": "Weak Hash",
+      "warning_code": 90,
+      "fingerprint": "7ae45391f647eaa39c6ab4ea081fdd4c928c38064850cacd3115a017ce0fc5ef",
+      "check_name": "WeakHash",
+      "message": "Weak hashing algorithm used: MD5",
+      "file": "app/helpers/rails_admin_next/application_helper.rb",
+      "line": 230,
+      "link": "https://brakemanscanner.org/docs/warning_types/weak_hash/",
+      "code": "Digest::MD5.hexdigest(email)",
+      "render_path": null,
+      "location": {
+        "type": "method",
+        "class": "RailsAdminNext::ApplicationHelper",
+        "method": "gravatar_url"
+      },
+      "user_input": null,
+      "confidence": "Medium",
+      "cwe_id": [
+        328
+      ],
+      "note": "False positive. MD5 implements the Gravatar avatar URL scheme (Gravatar keys avatars by the MD5 of the email). It is a non-cryptographic identifier, not used for passwords or integrity."
+    },
+    {
+      "warning_type": "Weak Hash",
+      "warning_code": 90,
+      "fingerprint": "ade4b22042c4f44d36b2a203a27252138eb53e191ff15f8e822c0623d8565311",
+      "check_name": "WeakHash",
+      "message": "Weak hashing algorithm used: MD5",
+      "file": "app/helpers/rails_admin_next/application_helper.rb",
+      "line": 236,
+      "link": "https://brakemanscanner.org/docs/warning_types/weak_hash/",
+      "code": "Digest::MD5.hexdigest(label)",
+      "render_path": null,
+      "location": {
+        "type": "method",
+        "class": "RailsAdminNext::ApplicationHelper",
+        "method": "collapsible_stack"
+      },
+      "user_input": null,
+      "confidence": "Medium",
+      "cwe_id": [
+        328
+      ],
+      "note": "False positive. MD5 builds a short, stable DOM/CSS key from a sidebar label (collapse-key). It is a non-cryptographic identifier for client-side targeting, not used for security."
+    },
+    {
+      "warning_type": "SQL Injection",
+      "warning_code": 0,
+      "fingerprint": "d15e1c138bacf89995ddd7472443a7cc493afca1b4d7c90cb4c4c1f828a94bec",
+      "check_name": "SQL",
+      "message": "Possible SQL injection",
+      "file": "lib/rails_admin_next/adapters/active_record.rb",
+      "line": 195,
+      "link": "https://brakemanscanner.org/docs/warning_types/sql_injection/",
+      "code": "scope.where(\"#{statement}\", *[value1, value2])",
+      "render_path": null,
+      "location": {
+        "type": "method",
+        "class": "RailsAdminNext::Adapters::ActiveRecord::WhereBuilder",
+        "method": "build"
+      },
+      "user_input": "statement",
+      "confidence": "Weak",
+      "cwe_id": [
+        89
+      ],
+      "note": "False positive. @statements are built by StatementBuilder from schema-derived column names and a fixed operator set using ? placeholders; every user-supplied value is bound positionally via *@values. No user input is interpolated into the SQL string."
+    },
+    {
+      "warning_type": "Dangerous Eval",
+      "warning_code": 13,
+      "fingerprint": "7cba47560dcc1117f0679d149479586da5c01b563d5974388d00ec644e6a6773",
+      "check_name": "Evaluation",
+      "message": "Dynamic string evaluated as code",
+      "file": "lib/rails_admin_next/config/actions.rb",
+      "line": 52,
+      "link": "https://brakemanscanner.org/docs/warning_types/dangerous_eval/",
+      "code": "\"RailsAdminNext::Config::Actions::#{parent_class.to_s.camelize}\".constantize.new.instance_eval(\"\\n            #{parent} true\\n            def key\\n              :#{key}\\n            end\\n          \", \"lib/rails_admin_next/config/actions.rb\", 52)",
+      "render_path": null,
+      "location": {
+        "type": "method",
+        "class": "RailsAdminNext::Config::Actions",
+        "method": "self.add_action"
+      },
+      "user_input": null,
+      "confidence": "Weak",
+      "cwe_id": [
+        913,
+        95
+      ],
+      "note": "False positive. Internal action-registry DSL: the instance_eval'd template interpolates only gem-defined action keys and scope kinds (:base/:collection/:member/:root), never request data."
+    },
+    {
+      "warning_type": "Dangerous Eval",
+      "warning_code": 13,
+      "fingerprint": "f25a967de73c369963f8999f96afcc6327d4fd49a6ee15725fe6a1dc3fd91a48",
+      "check_name": "Evaluation",
+      "message": "Dynamic string evaluated as code",
+      "file": "lib/rails_admin_next/config/actions.rb",
+      "line": 71,
+      "link": "https://brakemanscanner.org/docs/warning_types/dangerous_eval/",
+      "code": "instance_eval(\"\\n            def #{name.to_s.demodulize.underscore.to_sym}(&block)\\n              action = #{name.to_s.demodulize.underscore.to_sym}.new\\n              add_action_custom_key(action, &block)\\n            end\\n          \", \"lib/rails_admin_next/config/actions.rb\", 71)",
+      "render_path": null,
+      "location": {
+        "type": "method",
+        "class": "RailsAdminNext::Config::Actions",
+        "method": "self.register"
+      },
+      "user_input": null,
+      "confidence": "Weak",
+      "cwe_id": [
+        913,
+        95
+      ],
+      "note": "False positive. Internal action-registry DSL: the instance_eval'd template interpolates only gem-defined action class names, never request data."
+    },
+    {
+      "warning_type": "Mass Assignment",
+      "warning_code": 70,
+      "fingerprint": "c787e046c0932c7b107eb081bffa9cc6796d415358bf3614b6f601573f62488e",
+      "check_name": "MassAssignment",
+      "message": "Specify exact keys allowed for mass assignment instead of using `permit!` which allows any keys",
+      "file": "lib/rails_admin_next/config/actions/index.rb",
+      "line": 89,
+      "link": "https://brakemanscanner.org/docs/warning_types/mass_assignment/",
+      "code": "params[:csv_options].permit!",
+      "render_path": null,
+      "location": {
+        "type": "method",
+        "class": "Index",
+        "method": null
+      },
+      "user_input": null,
+      "confidence": "Medium",
+      "cwe_id": [
+        915
+      ],
+      "note": "False positive. The permitted hash is CSV export formatting options (encoding_to, skip_header, and the generator kwargs passed to CSV.generate), consumed by RailsAdmin::CSVConverter#to_csv. It is never assigned to a model, so there is no attribute mass-assignment; unrecognised keys merely raise in Encoding.find / CSV.generate."
+    }
+  ],
+  "brakeman_version": null
+}

data/config/importmap.rails_admin.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+# Engine-owned importmap, drawn by lib/rails_admin_next/engine.rb and distinct from the host's
+# config/importmap.rb. Rendered inline (CSP-nonce threaded) on admin pages by
+# app/views/layouts/rails_admin_next/_head.html.erb.
+
+# rails_admin's own browser-native ESM modules — served and fingerprinted by Propshaft from src/.
+# pin_all_from covers the controllers/ manifest and every controller too (rails_admin/controllers/*).
+pin "rails_admin", to: "rails_admin/base.js", preload: true
+pin_all_from File.expand_path("../src/rails_admin", __dir__), under: "rails_admin"
+
+# Self-hosted survivors. Stimulus (a genuinely new dependency) and Turbo ship single, pre-bundled
+# browser-native ESM files from their gems, served and fingerprinted by Propshaft off each gem's
+# auto-registered asset path — no jspm, no build step.
+pin "@hotwired/stimulus", to: "stimulus.min.js", preload: true
+pin "@hotwired/turbo-rails", to: "turbo.min.js", preload: true
+
+# The @rails/* and trix modules are self-hosted too: each is a single pre-bundled browser-native ESM
+# file shipped inside its Rails gem (actioncable/activestorage/actiontext) or action_text-trix, served
+# and fingerprinted by Propshaft off the gem's auto-registered asset path — zero external network, JS
+# versioned in lockstep with the gems (no jspm Dependabot blind spot). actioncable's asset path is
+# registered by the `require 'action_cable/engine'` in engine.rb (the @rails/activestorage/actiontext
+# and trix paths come from the host's ActiveStorage/ActionText, which load action_text-trix). There is
+# no jQuery, jQuery-UI, or @rails/ujs pin: destructive actions use Turbo's data-turbo-method/
+# data-turbo-confirm attributes, and date/time fields use native HTML5 inputs (no JS library).
+pin "@rails/actioncable", to: "actioncable.esm.js"
+pin "@rails/activestorage", to: "activestorage.esm.js"
+pin "@rails/actiontext", to: "actiontext.esm.js"
+pin "trix", to: "trix.js"

data/config/initializers/active_record_extensions.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+# The on_load(:active_record) block is class_eval'd in ActiveRecord::Base's
+# context, so these definitions land directly on ActiveRecord::Base.
+ActiveSupport.on_load(:active_record) do
+  def self.rails_admin_next(&)
+    RailsAdminNext.config(self, &)
+  end
+
+  def rails_admin_default_object_label_method
+    new_record? ? "new #{self.class}" : "#{self.class} ##{id}"
+  end
+
+  def safe_send(value)
+    if has_attribute?(value)
+      read_attribute(value)
+    else
+      send(value)
+    end
+  end
+end