rails_admin_next 1.2.1 → 2.0.0

data/docs/UPGRADING.md

@@ -8,9 +8,85 @@ the one-time changes a host app needs.
 
 The Ruby namespace is renamed **`RailsAdmin` → `RailsAdminNext`** (and `rails_admin` →
 `rails_admin_next`), so your initializer, engine mount, model macros, and route helpers
-need a mechanical rename. The **authorization contract is deliberately unchanged** — the
-`:access, :rails_admin` subject and the `admin.*` I18n namespace stay exactly as they were,
-so your CanCanCan abilities, Pundit policies, and translations need no edits.
+need a mechanical rename. The **authorization contract is deliberately unchanged** — every
+action's authorization key and the `admin.*` I18n namespace stay exactly as they were, so
+your Pundit policies and translations need no edits. CanCanCan is no longer a built-in
+adapter; see the 2.0 section below.
+
+## 2.0: CanCanCan support removed
+
+Pundit and ActionPolicy are the built-in authorization adapters.
+`config.authorize_with :cancancan` now raises `ArgumentError` while the initializer loads,
+listing the registered adapters. Any other unregistered key does the same. Move to Pundit,
+move to ActionPolicy (see [ActionPolicy adapter](#actionpolicy-adapter)), or keep CanCanCan
+with a custom adapter.
+
+### Move to Pundit
+
+```ruby
+RailsAdminNext.config do |config|
+  config.authorize_with :pundit
+end
+```
+
+- **`ApplicationPolicy`.** The adapter falls back to `::ApplicationPolicy` for the dashboard
+  (record `nil`) and for any model without its own policy.
+- **Action predicates.** The adapter calls each action's authorization key with a `?`
+  suffix: `dashboard?`, `index?`, `show?`, `new?`, `edit?`, `export?`, `destroy?`,
+  `history?` and `show_in_app?`. Saving a new record also calls `create?`, and saving an
+  edit calls `update?`. Member actions pass the record; list-level checks pass the class.
+  `edit?` and `destroy?` also get the class: the form's "Save and edit" button checks
+  `edit?`, and the index's bulk-delete menu checks `destroy?`. A predicate that reads record
+  attributes must handle a class, for example `!record.is_a?(Class) && record.active?`.
+- **A `Scope` for every model the admin lists.** A model whose policy resolves no `Scope`
+  lists nothing (see
+  [Pundit: a model with no policy Scope lists nothing](#pundit-a-model-with-no-policy-scope-lists-nothing)).
+  A policy that subclasses `ApplicationPolicy` without its own `Scope` inherits
+  `ApplicationPolicy::Scope`, so that class's `resolve` decides what the model lists.
+- **Optional `attributes_for(action)`** on a policy returns the attributes a new record
+  starts with, for example `{suspended: true}` for `:new`.
+
+Three differences from CanCanCan to check before switching:
+
+- **One `Scope` bounds every list.** The adapter passes no action to the `Scope`, so the same
+  scope bounds index, export, bulk delete and the dashboard count. Bulk destroy deletes every
+  selected record that `Scope` returns, with no per-record `destroy?` check. If an ability
+  allowed destroy or export on fewer records than read, resolve the `Scope` to the narrowest
+  of them, or stay on a custom adapter whose `query` honours the action.
+- **Nothing checks `:access, :rails_admin`.** Admin access is decided by the same policies,
+  and the `ApplicationPolicy` fallback, that the rest of the app uses. If those admit
+  ordinary users, gate admin entry separately: in `config.authenticate_with`, or with
+  admin-specific `authorization_key` values per action.
+- **The block form only gates entry.** `config.authorize_with { ... }` runs before every
+  action, but it checks no records and does not scope lists.
+
+### Keep CanCanCan with a custom adapter
+
+Register an adapter before the `RailsAdminNext.config` block that names its key, or the
+`ArgumentError` above fires at boot:
+
+```ruby
+RailsAdminNext.add_extension(:cancancan, MyApp::CanCanCanAdmin, authorization: true)
+
+RailsAdminNext.config do |config|
+  config.authorize_with :cancancan
+end
+```
+
+The module defines an `AuthorizationAdapter` class. `authorize_with` builds it with
+`new(controller, *args, &block)` and it answers:
+
+- `authorize(action, abstract_model, object)`: raises when the action is denied.
+- `authorized?(action, abstract_model, object)`: returns a boolean, for links and buttons.
+- `query(action, abstract_model)`: returns the scope lists, export and bulk actions read from.
+- `attributes_for(action, abstract_model)`: returns the attributes a new record starts with.
+- `self.setup` (optional): runs once when `authorize_with` names the key.
+
+`lib/rails_admin_next/extensions/pundit/authorization_adapter.rb` in the gem is the template.
+The removed CanCanCan adapter is a starting point you can copy:
+[v1.3.0 `extensions/cancancan/authorization_adapter.rb`](https://github.com/6temes/rails_admin_next/blob/v1.3.0/lib/rails_admin_next/extensions/cancancan/authorization_adapter.rb),
+with its module in `extensions/cancancan.rb` at the same tag. Abilities keep granting
+`can :access, :rails_admin`.
 
 ## 1. Gemfile
 
@@ -119,19 +195,19 @@ engine no longer provides it.
 
 ## Authorization (no change needed)
 
-The authorization contract is held stable — **do not touch your abilities or policies**:
+The authorization contract is held stable — **do not touch your policies**:
 
-- The access subject is `:rails_admin`.
 - Every action's authorization key (`:dashboard`, `:index`, `:show`, `:new`, `:edit`,
   `:export`, `:destroy`, `:history`, `:show_in_app`) is unchanged.
+- A custom adapter keeps the `:access, :rails_admin` subject by convention.
 
 ```ruby
-# This CanCanCan ability keeps working unchanged:
+# A custom CanCanCan adapter's ability still grants access with:
 can :access, :rails_admin
 ```
 
-The access subject is deliberately frozen and locked by a spec in the gem — a renamed
-subject can fail *open* (a `cannot` rule that no longer matches silently grants access).
+The authorization keys are locked by a spec in the gem — a renamed key can fail *open* (a
+deny rule that no longer matches silently grants access).
 
 ## Asset prerequisites
 
@@ -398,6 +474,19 @@ end
 
 Note the block: a bare `inverse_of nil` reads the option rather than setting it.
 
+## Nested forms that can reach themselves stop at three levels
+
+A nested form for an association that leads back to its own model, such as a self-referential
+`has_many :children` with `accepts_nested_attributes_for`, used to render without end and fail
+with `SystemStackError`, as did saved records that point back at each other. It now nests the
+same association at most three times along one chain; past that, the association's rows, blank
+template and add control are left out of the form, so a deeper tree is edited from a lower
+record. Chains of distinct associations are not capped.
+
+The blank row's child-index placeholder is tagged by depth, `new_<depth>_<association>` (for
+example `new_1_comments`), rather than `new_<association>`. Host JavaScript that looked for the
+old token in a nested form's `<template>` needs the new one.
+
 ## The show action answers HTML by default
 
 `show` used to declare its JSON format before its HTML one, so a request carrying no
@@ -431,12 +520,26 @@ ignored.
 
 If a client relied on a column the section doesn't show, add that field to the section.
 
+## Malformed filter params are ignored
+
+The index page used to answer a hand-written or stale `f[...]` query string with a 500: a
+filter that wasn't the `field => index => {o:, v:}` shape the filter box submits, one naming
+a field that isn't filterable (`is not currently filterable`), or a value the field couldn't
+parse, such as an impossible date or malformed JSON. Such a filter is now dropped and the
+rest of the list renders. A value that fails to parse counts as no value, so a bookmarked
+link to a field that has since stopped being filterable lists every record rather than
+erroring.
+
 ## Pundit: a model with no policy Scope lists nothing
 
 A model whose policy defines no `Scope` used to list every record. It now lists none: the
 list, export, bulk delete and dashboard count all return an empty set. Bulk delete deletes
 whatever the scope returns, with no per-record check, so "no Scope" can't mean "everything".
 
+This holds only when no `Scope` constant resolves. A policy that subclasses `ApplicationPolicy`
+without its own `Scope` inherits `ApplicationPolicy::Scope`: Pundit's generated `resolve` there
+raises `NoMethodError`, and one that returns `scope.all` lists every record.
+
 Define a `Scope` for each model the admin exposes:
 
 ```ruby
@@ -449,7 +552,154 @@ class PlayerPolicy < ApplicationPolicy
 end
 ```
 
-CanCanCan hosts are unaffected.
+## ActionPolicy adapter
+
+[ActionPolicy](https://github.com/palkan/action_policy) is a built-in adapter next to Pundit.
+Bundle `action_policy` in your app, then:
+
+```ruby
+RailsAdminNext.config do |config|
+  config.authorize_with :action_policy
+  config.current_user_method(&:current_user)
+end
+```
+
+The adapter authorizes as the user `current_user_method` returns. It checks the record's
+policy with the rule names the Pundit adapter uses: `dashboard?`, `index?`, `show?`, `new?`,
+`edit?`, `export?`, `destroy?`, `history?`, `show_in_app?`, plus `create?` and `update?` when a
+form is submitted, and `<authorization_key>?` for custom actions. Two ActionPolicy defaults
+change how a ported Pundit policy behaves:
+
+- `new?` is an alias of `create?` unless the policy defines `new?` itself.
+- A rule the policy does not define resolves to `manage?`, which is `false` on
+  `ActionPolicy::Base`, instead of raising.
+
+A model with no policy, and the dashboard, are checked against `ApplicationPolicy`. Lists,
+export, bulk delete and dashboard counts use the policy's default `relation_scope`; a model
+with no policy, no relation scope, or only named ones lists nothing. To prefill new records,
+define `attributes_for(action)` on the policy, as with Pundit.
+
+```ruby
+class ApplicationPolicy < ActionPolicy::Base
+  def dashboard? = user.admin?
+  def index? = user.admin?
+  def show? = user.admin?
+  def create? = user.admin?
+  def update? = user.admin?
+  alias_rule :edit?, to: :update?
+  def destroy? = user.admin?
+  def export? = user.admin?
+end
+
+class PlayerPolicy < ApplicationPolicy
+  relation_scope { |relation| relation }
+end
+```
+
+## An `:enum` field with no option source offers no options
+
+An `:enum` field takes its options from `enum_method`, which defaults to `<name>_enum` on the
+model class or the record. When neither defines it, the field used to call `<name>` itself and
+treat the record's current value as the option list: the index filter crashed, and the form
+offered that value instead of choices. It now offers no options.
+
+If a field's own method returns its option list, name it explicitly:
+
+```ruby
+field :colors, :enum do
+  enum_method :colors
+end
+```
+
+## A redeclared field keeps its `visible` block
+
+Declaring a field again in the same section used to discard a `visible { ... }` block set by an
+earlier declaration and show the field to everyone. The block now survives:
+
+```ruby
+field :salary do
+  visible { bindings[:view].current_user.admin? }
+end
+field :salary # still hidden from non-admins
+```
+
+If a field you hide conditionally started showing for everyone after a later `field` call, it is
+hidden again. A field hidden with a plain `visible false` is still shown again by a later
+declaration, as before.
+
+## Serialized fields load only plain YAML
+
+A `serialized` field (the default for a `store` or `serialize` attribute) now shows its value
+as plain YAML, without `!ruby/...` class tags, and loads the submitted YAML with only `Symbol`,
+`Date` and `Time` permitted. A store's `HashWithIndifferentAccess` comes back as a plain `Hash`,
+which the store wraps again on assignment. YAML naming any other class is rejected.
+
+The `safe_yaml` gem is no longer consulted, even when the host bundles it.
+`RailsAdminNext.yaml_load` and `RailsAdminNext.yaml_dump` are deprecated: call
+`YAML.safe_load` and `YAML.dump` directly.
+
+## `config.model "::Order"` configures `Order`
+
+A model named as a string or symbol with a leading `::` used to register a second, separate
+entry: its block never reached `Order`, and `Order` appeared twice in the navigation. The `::`
+is now dropped, so the block applies to `Order`. If such a block was silently doing nothing,
+check that what it configures is what you want before upgrading. `included_models` and
+`excluded_models` drop a leading `::` the same way.
+
+## Scope tabs apply to export and bulk delete
+
+The tab selected on a list (`list { scopes [...] }`) now also narrows export and bulk
+delete: "Export found" streams only the tab's records, and bulk delete lists and destroys
+only the tab's records, whatever ids are submitted. The bulk form and the confirmation
+form carry `scope` so the tab survives the round trip.
+
+A tabbed collection stays inside the authorization scope, so a tab that drops conditions,
+such as `unscoped`, cannot list, export or delete records the user may not see. It still
+drops the model's own configured `scope`. The authorization scope is built on the model's
+`default_scope`, so an `unscoped` tab no longer reaches records `default_scope` hides: a
+soft-delete "trash" tab built on `unscoped` comes up empty. Give such a tab a scope the
+authorization relation also reaches.
+
+The `scopes` block is now evaluated with `bindings[:controller]`, `bindings[:view]` and
+`bindings[:object]`, so tabs can depend on the current user:
+
+```ruby
+config.model "Order" do
+  list do
+    scopes { bindings[:controller].current_user.admin? ? [nil, :refunded] : [nil] }
+  end
+end
+```
+
+`list_entries` keeps its four positional arguments, but applies a tab only for the page's
+own model, its `additional_scope` defaults to `nil`, and it no longer reads the
+`associated_collection` picker params. Custom actions that listed picker records through
+it should call `association_entries(model_config, collection_scope)` instead.
+
+## `associated_collection_scope` runs after the list sort
+
+Association pickers apply `associated_collection_scope` after the picked model's list sort,
+so a `reorder` in it now decides the order. A plain `order` adds a secondary sort key after
+the list sort. Build on the relation the proc receives: returning a fresh relation discards
+the authorization scope, the picker's search query, sort and eager loads as well. Pickers
+never apply the picked model's scope tabs.
+
+## CSV export follows the list sort
+
+CSV export used to walk records with `find_each`, which discards the list sort, so every file
+came out in primary-key ascending order. It now writes rows in the order the list shows them:
+the sort the export request carries, or the list's default sort. For most models that default is
+the primary key descending, so an export with no sort chosen is now newest first.
+
+Rows are read in batches of 1000 instead of loading every record up front. An export with no
+matching records now contains the header row instead of an empty line.
+
+## Admin pages show a footer
+
+Every admin page now ends with a small, muted "Made in Tokyo with ❤️ and 🤖" line under the page
+content. It is not shown inside modals. To hide it, set `config.show_footer = false` in your
+initializer.
+
 ## Removed: options deprecated before RailsAdmin 3.0
 
 These six were deprecated upstream between 2019-07 and 2022-01 and had no effect for
@@ -493,3 +743,7 @@ These are intentionally gone — migrate off them before upgrading:
 
 The gem owns **no** history table. Auditing remains host/PaperTrail territory, so there is
 no gem migration to run — your existing `rails_admin_histories` table (if any) is unaffected.
+
+A record's history page now honours its column sort, and with no sort it lists newest
+first, like the model history page. It used to list a record's versions oldest first
+whatever the sort.

data/docs/security.md

@@ -16,6 +16,10 @@ destructive-action controls itself; a few things are left for the host to opt in
   can't name a hidden column, an association the export doesn't show, or a method to call.
 - **Pundit scopes fail closed.** A model whose policy has no `Scope` lists no records, rather
   than all of them.
+- **ActionPolicy scopes fail closed.** A model with no policy, or whose policy has no default
+  `relation_scope`, lists no records. A rule the policy does not define (`history?`,
+  `show_in_app?`, `export?`, a custom authorization key) resolves to the policy's `manage?`, so a
+  permissive `manage?` grants every admin action the policy leaves undefined.
 - **Destructive actions.** `delete` and `bulk_delete` render a confirmation page and additionally
   carry `data-turbo-confirm` on the destructive submit (Turbo's confirmation, not `@rails/ujs`).
 - **Mass assignment.** Submitted attributes are sliced to the model config's `visible_fields`

data/lib/generators/rails_admin_next/templates/initializer.erb

@@ -7,12 +7,12 @@ RailsAdminNext.config do |config|
   # end
   # config.current_user_method(&:current_user)
 
-  ## == CancanCan ==
-  # config.authorize_with :cancancan
-
   ## == Pundit ==
   # config.authorize_with :pundit
 
+  ## == ActionPolicy ==
+  # config.authorize_with :action_policy
+
   ## == PaperTrail ==
   # config.audit_with :paper_trail, 'User', 'PaperTrail::Version' # PaperTrail >= 3.0.0
 
@@ -22,6 +22,10 @@ RailsAdminNext.config do |config|
   ## To disable Gravatar integration in Navigation Bar set to false
   # config.show_gravatar = true
 
+  ## == Footer ==
+  ## To hide the "Made in Tokyo" footer under admin pages set to false
+  # config.show_footer = true
+
   config.actions do
     dashboard                     # mandatory
     index                         # mandatory

data/lib/rails_admin_next/abstract_model.rb

@@ -118,8 +118,16 @@ module RailsAdminNext
       extend Adapters::ActiveRecord
     end
 
+    # A value the field can't parse (an impossible date, malformed JSON or YAML) is
+    # treated as no value, element by element in an array. Only parse errors are
+    # rescued, so a bug in a custom parse_value still raises. Date::Error is an
+    # ArgumentError.
     def parse_field_value(field, value)
-      value.is_a?(Array) ? value.map { |v| field.parse_value(v) } : field.parse_value(value)
+      return value.map { |v| parse_field_value(field, v) } if value.is_a?(Array)
+
+      field.parse_value(value)
+    rescue ArgumentError, JSON::ParserError, Psych::Exception
+      nil
     end
 
     class StatementBuilder
@@ -242,7 +250,7 @@ module RailsAdminNext
         end
 
         def today
-          [Date.today, Date.today]
+          [Date.current, Date.current]
         end
 
         def yesterday
@@ -250,7 +258,7 @@ module RailsAdminNext
         end
 
         def this_week
-          [Date.today.beginning_of_week, Date.today.end_of_week]
+          [Date.current.beginning_of_week, Date.current.end_of_week]
         end
 
         def last_week
@@ -259,7 +267,7 @@ module RailsAdminNext
         end
 
         def between
-          [@value[1], @value[2]]
+          [Array.wrap(@value)[1], Array.wrap(@value)[2]]
         end
 
         def default

data/lib/rails_admin_next/adapters/active_record.rb

@@ -182,7 +182,10 @@ module RailsAdminNext
 
         def add(field, value, operator)
           field.searchable_columns.flatten.each do |column_infos|
-            statement, value1, value2 = StatementBuilder.new(quote(column_infos[:column]), column_infos[:type], value, operator, @scope.connection.adapter_name).to_statement
+            attribute_type = attribute_type(field, column_infos[:column])
+            statement, value1, value2 = StatementBuilder.new(quote(column_infos[:column]), column_infos[:type], value, operator, @scope.connection.adapter_name, column_type: attribute_type&.type).to_statement
+            statement, value1, value2 = "(1 = 0)" if out_of_range?(attribute_type, [value1, value2])
+
             @statements << statement if statement.present?
             @values << value1 unless value1.nil?
             @values << value2 unless value2.nil?
@@ -202,6 +205,29 @@ module RailsAdminNext
           "#{@scope.connection.quote_table_name(table)}.#{@scope.connection.quote_column_name(name)}"
         end
 
+        # The column's own attribute type, resolved from the field's model or, for an
+        # association, the associated model. Nil for a column on any other table.
+        def attribute_type(field, column)
+          table, name = column.split(".")
+          return unless name
+
+          models = [field.abstract_model]
+          models.concat(Array.wrap(field.associated_model_config).map(&:abstract_model)) if field.association?
+          models.map(&:model).detect { it.table_name == table }&.type_for_attribute(name)
+        end
+
+        # A number too wide for the column (an int4 searched with a 10-digit term) makes
+        # PostgreSQL reject the whole query. No row can hold it, so the column matches
+        # nothing instead: a search still matches the other columns, a filter matches none.
+        def out_of_range?(attribute_type, values)
+          return false unless attribute_type
+
+          values.grep(Integer).each { attribute_type.serialize(it) }
+          false
+        rescue ActiveModel::RangeError
+          true
+        end
+
         def build
           scope = @scope.where(@statements.join(" OR "), *@values)
           scope = scope.references(*@tables.uniq) if @tables.any?
@@ -225,11 +251,20 @@ module RailsAdminNext
 
       # filters example => {"string_field"=>{"0055"=>{"o"=>"like", "v"=>"test_value"}}, ...}
       # "0055" is the filter index, no use here. o is the operator, v the value
+      # Hand-written or stale params can have any shape, so anything that isn't
+      # field => index => filter with a scalar (or flat array) value, or names no
+      # filterable field, is skipped.
       def filter_scope(scope, filters, fields = config.list.fields.select(&:filterable?))
+        return scope unless filters.respond_to?(:each_pair)
+
         filters.each_pair do |field_name, filters_dump|
+          field = fields.detect { |f| f.name.to_s == field_name }
+          next unless field && filters_dump.respond_to?(:each_value)
+
           filters_dump.each_value do |filter_dump|
+            next unless filter_dump.respond_to?(:each_pair) && filter_value?(filter_dump[:v])
+
             wb = WhereBuilder.new(scope)
-            field = fields.detect { |f| f.name.to_s == field_name }
             value = parse_field_value(field, filter_dump[:v])
 
             wb.add(field, value, filter_dump[:o] || RailsAdminNext::Config.default_search_operator)
@@ -240,14 +275,19 @@ module RailsAdminNext
         scope
       end
 
+      def filter_value?(value)
+        Array.wrap(value).none? { it.is_a?(Array) || it.respond_to?(:each_pair) }
+      end
+
       def build_statement(column, type, value, operator)
         StatementBuilder.new(column, type, value, operator, model.connection.adapter_name).to_statement
       end
 
       class StatementBuilder < RailsAdminNext::AbstractModel::StatementBuilder
-        def initialize(column, type, value, operator, adapter_name)
+        def initialize(column, type, value, operator, adapter_name, column_type: nil)
           super(column, type, value, operator)
           @adapter_name = adapter_name
+          @column_type = column_type
         end
 
         protected
@@ -260,6 +300,9 @@ module RailsAdminNext
             uuid_unary_operators
           when :integer, :decimal, :float
             numeric_unary_operators
+          when :enum
+            # Only a string column can hold '' (and an integer one rejects the comparison).
+            %i[string text citext].include?(@column_type) ? generic_unary_operators : enum_unary_operators
           else
             generic_unary_operators
           end
@@ -288,6 +331,7 @@ module RailsAdminNext
         end
         alias_method :numeric_unary_operators, :boolean_unary_operators
         alias_method :uuid_unary_operators, :boolean_unary_operators
+        alias_method :enum_unary_operators, :boolean_unary_operators
 
         def range_filter(min, max)
           if min && max && min == max

data/lib/rails_admin_next/config/actions/base.rb

@@ -104,7 +104,6 @@ module RailsAdminNext
           key.to_sym
         end
 
-        # For CanCanCan and the like
         register_instance_option :authorization_key do
           key.to_sym
         end

data/lib/rails_admin_next/config/actions/bulk_delete.rb

@@ -20,7 +20,7 @@ module RailsAdminNext
               @objects = list_entries(@model_config, :destroy)
 
               if @objects.blank?
-                flash[:error] = t("admin.flash.error", name: pluralize(0, @model_config.label), action: t("admin.actions.delete.done"))
+                flash[:error] = t("admin.flash.error", name: pluralize(0, @model_config.label, plural: @model_config.label_plural), action: t("admin.actions.delete.done"))
                 redirect_to index_path
               else
                 render @action.template_name
@@ -49,10 +49,10 @@ module RailsAdminNext
               end
 
               if destroyed.nil?
-                flash[:error] = t("admin.flash.error", name: pluralize(0, @model_config.label), action: t("admin.actions.delete.done"))
+                flash[:error] = t("admin.flash.error", name: pluralize(0, @model_config.label, plural: @model_config.label_plural), action: t("admin.actions.delete.done"))
               else
-                flash[:success] = t("admin.flash.successful", name: pluralize(destroyed.count, @model_config.label), action: t("admin.actions.delete.done")) unless destroyed.empty?
-                flash[:error] = t("admin.flash.error", name: pluralize(not_destroyed.count, @model_config.label), action: t("admin.actions.delete.done")) unless not_destroyed.empty?
+                flash[:success] = t("admin.flash.successful", name: pluralize(destroyed.count, @model_config.label, plural: @model_config.label_plural), action: t("admin.actions.delete.done")) unless destroyed.empty?
+                flash[:error] = t("admin.flash.error", name: pluralize(not_destroyed.count, @model_config.label, plural: @model_config.label_plural), action: t("admin.actions.delete.done")) unless not_destroyed.empty?
               end
               redirect_to back_or_index
             end

data/lib/rails_admin_next/config/actions/index.rb

@@ -30,26 +30,10 @@ module RailsAdminNext
 
         register_instance_option :controller do
           proc do
-            # Resolve the active list scope (the scope tabs) and fold it into the
-            # relation *before* pagination. The paginated collection is a resolved
-            # page, not a chainable relation, so a named scope can no longer be
-            # appended afterwards.
             unless @objects
-              scopes = @model_config.list.scopes
-              list_scope =
-                if scopes.empty? || params[:scope].blank?
-                  scopes.first
-                elsif scopes.collect(&:to_s).include?(params[:scope])
-                  params[:scope].to_sym
-                end
-
-              additional_scope = get_association_scope_from_params
-              if list_scope
-                base_scope = additional_scope
-                additional_scope = proc { (base_scope ? instance_eval(&base_scope) : self).send(list_scope) }
-              end
-
-              @objects = list_entries(@model_config, :index, additional_scope)
+              # @association is set only when the picker guard accepts associated_collection; otherwise list normally.
+              association_scope = get_association_scope_from_params
+              @objects = @association ? association_entries(@model_config, association_scope) : list_entries
             end
 
             respond_to do |format|

data/lib/rails_admin_next/config/actions.rb

@@ -49,12 +49,8 @@ module RailsAdminNext
 
         def add_action(key, parent_class, parent, &)
           a = "RailsAdminNext::Config::Actions::#{parent_class.to_s.camelize}".constantize.new
-          a.instance_eval(%(
-            #{parent} true
-            def key
-              :#{key}
-            end
-          ), __FILE__, __LINE__ - 5)
+          a.send(parent, true)
+          a.define_singleton_method(:key) { key.to_sym }
           add_action_custom_key(a, &)
         end
 
@@ -68,12 +64,9 @@ module RailsAdminNext
             name = klass.to_s.demodulize.underscore.to_sym
           end
 
-          instance_eval %{
-            def #{name}(&block)
-              action = #{klass}.new
-              add_action_custom_key(action, &block)
-            end
-          }, __FILE__, __LINE__ - 5
+          define_singleton_method(name) do |&block|
+            add_action_custom_key(klass.new, &block)
+          end
         end
 
         private

data/lib/rails_admin_next/config/fields/association.rb

@@ -137,7 +137,7 @@ module RailsAdminNext
 
         # Returns collection of all selectable records
         def collection(scope = nil)
-          (scope || bindings[:controller].list_entries(associated_model_config, :index, associated_collection_scope, false))
+          (scope || bindings[:controller].association_entries(associated_model_config, associated_collection_scope))
             .map { |o| [o.send(associated_object_label_method), format_key(o.send(associated_primary_key)).to_s] }
         end
 

data/lib/rails_admin_next/config/fields/types/enum.rb

@@ -21,11 +21,17 @@ module RailsAdminNext
           end
 
           register_instance_option :enum_method do
-            @enum_method ||= (bindings[:object].class.respond_to?("#{name}_enum") || (bindings[:object] || abstract_model.model.new).respond_to?("#{name}_enum")) ? "#{name}_enum" : name
+            @enum_method ||= begin
+              method_name = "#{name}_enum"
+              method_name if (bindings[:object]&.class || abstract_model.model).respond_to?(method_name) ||
+                (bindings[:object] || abstract_model.model.new).respond_to?(method_name)
+            end
           end
 
           register_instance_option :enum do
-            if abstract_model.model.respond_to?(enum_method)
+            if enum_method.nil?
+              []
+            elsif abstract_model.model.respond_to?(enum_method)
               abstract_model.model.send(enum_method)
             else
               (bindings[:object] || abstract_model.model.new).send(enum_method)

data/lib/rails_admin_next/config/fields/types/serialized.rb

@@ -10,17 +10,32 @@ module RailsAdminNext
           # Register field type for the type loader
           RailsAdminNext::Config::Fields::Types.register(self)
 
+          # The YAML is admin-supplied, so loading permits no class beyond the scalars a
+          # plain value needs. Dumping strips Hash/Array subclasses (a store's
+          # HashWithIndifferentAccess) so what the form shows can be loaded back.
+          PERMITTED_CLASSES = [::Date, ::Symbol, ::Time].freeze
+
           register_instance_option :formatted_value do
-            RailsAdminNext.yaml_dump(value) unless value.nil?
+            YAML.dump(plain(value)) unless value.nil?
           end
 
           def parse_value(value)
-            value.present? ? (RailsAdminNext.yaml_load(value) || nil) : nil
+            value.present? ? (YAML.safe_load(value, permitted_classes: PERMITTED_CLASSES) || nil) : nil
           end
 
           def parse_input(params)
             params[name] = parse_value(params[name]) if params[name].is_a?(::String)
           end
+
+          private
+
+          def plain(object)
+            case object
+            when Hash then object.to_h { |key, value| [plain(key), plain(value)] }
+            when Array then object.map { plain(it) }
+            else object
+            end
+          end
         end
       end
     end