rails_admin_next 1.2.0 → 1.3.0

data/lib/rails_admin_next/config.rb

@@ -249,7 +249,7 @@ module RailsAdminNext
 
       # pool of all found model names from the whole application
       def models_pool
-        (viable_models - excluded_models.collect(&:to_s)).uniq.sort
+        (viable_models - excluded_models.collect { it.to_s.delete_prefix("::") }).uniq.sort
       end
 
       # Loads a model configuration instance from the registry or registers
@@ -272,7 +272,7 @@ module RailsAdminNext
           when Class, ConstLoadSuppressor::ConstProxy
             entity.name.to_sym
           when String, Symbol
-            entity.to_sym
+            entity.to_s.delete_prefix("::").to_sym
           else
             entity.class.name.to_sym
           end
@@ -369,7 +369,7 @@ module RailsAdminNext
       #
       # @see RailsAdminNext::Config.registry
       def reset_model(model)
-        key = model.is_a?(Class) ? model.name.to_sym : model.to_sym
+        key = model.is_a?(Class) ? model.name.to_sym : model.to_s.delete_prefix("::").to_sym
         @registry.delete(key)
       end
 
@@ -395,7 +395,7 @@ module RailsAdminNext
       private
 
       def viable_models
-        included_models.collect(&:to_s).presence || begin
+        included_models.collect { it.to_s.delete_prefix("::") }.presence || begin
           @@system_models ||= # memoization for tests
             ([Rails.application] + Rails::Engine.subclasses.collect(&:instance)).flat_map do |app|
               (app.paths["app/models"].to_a + app.config.eager_load_paths).collect do |load_path|

data/lib/rails_admin_next/extensions/paper_trail/auditing_adapter.rb

@@ -143,7 +143,7 @@ module RailsAdminNext
 
           versions = object.nil? ? versions_for_model(model) : object.public_send(model.model.versions_association_name)
           versions = versions.where("event LIKE ?", "%#{query}%") if query.present?
-          versions = versions.order(sort)
+          versions = versions.reorder(sort)
 
           paginate_versions(versions, all, (page.presence || 1).to_i, per_page.to_i)
         end

data/lib/rails_admin_next/extensions/pundit/authorization_adapter.rb

@@ -40,11 +40,13 @@ module RailsAdminNext
 
         # This is called when needing to scope a database query. It is called within the list
         # and bulk_delete/destroy actions and should return a scope which limits the records
-        # to those which the user can perform the given action on.
+        # to those which the user can perform the given action on. A model with no policy
+        # Scope gets no records: bulk_delete deletes whatever this returns without a
+        # per-record check, so a forgotten Scope must not mean "everything".
         def query(_action, abstract_model)
           @controller.send(:policy_scope, abstract_model.model.all)
         rescue ::Pundit::NotDefinedError
-          abstract_model.model.all
+          abstract_model.model.none
         end
 
         # This is called in the new/create actions to determine the initial attributes for new

data/lib/rails_admin_next/support/composite_keys_serializer.rb

@@ -3,12 +3,18 @@
 module RailsAdminNext
   module Support
     module CompositeKeysSerializer
+      # "_" joins the keys, so it is escaped as "~" plus its hex byte. "~" is escaped too so the
+      # escape cannot be forged, and both are URL-unreserved. Every other value serializes as-is,
+      # keeping existing links valid.
+      ESCAPED = /[_~]/
+      ESCAPE = /~(5F|7E)/
+
       def self.serialize(keys)
-        keys.map { |key| key&.to_s&.gsub("_", "__") }.join("_")
+        keys.map { |key| key&.to_s&.gsub(ESCAPED) { format("~%02X", it.ord) } }.join("_")
       end
 
       def self.deserialize(string)
-        string.split("_").map { |key| key&.gsub("__", "_") }
+        string.split("_").map { |key| key.gsub(ESCAPE) { $1.hex.chr } }
       end
     end
   end

data/lib/rails_admin_next/support/csv_converter.rb

@@ -4,14 +4,17 @@ require "csv"
 
 module RailsAdminNext
   class CSVConverter
+    BATCH_SIZE = 1000
+
     def initialize(objects = [], schema = nil)
       @fields = []
       @associations = []
       schema ||= {}
 
-      return if (@objects = objects).blank?
+      @objects = objects
+      @model = objects.is_a?(ActiveRecord::Relation) ? objects.klass : objects.first&.class
+      return unless @model
 
-      @model = objects.dup.first.class
       @abstract_model = RailsAdminNext::AbstractModel.new(@model)
       @model_config = @abstract_model.config
       @methods = [(schema[:only] || []) + (schema[:methods] || [])].flatten.compact
@@ -63,17 +66,54 @@ module RailsAdminNext
 
     def generate_csv_string(options)
       generator_options = (options[:generator] || {}).symbolize_keys.delete_if { |_, value| value.blank? }
-      method = @objects.respond_to?(:find_each) ? :find_each : :each
-
       CSV.generate(**generator_options) do |csv|
         csv << generate_csv_header unless options[:skip_header]
 
-        @objects.send(method) do |object|
+        each_object do |object|
           csv << generate_csv_row(object)
         end
       end
     end
 
+    def each_object(&)
+      return @objects.each(&) unless @objects.is_a?(ActiveRecord::Relation)
+      # Batching sets its own limit and offset, which would drop the relation's.
+      return @objects.each(&) if @objects.limit_value || @objects.offset_value
+
+      if (direction = primary_key_direction)
+        @objects.unscope(:order).find_each(order: direction, batch_size: BATCH_SIZE, &)
+      else
+        each_in_offset_batches(&)
+      end
+    end
+
+    # sort_scope writes the list sort as a single "<table>.<column> <direction>" string.
+    def primary_key_direction
+      primary_key = @model.primary_key
+      return unless primary_key.is_a?(String)
+
+      orders = @objects.order_values
+      return :asc if orders.empty?
+      return unless orders.one? && orders.first.is_a?(String)
+
+      table = Regexp.escape(@model.table_name)
+      column = Regexp.escape(primary_key)
+      orders.first[/\A(?:\W?#{table}\W?\.)?\W?#{column}\W? (asc|desc)\z/i, 1]&.downcase&.to_sym
+    end
+
+    # The primary-key tie-break makes the order total, so rows that tie on the sort
+    # column cannot shift between batches. A short batch is not the last one: sorting
+    # on an eager-loaded has-many column returns fewer records than the limit.
+    def each_in_offset_batches(&)
+      ordered = @objects.order(Array(@model.primary_key).index_with(:asc))
+      0.step(by: BATCH_SIZE) do |offset|
+        batch = ordered.limit(BATCH_SIZE).offset(offset).to_a
+        break if batch.empty?
+
+        batch.each(&)
+      end
+    end
+
     def generate_csv_header
       @fields.collect do |field|
         ::I18n.t("admin.export.csv.header_for_root_methods", name: field.label, model: @abstract_model.pretty_name)

data/lib/rails_admin_next/support/serialization_schema.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+require "rails_admin_next/support/hash_helper"
+
+module RailsAdminNext
+  # The options handed to to_json/serializable_hash, limited to what a section
+  # shows. Both serializers call every name under `methods` and `include` on each
+  # record, and serialize every attribute when `only` is missing, so a requested
+  # schema is only ever intersected with this, never passed through.
+  class SerializationSchema
+    def initialize(section, include_associations:)
+      @section = section
+      @include_associations = include_associations
+    end
+
+    # Attributes only: a virtual field need not be a method on the record, so
+    # calling it unasked could raise where the plain serialization never did.
+    def default
+      {only: allowed[:only]}
+    end
+
+    def sanitize(requested)
+      requested = HashHelper.symbolize(requested)
+      schema = filter(requested, allowed)
+      if @include_associations && requested[:include].is_a?(Hash)
+        schema[:include] = requested[:include].each_with_object({}) do |(name, value), included|
+          next unless value.is_a?(Hash) && allowed[:include].key?(name)
+
+          included[name] = filter(value, allowed[:include][name])
+        end
+      end
+      schema
+    end
+
+    private
+
+    def allowed
+      @allowed ||= begin
+        fields = @section.visible_fields
+        names = field_names(fields.select { |f| !f.association? || f.association.polymorphic? })
+        if @include_associations
+          names[:include] = fields.select { |f| f.association? && !f.association.polymorphic? }.to_h do |field|
+            associated = field.associated_model_config.export.with(@section.bindings.merge(object: field.associated_model_config.abstract_model.model.new))
+            [field.name, field_names(associated.visible_fields.reject(&:association?))]
+          end
+        else
+          # The section already shows these associations, so their keys expose nothing more
+          names[:only].concat(fields.select { |f| f.association? && f.association.type == :belongs_to && !f.association.polymorphic? }
+            .flat_map { |f| Array(f.association.foreign_key).map(&:to_sym) })
+        end
+        names
+      end
+    end
+
+    # Mirrors the names the export form offers (main/export.html.erb).
+    def field_names(fields)
+      fields.each_with_object({only: [], methods: []}) do |field, names|
+        list = field.virtual? ? names[:methods] : names[:only]
+        if field.association?
+          list << field.method_name.to_sym << field.association.foreign_type.to_sym
+        else
+          list << field.name.to_sym
+        end
+      end
+    end
+
+    # An empty `only` serializes no attribute in ActiveRecord, which is the point.
+    def filter(requested, permitted)
+      schema = {only: Array(requested[:only]) & permitted[:only]}
+      schema[:methods] = Array(requested[:methods]) & permitted[:methods] if requested.key?(:methods)
+      schema
+    end
+  end
+end

data/lib/rails_admin_next/version.rb

@@ -6,7 +6,7 @@ module RailsAdminNext
     # the tag's version over these constants at build time, so the in-repo values are only
     # the floor a local `gem build` produces.
     MAJOR = 1
-    MINOR = 2
+    MINOR = 3
     PATCH = 0
     PRE = nil
 

data/lib/rails_admin_next.rb

@@ -12,6 +12,7 @@ require "rails_admin_next/extensions/paper_trail"
 require "rails_admin_next/support/csv_converter"
 require "rails_admin_next/support/hash_helper"
 require "rails_admin_next/support/paginated_collection"
+require "rails_admin_next/support/serialization_schema"
 require "yaml"
 
 module RailsAdminNext
@@ -48,25 +49,13 @@ module RailsAdminNext
     @deprecator ||= ActiveSupport::Deprecation.new(RailsAdminNext::Version.to_s, "RailsAdminNext")
   end
 
-  # Backwards-compatible with safe_yaml/load when SafeYAML isn't available.
-  # Evaluates available YAML loaders at boot and creates appropriate method,
-  # so no conditionals are required at runtime.
-  begin
-    require "safe_yaml/load"
-    def self.yaml_load(yaml)
-      SafeYAML.load(yaml)
-    end
-  rescue LoadError
-    if YAML.respond_to?(:safe_load)
-      def self.yaml_load(yaml)
-        YAML.safe_load(yaml)
-      end
-    else
-      raise LoadError.new "Safe-loading of YAML is not available. Please install 'safe_yaml' or install Psych 2.0+"
-    end
+  def self.yaml_load(yaml)
+    deprecator.warn("RailsAdminNext.yaml_load is deprecated and will be removed. Call YAML.safe_load directly.")
+    YAML.safe_load(yaml)
   end
 
   def self.yaml_dump(object)
+    deprecator.warn("RailsAdminNext.yaml_dump is deprecated and will be removed. Call YAML.dump directly.")
     YAML.dump(object)
   end
 end

data/src/rails_admin/controllers/nested_form_controller.js

@@ -7,7 +7,7 @@ import { Controller } from "@hotwired/stimulus";
 //
 //   - add: clones a blank subform from the <template>. For a has_many
 //     association the template carries a child-index placeholder
-//     (e.g. "new_nested_field_tests") which is swapped for a unique value so
+//     (e.g. "new_1_nested_field_tests") which is swapped for a unique value so
 //     each new row submits under its own index; has_one/belongs_to subforms
 //     have no placeholder. Focus then moves to the first visible field.
 //   - remove on an unsaved subform deletes it from the DOM.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails_admin_next
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.3.0
 platform: ruby
 authors:
 - Daniel López Prat
@@ -298,6 +298,7 @@ files:
 - lib/rails_admin_next/support/csv_converter.rb
 - lib/rails_admin_next/support/hash_helper.rb
 - lib/rails_admin_next/support/paginated_collection.rb
+- lib/rails_admin_next/support/serialization_schema.rb
 - lib/rails_admin_next/version.rb
 - lib/tasks/rails_admin.rake
 - skills/rails-admin-next/SKILL.md
@@ -338,7 +339,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 4.0.5
+      version: 4.0.9
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="