rails_admin_next 1.0.1 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f2beeee63d5a457910c59511f4f4f28062df8c2349fb0e7bba5ee36cb8625ef2
-  data.tar.gz: e9c500e67f698ac56486353df1e0c20e956d9cec9a63fa65fa036ac35e3fb834
+  metadata.gz: a1e669bb86719b972a161917a8f2b88747a6be2e2233ada17c3a437e6dfdeaaf
+  data.tar.gz: 66a69ecedbd7e4fdca9991e2044bede57d842f5bc7e1d29159a2fb4ef41a361f
 SHA512:
-  metadata.gz: 65db352b31758be6c51c44be449b327cde1cc64e3de279ad826c86faf68baacf317d957e524d313b0c859d0c43fcbf3519e7b17025d418cc2e00157c0be0323d
-  data.tar.gz: 01d302227dcb922055eac4c33f06860225d895e8a4c237f92c6e9b48bf78abf631d99b71d5857b271e3be0e6482e1ad7b84b76244165bb07baa5350eb1650f57
+  metadata.gz: 85c4a2ad4d178fee59d393020db78d735c114c8b0bb41cf42f14e70017363edd78bb49e0c461db95e8098901f30bf974a2a93683f70faf3cbb935978468cd24f
+  data.tar.gz: 0a60be77736c263a0dabea8abb46f573948b56ee672b0ca75473012feeb5a8889a3d5bac60668a3057602f7c5b51db097f9ff39171e210671a8d16ef3856db99

data/Gemfile

@@ -7,40 +7,39 @@ gem "rails"
 gem "turbo-rails"
 
 group :development, :test do
-  gem "pry", ">= 0.9"
+  gem "pry"
 end
 
 group :test do
   gem "brakeman", require: false
-  gem "bundler-audit", require: false
   gem "cancancan", "~> 3.0"
-  gem "cuprite", "!= 0.15.1"
-  gem "database_cleaner-active_record", ">= 2.0", require: false
-  gem "factory_bot", ">= 4.2", "!= 6.4.5"
-  gem "generator_spec", ">= 0.8"
-  gem "image_processing", ">= 1.2"
+  gem "cuprite"
+  gem "database_cleaner-active_record", require: false
+  gem "factory_bot"
+  gem "generator_spec"
+  gem "image_processing"
   gem "pundit"
-  gem "rspec-expectations", "!= 3.8.3"
-  gem "rspec-rails", ">= 4.0.0.beta2"
+  gem "rspec-rails"
   gem "rspec-retry"
-  gem "ruby-vips", ">= 2.1"
-  gem "simplecov", ">= 0.9", require: false
-  gem "simplecov-lcov", require: false
-  gem "standard", ">= 1.35.1", require: false
-
-  # Windows does not include zoneinfo files, so bundle the tzinfo-data gem
-  gem "tzinfo-data", platforms: %i[mingw mswin x64_mingw jruby]
+  gem "ruby-vips"
+  gem "standard", require: false
   gem "warden"
+  # Capybara's own default server is puma, which is not in this bundle; spec_helper selects
+  # webrick instead. It arrives as a transitive of ferrum, so declare what the suite runs on
+  # rather than borrowing someone else's dependency.
+  gem "webrick"
+
+  # Windows does not ship zoneinfo files.
+  gem "tzinfo-data", platforms: %i[windows]
 end
 
+# The dummy app boots with `Bundler.require(*Rails.groups, :active_record)`, so this group is
+# loaded in every environment — that is what puts the adapter on the load path outside :test.
 group :active_record do
-  gem "paper_trail", ">= 12.0"
-
-  platforms :ruby, :mswin, :mingw, :x64_mingw do
-    gem "mysql2", ">= 0.3.14"
-    gem "pg", ">= 1.0.0"
-    gem "sqlite3", ">= 1.3.0"
-  end
+  gem "mysql2"
+  gem "paper_trail"
+  gem "pg"
+  gem "sqlite3"
 end
 
 gemspec

data/app/controllers/rails_admin_next/main_controller.rb

@@ -108,10 +108,17 @@ module RailsAdminNext
       model_config.send(action).with(controller: self, view: view_context, object: @object).visible_fields
     end
 
-    def sanitize_params_for!(action, model_config = @model_config, target_params = params[@abstract_model.param_key])
+    def sanitize_params_for!(action, model_config = @model_config, target_params = params[@abstract_model.param_key], nested_in = nil)
       return unless target_params.present?
 
-      fields = visible_fields(action, model_config)
+      # A subform never draws the child's link back to the record being edited — the parent
+      # association names it, and FormBuilder#nested_field_association? skips it on that name.
+      # Deriving the allowlist from visible_fields alone would keep permitting keys no form of
+      # ours submits, so drop that one field here too. Only at nested depth: editing a Comment
+      # on its own is a legitimate way to set its commentable.
+      fields = visible_fields(action, model_config).reject do |field|
+        nested_in && field.is_a?(Config::Fields::Association) && field.name == nested_in.inverse_of
+      end
       allowed_methods = fields.collect(&:allowed_methods).flatten.uniq.collect(&:to_s) << "id" << "_destroy"
       fields.each { |field| field.parse_input(target_params) }
       target_params.slice!(*allowed_methods)
@@ -132,7 +139,7 @@ module RailsAdminNext
             []
           end
         children_params.each do |children_param|
-          sanitize_params_for!(:nested, association.associated_model_config, children_param) if children_param.respond_to?(:values)
+          sanitize_params_for!(:nested, association.associated_model_config, children_param, association) if children_param.respond_to?(:values)
         end
       end
     end

data/app/helpers/rails_admin_next/application_helper.rb

@@ -144,7 +144,7 @@ module RailsAdminNext
           content_tag(:li, class: ["breadcrumb-item", current_action?(a, am, o) && "active"]) do
             if current_action?(a, am, o)
               wording_for(:breadcrumb, a, am, o)
-            elsif a.http_methods.include?(:get)
+            elsif a.linkable?
               link_to rails_admin_next.url_for(action: a.action_name, controller: "rails_admin_next/main", model_name: am.try(:to_param), id: o.try(:persisted?) && o.try(:id) || nil) do
                 wording_for(:breadcrumb, a, am, o)
               end
@@ -159,7 +159,7 @@ module RailsAdminNext
     # parent => :root, :collection, :member
     # perf matters here (no action view trickery)
     def menu_for(parent, abstract_model = nil, object = nil, only_icon = false)
-      actions = actions(parent, abstract_model, object).select { |a| a.http_methods.include?(:get) && a.show_in_menu }
+      actions = actions(parent, abstract_model, object).select { |a| a.linkable? && a.show_in_menu }
       actions.collect do |action|
         wording = wording_for(:menu, action)
         li_class = ["nav-item", "icon", "#{action.key}_#{parent}_link"]

data/app/helpers/rails_admin_next/form_builder.rb

@@ -164,10 +164,17 @@ module RailsAdminNext
 
     private
 
+    # A field the parent association names as its inverse is the child's link back to
+    # the record being edited, so the user is never asked to fill it. That name match
+    # stands on its own: a polymorphic child such as Comment#commentable declares no
+    # inverse_of, so gating it on the child's own inverse_of would never let it fire.
+    # It stays limited to association fields because a polymorphic `as:` is never checked
+    # against the child class, and a plain column could otherwise match it by name.
     def nested_field_association?(field, nested_in)
-      field.inverse_of.presence && nested_in.presence && field.inverse_of == nested_in.name &&
-        (@template.instance_variable_get(:@model_config).abstract_model == field.abstract_model ||
-         field.name == nested_in.inverse_of)
+      nested_in.presence &&
+        ((field.is_a?(Config::Fields::Association) && field.name == nested_in.inverse_of) ||
+         (field.inverse_of.presence && field.inverse_of == nested_in.name &&
+          @template.instance_variable_get(:@model_config).abstract_model == field.abstract_model))
     end
   end
 end

data/app/views/layouts/rails_admin_next/_head.html.erb

@@ -10,17 +10,19 @@
     CSP out of the picture and lets :light/:dark pins override the OS preference. %>
 <meta content="<%= {auto: 'light dark', light: 'light', dark: 'dark'}.fetch(RailsAdminNext.config.color_scheme) %>" name="color-scheme">
 <%# The entry stylesheet pulls tokens/framework/skin via @import, which the browser only discovers
-    after fetching and parsing the entry file. Preload the three targets so all four fetch in parallel. %>
-<link rel="preload" as="style" href="<%= asset_path('rails_admin/tokens.css') %>">
-<link rel="preload" as="style" href="<%= asset_path('rails_admin/framework.css') %>">
-<link rel="preload" as="style" href="<%= asset_path('rails_admin/skin.css') %>">
+    after fetching and parsing the entry file. Preload the three targets so all four fetch in parallel.
+    A nonce-based style-src blocks a preload the same as a stylesheet, so these carry the nonce too;
+    `tag` drops the attribute entirely when no policy is configured and the nonce is nil. %>
+<% %w[tokens framework skin].each do |sheet| %>
+  <%= tag.link rel: "preload", as: "style", href: asset_path("rails_admin/#{sheet}.css"), nonce: content_security_policy_nonce %>
+<% end %>
 <%# Date/time fields use native HTML5 inputs; the picker UI is the browser's. Icons are inline SVG (no icon font). %>
-<%= stylesheet_link_tag "rails_admin", media: :all, data: {'turbo-track': 'reload'} %>
+<%= stylesheet_link_tag "rails_admin", media: :all, nonce: true, data: {'turbo-track': 'reload'} %>
 <%# Rich-text (ActionText) fields render a Trix editor; load its stylesheet so the toolbar is styled.
     trix.css ships with the action_text-trix gem and is on the Propshaft load path when ActionText is used.
     NOTE: trix.css is light-only for now — dark styling for the Trix toolbar/editor is deferred. %>
 <% if defined?(ActionText::Engine) %>
-  <%= stylesheet_link_tag "trix", media: :all, data: {'turbo-track': 'reload'} %>
+  <%= stylesheet_link_tag "trix", media: :all, nonce: true, data: {'turbo-track': 'reload'} %>
 <% end %>
 <%# Zero-build delivery: browser-native ESM pinned by the engine-owned importmap, served by Propshaft.
     The importmap-rails helpers thread the request CSP nonce onto every inline <script> they emit. %>

data/config/locales/rails_admin_next.en.yml

@@ -53,6 +53,7 @@ en:
     flash:
       successful: "%{name} successfully %{action}"
       error: "%{name} failed to be %{action}"
+      delete_restricted: "%{name} failed to be deleted: %{reason}"
       noaction: "No actions were taken"
       model_not_found: "Model '%{model}' could not be found"
       object_not_found: "%{model} with id '%{id}' could not be found"

data/lib/rails_admin_next/abstract_model.rb

@@ -131,6 +131,17 @@ module RailsAdminNext
       end
 
       def to_statement
+        # A multi-select filter submits its values as an array, so the sentinel has to
+        # be stripped out of one rather than compared against it. An array emptied by
+        # that strip discards the filter, but one that arrived empty does not: a date
+        # filter carries its meaning in the operator alone ("today", "this_week").
+        #
+        # "between" is excluded because it alone reads the array by index, so removing
+        # an element would shift the range ends rather than discard anything.
+        if @value.is_a?(Array) && @operator != "between" && @value.include?("_discard")
+          @value -= ["_discard"]
+          return if @value.empty?
+        end
         return if [@operator, @value].any? { |v| v == "_discard" }
 
         unary_operators[@operator] || unary_operators[@value] ||

data/lib/rails_admin_next/adapters/active_record/association.rb

@@ -104,8 +104,31 @@ module RailsAdminNext
           options[:polymorphic] || false
         end
 
+        # A polymorphic `as:` names the belongs_to on the other side, and Rails resolves
+        # an inverse for conventional pairs that declare nothing — both are the
+        # association's inverse for form-nesting purposes. `inverse_of: false` opts out
+        # of all of it, the way it does in Rails.
+        #
+        # The declared option is read first because it has to be: asking Rails for the
+        # inverse of a polymorphic belongs_to that declares one raises, since there is no
+        # single class to look the name up on.
         def inverse_of
-          options[:inverse_of].try :to_sym
+          return nil if options[:inverse_of] == false
+
+          options[:inverse_of].try(:to_sym) || association.inverse_of&.name || as
+        end
+
+        # Rails guards the presence validator it adds for a required belongs_to with
+        # an `if:` condition, and the validator scan in Fields::Base#required? skips
+        # conditional validators, so required-ness has to come from the reflection.
+        def required?
+          return false unless type == :belongs_to
+          # A `default:` association is filled by a before_validation callback, so the
+          # record validates without the user choosing anything.
+          return false if options[:default]
+
+          optional = options[:optional]
+          optional.nil? ? model.belongs_to_required_by_default : !optional
         end
 
         def read_only?

data/lib/rails_admin_next/config/actions/base.rb

@@ -147,6 +147,13 @@ module RailsAdminNext
 
         # Off API.
 
+        # Whether visiting the action's URL performs it, so it can be rendered as a
+        # plain link rather than a button. Verbs are host-supplied, so they may be
+        # written as :GET or "get".
+        def linkable?
+          http_methods.include?(:get) || http_methods.any? { |verb| verb.to_s.casecmp?("get") }
+        end
+
         def key
           self.class.key
         end

data/lib/rails_admin_next/config/actions/bulk_delete.rb

@@ -34,9 +34,14 @@ module RailsAdminNext
               unless params[:bulk_ids].blank?
                 @objects = list_entries(@model_config, :destroy)
                 unless @objects.blank?
-                  processed_objects = @abstract_model.destroy(@objects)
-                  destroyed = processed_objects.select(&:destroyed?)
-                  not_destroyed = processed_objects - destroyed
+                  # Rescue per record: dependent: :restrict_with_exception raises, and an
+                  # escaping raise would abandon every record behind it in the batch.
+                  destroyed, not_destroyed = Array.wrap(@objects).partition do |object|
+                    object.destroy
+                    object.destroyed?
+                  rescue ActiveRecord::DeleteRestrictionError
+                    false
+                  end
                   destroyed.each do |object|
                     @auditing_adapter&.delete_object(object, @abstract_model, _current_user)
                   end

data/lib/rails_admin_next/config/actions/delete.rb

@@ -33,12 +33,20 @@ module RailsAdminNext
 
             elsif request.delete? # DESTROY
 
-              @auditing_adapter&.delete_object(@object, @abstract_model, _current_user)
-              if @object.destroy
-                flash[:success] = t("admin.flash.successful", name: @model_config.label, action: t("admin.actions.delete.done"))
-                redirect_to index_path
-              else
-                handle_save_error :delete
+              begin
+                if @object.destroy
+                  @auditing_adapter&.delete_object(@object, @abstract_model, _current_user)
+                  flash[:success] = t("admin.flash.successful", name: @model_config.label, action: t("admin.actions.delete.done"))
+                  redirect_to index_path
+                else
+                  handle_save_error :delete
+                end
+              rescue ActiveRecord::DeleteRestrictionError => e
+                # dependent: :restrict_with_exception raises instead of adding an error to the
+                # record, so there is nothing for handle_save_error to render — report the
+                # association the exception names and send the admin back where they came from.
+                flash[:error] = t("admin.flash.delete_restricted", name: @model_config.label, reason: e.message)
+                redirect_to back_or_index, status: :see_other
               end
 
             end

data/lib/rails_admin_next/config/actions/show.rb

@@ -20,9 +20,11 @@ module RailsAdminNext
 
         register_instance_option :controller do
           proc do
+            # HTML first: an Accept-less request arrives as */*, which matches every
+            # registered type, so Rails falls back to whichever is declared first.
             respond_to do |format|
-              format.json { render json: @object }
               format.html { render @action.template_name }
+              format.json { render json: @object }
             end
           end
         end

data/lib/rails_admin_next/config/configurable.rb

@@ -55,9 +55,13 @@ module RailsAdminNext
           option_name = option_name.to_s
           options[option_name] = nil
 
-          # If it's a boolean create an alias for it and remove question mark
+          # If it's a boolean create an alias for it and remove question mark. The
+          # rebinding is what the rest of the method reads: the getter, the setter, the
+          # @<name>_registered variable and the recursion key all want the chopped name,
+          # while @config_options keeps the un-chopped one it was registered under.
           if option_name.end_with?("?")
-            scope.send(:define_method, "#{option_name.chop!}?") do
+            option_name = option_name.chop
+            scope.send(:define_method, "#{option_name}?") do
               send(option_name)
             end
           end

data/lib/rails_admin_next/config/fields/base.rb

@@ -16,6 +16,9 @@ module RailsAdminNext
         include RailsAdminNext::Config::Groupable
         include RailsAdminNext::Config::Inspectable
 
+        # The length-validation options that are compared against the column limit.
+        LENGTH_BOUNDS = %i[is maximum minimum].freeze
+
         attr_reader :name, :properties, :abstract_model, :parent, :root
         attr_accessor :defined, :order, :section
 
@@ -196,8 +199,14 @@ module RailsAdminNext
 
         # Accessor for field's length restrictions per validations
         #
+        # ActiveModel also accepts a bound as a Proc or a Symbol, which it resolves
+        # against the record at validation time. Neither can be compared against the
+        # column limit here, so both are dropped. Devise's password length validation
+        # declares its bounds as Procs.
         register_instance_option :valid_length do
-          @valid_length ||= abstract_model.model.validators_on(name).detect { |v| v.kind == :length }.try(&:options) || {}
+          @valid_length ||=
+            (abstract_model.model.validators_on(name).detect { |v| v.kind == :length }.try(&:options) || {})
+              .reject { |option, bound| LENGTH_BOUNDS.include?(option) && (bound.is_a?(Proc) || bound.is_a?(Symbol)) }
         end
 
         register_instance_option :partial do
@@ -215,7 +224,9 @@ module RailsAdminNext
               :nil
             end
 
-          (@required ||= {})[context] ||= !!([name] + children_fields).uniq.detect do |column_name|
+          # An association Rails treats as optional can still be required by a validator on its
+          # foreign key, so the reflection answer widens the validator scan instead of replacing it.
+          (@required ||= {})[context] ||= (association? && properties.try(:required?)) || !!([name] + children_fields).uniq.detect do |column_name|
             abstract_model.model.validators_on(column_name).detect do |v|
               !(v.options[:allow_nil] || v.options[:allow_blank]) &&
                 %i[presence numericality attachment_presence].include?(v.kind) &&
@@ -264,8 +275,6 @@ module RailsAdminNext
           false
         end
 
-        register_deprecated_instance_option :eager_load?, :eager_load
-
         def eager_load_values
           case eager_load
           when true

data/lib/rails_admin_next/config/fields/types/datetime.rb

@@ -63,11 +63,6 @@ module RailsAdminNext
             :form_datetime
           end
 
-          # Picker-only legacy option; native HTML5 inputs render per the browser locale, so it is ignored.
-          register_deprecated_instance_option :momentjs_format do
-            RailsAdminNext.deprecator.warn("The momentjs_format configuration option is deprecated and ignored; date/time fields now use native HTML5 inputs.")
-          end
-
           # The native <input type="datetime-local" step="1"> control accepts and emits ISO 8601 only.
           def form_value
             value&.in_time_zone&.strftime("%Y-%m-%dT%H:%M:%S") || form_default_value

data/lib/rails_admin_next/config/fields/types/multiple_file_upload.rb

@@ -29,8 +29,6 @@ module RailsAdminNext
               nil
             end
 
-            register_deprecated_instance_option :delete_key, :delete_value
-
             register_instance_option :pretty_value do
               if value.presence
                 v = bindings[:view]

data/lib/rails_admin_next/config/sections/list.rb

@@ -46,17 +46,9 @@ module RailsAdminNext
           ""
         end
 
-        register_deprecated_instance_option :sidescroll do
-          RailsAdminNext.deprecator.warn("The sidescroll configuration option was removed, it is always enabled now.")
-        end
-
         def fields_for_table
           visible_fields.partition(&:sticky?).flatten
         end
-
-        register_deprecated_instance_option :sort_reverse do
-          RailsAdminNext.deprecator.warn("The sort_reverse configuration option is deprecated and has no effect.")
-        end
       end
     end
   end

data/lib/rails_admin_next/config.rb

@@ -316,14 +316,6 @@ module RailsAdminNext
         end
       end
 
-      def total_columns_width=(_)
-        RailsAdminNext.deprecator.warn("The total_columns_width configuration option is deprecated and has no effect.")
-      end
-
-      def sidescroll=(_)
-        RailsAdminNext.deprecator.warn("The sidescroll configuration option was removed, it is always enabled now.")
-      end
-
       # Setup actions to be used.
       def actions(&block)
         return unless block

data/lib/rails_admin_next/version.rb

@@ -6,8 +6,8 @@ module RailsAdminNext
     # the tag's version over these constants at build time, so the in-repo values are only
     # the floor a local `gem build` produces.
     MAJOR = 1
-    MINOR = 0
-    PATCH = 1
+    MINOR = 1
+    PATCH = 0
     PRE = nil
 
     class << self

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails_admin_next
 version: !ruby/object:Gem::Version
-  version: 1.0.1
+  version: 1.1.0
 platform: ruby
 authors:
 - Daniel López Prat
@@ -340,7 +340,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 1.8.11
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.16
 specification_version: 4
 summary: Admin for Rails
 test_files: []