rails_admin_next 1.2.0 → 1.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fbd1b1c7b37f7d5d89eb5f9ef44dc086bedf1ecbd47f908c545afbb35e8f8bc1
-  data.tar.gz: 9358676100cad7935f07c91a757e27a761fe463e1a2fc6b291f8d8a0dc63df0d
+  metadata.gz: 957743cf70d6fa24bb0cb1eaf74ca15b4a3b2996e0dca4f5dcee2d6428985d6b
+  data.tar.gz: a205770a7170c2b1ce7e04a85cd6422f6cda1d150da237df81795387af8cc18d
 SHA512:
-  metadata.gz: 8b999764cff3b8b068b54f5bba5ac2107d9f4545584a76be7764c63b24cfc7135560ce7372fc953bae2aab8a5ef5e3e09735e3e592125b93d21ee70f6f5662a8
-  data.tar.gz: 477419b70e7056875a32b0790422a1310423d93cd43d91bc68007e918dace9b30acd3a6ad55c38eff654df59fbbe11bb87e5a8141c669807849897519a2ad8d0
+  metadata.gz: ad848e8080f75c1e3d6b12c180dcb745bb4a3caea7791ee08d4fec1d97567836effacf01ea340a764b0febb4a52c345e793b3d1708d7496e9d1c2e3f6a167f6d
+  data.tar.gz: 37ec4a516104eb2ecc4d8924c758ad862b8fa091f32a0d460b0dfda2f8bc566a233fa61ea81d6cdbbfe49695b1d71eb0aed55f75c281001e9d86a73821fbe8a8

data/README.md

@@ -8,7 +8,7 @@
 
 [![Build](https://github.com/6temes/rails_admin_next/actions/workflows/test.yml/badge.svg)](https://github.com/6temes/rails_admin_next/actions/workflows/test.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE.md)
-[![Ruby](https://img.shields.io/badge/Ruby-4.0.5%2B-CC342D.svg)](https://www.ruby-lang.org)
+[![Ruby](https://img.shields.io/badge/Ruby-4.0.9%2B-CC342D.svg)](https://www.ruby-lang.org)
 [![Rails](https://img.shields.io/badge/Rails-8.1-CC0000.svg)](https://rubyonrails.org)
 
 [Why RailsAdminNext?](#why-railsadminnext) ◆ [Quick Start](#quick-start) ◆ [Installation](#installation) ◆ [Architecture](#architecture) ◆ [Security](#security) ◆ [Upgrading](#upgrading-from-railsadmin)
@@ -32,7 +32,7 @@ multi-bundler, jQuery-era machinery. RailsAdminNext keeps the admin and drops th
 - **⚡ Zero build step** — browser-native ESM over **importmap + Propshaft**; no Webpack/Vite/Sprockets, no `yarn build`, no generated pins.
 - **🧩 Turbo + Stimulus** — the jQuery / jQuery-UI / Bootstrap-JS / `@rails/ujs` stack is gone, replaced by engine-shipped Stimulus controllers; styling is hand-maintained vanilla CSS.
 - **🔒 Hardened & CDN-free** — a documented CSRF / clickjacking / mass-assignment / CSP posture ([SECURITY.md](SECURITY.md)) and **zero external CDN**, default or opt-in — every asset is self-hosted off a gem.
-- **🎯 One modern target** — Ruby ≥ 4.0.5, Rails ~> 8.1, ActiveRecord only, latest Chrome + Safari. No Mongoid, no multi-bundler / multi-Rails matrix, no legacy-browser CSS.
+- **🎯 One modern target** — Ruby ≥ 4.0.9, Rails ~> 8.1, ActiveRecord only, latest Chrome + Safari. No Mongoid, no multi-bundler / multi-Rails matrix, no legacy-browser CSS.
 - **↩️ Familiar** — `RailsAdminNext.config`, per-model `rails_admin_next do … end` blocks, and CanCanCan / Pundit authorization all work as before; upgrading from RailsAdmin is a mechanical rename.
 
 ## Quick Start
@@ -50,17 +50,21 @@ bin/rails s                            # then open http://localhost:3000/admin
 
 That's the whole setup — no `yarn add`, no asset build, no generated pins. The engine ships its own importmap and CSS.
 
-> **Prerequisites:** Ruby ≥ 4.0.5 · Rails ~> 8.1 · ActiveRecord · a [Propshaft][propshaft] + [importmap-rails][importmap] host (both are pulled in as dependencies). See [Installation](#installation) for the full walkthrough.
+> **Prerequisites:** Ruby ≥ 4.0.9 · Rails ~> 8.1 · ActiveRecord · a [Propshaft][propshaft] + [importmap-rails][importmap] host (both are pulled in as dependencies). See [Installation](#installation) for the full walkthrough.
 
 ## Requirements
 
-- Ruby >= 4.0.5
+- Ruby >= 4.0.9
 - Rails ~> 8.1
 - ActiveRecord (Mongoid is not supported)
 - [Propshaft][propshaft] and [importmap-rails][importmap] (both are pulled in as
   dependencies; RailsAdminNext serves its frontend over them, with no bundler or build step)
 - Latest stable Chrome or Safari for the admin's users (see [Browser support](#browser-support))
 
+RailsAdminNext expects **evergreen** hosts. The Ruby floor follows the latest stable Ruby
+patch release, and a release can raise it without a major version bump. Keep your app on
+current Ruby and Rails to keep receiving updates.
+
 [propshaft]: https://github.com/rails/propshaft
 [importmap]: https://github.com/rails/importmap-rails
 

data/app/controllers/rails_admin_next/main_controller.rb

@@ -108,6 +108,17 @@ module RailsAdminNext
       model_config.send(action).with(controller: self, view: view_context, object: @object).visible_fields
     end
 
+    # Memoized, as export renders through index, which switches @action
+    def serialization_schema
+      @serialization_schema ||= begin
+        section = %i[export show].include?(@action.key) ? @model_config.send(@action.key) : @model_config.list
+        SerializationSchema.new(
+          section.with(controller: self, view: view_context, object: @object || @abstract_model.model.new),
+          include_associations: @action.key == :export
+        )
+      end
+    end
+
     def sanitize_params_for!(action, model_config = @model_config, target_params = params[@abstract_model.param_key], nested_in = nil)
       return unless target_params.present?
 

data/docs/UPGRADING.md

@@ -416,8 +416,40 @@ curl -H 'Accept: application/json' https://example.com/admin/player/1
 curl https://example.com/admin/player/1.json
 ```
 
-Note that the JSON branch renders the whole record, including columns the model config
-hides from the show view.
+The JSON branch renders only the fields the show view displays (see below).
+
+## JSON and XML serialize only configured fields
+
+The index action's `.json`/`.xml`, the show action's `.json`, and the export action's JSON/XML
+used to serialize every attribute of the record, and export passed the submitted `schema` straight
+to `to_json`/`to_xml` — so any `methods` or `include` name in it was called on every record.
+
+They now serialize only what the matching section shows: `list` for index, `show` for show,
+`export` for export. Index and show also keep the foreign keys of the `belongs_to` associations
+they display. A submitted export `schema` is intersected with the export fields, and `except` is
+ignored.
+
+If a client relied on a column the section doesn't show, add that field to the section.
+
+## Pundit: a model with no policy Scope lists nothing
+
+A model whose policy defines no `Scope` used to list every record. It now lists none: the
+list, export, bulk delete and dashboard count all return an empty set. Bulk delete deletes
+whatever the scope returns, with no per-record check, so "no Scope" can't mean "everything".
+
+Define a `Scope` for each model the admin exposes:
+
+```ruby
+class PlayerPolicy < ApplicationPolicy
+  class Scope < ApplicationPolicy::Scope
+    def resolve
+      scope.all
+    end
+  end
+end
+```
+
+CanCanCan hosts are unaffected.
 ## Removed: options deprecated before RailsAdmin 3.0
 
 These six were deprecated upstream between 2019-07 and 2022-01 and had no effect for

data/docs/security.md

@@ -11,6 +11,11 @@ destructive-action controls itself; a few things are left for the host to opt in
 - **Clickjacking.** Every admin response carries `X-Frame-Options: SAMEORIGIN`.
 - **Export.** The CSV/JSON/XML data stream requires a non-GET, CSRF-protected request; `GET` only
   renders the export form, so the table can't be exfiltrated via a crafted link.
+- **Serialization.** JSON and XML output is limited to the fields the section shows (`list`,
+  `show` or `export`). A submitted export `schema` is intersected with the export fields, so it
+  can't name a hidden column, an association the export doesn't show, or a method to call.
+- **Pundit scopes fail closed.** A model whose policy has no `Scope` lists no records, rather
+  than all of them.
 - **Destructive actions.** `delete` and `bulk_delete` render a confirmation page and additionally
   carry `data-turbo-confirm` on the destructive submit (Turbo's confirmation, not `@rails/ujs`).
 - **Mass assignment.** Submitted attributes are sliced to the model config's `visible_fields`

data/docs/upstream-parity.md

@@ -1,8 +1,8 @@
 # Upstream parity
 
-Assessed through upstream `897ffc13` (2026-09-13). Fork point: `d8e0809e` (2025-09-14).
+Assessed through upstream `2dfd05f1` (2026-10-30). Fork point: `d8e0809e` (2025-09-14).
 
-Divergence from the fork point: 787 files, +20,899 / −73,565 lines.
+Divergence from the fork point: 792 files, +21,203 / −73,569 lines.
 
 ## How this fork tracks upstream
 
@@ -18,6 +18,50 @@ Commits are listed newest first, as `git log` reports them.
 
 | upstream | subject | verdict | ours |
 |---|---|---|---|
+| `2dfd05f1` | Test ferrum 0.19.2 with flatten mode on JRuby | n/a — JRuby leg over Appraisal gemfiles; neither exists here | — |
+| `bf8f645c` | Replace nested_form with RailsAdmin's own nested form implementation | partly relevant — per-controller `<template>` and button controls already here; unsaved-row remove, self-reference recursion, placeholder collision and the dummy belongs_to still apply | [#73](https://github.com/6temes/rails_admin_next/issues/73) |
+| `6e27f4d3` | Let the adapter narrow a scope, instead of merging it here | n/a — one AR adapter; the controller's merge is already its vocabulary, no behaviour change | — |
+| `20f8f29a` | Narrow a listing by the scope it selects before it is paginated | partly adapted — pre-pagination done; export and bulk delete ignore the tab, and remote pickers get it | [#60](https://github.com/6temes/rails_admin_next/issues/60) |
+| `7e5a7d67` | Keep the browser driver off a version the suite hangs on | partly relevant — the pin is JRuby-only (n/a); the missing job timeout matches this fork's apt-step hangs | [#74](https://github.com/6temes/rails_admin_next/issues/74) |
+| `1e0bd4fd` | Say what an upload needs from an embedded document | n/a — embedded documents are Mongoid; no upload docs here | — |
+| `6651f64d` | Say which records associated_collection_scope governs | n/a — the option isn't documented here, so nothing to correct | — |
+| `51d7321a` | Look up a registered visible block by the option's own name | relevant — measured: redeclaring a field drops its visible block; `admin?` raises NameError | [#64](https://github.com/6temes/rails_admin_next/issues/64) |
+| `e67edd00` | Escape a field name before it stands in for a selector | n/a — the filter container is found by `getElementById`; other selectors use `CSS.escape` or quoted values | — |
+| `11cd3e53` | Leave out a column the queried term could never fit | relevant — measured: PG raises NumericValueOutOfRange for a 10-digit term on int4 | [#56](https://github.com/6temes/rails_admin_next/issues/56) |
+| `2d9f951f` | Have no enumeration rather than crash when there's no _enum method | relevant — measured: enum without a source crashes filter_operators; native PG enums hit it unconfigured | [#58](https://github.com/6temes/rails_admin_next/issues/58) |
+| `c4b64ede` | Document sort_by's array and hash forms | n/a — sort_by isn't documented here; the forms are supported | — |
+| `cbed4c42` | Fall back to the guessed encoding when a CSV export leaves it blank | n/a — measured: blank does what the form says here (leaves encoding untouched); the fallback is a no-op on the connection encoding | — |
+| `8748af05` | Bind the controller and view before reading a model's list scopes | relevant — measured: both reads are unbound | [#62](https://github.com/6temes/rails_admin_next/issues/62) |
+| `3e26f685` | Keep a serialized value's wrapper class out of the text an admin edits | relevant — measured: every AR `store` round-trip raises DisallowedClass | [#63](https://github.com/6temes/rails_admin_next/issues/63) |
+| `8b7f686b` | Let a requested sort win over has_paper_trail's own version order | relevant — `order` appended after paper_trail's association order | [#69](https://github.com/6temes/rails_admin_next/issues/69) |
+| `e9e13ebf` | Recognize a native timestamptz column as a timestamp field | relevant — measured: Rails 8.1.4 PG reports `:timestamptz`, which the registry rejects | [#55](https://github.com/6temes/rails_admin_next/issues/55) |
+| `0c6b8e9d` | Version 4.0.0.beta2 | n/a — upstream release chore | — |
+| `d96845da` | [Security] Fail closed when Pundit policy scope is undefined | relevant — the adapter rescued a missing Scope with `model.all`; fixed with plain AR `none` (no repository indirection needed) | [#77](https://github.com/6temes/rails_admin_next/pull/77) |
+| `a6cf6bb0` | [Security] Limit JSON/XML serialization to the configured fields | partly adapted — the GET gate was already here; methods/hidden columns via `schema` and full-row index/show output fixed; the default never calls virtual fields | [#77](https://github.com/6temes/rails_admin_next/pull/77) |
+| `fca081f2` | Version 4.0.0.beta | n/a — upstream release chore | — |
+| `00ddcd06` | Drop the dummy app's tooling for asset modes that no longer exist | n/a — none of those files are tracked here | — |
+| `d593bcaf` | Serve the dummy app's own JavaScript through every asset pipeline | n/a — one pipeline; the host entry is an ESM module importing Turbo | — |
+| `72bdd18d` | Let any callable serve as asset_source | n/a — `asset_source=` is a deprecated no-op here | — |
+| `812109cf` | Put the :external stylesheet where a JS build will not eat it | n/a — the installer writes only an initializer | — |
+| `9ed33f69` | Keep the dummy app's test hooks out of development | n/a — the only test hook here is invisible | — |
+| `7cc5e292` | Keep the dummy app's cookies readable, and cover CSRF both ways | partly relevant — the json pin is moot on Rails 8.1.4; the CSRF acceptance coverage gap applies | [#76](https://github.com/6temes/rails_admin_next/issues/76) |
+| `fd0bf316` | Drop the docs left behind by the asset rework | n/a — docs here mention those pipelines only as removed | — |
+| `3af6946c` | Flush rich-text editors before the modal submits | n/a — Trix writes its input on every change; no submit-time editor remains | — |
+| `a16b425f` | Test carrierwave 3.x and 4.x within the existing CI matrix | n/a — CarrierWave removed | — |
+| `8302cc29` | Lower a search term with String#downcase | adapted — already `downcase`; no `mb_chars` left | — |
+| `63ebb9ac` | Ask whether an enum is null, not whether it equals '' | relevant — measured: PG rejects `= ''` on an integer enum | [#57](https://github.com/6temes/rails_admin_next/issues/57) |
+| `749cbe75` | Let associated_collection_scope decide the order it asks for | relevant — scope applied before the reorder; the swap must follow #60 | [#61](https://github.com/6temes/rails_admin_next/issues/61) |
+| `47da8e99` | Refresh SimpleMDE editors when their tab is shown | n/a — no layout-measuring editor ships here | — |
+| `4443ab35` | Ship a prebuilt asset bundle; collapse config.asset_source | n/a — already a single zero-build importmap + Propshaft path | — |
+| `478484fb` | CI: install ImageMagick against a refreshed package list | n/a — the step here already runs `apt-get update` and `-y`; the failure here is a stall (#74) | — |
+| `a6f4c5ad` | Fix the viewport meta tag's name attribute | relevant — the identical malformed tag is in `_head.html.erb` | [#72](https://github.com/6temes/rails_admin_next/issues/72) |
+| `88e6df4d` | Strip a leading :: when deriving a model's config registry key | relevant — measured: config ignored and the model listed twice | [#70](https://github.com/6temes/rails_admin_next/issues/70) |
+| `a5607f24` | Use label_plural in bulk delete flash messages | relevant — measured: translated plural ignored | [#71](https://github.com/6temes/rails_admin_next/issues/71) |
+| `7b60193b` | Let the page catch up before reading the database | adapted — fixed independently here | [#23](https://github.com/6temes/rails_admin_next/pull/23) |
+| `ef3e3f57` | Keep one dead browser from failing the examples after it | partly relevant — the driver restore applies; the startup-timeout half is deferred (never seen in ~60 runs) | [#75](https://github.com/6temes/rails_admin_next/issues/75) |
+| `cc293dea` | Wait for the autocomplete menu itself, not for one of its entries | n/a — waits here use counts or text the stale menu can't satisfy; the widget renders once per query (as `77e5d0bc`) | — |
+| `d3cfba1d` | Render the list for a filter URL written by hand | relevant — measured: seven malformed shapes 500, one specific to this fork | [#65](https://github.com/6temes/rails_admin_next/issues/65) |
+| `ede4e77b` | Split the adapter layer into a Reflection and a Repository | declined — multi-ORM refactor, one adapter here; four embedded fixes filed separately | [#59](https://github.com/6temes/rails_admin_next/issues/59), [#66](https://github.com/6temes/rails_admin_next/issues/66), [#67](https://github.com/6temes/rails_admin_next/issues/67), [#68](https://github.com/6temes/rails_admin_next/issues/68) |
 | `897ffc13` | Fix _discard leaking into SQL for multi-select enum filters | adapted — server half only; the client half was already stronger here (disabled options), so upstream's JS was deliberately not ported | [#36](https://github.com/6temes/rails_admin_next/pull/36) |
 | `11f214f6` | Remove config options deprecated before RailsAdmin 3.0 | adapted — the deprecator half already shipped; this removed the six options | [#40](https://github.com/6temes/rails_admin_next/pull/40) |
 | `cbea80b1` | Match GET in http_methods case-insensitively | adapted — `Actions::Base#linkable?` | [#38](https://github.com/6temes/rails_admin_next/pull/38) |
@@ -31,7 +75,7 @@ Commits are listed newest first, as `git log` reports them.
 | `2eed28e1` | Fully specify all ESM imports with an extension | n/a — measured: every relative import in `src/` already carries `.js`; browser-native ESM requires it | — |
 | `e8dec57a` | Upgrade @hotwired/turbo-rails to resolve security warning | n/a — turbo comes from the `turbo-rails` gem (2.0.23), which Dependabot reads | — |
 | `07b2066a` | Replace `asset-url` with `url` in Sass files | n/a — no Sass; one hand-owned CSS file | — |
-| `a0946615` | Drop support for Rails 6.x and Ruby 2.5/2.6 | n/a — this fork is Rails ~> 8.1 / Ruby >= 4.0.5 only | — |
+| `a0946615` | Drop support for Rails 6.x and Ruby 2.5/2.6 | n/a — this fork is Rails ~> 8.1 / Ruby >= 4.0.9 only | — |
 | `0543cb3f` | Revert npm package.json version ahead of actual publish | n/a — no npm package | — |
 | `cf7b112e` | Run Prettier on migrated docs | n/a — upstream's vendored wiki | — |
 | `1c2b92a3` | Rewrite wiki cross-links to relative docs/ links | n/a — upstream's vendored wiki | — |

data/lib/rails_admin_next/config/actions/export.rb

@@ -22,7 +22,8 @@ module RailsAdminNext
             # table with attacker-chosen columns; the export form posts back to this same action.
             if format && !request.get?
               request.format = format
-              @schema = HashHelper.symbolize(params[:schema].slice(:except, :include, :methods, :only).permit!.to_h) if params[:schema] # to_json and to_xml expect symbols for keys AND values.
+              serialization_schema # built while @action is still export
+              @schema = serialization_schema.sanitize(params[:schema].slice(:include, :methods, :only).permit!.to_h) if params[:schema]
               @objects = list_entries(@model_config, :export)
               index
             else

data/lib/rails_admin_next/config/actions/index.rb

@@ -66,7 +66,7 @@ module RailsAdminNext
                       @objects.collect { |object| {id: object.id.to_s, label: object.send(@model_config.object_label_method).to_s} }
                     end
                   else
-                    @objects.to_json(@schema)
+                    @objects.to_json(@schema || serialization_schema.default)
                   end
 
                 if params[:send_data]
@@ -77,7 +77,7 @@ module RailsAdminNext
               end
 
               format.xml do
-                output = @objects.map { |object| object.serializable_hash(@schema || {}) }.to_xml(root: @abstract_model.model.model_name.plural)
+                output = @objects.map { |object| object.serializable_hash(@schema || serialization_schema.default) }.to_xml(root: @abstract_model.model.model_name.plural)
                 if params[:send_data]
                   send_data output, filename: "#{params[:model_name]}_#{DateTime.now.strftime("%Y-%m-%d_%Hh%Mm%S")}.xml"
                 else

data/lib/rails_admin_next/config/actions/show.rb

@@ -24,7 +24,7 @@ module RailsAdminNext
             # registered type, so Rails falls back to whichever is declared first.
             respond_to do |format|
               format.html { render @action.template_name }
-              format.json { render json: @object }
+              format.json { render json: @object.to_json(serialization_schema.default) }
             end
           end
         end

data/lib/rails_admin_next/extensions/pundit/authorization_adapter.rb

@@ -40,11 +40,13 @@ module RailsAdminNext
 
         # This is called when needing to scope a database query. It is called within the list
         # and bulk_delete/destroy actions and should return a scope which limits the records
-        # to those which the user can perform the given action on.
+        # to those which the user can perform the given action on. A model with no policy
+        # Scope gets no records: bulk_delete deletes whatever this returns without a
+        # per-record check, so a forgotten Scope must not mean "everything".
         def query(_action, abstract_model)
           @controller.send(:policy_scope, abstract_model.model.all)
         rescue ::Pundit::NotDefinedError
-          abstract_model.model.all
+          abstract_model.model.none
         end
 
         # This is called in the new/create actions to determine the initial attributes for new

data/lib/rails_admin_next/support/serialization_schema.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+require "rails_admin_next/support/hash_helper"
+
+module RailsAdminNext
+  # The options handed to to_json/serializable_hash, limited to what a section
+  # shows. Both serializers call every name under `methods` and `include` on each
+  # record, and serialize every attribute when `only` is missing, so a requested
+  # schema is only ever intersected with this, never passed through.
+  class SerializationSchema
+    def initialize(section, include_associations:)
+      @section = section
+      @include_associations = include_associations
+    end
+
+    # Attributes only: a virtual field need not be a method on the record, so
+    # calling it unasked could raise where the plain serialization never did.
+    def default
+      {only: allowed[:only]}
+    end
+
+    def sanitize(requested)
+      requested = HashHelper.symbolize(requested)
+      schema = filter(requested, allowed)
+      if @include_associations && requested[:include].is_a?(Hash)
+        schema[:include] = requested[:include].each_with_object({}) do |(name, value), included|
+          next unless value.is_a?(Hash) && allowed[:include].key?(name)
+
+          included[name] = filter(value, allowed[:include][name])
+        end
+      end
+      schema
+    end
+
+    private
+
+    def allowed
+      @allowed ||= begin
+        fields = @section.visible_fields
+        names = field_names(fields.select { |f| !f.association? || f.association.polymorphic? })
+        if @include_associations
+          names[:include] = fields.select { |f| f.association? && !f.association.polymorphic? }.to_h do |field|
+            associated = field.associated_model_config.export.with(@section.bindings.merge(object: field.associated_model_config.abstract_model.model.new))
+            [field.name, field_names(associated.visible_fields.reject(&:association?))]
+          end
+        else
+          # The section already shows these associations, so their keys expose nothing more
+          names[:only].concat(fields.select { |f| f.association? && f.association.type == :belongs_to && !f.association.polymorphic? }
+            .flat_map { |f| Array(f.association.foreign_key).map(&:to_sym) })
+        end
+        names
+      end
+    end
+
+    # Mirrors the names the export form offers (main/export.html.erb).
+    def field_names(fields)
+      fields.each_with_object({only: [], methods: []}) do |field, names|
+        list = field.virtual? ? names[:methods] : names[:only]
+        if field.association?
+          list << field.method_name.to_sym << field.association.foreign_type.to_sym
+        else
+          list << field.name.to_sym
+        end
+      end
+    end
+
+    # An empty `only` serializes no attribute in ActiveRecord, which is the point.
+    def filter(requested, permitted)
+      schema = {only: Array(requested[:only]) & permitted[:only]}
+      schema[:methods] = Array(requested[:methods]) & permitted[:methods] if requested.key?(:methods)
+      schema
+    end
+  end
+end

data/lib/rails_admin_next/version.rb

@@ -7,7 +7,7 @@ module RailsAdminNext
     # the floor a local `gem build` produces.
     MAJOR = 1
     MINOR = 2
-    PATCH = 0
+    PATCH = 1
     PRE = nil
 
     class << self

data/lib/rails_admin_next.rb

@@ -12,6 +12,7 @@ require "rails_admin_next/extensions/paper_trail"
 require "rails_admin_next/support/csv_converter"
 require "rails_admin_next/support/hash_helper"
 require "rails_admin_next/support/paginated_collection"
+require "rails_admin_next/support/serialization_schema"
 require "yaml"
 
 module RailsAdminNext

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails_admin_next
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.2.1
 platform: ruby
 authors:
 - Daniel López Prat
@@ -298,6 +298,7 @@ files:
 - lib/rails_admin_next/support/csv_converter.rb
 - lib/rails_admin_next/support/hash_helper.rb
 - lib/rails_admin_next/support/paginated_collection.rb
+- lib/rails_admin_next/support/serialization_schema.rb
 - lib/rails_admin_next/version.rb
 - lib/tasks/rails_admin.rake
 - skills/rails-admin-next/SKILL.md
@@ -338,7 +339,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 4.0.5
+      version: 4.0.9
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="