rails_admin_next 1.2.1 → 2.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 957743cf70d6fa24bb0cb1eaf74ca15b4a3b2996e0dca4f5dcee2d6428985d6b
-  data.tar.gz: a205770a7170c2b1ce7e04a85cd6422f6cda1d150da237df81795387af8cc18d
+  metadata.gz: 85cf357bfb48a568e28ee9d031d96f9d9d96546564579a17273d06ddd1643a45
+  data.tar.gz: a3850dcf1e9f5fb4bf6797a1175be2112d6f5ecc1d9f4588dfc561a412ce9072
 SHA512:
-  metadata.gz: ad848e8080f75c1e3d6b12c180dcb745bb4a3caea7791ee08d4fec1d97567836effacf01ea340a764b0febb4a52c345e793b3d1708d7496e9d1c2e3f6a167f6d
-  data.tar.gz: 37ec4a516104eb2ecc4d8924c758ad862b8fa091f32a0d460b0dfda2f8bc566a233fa61ea81d6cdbbfe49695b1d71eb0aed55f75c281001e9d86a73821fbe8a8
+  metadata.gz: 950489886f285808c1d8688a3099361d63bc0f2bead9b15b3b752c3de41e696a48232f63bd6bdce8ec6835a9266b35f3b13a1faebc10572a0de1daf05b87a61b
+  data.tar.gz: 6dcc9aa9063071f2008888dff5c1c4e43042c6fd3026ce6c52bdd5844080f0276cbb719241427c84254d95d2b05160cf066aaf699ddd14ac03c5c9204a5d791d

data/Gemfile

@@ -11,8 +11,8 @@ group :development, :test do
 end
 
 group :test do
+  gem "action_policy"
   gem "brakeman", require: false
-  gem "cancancan", "~> 3.0"
   gem "cuprite"
   gem "database_cleaner-active_record", require: false
   gem "factory_bot"

data/README.md

@@ -33,7 +33,7 @@ multi-bundler, jQuery-era machinery. RailsAdminNext keeps the admin and drops th
 - **🧩 Turbo + Stimulus** — the jQuery / jQuery-UI / Bootstrap-JS / `@rails/ujs` stack is gone, replaced by engine-shipped Stimulus controllers; styling is hand-maintained vanilla CSS.
 - **🔒 Hardened & CDN-free** — a documented CSRF / clickjacking / mass-assignment / CSP posture ([SECURITY.md](SECURITY.md)) and **zero external CDN**, default or opt-in — every asset is self-hosted off a gem.
 - **🎯 One modern target** — Ruby ≥ 4.0.9, Rails ~> 8.1, ActiveRecord only, latest Chrome + Safari. No Mongoid, no multi-bundler / multi-Rails matrix, no legacy-browser CSS.
-- **↩️ Familiar** — `RailsAdminNext.config`, per-model `rails_admin_next do … end` blocks, and CanCanCan / Pundit authorization all work as before; upgrading from RailsAdmin is a mechanical rename.
+- **↩️ Familiar** — `RailsAdminNext.config`, per-model `rails_admin_next do … end` blocks, and Pundit authorization all work as before; upgrading from RailsAdmin is a mechanical rename.
 
 ## Quick Start
 
@@ -113,12 +113,12 @@ always match the installed version.
 - File uploads (ActiveStorage)
 - Rich text fields (ActionText / Trix)
 - Authentication (via [Devise][devise] or any other scheme)
-- Authorization (via [CanCanCan][cancancan] or [Pundit][pundit])
+- Authorization (via [Pundit][pundit], [ActionPolicy][action_policy] or a custom adapter)
 - User action history (via [PaperTrail][papertrail])
 
 [devise]: https://github.com/heartcombo/devise
-[cancancan]: https://github.com/CanCanCommunity/cancancan
 [pundit]: https://github.com/varvet/pundit
+[action_policy]: https://github.com/palkan/action_policy
 [papertrail]: https://github.com/paper-trail-gem/paper_trail
 
 ## Configuration
@@ -143,8 +143,15 @@ RailsAdminNext.config do |config|
 end
 ```
 
-This is also where you wire up [Devise][devise], [CanCanCan][cancancan]/[Pundit][pundit],
-and [PaperTrail][papertrail].
+This is also where you wire up [Devise][devise], [Pundit][pundit], and [PaperTrail][papertrail].
+
+Every admin page ends with a small "Made in Tokyo with ❤️ and 🤖" footer. To hide it:
+
+```ruby
+RailsAdminNext.config do |config|
+  config.show_footer = false
+end
+```
 
 ### Per model
 
@@ -170,19 +177,24 @@ The configuration DSL is unchanged from upstream RailsAdmin, so the upstream
 
 ### Authorization keys are stable
 
-The authorization contract is held stable, so existing CanCanCan
-abilities and Pundit policies keep working **without edits**: the access subject is
-`:rails_admin` and every action's
-authorization key (`:dashboard`, `:index`, `:show`, `:new`, `:edit`, `:export`,
-`:destroy`, `:history`, `:show_in_app`) is unchanged.
-
-```ruby
-# Still grants access to the admin:
-can :access, :rails_admin
-```
+The authorization contract is held stable, so existing Pundit policies keep working
+**without edits**: every action's authorization key (`:dashboard`, `:index`, `:show`,
+`:new`, `:edit`, `:export`, `:destroy`, `:history`, `:show_in_app`) is unchanged, and the
+Pundit adapter calls it with a `?` suffix (`index?`, `edit?`). Pundit and ActionPolicy are
+the built-in adapters; any other authorization library plugs in as a custom adapter, which by convention
+checks the `:access, :rails_admin` subject. See [docs/UPGRADING.md](docs/UPGRADING.md).
 
 The `admin.*` I18n namespace is likewise unchanged.
 
+### ActionPolicy
+
+`config.authorize_with :action_policy` checks each action against the record's policy with
+the same `<key>?` rules the Pundit adapter calls (`index?`, `show?`, `new?`, `edit?`,
+`destroy?`, `export?`, `history?`, `show_in_app?`, `dashboard?`), and scopes lists, export
+and bulk delete through the policy's default `relation_scope`. A model with no policy, or a
+policy with no default relation scope, lists nothing. Bundle `action_policy` yourself; see
+the "ActionPolicy adapter" section of [docs/UPGRADING.md](docs/UPGRADING.md).
+
 ## Frontend and assets
 
 RailsAdminNext ships a single, zero-build asset path:
@@ -294,16 +306,16 @@ action methods**, where each admin operation is an object.
 - **One controller, many action objects** — to change how e.g. _edit_ behaves, edit `lib/rails_admin_next/config/actions/edit.rb`, not the controller.
 - **ORM facade** — nothing outside `AbstractModel` references ActiveRecord directly; the adapter seam is intact even though Mongoid was removed.
 - **Lazy, layered config** — `config/initializers` blocks run before in-model `rails_admin_next do … end` blocks, so per-model config overrides the initializer defaults.
-- **A deliberately frozen `rails_admin` surface** — the Ruby layer is `RailsAdminNext`, but the `:access, :rails_admin` authorization subject, the `admin.*` I18n namespace, and the `src/rails_admin/` asset tree stay `rails_admin` on purpose, so host abilities, translations, and assets keep working across the rename.
+- **A deliberately frozen `rails_admin` surface** — the Ruby layer is `RailsAdminNext`, but the action authorization keys, the `admin.*` I18n namespace, and the `src/rails_admin/` asset tree stay `rails_admin`-era on purpose, so host policies, translations, and assets keep working across the rename.
 
 ## Upgrading from RailsAdmin
 
 See [docs/UPGRADING.md](docs/UPGRADING.md) for the one-time changes a host app needs:
 the Gemfile gem name, the importmap/Propshaft prerequisites, and a mechanical rename of the
 `RailsAdmin` constant, initializer, mount, model macro, and route helpers to `RailsAdminNext`
-(`rails_admin_next`). The `:access, :rails_admin` authorization subject and the `admin.*`
-I18n namespace are deliberately left unchanged, so CanCanCan/Pundit rules and translations
-keep working without edits.
+(`rails_admin_next`). The action authorization keys and the `admin.*` I18n namespace are
+deliberately left unchanged, so Pundit policies and translations keep working without edits.
+Its 2.0 section covers hosts whose authorization library is no longer a built-in adapter.
 
 ## Security
 
@@ -333,5 +345,5 @@ RailsAdminNext is released under the [MIT License](LICENSE.md).
 ---
 
 <div align="center">
-  <sub>Built in Tokyo with ❤️ and 🤖</sub>
+  <sub>Made in Tokyo with ❤️ and 🤖</sub>
 </div>

data/app/assets/stylesheets/rails_admin/skin.css

@@ -430,6 +430,10 @@ body.rails_admin #filters_box {
     display: none;
   }
 }
+body.rails_admin .dashboard-statistics {
+  overflow-x: auto;
+  overscroll-behavior: contain;
+}
 body.rails_admin #sidescroll {
   margin-bottom: 20px;
   overflow-x: auto;
@@ -456,6 +460,14 @@ body.rails_admin .pagination .page-item {
   white-space: nowrap;
 }
 
+/* === Admin skin: footer ================================================= */
+body.rails_admin .admin-footer {
+  padding: 2rem 0 1rem;
+  font-size: 0.875em;
+  color: var(--ra-gray-600);
+  text-align: center;
+}
+
 /* === Admin skin: responsive adjustments ================================= */
 @media screen and (min-width: 576px) {
   body.rails_admin .sidebar.btn-toggle-nav {

data/app/controllers/rails_admin_next/main_controller.rb

@@ -8,19 +8,35 @@ module RailsAdminNext
 
     before_action :check_for_cancel
 
+    helper_method :list_scopes
+
     def bulk_action
       get_model
       process(params[:bulk_action]) if params[:bulk_action].in?(RailsAdminNext::Config::Actions.all(:bulkable, controller: self, abstract_model: @abstract_model).collect(&:route_fragment))
     end
 
-    def list_entries(model_config = @model_config, auth_scope_key = :index, additional_scope = get_association_scope_from_params, pagination = !(params[:associated_collection] || params[:all] || params[:bulk_ids]))
+    def list_entries(model_config = @model_config, auth_scope_key = :index, additional_scope = nil, pagination = !(params[:all] || params[:bulk_ids]))
       scope = model_config.scope
       auth_scope = @authorization_adapter&.query(auth_scope_key, model_config.abstract_model)
       scope = scope.merge(auth_scope) if auth_scope
+      tab = list_scope if model_config == @model_config
+      if tab
+        scope = scope.public_send(tab)
+        scope = within_authorized(scope, auth_scope) if auth_scope
+      end
       scope = scope.instance_eval(&additional_scope) if additional_scope
       get_collection(model_config, scope, pagination)
     end
 
+    # The association scope chains after get_collection, which only works on an unpaginated relation.
+    def association_entries(model_config, collection_scope)
+      scope = model_config.scope
+      auth_scope = @authorization_adapter&.query(:index, model_config.abstract_model)
+      scope = scope.merge(auth_scope) if auth_scope
+      scope = get_collection(model_config, scope, false)
+      collection_scope ? scope.instance_eval(&collection_scope) : scope
+    end
+
     private
 
     def action_missing(name, *_args)
@@ -78,9 +94,7 @@ module RailsAdminNext
     end
 
     def get_sort_hash(model_config)
-      field = model_config.list.fields.detect { |f| f.name.to_s == params[:sort] }
-      # If no sort param, default to the `sort_by` specified in the list config
-      field ||= model_config.list.possible_fields.detect { |f| f.name == model_config.list.sort_by.try(:to_sym) }
+      field = sort_field(model_config)
 
       column =
         if field.nil? || field.sortable == false # use default sort, asked field does not exist or is not sortable
@@ -93,6 +107,12 @@ module RailsAdminNext
       {sort: column, sort_reverse: (params[:sort_reverse] == (field&.sort_reverse&.to_s || "true"))}
     end
 
+    def sort_field(model_config)
+      field = model_config.list.fields.detect { |f| f.name.to_s == params[:sort] }
+      # If no sort param, default to the `sort_by` specified in the list config
+      field || model_config.list.possible_fields.detect { |f| f.name == model_config.list.sort_by.try(:to_sym) }
+    end
+
     def redirect_to_on_success
       notice = I18n.t("admin.flash.successful", name: @model_config.label, action: I18n.t("admin.actions.#{@action.key}.done"))
       if params[:_add_another]
@@ -178,7 +198,8 @@ module RailsAdminNext
 
     def get_collection(model_config, scope, pagination)
       section = (@action.key == :export) ? model_config.export : model_config.list
-      eager_loads = section.fields.flat_map(&:eager_load_values)
+      # The sort comes from the list, so export must also load the association a list sort orders by.
+      eager_loads = (section.fields + Array(sort_field(model_config))).flat_map(&:eager_load_values).uniq
       options = {}
       options = options.merge(page: (params[:page] || 1).to_i, per: params[:per] || model_config.list.items_per_page) if pagination
       options = options.merge(include: eager_loads) unless eager_loads.blank?
@@ -189,14 +210,39 @@ module RailsAdminNext
       model_config.abstract_model.all(options, scope)
     end
 
+    def list_scopes
+      @_list_scopes ||= @model_config.list.with(controller: self, view: view_context, object: @abstract_model.model.new).scopes
+    end
+
+    # A row-value IN: `where(primary_key => relation)` renders an empty condition for composite keys.
+    def within_authorized(scope, auth_scope)
+      key = Array(scope.primary_key).map { scope.arel_table[it] }
+      scope.where(Arel::Nodes::In.new(Arel::Nodes::Grouping.new(key), auth_scope.reselect(*key).arel.ast))
+    end
+
+    def list_scope
+      return if params[:compact]
+
+      if list_scopes.empty? || params[:scope].blank?
+        list_scopes.first
+      elsif list_scopes.collect(&:to_s).include?(params[:scope])
+        params[:scope].to_sym
+      end
+    end
+
     def get_association_scope_from_params
       return nil unless params[:associated_collection].present?
 
       source_abstract_model = RailsAdminNext::AbstractModel.new(to_model_name(params[:source_abstract_model]))
       source_model_config = source_abstract_model.config
-      source_object = source_abstract_model.get(params[:source_object_id])
       action = params[:current_action].in?(%w[create update]) ? params[:current_action] : "edit"
-      @association = source_model_config.send(action).fields.detect { |f| f.name == params[:associated_collection].to_sym }.with(controller: self, object: source_object)
+      field = source_model_config.send(action).fields.detect { |f| f.name == params[:associated_collection].to_sym }
+      # The picker's params are client-supplied; a field that doesn't target this model would run its scope and labels on the wrong records.
+      # Polymorphic pickers never send associated_collection, and their collection ignores the listed records.
+      return nil unless field&.association? && !field.polymorphic? && field.associated_model_config == @model_config
+
+      source_object = source_abstract_model.get(params[:source_object_id])
+      @association = field.with(controller: self, object: source_object)
       @association.associated_collection_scope
     end
   end

data/app/helpers/rails_admin_next/form_builder.rb

@@ -4,6 +4,10 @@ module RailsAdminNext
   class FormBuilder < ::ActionView::Helpers::FormBuilder
     include ::RailsAdminNext::ApplicationHelper
 
+    # Bounds the nested form of an association that can reach itself. Counting repeats of
+    # one association, rather than depth, leaves chains of distinct models uncapped.
+    MAX_NESTED_FORM_RECURSION = 3
+
     def generate(options = {})
       without_field_error_proc_added_div do
         options.reverse_merge!(
@@ -78,8 +82,10 @@ module RailsAdminNext
 
     # Wraps one nested-attributes subform (rendered by native `fields_for`) for
     # the nested-form Stimulus controller: a `.fields` container, an optional
-    # `_destroy` hidden field + remove button (gated on `allow_destroy`, always
-    # present in the blank <template>), then the recursively generated fields.
+    # `_destroy` hidden field (gated on `allow_destroy`, always present in the blank
+    # <template>), a remove button, then the recursively generated fields. A saved
+    # record is removable only under `allow_destroy`; an unsaved one always is, so a
+    # row added before a failed save can still be taken back.
     def nested_field_set(nested_form, field, allow_destroy:)
       @template.content_tag(:div, class: "fields tab-pane active", data: {"nested-form-target": "subform"}) do
         contents = []
@@ -88,8 +94,8 @@ module RailsAdminNext
         # persisted subform from a brand-new one. Suppress the auto-id in the
         # partials with `include_id: false` so it is not rendered twice.
         contents << nested_form.hidden_field(:id) if nested_form.object.persisted?
-        if allow_destroy
-          contents << nested_form.hidden_field(:_destroy, data: {"nested-form-target": "destroy"})
+        contents << nested_form.hidden_field(:_destroy, data: {"nested-form-target": "destroy"}) if allow_destroy
+        if allow_destroy || nested_form.object.new_record?
           contents << @template.content_tag(:button, RailsAdminNext::Icons.svg(:trash).html_safe, type: "button", class: "btn btn-danger remove_nested_fields", data: {action: "nested-form#remove"})
         end
         contents << nested_form.generate(action: :nested, model_config: field.associated_model_config, nested_in: field)
@@ -97,6 +103,19 @@ module RailsAdminNext
       end
     end
 
+    # Whether this association's subforms, its blank <template> and its add control render
+    # here. Saved records can form a cycle too, so the bound covers them as well.
+    def nested_within_bound?(field)
+      @object_name.to_s.scan("[#{field.name}_attributes]").size < MAX_NESTED_FORM_RECURSION
+    end
+
+    # The child index the <template> carries until a row is added. Tagged by depth, not by
+    # association name alone: the add control replaces every occurrence in the template,
+    # nested templates included, and a name-tagged token can be a prefix of a nested one's.
+    def nested_placeholder(field)
+      "new_#{@object_name.to_s.scan("_attributes]").size + 1}_#{field.name}"
+    end
+
     def object_infos
       model_config = RailsAdminNext.config(object)
       model_label = model_config.label

data/app/helpers/rails_admin_next/main_helper.rb

@@ -29,7 +29,7 @@ module RailsAdminNext
       return @ordered_filters if @ordered_filters.present?
 
       @index = 0
-      @ordered_filters = (params[:f].try(:permit!).try(:to_h) || @model_config.list.filters).each_with_object({}) do |filter, memo|
+      @ordered_filters = (filters_from_params || @model_config.list.filters).each_with_object({}) do |filter, memo|
         field_name = filter.is_a?(Array) ? filter.first : filter
         (filter.is_a?(Array) ? filter.last : {(@index += 1) => {"v" => ""}}).each do |index, filter_hash|
           if filter_hash["disabled"].blank?
@@ -41,6 +41,17 @@ module RailsAdminNext
       end.to_a.sort_by(&:first)
     end
 
+    # Only the field => index => filter shape the filter box submits, for fields that
+    # are filterable; hand-written or stale params are dropped rather than raising.
+    def filters_from_params
+      return unless params[:f].respond_to?(:permit!)
+
+      names = filterable_fields.map { it.name.to_s }
+      params[:f].permit!.to_h.filter_map do |name, filters_dump|
+        [name, filters_dump.select { |_index, filter| filter.is_a?(Hash) }] if names.include?(name) && filters_dump.is_a?(Hash)
+      end.to_h
+    end
+
     def ordered_filter_options
       if ordered_filters
         @ordered_filter_options ||= ordered_filters.map do |duplet|

data/app/views/layouts/rails_admin_next/_head.html.erb

@@ -1,7 +1,7 @@
 <%# locals: () -%>
 <meta content="IE=edge" http-equiv="X-UA-Compatible">
 <meta content="text/html; charset=utf-8" http-equiv="Content-Type">
-<meta content="width=device-width, initial-scale=1" name="viewport; charset=utf-8">
+<meta content="width=device-width, initial-scale=1" name="viewport">
 <meta content="NONE,NOARCHIVE" name="robots">
 <meta content="false" name="turbo-prefetch">
 <%= csrf_meta_tag %>

data/app/views/layouts/rails_admin_next/_navigation.html.erb

@@ -7,7 +7,7 @@
     </small>
   </a>
   <button class="navbar-toggler" type="button" data-collapse-target="trigger" data-action="collapse#toggle" aria-expanded="false" aria-controls="secondary-navigation">
-    <span class="sr-only">
+    <span class="visually-hidden">
       <%= t('admin.toggle_navigation') %>
     </span>
     <span class="navbar-toggler-icon"></span>

data/app/views/layouts/rails_admin_next/application.html.erb

@@ -20,6 +20,9 @@
           <div class="container-fluid">
             <%= render template: 'layouts/rails_admin_next/content' %>
           </div>
+          <% if RailsAdminNext::Config.show_footer %>
+            <footer class="admin-footer">Made in Tokyo with ❤️ and 🤖</footer>
+          <% end %>
         </div>
       </div>
     </div>

data/app/views/rails_admin_next/main/_form_nested_many.html.erb

@@ -3,18 +3,23 @@
   associated_model = field.associated_model_config.abstract_model
   add_label = rails_admin_icon(:new) + " " + wording_for(:link, :new, associated_model)
   allow_destroy = field.nested_form && field.nested_form[:allow_destroy]
-  placeholder = "new_#{field.name}"
+  placeholder = form.nested_placeholder(field)
+  template = form.nested_within_bound?(field)
 -%>
 <div class="controls col-sm-10" data-controller="nested-form" data-nested-form-placeholder-value="<%= placeholder %>">
   <div class="tab-content" data-nested-form-target="container">
-    <%= form.fields_for field.name, nil, include_id: false do |nested_form| %>
-      <%= form.nested_field_set nested_form, field, allow_destroy: allow_destroy %>
+    <% if template %>
+      <%= form.fields_for field.name, nil, include_id: false do |nested_form| %>
+        <%= form.nested_field_set nested_form, field, allow_destroy: allow_destroy %>
+      <% end %>
     <% end %>
   </div>
-  <% if field.inline_add %>
+  <% if field.inline_add && template %>
     <button type="button" class="btn btn-info add_nested_fields" data-action="nested-form#add"><%= add_label %></button>
   <% end %>
   <%= form.errors_for(field) %>
   <%= form.help_for(field) %>
+  <% if template %>
   <template data-nested-form-target="template"><%= form.fields_for field.name, associated_model.model.new, child_index: placeholder, include_id: false do |nested_form| %><%= form.nested_field_set nested_form, field, allow_destroy: true %><% end %></template>
+  <% end %>
 </div>

data/app/views/rails_admin_next/main/_form_nested_one.html.erb

@@ -3,17 +3,22 @@
   associated_model = field.associated_model_config.abstract_model
   add_label = rails_admin_icon(:new) + " " + wording_for(:link, :new, associated_model)
   allow_destroy = field.nested_form && field.nested_form[:allow_destroy]
+  template = form.nested_within_bound?(field)
 -%>
 <div class="controls col-sm-10" data-controller="nested-form" data-nested-form-singular-value="true">
   <div class="tab-content" data-nested-form-target="container">
-    <%= form.fields_for field.name, nil, include_id: false do |nested_form| %>
-      <%= form.nested_field_set nested_form, field, allow_destroy: allow_destroy %>
+    <% if template %>
+      <%= form.fields_for field.name, nil, include_id: false do |nested_form| %>
+        <%= form.nested_field_set nested_form, field, allow_destroy: allow_destroy %>
+      <% end %>
     <% end %>
   </div>
-  <% if field.inline_add %>
+  <% if field.inline_add && template %>
     <button type="button" class="btn btn-info add_nested_fields" data-action="nested-form#add"><%= add_label %></button>
   <% end %>
   <%= form.errors_for(field) %>
   <%= form.help_for(field) %>
+  <% if template %>
   <template data-nested-form-target="template"><%= form.fields_for field.name, associated_model.model.new, include_id: false do |nested_form| %><%= form.nested_field_set nested_form, field, allow_destroy: true %><% end %></template>
+  <% end %>
 </div>

data/app/views/rails_admin_next/main/bulk_delete.html.erb

@@ -4,7 +4,7 @@
 <ul>
   <%= render partial: "delete_notice", collection: @objects %>
 </ul>
-<%= form_tag bulk_delete_path(model_name: @abstract_model.to_param, bulk_ids: @objects.map(&:id)), method: :delete do %>
+<%= form_tag bulk_delete_path(model_name: @abstract_model.to_param, bulk_ids: @objects.map(&:id), scope: params[:scope].presence), method: :delete do %>
   <div class="form-actions">
     <input name="return_to" type="<%= :hidden %>" value="<%= (params[:return_to].presence || request.referer) %>" />
     <button class="btn btn-danger" data-disable-with="<%= t("admin.form.confirmation") %>" data-turbo-confirm="<%= t("admin.form.bulk_delete") %>" type="submit">

data/app/views/rails_admin_next/main/dashboard.html.erb

@@ -1,56 +1,58 @@
 <% if @abstract_models %>
-  <table class="table table-condensed table-striped table-hover">
-    <thead>
-      <tr>
-        <th class="shrink model-name">
-          <%= t "admin.table_headers.model_name" %>
-        </th>
-        <th class="shrink last-created">
-          <%= t "admin.table_headers.last_created" %>
-        </th>
-        <th class="records">
-          <%= t "admin.table_headers.records" %>
-        </th>
-        <th class="shrink controls"></th>
-      </tr>
-    </thead>
-    <tbody class="table-group-divider">
-      <% @abstract_models.each do |abstract_model| %>
-        <% if authorized? :index, abstract_model %>
-          <% index_path = index_path(model_name: abstract_model.to_param) %>
-          <% row_class = "#{cycle("odd", "even")}#{" link" if index_path} #{abstract_model.param_key}_links" %>
-          <tr class="<%= row_class %>" data-link="<%= index_path %>">
-            <% last_created = @most_recent_created[abstract_model.model.name] %>
-            <% active = last_created.try(:today?) %>
-            <td>
-              <span class="show">
-                <%= link_to abstract_model.config.label_plural, index_path %>
-              </span>
-            </td>
-            <td>
-              <% if last_created %>
-                <%= t "admin.misc.time_ago", time: time_ago_in_words(last_created), default: "#{time_ago_in_words(last_created)} #{t("admin.misc.ago")}" %>
-              <% end %>
-            </td>
-            <td>
-              <% count = @count[abstract_model.model.name] %>
-              <% percent = count > 0 ? (@max <= 1 ? count : ((Math.log(count+1) * 100.0) / Math.log(@max+1)).to_i) : -1 %>
-              <div class="progress" style="margin-bottom:0px">
-                <div class="bg-<%= get_indicator(percent) %> progress-bar<%= ' progress-bar-striped progress-bar-animated' if active %>" style="width:<%= [2.0, percent].max.to_i %>%">
-                  <%= @count[abstract_model.model.name] %>
+  <div class="dashboard-statistics">
+    <table class="table table-condensed table-striped table-hover">
+      <thead>
+        <tr>
+          <th class="shrink model-name">
+            <%= t "admin.table_headers.model_name" %>
+          </th>
+          <th class="shrink last-created">
+            <%= t "admin.table_headers.last_created" %>
+          </th>
+          <th class="records">
+            <%= t "admin.table_headers.records" %>
+          </th>
+          <th class="shrink controls"></th>
+        </tr>
+      </thead>
+      <tbody class="table-group-divider">
+        <% @abstract_models.each do |abstract_model| %>
+          <% if authorized? :index, abstract_model %>
+            <% index_path = index_path(model_name: abstract_model.to_param) %>
+            <% row_class = "#{cycle("odd", "even")}#{" link" if index_path} #{abstract_model.param_key}_links" %>
+            <tr class="<%= row_class %>" data-link="<%= index_path %>">
+              <% last_created = @most_recent_created[abstract_model.model.name] %>
+              <% active = last_created.try(:today?) %>
+              <td>
+                <span class="show">
+                  <%= link_to abstract_model.config.label_plural, index_path %>
+                </span>
+              </td>
+              <td>
+                <% if last_created %>
+                  <%= t "admin.misc.time_ago", time: time_ago_in_words(last_created), default: "#{time_ago_in_words(last_created)} #{t("admin.misc.ago")}" %>
+                <% end %>
+              </td>
+              <td>
+                <% count = @count[abstract_model.model.name] %>
+                <% percent = count > 0 ? (@max <= 1 ? count : ((Math.log(count+1) * 100.0) / Math.log(@max+1)).to_i) : -1 %>
+                <div class="progress" style="margin-bottom:0px">
+                  <div class="bg-<%= get_indicator(percent) %> progress-bar<%= ' progress-bar-striped progress-bar-animated' if active %>" style="width:<%= [2.0, percent].max.to_i %>%">
+                    <%= @count[abstract_model.model.name] %>
+                  </div>
                 </div>
-              </div>
-            </td>
-            <td class="links">
-              <ul class="nav d-inline list-inline">
-                <%= menu_for :collection, abstract_model, nil, true %>
-              </ul>
-            </td>
-          </tr>
+              </td>
+              <td class="links">
+                <ul class="nav d-inline list-inline">
+                  <%= menu_for :collection, abstract_model, nil, true %>
+                </ul>
+              </td>
+            </tr>
+          <% end %>
         <% end %>
-      <% end %>
-    </tbody>
-  </table>
+      </tbody>
+    </table>
+  </div>
 <% end %>
 <% if @history && authorized?(:history_index) %>
   <div class="block" id="block-tables">

data/app/views/rails_admin_next/main/index.html.erb

@@ -82,9 +82,9 @@
       </div>
     </div>
   <% end %>
-  <% unless @model_config.list.scopes.empty? %>
+  <% unless list_scopes.empty? %>
     <ul class="nav nav-tabs" id="scope_selector">
-      <% @model_config.list.scopes.each_with_index do |scope, index| %>
+      <% list_scopes.each_with_index do |scope, index| %>
         <% scope = '_all' if scope.nil? %>
         <li class="nav-item">
           <a href="<%= index_path(params.merge(scope: scope, page: nil)) %>" class="nav-link <%= 'active' if scope.to_s == params[:scope] || (params[:scope].blank? && index == 0) %>">
@@ -96,6 +96,7 @@
   <% end %>
   <%= form_tag bulk_action_path(model_name: @abstract_model.to_param), method: :post, id: "bulk_form", class: ["form", "mb-3"] do %>
     <%= hidden_field_tag :bulk_action %>
+    <%= hidden_field_tag :scope, params[:scope] if params[:scope].present? %>
     <% if description.present? %>
       <p>
         <strong>