rails_admin_next 1.2.0 → 1.3.0

data/docs/UPGRADING.md

@@ -398,6 +398,19 @@ end
 
 Note the block: a bare `inverse_of nil` reads the option rather than setting it.
 
+## Nested forms that can reach themselves stop at three levels
+
+A nested form for an association that leads back to its own model, such as a self-referential
+`has_many :children` with `accepts_nested_attributes_for`, used to render without end and fail
+with `SystemStackError`, as did saved records that point back at each other. It now nests the
+same association at most three times along one chain; past that, the association's rows, blank
+template and add control are left out of the form, so a deeper tree is edited from a lower
+record. Chains of distinct associations are not capped.
+
+The blank row's child-index placeholder is tagged by depth, `new_<depth>_<association>` (for
+example `new_1_comments`), rather than `new_<association>`. Host JavaScript that looked for the
+old token in a nested form's `<template>` needs the new one.
+
 ## The show action answers HTML by default
 
 `show` used to declare its JSON format before its HTML one, so a request carrying no
@@ -416,8 +429,149 @@ curl -H 'Accept: application/json' https://example.com/admin/player/1
 curl https://example.com/admin/player/1.json
 ```
 
-Note that the JSON branch renders the whole record, including columns the model config
-hides from the show view.
+The JSON branch renders only the fields the show view displays (see below).
+
+## JSON and XML serialize only configured fields
+
+The index action's `.json`/`.xml`, the show action's `.json`, and the export action's JSON/XML
+used to serialize every attribute of the record, and export passed the submitted `schema` straight
+to `to_json`/`to_xml` — so any `methods` or `include` name in it was called on every record.
+
+They now serialize only what the matching section shows: `list` for index, `show` for show,
+`export` for export. Index and show also keep the foreign keys of the `belongs_to` associations
+they display. A submitted export `schema` is intersected with the export fields, and `except` is
+ignored.
+
+If a client relied on a column the section doesn't show, add that field to the section.
+
+## Malformed filter params are ignored
+
+The index page used to answer a hand-written or stale `f[...]` query string with a 500: a
+filter that wasn't the `field => index => {o:, v:}` shape the filter box submits, one naming
+a field that isn't filterable (`is not currently filterable`), or a value the field couldn't
+parse, such as an impossible date or malformed JSON. Such a filter is now dropped and the
+rest of the list renders. A value that fails to parse counts as no value, so a bookmarked
+link to a field that has since stopped being filterable lists every record rather than
+erroring.
+
+## Pundit: a model with no policy Scope lists nothing
+
+A model whose policy defines no `Scope` used to list every record. It now lists none: the
+list, export, bulk delete and dashboard count all return an empty set. Bulk delete deletes
+whatever the scope returns, with no per-record check, so "no Scope" can't mean "everything".
+
+Define a `Scope` for each model the admin exposes:
+
+```ruby
+class PlayerPolicy < ApplicationPolicy
+  class Scope < ApplicationPolicy::Scope
+    def resolve
+      scope.all
+    end
+  end
+end
+```
+
+CanCanCan hosts are unaffected.
+
+## An `:enum` field with no option source offers no options
+
+An `:enum` field takes its options from `enum_method`, which defaults to `<name>_enum` on the
+model class or the record. When neither defines it, the field used to call `<name>` itself and
+treat the record's current value as the option list: the index filter crashed, and the form
+offered that value instead of choices. It now offers no options.
+
+If a field's own method returns its option list, name it explicitly:
+
+```ruby
+field :colors, :enum do
+  enum_method :colors
+end
+```
+
+## A redeclared field keeps its `visible` block
+
+Declaring a field again in the same section used to discard a `visible { ... }` block set by an
+earlier declaration and show the field to everyone. The block now survives:
+
+```ruby
+field :salary do
+  visible { bindings[:view].current_user.admin? }
+end
+field :salary # still hidden from non-admins
+```
+
+If a field you hide conditionally started showing for everyone after a later `field` call, it is
+hidden again. A field hidden with a plain `visible false` is still shown again by a later
+declaration, as before.
+
+## Serialized fields load only plain YAML
+
+A `serialized` field (the default for a `store` or `serialize` attribute) now shows its value
+as plain YAML, without `!ruby/...` class tags, and loads the submitted YAML with only `Symbol`,
+`Date` and `Time` permitted. A store's `HashWithIndifferentAccess` comes back as a plain `Hash`,
+which the store wraps again on assignment. YAML naming any other class is rejected.
+
+The `safe_yaml` gem is no longer consulted, even when the host bundles it.
+`RailsAdminNext.yaml_load` and `RailsAdminNext.yaml_dump` are deprecated: call
+`YAML.safe_load` and `YAML.dump` directly.
+
+## `config.model "::Order"` configures `Order`
+
+A model named as a string or symbol with a leading `::` used to register a second, separate
+entry: its block never reached `Order`, and `Order` appeared twice in the navigation. The `::`
+is now dropped, so the block applies to `Order`. If such a block was silently doing nothing,
+check that what it configures is what you want before upgrading. `included_models` and
+`excluded_models` drop a leading `::` the same way.
+
+## Scope tabs apply to export and bulk delete
+
+The tab selected on a list (`list { scopes [...] }`) now also narrows export and bulk
+delete: "Export found" streams only the tab's records, and bulk delete lists and destroys
+only the tab's records, whatever ids are submitted. The bulk form and the confirmation
+form carry `scope` so the tab survives the round trip.
+
+A tabbed collection stays inside the authorization scope, so a tab that drops conditions,
+such as `unscoped`, cannot list, export or delete records the user may not see. It still
+drops the model's own configured `scope`. The authorization scope is built on the model's
+`default_scope`, so an `unscoped` tab no longer reaches records `default_scope` hides: a
+soft-delete "trash" tab built on `unscoped` comes up empty. Give such a tab a scope the
+authorization relation also reaches.
+
+The `scopes` block is now evaluated with `bindings[:controller]`, `bindings[:view]` and
+`bindings[:object]`, so tabs can depend on the current user:
+
+```ruby
+config.model "Order" do
+  list do
+    scopes { bindings[:controller].current_user.admin? ? [nil, :refunded] : [nil] }
+  end
+end
+```
+
+`list_entries` keeps its four positional arguments, but applies a tab only for the page's
+own model, its `additional_scope` defaults to `nil`, and it no longer reads the
+`associated_collection` picker params. Custom actions that listed picker records through
+it should call `association_entries(model_config, collection_scope)` instead.
+
+## `associated_collection_scope` runs after the list sort
+
+Association pickers apply `associated_collection_scope` after the picked model's list sort,
+so a `reorder` in it now decides the order. A plain `order` adds a secondary sort key after
+the list sort. Build on the relation the proc receives: returning a fresh relation discards
+the authorization scope, the picker's search query, sort and eager loads as well. Pickers
+never apply the picked model's scope tabs.
+
+## CSV export follows the list sort
+
+CSV export used to walk records with `find_each`, which discards the list sort, so every file
+came out in primary-key ascending order. It now writes rows in the order the list shows them:
+the sort the export request carries, or the list's default sort. For most models that default is
+the primary key descending, so an export with no sort chosen is now newest first.
+
+Rows are read in batches of 1000 instead of loading every record up front. An export with no
+matching records now contains the header row instead of an empty line.
+
 ## Removed: options deprecated before RailsAdmin 3.0
 
 These six were deprecated upstream between 2019-07 and 2022-01 and had no effect for
@@ -461,3 +615,7 @@ These are intentionally gone — migrate off them before upgrading:
 
 The gem owns **no** history table. Auditing remains host/PaperTrail territory, so there is
 no gem migration to run — your existing `rails_admin_histories` table (if any) is unaffected.
+
+A record's history page now honours its column sort, and with no sort it lists newest
+first, like the model history page. It used to list a record's versions oldest first
+whatever the sort.

data/docs/security.md

@@ -11,6 +11,11 @@ destructive-action controls itself; a few things are left for the host to opt in
 - **Clickjacking.** Every admin response carries `X-Frame-Options: SAMEORIGIN`.
 - **Export.** The CSV/JSON/XML data stream requires a non-GET, CSRF-protected request; `GET` only
   renders the export form, so the table can't be exfiltrated via a crafted link.
+- **Serialization.** JSON and XML output is limited to the fields the section shows (`list`,
+  `show` or `export`). A submitted export `schema` is intersected with the export fields, so it
+  can't name a hidden column, an association the export doesn't show, or a method to call.
+- **Pundit scopes fail closed.** A model whose policy has no `Scope` lists no records, rather
+  than all of them.
 - **Destructive actions.** `delete` and `bulk_delete` render a confirmation page and additionally
   carry `data-turbo-confirm` on the destructive submit (Turbo's confirmation, not `@rails/ujs`).
 - **Mass assignment.** Submitted attributes are sliced to the model config's `visible_fields`

data/docs/upstream-parity.md

@@ -1,8 +1,8 @@
 # Upstream parity
 
-Assessed through upstream `897ffc13` (2026-09-13). Fork point: `d8e0809e` (2025-09-14).
+Assessed through upstream `2dfd05f1` (2026-10-30). Fork point: `d8e0809e` (2025-09-14).
 
-Divergence from the fork point: 787 files, +20,899 / −73,565 lines.
+Divergence from the fork point: 792 files, +21,203 / −73,569 lines.
 
 ## How this fork tracks upstream
 
@@ -18,6 +18,50 @@ Commits are listed newest first, as `git log` reports them.
 
 | upstream | subject | verdict | ours |
 |---|---|---|---|
+| `2dfd05f1` | Test ferrum 0.19.2 with flatten mode on JRuby | n/a — JRuby leg over Appraisal gemfiles; neither exists here | — |
+| `bf8f645c` | Replace nested_form with RailsAdmin's own nested form implementation | partly relevant — per-controller `<template>` and button controls already here; unsaved-row remove, self-reference recursion, placeholder collision and the dummy belongs_to still apply | [#73](https://github.com/6temes/rails_admin_next/issues/73) |
+| `6e27f4d3` | Let the adapter narrow a scope, instead of merging it here | n/a — one AR adapter; the controller's merge is already its vocabulary, no behaviour change | — |
+| `20f8f29a` | Narrow a listing by the scope it selects before it is paginated | partly adapted — pre-pagination done; export and bulk delete ignore the tab, and remote pickers get it | [#60](https://github.com/6temes/rails_admin_next/issues/60) |
+| `7e5a7d67` | Keep the browser driver off a version the suite hangs on | partly relevant — the pin is JRuby-only (n/a); the missing job timeout matches this fork's apt-step hangs | [#74](https://github.com/6temes/rails_admin_next/issues/74) |
+| `1e0bd4fd` | Say what an upload needs from an embedded document | n/a — embedded documents are Mongoid; no upload docs here | — |
+| `6651f64d` | Say which records associated_collection_scope governs | n/a — the option isn't documented here, so nothing to correct | — |
+| `51d7321a` | Look up a registered visible block by the option's own name | relevant — measured: redeclaring a field drops its visible block; `admin?` raises NameError | [#64](https://github.com/6temes/rails_admin_next/issues/64) |
+| `e67edd00` | Escape a field name before it stands in for a selector | n/a — the filter container is found by `getElementById`; other selectors use `CSS.escape` or quoted values | — |
+| `11cd3e53` | Leave out a column the queried term could never fit | relevant — measured: PG raises NumericValueOutOfRange for a 10-digit term on int4 | [#56](https://github.com/6temes/rails_admin_next/issues/56) |
+| `2d9f951f` | Have no enumeration rather than crash when there's no _enum method | relevant — measured: enum without a source crashes filter_operators; native PG enums hit it unconfigured | [#58](https://github.com/6temes/rails_admin_next/issues/58) |
+| `c4b64ede` | Document sort_by's array and hash forms | n/a — sort_by isn't documented here; the forms are supported | — |
+| `cbed4c42` | Fall back to the guessed encoding when a CSV export leaves it blank | n/a — measured: blank does what the form says here (leaves encoding untouched); the fallback is a no-op on the connection encoding | — |
+| `8748af05` | Bind the controller and view before reading a model's list scopes | relevant — measured: both reads are unbound | [#62](https://github.com/6temes/rails_admin_next/issues/62) |
+| `3e26f685` | Keep a serialized value's wrapper class out of the text an admin edits | relevant — measured: every AR `store` round-trip raises DisallowedClass | [#63](https://github.com/6temes/rails_admin_next/issues/63) |
+| `8b7f686b` | Let a requested sort win over has_paper_trail's own version order | relevant — `order` appended after paper_trail's association order | [#69](https://github.com/6temes/rails_admin_next/issues/69) |
+| `e9e13ebf` | Recognize a native timestamptz column as a timestamp field | relevant — measured: Rails 8.1.4 PG reports `:timestamptz`, which the registry rejects | [#55](https://github.com/6temes/rails_admin_next/issues/55) |
+| `0c6b8e9d` | Version 4.0.0.beta2 | n/a — upstream release chore | — |
+| `d96845da` | [Security] Fail closed when Pundit policy scope is undefined | relevant — the adapter rescued a missing Scope with `model.all`; fixed with plain AR `none` (no repository indirection needed) | [#77](https://github.com/6temes/rails_admin_next/pull/77) |
+| `a6cf6bb0` | [Security] Limit JSON/XML serialization to the configured fields | partly adapted — the GET gate was already here; methods/hidden columns via `schema` and full-row index/show output fixed; the default never calls virtual fields | [#77](https://github.com/6temes/rails_admin_next/pull/77) |
+| `fca081f2` | Version 4.0.0.beta | n/a — upstream release chore | — |
+| `00ddcd06` | Drop the dummy app's tooling for asset modes that no longer exist | n/a — none of those files are tracked here | — |
+| `d593bcaf` | Serve the dummy app's own JavaScript through every asset pipeline | n/a — one pipeline; the host entry is an ESM module importing Turbo | — |
+| `72bdd18d` | Let any callable serve as asset_source | n/a — `asset_source=` is a deprecated no-op here | — |
+| `812109cf` | Put the :external stylesheet where a JS build will not eat it | n/a — the installer writes only an initializer | — |
+| `9ed33f69` | Keep the dummy app's test hooks out of development | n/a — the only test hook here is invisible | — |
+| `7cc5e292` | Keep the dummy app's cookies readable, and cover CSRF both ways | partly relevant — the json pin is moot on Rails 8.1.4; the CSRF acceptance coverage gap applies | [#76](https://github.com/6temes/rails_admin_next/issues/76) |
+| `fd0bf316` | Drop the docs left behind by the asset rework | n/a — docs here mention those pipelines only as removed | — |
+| `3af6946c` | Flush rich-text editors before the modal submits | n/a — Trix writes its input on every change; no submit-time editor remains | — |
+| `a16b425f` | Test carrierwave 3.x and 4.x within the existing CI matrix | n/a — CarrierWave removed | — |
+| `8302cc29` | Lower a search term with String#downcase | adapted — already `downcase`; no `mb_chars` left | — |
+| `63ebb9ac` | Ask whether an enum is null, not whether it equals '' | relevant — measured: PG rejects `= ''` on an integer enum | [#57](https://github.com/6temes/rails_admin_next/issues/57) |
+| `749cbe75` | Let associated_collection_scope decide the order it asks for | relevant — scope applied before the reorder; the swap must follow #60 | [#61](https://github.com/6temes/rails_admin_next/issues/61) |
+| `47da8e99` | Refresh SimpleMDE editors when their tab is shown | n/a — no layout-measuring editor ships here | — |
+| `4443ab35` | Ship a prebuilt asset bundle; collapse config.asset_source | n/a — already a single zero-build importmap + Propshaft path | — |
+| `478484fb` | CI: install ImageMagick against a refreshed package list | n/a — the step here already runs `apt-get update` and `-y`; the failure here is a stall (#74) | — |
+| `a6f4c5ad` | Fix the viewport meta tag's name attribute | relevant — the identical malformed tag is in `_head.html.erb` | [#72](https://github.com/6temes/rails_admin_next/issues/72) |
+| `88e6df4d` | Strip a leading :: when deriving a model's config registry key | relevant — measured: config ignored and the model listed twice | [#70](https://github.com/6temes/rails_admin_next/issues/70) |
+| `a5607f24` | Use label_plural in bulk delete flash messages | relevant — measured: translated plural ignored | [#71](https://github.com/6temes/rails_admin_next/issues/71) |
+| `7b60193b` | Let the page catch up before reading the database | adapted — fixed independently here | [#23](https://github.com/6temes/rails_admin_next/pull/23) |
+| `ef3e3f57` | Keep one dead browser from failing the examples after it | partly relevant — the driver restore applies; the startup-timeout half is deferred (never seen in ~60 runs) | [#75](https://github.com/6temes/rails_admin_next/issues/75) |
+| `cc293dea` | Wait for the autocomplete menu itself, not for one of its entries | n/a — waits here use counts or text the stale menu can't satisfy; the widget renders once per query (as `77e5d0bc`) | — |
+| `d3cfba1d` | Render the list for a filter URL written by hand | relevant — measured: seven malformed shapes 500, one specific to this fork | [#65](https://github.com/6temes/rails_admin_next/issues/65) |
+| `ede4e77b` | Split the adapter layer into a Reflection and a Repository | declined — multi-ORM refactor, one adapter here; four embedded fixes filed separately | [#59](https://github.com/6temes/rails_admin_next/issues/59), [#66](https://github.com/6temes/rails_admin_next/issues/66), [#67](https://github.com/6temes/rails_admin_next/issues/67), [#68](https://github.com/6temes/rails_admin_next/issues/68) |
 | `897ffc13` | Fix _discard leaking into SQL for multi-select enum filters | adapted — server half only; the client half was already stronger here (disabled options), so upstream's JS was deliberately not ported | [#36](https://github.com/6temes/rails_admin_next/pull/36) |
 | `11f214f6` | Remove config options deprecated before RailsAdmin 3.0 | adapted — the deprecator half already shipped; this removed the six options | [#40](https://github.com/6temes/rails_admin_next/pull/40) |
 | `cbea80b1` | Match GET in http_methods case-insensitively | adapted — `Actions::Base#linkable?` | [#38](https://github.com/6temes/rails_admin_next/pull/38) |
@@ -31,7 +75,7 @@ Commits are listed newest first, as `git log` reports them.
 | `2eed28e1` | Fully specify all ESM imports with an extension | n/a — measured: every relative import in `src/` already carries `.js`; browser-native ESM requires it | — |
 | `e8dec57a` | Upgrade @hotwired/turbo-rails to resolve security warning | n/a — turbo comes from the `turbo-rails` gem (2.0.23), which Dependabot reads | — |
 | `07b2066a` | Replace `asset-url` with `url` in Sass files | n/a — no Sass; one hand-owned CSS file | — |
-| `a0946615` | Drop support for Rails 6.x and Ruby 2.5/2.6 | n/a — this fork is Rails ~> 8.1 / Ruby >= 4.0.5 only | — |
+| `a0946615` | Drop support for Rails 6.x and Ruby 2.5/2.6 | n/a — this fork is Rails ~> 8.1 / Ruby >= 4.0.9 only | — |
 | `0543cb3f` | Revert npm package.json version ahead of actual publish | n/a — no npm package | — |
 | `cf7b112e` | Run Prettier on migrated docs | n/a — upstream's vendored wiki | — |
 | `1c2b92a3` | Rewrite wiki cross-links to relative docs/ links | n/a — upstream's vendored wiki | — |

data/lib/rails_admin_next/abstract_model.rb

@@ -118,8 +118,16 @@ module RailsAdminNext
       extend Adapters::ActiveRecord
     end
 
+    # A value the field can't parse (an impossible date, malformed JSON or YAML) is
+    # treated as no value, element by element in an array. Only parse errors are
+    # rescued, so a bug in a custom parse_value still raises. Date::Error is an
+    # ArgumentError.
     def parse_field_value(field, value)
-      value.is_a?(Array) ? value.map { |v| field.parse_value(v) } : field.parse_value(value)
+      return value.map { |v| parse_field_value(field, v) } if value.is_a?(Array)
+
+      field.parse_value(value)
+    rescue ArgumentError, JSON::ParserError, Psych::Exception
+      nil
     end
 
     class StatementBuilder
@@ -242,7 +250,7 @@ module RailsAdminNext
         end
 
         def today
-          [Date.today, Date.today]
+          [Date.current, Date.current]
         end
 
         def yesterday
@@ -250,7 +258,7 @@ module RailsAdminNext
         end
 
         def this_week
-          [Date.today.beginning_of_week, Date.today.end_of_week]
+          [Date.current.beginning_of_week, Date.current.end_of_week]
         end
 
         def last_week
@@ -259,7 +267,7 @@ module RailsAdminNext
         end
 
         def between
-          [@value[1], @value[2]]
+          [Array.wrap(@value)[1], Array.wrap(@value)[2]]
         end
 
         def default

data/lib/rails_admin_next/adapters/active_record.rb

@@ -182,7 +182,10 @@ module RailsAdminNext
 
         def add(field, value, operator)
           field.searchable_columns.flatten.each do |column_infos|
-            statement, value1, value2 = StatementBuilder.new(quote(column_infos[:column]), column_infos[:type], value, operator, @scope.connection.adapter_name).to_statement
+            attribute_type = attribute_type(field, column_infos[:column])
+            statement, value1, value2 = StatementBuilder.new(quote(column_infos[:column]), column_infos[:type], value, operator, @scope.connection.adapter_name, column_type: attribute_type&.type).to_statement
+            statement, value1, value2 = "(1 = 0)" if out_of_range?(attribute_type, [value1, value2])
+
             @statements << statement if statement.present?
             @values << value1 unless value1.nil?
             @values << value2 unless value2.nil?
@@ -202,6 +205,29 @@ module RailsAdminNext
           "#{@scope.connection.quote_table_name(table)}.#{@scope.connection.quote_column_name(name)}"
         end
 
+        # The column's own attribute type, resolved from the field's model or, for an
+        # association, the associated model. Nil for a column on any other table.
+        def attribute_type(field, column)
+          table, name = column.split(".")
+          return unless name
+
+          models = [field.abstract_model]
+          models.concat(Array.wrap(field.associated_model_config).map(&:abstract_model)) if field.association?
+          models.map(&:model).detect { it.table_name == table }&.type_for_attribute(name)
+        end
+
+        # A number too wide for the column (an int4 searched with a 10-digit term) makes
+        # PostgreSQL reject the whole query. No row can hold it, so the column matches
+        # nothing instead: a search still matches the other columns, a filter matches none.
+        def out_of_range?(attribute_type, values)
+          return false unless attribute_type
+
+          values.grep(Integer).each { attribute_type.serialize(it) }
+          false
+        rescue ActiveModel::RangeError
+          true
+        end
+
         def build
           scope = @scope.where(@statements.join(" OR "), *@values)
           scope = scope.references(*@tables.uniq) if @tables.any?
@@ -225,11 +251,20 @@ module RailsAdminNext
 
       # filters example => {"string_field"=>{"0055"=>{"o"=>"like", "v"=>"test_value"}}, ...}
       # "0055" is the filter index, no use here. o is the operator, v the value
+      # Hand-written or stale params can have any shape, so anything that isn't
+      # field => index => filter with a scalar (or flat array) value, or names no
+      # filterable field, is skipped.
       def filter_scope(scope, filters, fields = config.list.fields.select(&:filterable?))
+        return scope unless filters.respond_to?(:each_pair)
+
         filters.each_pair do |field_name, filters_dump|
+          field = fields.detect { |f| f.name.to_s == field_name }
+          next unless field && filters_dump.respond_to?(:each_value)
+
           filters_dump.each_value do |filter_dump|
+            next unless filter_dump.respond_to?(:each_pair) && filter_value?(filter_dump[:v])
+
             wb = WhereBuilder.new(scope)
-            field = fields.detect { |f| f.name.to_s == field_name }
             value = parse_field_value(field, filter_dump[:v])
 
             wb.add(field, value, filter_dump[:o] || RailsAdminNext::Config.default_search_operator)
@@ -240,14 +275,19 @@ module RailsAdminNext
         scope
       end
 
+      def filter_value?(value)
+        Array.wrap(value).none? { it.is_a?(Array) || it.respond_to?(:each_pair) }
+      end
+
       def build_statement(column, type, value, operator)
         StatementBuilder.new(column, type, value, operator, model.connection.adapter_name).to_statement
       end
 
       class StatementBuilder < RailsAdminNext::AbstractModel::StatementBuilder
-        def initialize(column, type, value, operator, adapter_name)
+        def initialize(column, type, value, operator, adapter_name, column_type: nil)
           super(column, type, value, operator)
           @adapter_name = adapter_name
+          @column_type = column_type
         end
 
         protected
@@ -260,6 +300,9 @@ module RailsAdminNext
             uuid_unary_operators
           when :integer, :decimal, :float
             numeric_unary_operators
+          when :enum
+            # Only a string column can hold '' (and an integer one rejects the comparison).
+            %i[string text citext].include?(@column_type) ? generic_unary_operators : enum_unary_operators
           else
             generic_unary_operators
           end
@@ -288,6 +331,7 @@ module RailsAdminNext
         end
         alias_method :numeric_unary_operators, :boolean_unary_operators
         alias_method :uuid_unary_operators, :boolean_unary_operators
+        alias_method :enum_unary_operators, :boolean_unary_operators
 
         def range_filter(min, max)
           if min && max && min == max

data/lib/rails_admin_next/config/actions/bulk_delete.rb

@@ -20,7 +20,7 @@ module RailsAdminNext
               @objects = list_entries(@model_config, :destroy)
 
               if @objects.blank?
-                flash[:error] = t("admin.flash.error", name: pluralize(0, @model_config.label), action: t("admin.actions.delete.done"))
+                flash[:error] = t("admin.flash.error", name: pluralize(0, @model_config.label, plural: @model_config.label_plural), action: t("admin.actions.delete.done"))
                 redirect_to index_path
               else
                 render @action.template_name
@@ -49,10 +49,10 @@ module RailsAdminNext
               end
 
               if destroyed.nil?
-                flash[:error] = t("admin.flash.error", name: pluralize(0, @model_config.label), action: t("admin.actions.delete.done"))
+                flash[:error] = t("admin.flash.error", name: pluralize(0, @model_config.label, plural: @model_config.label_plural), action: t("admin.actions.delete.done"))
               else
-                flash[:success] = t("admin.flash.successful", name: pluralize(destroyed.count, @model_config.label), action: t("admin.actions.delete.done")) unless destroyed.empty?
-                flash[:error] = t("admin.flash.error", name: pluralize(not_destroyed.count, @model_config.label), action: t("admin.actions.delete.done")) unless not_destroyed.empty?
+                flash[:success] = t("admin.flash.successful", name: pluralize(destroyed.count, @model_config.label, plural: @model_config.label_plural), action: t("admin.actions.delete.done")) unless destroyed.empty?
+                flash[:error] = t("admin.flash.error", name: pluralize(not_destroyed.count, @model_config.label, plural: @model_config.label_plural), action: t("admin.actions.delete.done")) unless not_destroyed.empty?
               end
               redirect_to back_or_index
             end

data/lib/rails_admin_next/config/actions/export.rb

@@ -22,7 +22,8 @@ module RailsAdminNext
             # table with attacker-chosen columns; the export form posts back to this same action.
             if format && !request.get?
               request.format = format
-              @schema = HashHelper.symbolize(params[:schema].slice(:except, :include, :methods, :only).permit!.to_h) if params[:schema] # to_json and to_xml expect symbols for keys AND values.
+              serialization_schema # built while @action is still export
+              @schema = serialization_schema.sanitize(params[:schema].slice(:include, :methods, :only).permit!.to_h) if params[:schema]
               @objects = list_entries(@model_config, :export)
               index
             else

data/lib/rails_admin_next/config/actions/index.rb

@@ -30,26 +30,10 @@ module RailsAdminNext
 
         register_instance_option :controller do
           proc do
-            # Resolve the active list scope (the scope tabs) and fold it into the
-            # relation *before* pagination. The paginated collection is a resolved
-            # page, not a chainable relation, so a named scope can no longer be
-            # appended afterwards.
             unless @objects
-              scopes = @model_config.list.scopes
-              list_scope =
-                if scopes.empty? || params[:scope].blank?
-                  scopes.first
-                elsif scopes.collect(&:to_s).include?(params[:scope])
-                  params[:scope].to_sym
-                end
-
-              additional_scope = get_association_scope_from_params
-              if list_scope
-                base_scope = additional_scope
-                additional_scope = proc { (base_scope ? instance_eval(&base_scope) : self).send(list_scope) }
-              end
-
-              @objects = list_entries(@model_config, :index, additional_scope)
+              # @association is set only when the picker guard accepts associated_collection; otherwise list normally.
+              association_scope = get_association_scope_from_params
+              @objects = @association ? association_entries(@model_config, association_scope) : list_entries
             end
 
             respond_to do |format|
@@ -66,7 +50,7 @@ module RailsAdminNext
                       @objects.collect { |object| {id: object.id.to_s, label: object.send(@model_config.object_label_method).to_s} }
                     end
                   else
-                    @objects.to_json(@schema)
+                    @objects.to_json(@schema || serialization_schema.default)
                   end
 
                 if params[:send_data]
@@ -77,7 +61,7 @@ module RailsAdminNext
               end
 
               format.xml do
-                output = @objects.map { |object| object.serializable_hash(@schema || {}) }.to_xml(root: @abstract_model.model.model_name.plural)
+                output = @objects.map { |object| object.serializable_hash(@schema || serialization_schema.default) }.to_xml(root: @abstract_model.model.model_name.plural)
                 if params[:send_data]
                   send_data output, filename: "#{params[:model_name]}_#{DateTime.now.strftime("%Y-%m-%d_%Hh%Mm%S")}.xml"
                 else

data/lib/rails_admin_next/config/actions/show.rb

@@ -24,7 +24,7 @@ module RailsAdminNext
             # registered type, so Rails falls back to whichever is declared first.
             respond_to do |format|
               format.html { render @action.template_name }
-              format.json { render json: @object }
+              format.json { render json: @object.to_json(serialization_schema.default) }
             end
           end
         end

data/lib/rails_admin_next/config/actions.rb

@@ -49,12 +49,8 @@ module RailsAdminNext
 
         def add_action(key, parent_class, parent, &)
           a = "RailsAdminNext::Config::Actions::#{parent_class.to_s.camelize}".constantize.new
-          a.instance_eval(%(
-            #{parent} true
-            def key
-              :#{key}
-            end
-          ), __FILE__, __LINE__ - 5)
+          a.send(parent, true)
+          a.define_singleton_method(:key) { key.to_sym }
           add_action_custom_key(a, &)
         end
 
@@ -68,12 +64,9 @@ module RailsAdminNext
             name = klass.to_s.demodulize.underscore.to_sym
           end
 
-          instance_eval %{
-            def #{name}(&block)
-              action = #{klass}.new
-              add_action_custom_key(action, &block)
-            end
-          }, __FILE__, __LINE__ - 5
+          define_singleton_method(name) do |&block|
+            add_action_custom_key(klass.new, &block)
+          end
         end
 
         private

data/lib/rails_admin_next/config/fields/association.rb

@@ -137,7 +137,7 @@ module RailsAdminNext
 
         # Returns collection of all selectable records
         def collection(scope = nil)
-          (scope || bindings[:controller].list_entries(associated_model_config, :index, associated_collection_scope, false))
+          (scope || bindings[:controller].association_entries(associated_model_config, associated_collection_scope))
             .map { |o| [o.send(associated_object_label_method), format_key(o.send(associated_primary_key)).to_s] }
         end
 

data/lib/rails_admin_next/config/fields/types/enum.rb

@@ -21,11 +21,17 @@ module RailsAdminNext
           end
 
           register_instance_option :enum_method do
-            @enum_method ||= (bindings[:object].class.respond_to?("#{name}_enum") || (bindings[:object] || abstract_model.model.new).respond_to?("#{name}_enum")) ? "#{name}_enum" : name
+            @enum_method ||= begin
+              method_name = "#{name}_enum"
+              method_name if (bindings[:object]&.class || abstract_model.model).respond_to?(method_name) ||
+                (bindings[:object] || abstract_model.model.new).respond_to?(method_name)
+            end
           end
 
           register_instance_option :enum do
-            if abstract_model.model.respond_to?(enum_method)
+            if enum_method.nil?
+              []
+            elsif abstract_model.model.respond_to?(enum_method)
               abstract_model.model.send(enum_method)
             else
               (bindings[:object] || abstract_model.model.new).send(enum_method)

data/lib/rails_admin_next/config/fields/types/serialized.rb

@@ -10,17 +10,32 @@ module RailsAdminNext
           # Register field type for the type loader
           RailsAdminNext::Config::Fields::Types.register(self)
 
+          # The YAML is admin-supplied, so loading permits no class beyond the scalars a
+          # plain value needs. Dumping strips Hash/Array subclasses (a store's
+          # HashWithIndifferentAccess) so what the form shows can be loaded back.
+          PERMITTED_CLASSES = [::Date, ::Symbol, ::Time].freeze
+
           register_instance_option :formatted_value do
-            RailsAdminNext.yaml_dump(value) unless value.nil?
+            YAML.dump(plain(value)) unless value.nil?
           end
 
           def parse_value(value)
-            value.present? ? (RailsAdminNext.yaml_load(value) || nil) : nil
+            value.present? ? (YAML.safe_load(value, permitted_classes: PERMITTED_CLASSES) || nil) : nil
           end
 
           def parse_input(params)
             params[name] = parse_value(params[name]) if params[name].is_a?(::String)
           end
+
+          private
+
+          def plain(object)
+            case object
+            when Hash then object.to_h { |key, value| [plain(key), plain(value)] }
+            when Array then object.map { plain(it) }
+            else object
+            end
+          end
         end
       end
     end

data/lib/rails_admin_next/config/fields/types/timestamp.rb

@@ -9,6 +9,7 @@ module RailsAdminNext
         class Timestamp < RailsAdminNext::Config::Fields::Types::Datetime
           # Register field type for the type loader
           RailsAdminNext::Config::Fields::Types.register(self)
+          RailsAdminNext::Config::Fields::Types.register(:timestamptz, self)
         end
       end
     end

data/lib/rails_admin_next/config/has_fields.rb

@@ -10,7 +10,7 @@ module RailsAdminNext
 
         # some fields are hidden by default (belongs_to keys, has_many associations in list views.)
         # unhide them if config specifically defines them
-        field.show if field && !field.instance_variable_get("@#{field.name}_registered").is_a?(Proc)
+        field.show if field && !field.instance_variable_get(:@visible_registered).is_a?(Proc)
         # Specify field as virtual if type is not specifically set and field was not
         # found in default stack
         if field.nil? && type.nil?