rails_admin_next 1.3.0 → 2.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 79af82d2ebf188875574650be98cd21e394a1a324b887cc45518d49f9fa3ec41
-  data.tar.gz: 3a1d0d3b539034bc59e0019b1d56ff5dd3420285ea91a73ab193533de5f26c53
+  metadata.gz: 85cf357bfb48a568e28ee9d031d96f9d9d96546564579a17273d06ddd1643a45
+  data.tar.gz: a3850dcf1e9f5fb4bf6797a1175be2112d6f5ecc1d9f4588dfc561a412ce9072
 SHA512:
-  metadata.gz: c20bd5d419f98867c7f2528ccf8139e5e09618ee13d4d982457fc983905c41d79b60d04c46971021531ccbc9607ceaace4ddd99072242c6003187c8e656a09f5
-  data.tar.gz: 3c06806088cbb19f949301c5150eba329392eccde2ee96128c3fb9a8ac23b3639418d358d4074ea59f1995aa186a9a399e17b86374c280953fb526b2ff1deb48
+  metadata.gz: 950489886f285808c1d8688a3099361d63bc0f2bead9b15b3b752c3de41e696a48232f63bd6bdce8ec6835a9266b35f3b13a1faebc10572a0de1daf05b87a61b
+  data.tar.gz: 6dcc9aa9063071f2008888dff5c1c4e43042c6fd3026ce6c52bdd5844080f0276cbb719241427c84254d95d2b05160cf066aaf699ddd14ac03c5c9204a5d791d

data/Gemfile

@@ -11,8 +11,8 @@ group :development, :test do
 end
 
 group :test do
+  gem "action_policy"
   gem "brakeman", require: false
-  gem "cancancan", "~> 3.0"
   gem "cuprite"
   gem "database_cleaner-active_record", require: false
   gem "factory_bot"

data/README.md

@@ -33,7 +33,7 @@ multi-bundler, jQuery-era machinery. RailsAdminNext keeps the admin and drops th
 - **🧩 Turbo + Stimulus** — the jQuery / jQuery-UI / Bootstrap-JS / `@rails/ujs` stack is gone, replaced by engine-shipped Stimulus controllers; styling is hand-maintained vanilla CSS.
 - **🔒 Hardened & CDN-free** — a documented CSRF / clickjacking / mass-assignment / CSP posture ([SECURITY.md](SECURITY.md)) and **zero external CDN**, default or opt-in — every asset is self-hosted off a gem.
 - **🎯 One modern target** — Ruby ≥ 4.0.9, Rails ~> 8.1, ActiveRecord only, latest Chrome + Safari. No Mongoid, no multi-bundler / multi-Rails matrix, no legacy-browser CSS.
-- **↩️ Familiar** — `RailsAdminNext.config`, per-model `rails_admin_next do … end` blocks, and CanCanCan / Pundit authorization all work as before; upgrading from RailsAdmin is a mechanical rename.
+- **↩️ Familiar** — `RailsAdminNext.config`, per-model `rails_admin_next do … end` blocks, and Pundit authorization all work as before; upgrading from RailsAdmin is a mechanical rename.
 
 ## Quick Start
 
@@ -113,12 +113,12 @@ always match the installed version.
 - File uploads (ActiveStorage)
 - Rich text fields (ActionText / Trix)
 - Authentication (via [Devise][devise] or any other scheme)
-- Authorization (via [CanCanCan][cancancan] or [Pundit][pundit])
+- Authorization (via [Pundit][pundit], [ActionPolicy][action_policy] or a custom adapter)
 - User action history (via [PaperTrail][papertrail])
 
 [devise]: https://github.com/heartcombo/devise
-[cancancan]: https://github.com/CanCanCommunity/cancancan
 [pundit]: https://github.com/varvet/pundit
+[action_policy]: https://github.com/palkan/action_policy
 [papertrail]: https://github.com/paper-trail-gem/paper_trail
 
 ## Configuration
@@ -143,8 +143,15 @@ RailsAdminNext.config do |config|
 end
 ```
 
-This is also where you wire up [Devise][devise], [CanCanCan][cancancan]/[Pundit][pundit],
-and [PaperTrail][papertrail].
+This is also where you wire up [Devise][devise], [Pundit][pundit], and [PaperTrail][papertrail].
+
+Every admin page ends with a small "Made in Tokyo with ❤️ and 🤖" footer. To hide it:
+
+```ruby
+RailsAdminNext.config do |config|
+  config.show_footer = false
+end
+```
 
 ### Per model
 
@@ -170,19 +177,24 @@ The configuration DSL is unchanged from upstream RailsAdmin, so the upstream
 
 ### Authorization keys are stable
 
-The authorization contract is held stable, so existing CanCanCan
-abilities and Pundit policies keep working **without edits**: the access subject is
-`:rails_admin` and every action's
-authorization key (`:dashboard`, `:index`, `:show`, `:new`, `:edit`, `:export`,
-`:destroy`, `:history`, `:show_in_app`) is unchanged.
-
-```ruby
-# Still grants access to the admin:
-can :access, :rails_admin
-```
+The authorization contract is held stable, so existing Pundit policies keep working
+**without edits**: every action's authorization key (`:dashboard`, `:index`, `:show`,
+`:new`, `:edit`, `:export`, `:destroy`, `:history`, `:show_in_app`) is unchanged, and the
+Pundit adapter calls it with a `?` suffix (`index?`, `edit?`). Pundit and ActionPolicy are
+the built-in adapters; any other authorization library plugs in as a custom adapter, which by convention
+checks the `:access, :rails_admin` subject. See [docs/UPGRADING.md](docs/UPGRADING.md).
 
 The `admin.*` I18n namespace is likewise unchanged.
 
+### ActionPolicy
+
+`config.authorize_with :action_policy` checks each action against the record's policy with
+the same `<key>?` rules the Pundit adapter calls (`index?`, `show?`, `new?`, `edit?`,
+`destroy?`, `export?`, `history?`, `show_in_app?`, `dashboard?`), and scopes lists, export
+and bulk delete through the policy's default `relation_scope`. A model with no policy, or a
+policy with no default relation scope, lists nothing. Bundle `action_policy` yourself; see
+the "ActionPolicy adapter" section of [docs/UPGRADING.md](docs/UPGRADING.md).
+
 ## Frontend and assets
 
 RailsAdminNext ships a single, zero-build asset path:
@@ -294,16 +306,16 @@ action methods**, where each admin operation is an object.
 - **One controller, many action objects** — to change how e.g. _edit_ behaves, edit `lib/rails_admin_next/config/actions/edit.rb`, not the controller.
 - **ORM facade** — nothing outside `AbstractModel` references ActiveRecord directly; the adapter seam is intact even though Mongoid was removed.
 - **Lazy, layered config** — `config/initializers` blocks run before in-model `rails_admin_next do … end` blocks, so per-model config overrides the initializer defaults.
-- **A deliberately frozen `rails_admin` surface** — the Ruby layer is `RailsAdminNext`, but the `:access, :rails_admin` authorization subject, the `admin.*` I18n namespace, and the `src/rails_admin/` asset tree stay `rails_admin` on purpose, so host abilities, translations, and assets keep working across the rename.
+- **A deliberately frozen `rails_admin` surface** — the Ruby layer is `RailsAdminNext`, but the action authorization keys, the `admin.*` I18n namespace, and the `src/rails_admin/` asset tree stay `rails_admin`-era on purpose, so host policies, translations, and assets keep working across the rename.
 
 ## Upgrading from RailsAdmin
 
 See [docs/UPGRADING.md](docs/UPGRADING.md) for the one-time changes a host app needs:
 the Gemfile gem name, the importmap/Propshaft prerequisites, and a mechanical rename of the
 `RailsAdmin` constant, initializer, mount, model macro, and route helpers to `RailsAdminNext`
-(`rails_admin_next`). The `:access, :rails_admin` authorization subject and the `admin.*`
-I18n namespace are deliberately left unchanged, so CanCanCan/Pundit rules and translations
-keep working without edits.
+(`rails_admin_next`). The action authorization keys and the `admin.*` I18n namespace are
+deliberately left unchanged, so Pundit policies and translations keep working without edits.
+Its 2.0 section covers hosts whose authorization library is no longer a built-in adapter.
 
 ## Security
 
@@ -333,5 +345,5 @@ RailsAdminNext is released under the [MIT License](LICENSE.md).
 ---
 
 <div align="center">
-  <sub>Built in Tokyo with ❤️ and 🤖</sub>
+  <sub>Made in Tokyo with ❤️ and 🤖</sub>
 </div>

data/app/assets/stylesheets/rails_admin/skin.css

@@ -460,6 +460,14 @@ body.rails_admin .pagination .page-item {
   white-space: nowrap;
 }
 
+/* === Admin skin: footer ================================================= */
+body.rails_admin .admin-footer {
+  padding: 2rem 0 1rem;
+  font-size: 0.875em;
+  color: var(--ra-gray-600);
+  text-align: center;
+}
+
 /* === Admin skin: responsive adjustments ================================= */
 @media screen and (min-width: 576px) {
   body.rails_admin .sidebar.btn-toggle-nav {

data/app/views/layouts/rails_admin_next/application.html.erb

@@ -20,6 +20,9 @@
           <div class="container-fluid">
             <%= render template: 'layouts/rails_admin_next/content' %>
           </div>
+          <% if RailsAdminNext::Config.show_footer %>
+            <footer class="admin-footer">Made in Tokyo with ❤️ and 🤖</footer>
+          <% end %>
         </div>
       </div>
     </div>

data/docs/UPGRADING.md

@@ -8,9 +8,85 @@ the one-time changes a host app needs.
 
 The Ruby namespace is renamed **`RailsAdmin` → `RailsAdminNext`** (and `rails_admin` →
 `rails_admin_next`), so your initializer, engine mount, model macros, and route helpers
-need a mechanical rename. The **authorization contract is deliberately unchanged** — the
-`:access, :rails_admin` subject and the `admin.*` I18n namespace stay exactly as they were,
-so your CanCanCan abilities, Pundit policies, and translations need no edits.
+need a mechanical rename. The **authorization contract is deliberately unchanged** — every
+action's authorization key and the `admin.*` I18n namespace stay exactly as they were, so
+your Pundit policies and translations need no edits. CanCanCan is no longer a built-in
+adapter; see the 2.0 section below.
+
+## 2.0: CanCanCan support removed
+
+Pundit and ActionPolicy are the built-in authorization adapters.
+`config.authorize_with :cancancan` now raises `ArgumentError` while the initializer loads,
+listing the registered adapters. Any other unregistered key does the same. Move to Pundit,
+move to ActionPolicy (see [ActionPolicy adapter](#actionpolicy-adapter)), or keep CanCanCan
+with a custom adapter.
+
+### Move to Pundit
+
+```ruby
+RailsAdminNext.config do |config|
+  config.authorize_with :pundit
+end
+```
+
+- **`ApplicationPolicy`.** The adapter falls back to `::ApplicationPolicy` for the dashboard
+  (record `nil`) and for any model without its own policy.
+- **Action predicates.** The adapter calls each action's authorization key with a `?`
+  suffix: `dashboard?`, `index?`, `show?`, `new?`, `edit?`, `export?`, `destroy?`,
+  `history?` and `show_in_app?`. Saving a new record also calls `create?`, and saving an
+  edit calls `update?`. Member actions pass the record; list-level checks pass the class.
+  `edit?` and `destroy?` also get the class: the form's "Save and edit" button checks
+  `edit?`, and the index's bulk-delete menu checks `destroy?`. A predicate that reads record
+  attributes must handle a class, for example `!record.is_a?(Class) && record.active?`.
+- **A `Scope` for every model the admin lists.** A model whose policy resolves no `Scope`
+  lists nothing (see
+  [Pundit: a model with no policy Scope lists nothing](#pundit-a-model-with-no-policy-scope-lists-nothing)).
+  A policy that subclasses `ApplicationPolicy` without its own `Scope` inherits
+  `ApplicationPolicy::Scope`, so that class's `resolve` decides what the model lists.
+- **Optional `attributes_for(action)`** on a policy returns the attributes a new record
+  starts with, for example `{suspended: true}` for `:new`.
+
+Three differences from CanCanCan to check before switching:
+
+- **One `Scope` bounds every list.** The adapter passes no action to the `Scope`, so the same
+  scope bounds index, export, bulk delete and the dashboard count. Bulk destroy deletes every
+  selected record that `Scope` returns, with no per-record `destroy?` check. If an ability
+  allowed destroy or export on fewer records than read, resolve the `Scope` to the narrowest
+  of them, or stay on a custom adapter whose `query` honours the action.
+- **Nothing checks `:access, :rails_admin`.** Admin access is decided by the same policies,
+  and the `ApplicationPolicy` fallback, that the rest of the app uses. If those admit
+  ordinary users, gate admin entry separately: in `config.authenticate_with`, or with
+  admin-specific `authorization_key` values per action.
+- **The block form only gates entry.** `config.authorize_with { ... }` runs before every
+  action, but it checks no records and does not scope lists.
+
+### Keep CanCanCan with a custom adapter
+
+Register an adapter before the `RailsAdminNext.config` block that names its key, or the
+`ArgumentError` above fires at boot:
+
+```ruby
+RailsAdminNext.add_extension(:cancancan, MyApp::CanCanCanAdmin, authorization: true)
+
+RailsAdminNext.config do |config|
+  config.authorize_with :cancancan
+end
+```
+
+The module defines an `AuthorizationAdapter` class. `authorize_with` builds it with
+`new(controller, *args, &block)` and it answers:
+
+- `authorize(action, abstract_model, object)`: raises when the action is denied.
+- `authorized?(action, abstract_model, object)`: returns a boolean, for links and buttons.
+- `query(action, abstract_model)`: returns the scope lists, export and bulk actions read from.
+- `attributes_for(action, abstract_model)`: returns the attributes a new record starts with.
+- `self.setup` (optional): runs once when `authorize_with` names the key.
+
+`lib/rails_admin_next/extensions/pundit/authorization_adapter.rb` in the gem is the template.
+The removed CanCanCan adapter is a starting point you can copy:
+[v1.3.0 `extensions/cancancan/authorization_adapter.rb`](https://github.com/6temes/rails_admin_next/blob/v1.3.0/lib/rails_admin_next/extensions/cancancan/authorization_adapter.rb),
+with its module in `extensions/cancancan.rb` at the same tag. Abilities keep granting
+`can :access, :rails_admin`.
 
 ## 1. Gemfile
 
@@ -119,19 +195,19 @@ engine no longer provides it.
 
 ## Authorization (no change needed)
 
-The authorization contract is held stable — **do not touch your abilities or policies**:
+The authorization contract is held stable — **do not touch your policies**:
 
-- The access subject is `:rails_admin`.
 - Every action's authorization key (`:dashboard`, `:index`, `:show`, `:new`, `:edit`,
   `:export`, `:destroy`, `:history`, `:show_in_app`) is unchanged.
+- A custom adapter keeps the `:access, :rails_admin` subject by convention.
 
 ```ruby
-# This CanCanCan ability keeps working unchanged:
+# A custom CanCanCan adapter's ability still grants access with:
 can :access, :rails_admin
 ```
 
-The access subject is deliberately frozen and locked by a spec in the gem — a renamed
-subject can fail *open* (a `cannot` rule that no longer matches silently grants access).
+The authorization keys are locked by a spec in the gem — a renamed key can fail *open* (a
+deny rule that no longer matches silently grants access).
 
 ## Asset prerequisites
 
@@ -460,6 +536,10 @@ A model whose policy defines no `Scope` used to list every record. It now lists
 list, export, bulk delete and dashboard count all return an empty set. Bulk delete deletes
 whatever the scope returns, with no per-record check, so "no Scope" can't mean "everything".
 
+This holds only when no `Scope` constant resolves. A policy that subclasses `ApplicationPolicy`
+without its own `Scope` inherits `ApplicationPolicy::Scope`: Pundit's generated `resolve` there
+raises `NoMethodError`, and one that returns `scope.all` lists every record.
+
 Define a `Scope` for each model the admin exposes:
 
 ```ruby
@@ -472,7 +552,49 @@ class PlayerPolicy < ApplicationPolicy
 end
 ```
 
-CanCanCan hosts are unaffected.
+## ActionPolicy adapter
+
+[ActionPolicy](https://github.com/palkan/action_policy) is a built-in adapter next to Pundit.
+Bundle `action_policy` in your app, then:
+
+```ruby
+RailsAdminNext.config do |config|
+  config.authorize_with :action_policy
+  config.current_user_method(&:current_user)
+end
+```
+
+The adapter authorizes as the user `current_user_method` returns. It checks the record's
+policy with the rule names the Pundit adapter uses: `dashboard?`, `index?`, `show?`, `new?`,
+`edit?`, `export?`, `destroy?`, `history?`, `show_in_app?`, plus `create?` and `update?` when a
+form is submitted, and `<authorization_key>?` for custom actions. Two ActionPolicy defaults
+change how a ported Pundit policy behaves:
+
+- `new?` is an alias of `create?` unless the policy defines `new?` itself.
+- A rule the policy does not define resolves to `manage?`, which is `false` on
+  `ActionPolicy::Base`, instead of raising.
+
+A model with no policy, and the dashboard, are checked against `ApplicationPolicy`. Lists,
+export, bulk delete and dashboard counts use the policy's default `relation_scope`; a model
+with no policy, no relation scope, or only named ones lists nothing. To prefill new records,
+define `attributes_for(action)` on the policy, as with Pundit.
+
+```ruby
+class ApplicationPolicy < ActionPolicy::Base
+  def dashboard? = user.admin?
+  def index? = user.admin?
+  def show? = user.admin?
+  def create? = user.admin?
+  def update? = user.admin?
+  alias_rule :edit?, to: :update?
+  def destroy? = user.admin?
+  def export? = user.admin?
+end
+
+class PlayerPolicy < ApplicationPolicy
+  relation_scope { |relation| relation }
+end
+```
 
 ## An `:enum` field with no option source offers no options
 
@@ -572,6 +694,12 @@ the primary key descending, so an export with no sort chosen is now newest first
 Rows are read in batches of 1000 instead of loading every record up front. An export with no
 matching records now contains the header row instead of an empty line.
 
+## Admin pages show a footer
+
+Every admin page now ends with a small, muted "Made in Tokyo with ❤️ and 🤖" line under the page
+content. It is not shown inside modals. To hide it, set `config.show_footer = false` in your
+initializer.
+
 ## Removed: options deprecated before RailsAdmin 3.0
 
 These six were deprecated upstream between 2019-07 and 2022-01 and had no effect for

data/docs/security.md

@@ -16,6 +16,10 @@ destructive-action controls itself; a few things are left for the host to opt in
   can't name a hidden column, an association the export doesn't show, or a method to call.
 - **Pundit scopes fail closed.** A model whose policy has no `Scope` lists no records, rather
   than all of them.
+- **ActionPolicy scopes fail closed.** A model with no policy, or whose policy has no default
+  `relation_scope`, lists no records. A rule the policy does not define (`history?`,
+  `show_in_app?`, `export?`, a custom authorization key) resolves to the policy's `manage?`, so a
+  permissive `manage?` grants every admin action the policy leaves undefined.
 - **Destructive actions.** `delete` and `bulk_delete` render a confirmation page and additionally
   carry `data-turbo-confirm` on the destructive submit (Turbo's confirmation, not `@rails/ujs`).
 - **Mass assignment.** Submitted attributes are sliced to the model config's `visible_fields`

data/lib/generators/rails_admin_next/templates/initializer.erb

@@ -7,12 +7,12 @@ RailsAdminNext.config do |config|
   # end
   # config.current_user_method(&:current_user)
 
-  ## == CancanCan ==
-  # config.authorize_with :cancancan
-
   ## == Pundit ==
   # config.authorize_with :pundit
 
+  ## == ActionPolicy ==
+  # config.authorize_with :action_policy
+
   ## == PaperTrail ==
   # config.audit_with :paper_trail, 'User', 'PaperTrail::Version' # PaperTrail >= 3.0.0
 
@@ -22,6 +22,10 @@ RailsAdminNext.config do |config|
   ## To disable Gravatar integration in Navigation Bar set to false
   # config.show_gravatar = true
 
+  ## == Footer ==
+  ## To hide the "Made in Tokyo" footer under admin pages set to false
+  # config.show_footer = true
+
   config.actions do
     dashboard                     # mandatory
     index                         # mandatory

data/lib/rails_admin_next/config/actions/base.rb

@@ -104,7 +104,6 @@ module RailsAdminNext
           key.to_sym
         end
 
-        # For CanCanCan and the like
         register_instance_option :authorization_key do
           key.to_sym
         end

data/lib/rails_admin_next/config.rb

@@ -73,6 +73,9 @@ module RailsAdminNext
       # show Gravatar in Navigation bar
       attr_accessor :show_gravatar
 
+      # show the "Made in Tokyo" footer under every admin page
+      attr_accessor :show_footer
+
       # accepts a hash of static links to be shown below the main navigation
       attr_accessor :navigation_static_links
       attr_accessor :navigation_static_label
@@ -171,21 +174,37 @@ module RailsAdminNext
       #     end
       #   end
       #
+      # The block form only gates entry: it runs before every action, but nothing checks
+      # individual records or scopes the list.
+      #
       # To use an authorization adapter, pass the name of the adapter. For example,
-      # to use with CanCanCan[https://github.com/CanCanCommunity/cancancan/], pass it like this.
+      # to use with Pundit[https://github.com/varvet/pundit], pass it like this.
+      #
+      # @example Pundit
+      #   RailsAdminNext.config do |config|
+      #     config.authorize_with :pundit
+      #   end
       #
-      # @example CanCanCan
+      # @example ActionPolicy
       #   RailsAdminNext.config do |config|
-      #     config.authorize_with :cancancan
+      #     config.authorize_with :action_policy
       #   end
       #
-      # See the wiki[https://github.com/railsadminteam/rails_admin/wiki] for more on authorization.
+      # A custom adapter is registered with
+      # RailsAdminNext.add_extension(key, mod, authorization: true) before it is named here.
+      # See docs/UPGRADING.md for the adapter contract.
       #
       # @see RailsAdminNext::Config::DEFAULT_AUTHORIZE
       def authorize_with(*args, &block)
         extension = args.shift
         if extension
-          klass = RailsAdminNext::AUTHORIZATION_ADAPTERS[extension]
+          klass = RailsAdminNext::AUTHORIZATION_ADAPTERS.fetch(extension) do
+            raise ArgumentError, "Unknown authorization adapter #{extension.inspect}. " \
+              "Registered adapters: #{RailsAdminNext::AUTHORIZATION_ADAPTERS.keys.map(&:inspect).join(", ")}. " \
+              "Register a custom adapter with RailsAdminNext.add_extension(key, mod, authorization: true) " \
+              "before this config block, or pass a block to authorize_with to gate admin entry only " \
+              "(no per-record checks or list scoping). See docs/UPGRADING.md."
+          end
           klass.setup if klass.respond_to? :setup
           @authorize = proc do
             @authorization_adapter = klass.new(*([self] + args).compact, &block)
@@ -355,6 +374,7 @@ module RailsAdminNext
         @registry = {}
         @navbar_css_classes = %w[navbar-dark bg-primary border-bottom]
         @show_gravatar = true
+        @show_footer = true
         @navigation_static_links = {}
         @navigation_static_label = nil
         @composite_keys_serializer = RailsAdminNext::Support::CompositeKeysSerializer

data/lib/rails_admin_next/extensions/action_policy/authorization_adapter.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+module RailsAdminNext
+  module Extensions
+    module ActionPolicy
+      class AuthorizationAdapter
+        # ActionPolicy is referenced only inside methods, so hosts without the gem still boot.
+        def self.setup
+          include ::ActionPolicy::Behaviour
+
+          authorize :user, through: -> { @controller._current_user }
+        end
+
+        def initialize(controller)
+          @controller = controller
+        end
+
+        def authorize(action, abstract_model = nil, model_object = nil)
+          return unless action
+
+          record = model_object || abstract_model&.model
+          authorize!(record, to: rule_for(action), with: policy_class_for(record))
+          @controller.skip_verify_authorized! if @controller.respond_to?(:skip_verify_authorized!)
+        end
+
+        def authorized?(action, abstract_model = nil, model_object = nil)
+          return unless action
+
+          record = model_object || abstract_model&.model
+          allowed_to?(rule_for(action), record, with: policy_class_for(record))
+        end
+
+        def query(_action, abstract_model)
+          @controller.skip_verify_authorized_scoped! if @controller.respond_to?(:skip_verify_authorized_scoped!)
+          model = abstract_model.model
+          authorized_scope(model.all, type: :active_record_relation, with: ::ActionPolicy.lookup(model))
+        rescue ::ActionPolicy::NotFound, ::ActionPolicy::UnknownScopeType, ::ActionPolicy::UnknownNamedScope
+          abstract_model.model.none
+        end
+
+        def attributes_for(action, abstract_model)
+          record = abstract_model&.model
+          policy_for(record:, with: policy_class_for(record)).try(:attributes_for, action) || {}
+        end
+
+        private
+
+        def policy_class_for(record)
+          ::ActionPolicy.lookup(record, default: ::ApplicationPolicy)
+        end
+
+        # A Symbol, because ActionPolicy keys its rule aliases (new? -> create?) by Symbol and a
+        # String would silently skip them.
+        def rule_for(action)
+          action.to_s.end_with?("?") ? action.to_sym : :"#{action}?"
+        end
+      end
+    end
+  end
+end

data/lib/rails_admin_next/extensions/action_policy.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+require "rails_admin_next/extensions/action_policy/authorization_adapter"
+
+RailsAdminNext.add_extension(:action_policy, RailsAdminNext::Extensions::ActionPolicy, authorization: true)

data/lib/rails_admin_next/extensions/pundit/authorization_adapter.rb

@@ -46,7 +46,7 @@ module RailsAdminNext
         def query(_action, abstract_model)
           @controller.send(:policy_scope, abstract_model.model.all)
         rescue ::Pundit::NotDefinedError
-          abstract_model.model.none
+          host_policy_scope? ? abstract_model.model.none : model_scope(abstract_model.model)
         end
 
         # This is called in the new/create actions to determine the initial attributes for new
@@ -65,6 +65,22 @@ module RailsAdminNext
           ::ApplicationPolicy.new(@controller.send(:pundit_user), record)
         end
 
+        # action_policy defines ActiveRecord::Relation#policy_class as nil, which hides every
+        # Scope from Pundit's relation lookup when both gems are bundled; the model still finds it.
+        # A host override of policy_scope (e.g. namespacing) chose its own Scope, so it is never
+        # swapped for the model's.
+        def host_policy_scope?
+          @controller.method(:policy_scope).owner != (defined?(::Pundit::Authorization) ? ::Pundit::Authorization : ::Pundit)
+        end
+
+        def model_scope(model)
+          scope_class = ::Pundit::PolicyFinder.new(model).scope
+          return model.none unless scope_class
+
+          @controller.instance_variable_set(:@_pundit_policy_scoped, true)
+          scope_class.new(@controller.send(:pundit_user), model.all).resolve
+        end
+
         def action_for_pundit(action)
           (action[-1, 1] == "?") ? action : "#{action}?"
         end

data/lib/rails_admin_next/version.rb

@@ -5,8 +5,8 @@ module RailsAdminNext
     # Releases are cut by publishing a Release-Drafter draft: the gem-push workflow stamps
     # the tag's version over these constants at build time, so the in-repo values are only
     # the floor a local `gem build` produces.
-    MAJOR = 1
-    MINOR = 3
+    MAJOR = 2
+    MINOR = 0
     PATCH = 0
     PRE = nil
 

data/lib/rails_admin_next.rb

@@ -6,8 +6,8 @@ require "rails_admin_next/config"
 require "rails_admin_next/config/const_load_suppressor"
 require "rails_admin_next/icons"
 require "rails_admin_next/extension"
-require "rails_admin_next/extensions/cancancan"
 require "rails_admin_next/extensions/pundit"
+require "rails_admin_next/extensions/action_policy"
 require "rails_admin_next/extensions/paper_trail"
 require "rails_admin_next/support/csv_converter"
 require "rails_admin_next/support/hash_helper"

data/skills/rails-admin-next/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: rails-admin-next
-description: Configure or extend the rails_admin_next admin in a host Rails app (models, fields, custom actions and field types, CanCanCan/Pundit authorization, PaperTrail history, theming, CSP). Use instead of upstream RailsAdmin knowledge, which is wrong for this fork.
+description: Configure or extend the rails_admin_next admin in a host Rails app (models, fields, custom actions and field types, Pundit, ActionPolicy or custom-adapter authorization, PaperTrail history, theming, CSP). Use instead of upstream RailsAdmin knowledge, which is wrong for this fork.
 ---
 
 # rails_admin_next
@@ -35,7 +35,7 @@ Renamed (write the new form):
 
 Not renamed (leave as is):
 
-- The authorization subject is still `:rails_admin`. CanCanCan abilities grant `can :access, :rails_admin`. Never rewrite it to `:rails_admin_next`, which fails authorization.
+- The authorization subject is still `:rails_admin`. A custom adapter that keeps CanCanCan grants `can :access, :rails_admin`. Never rewrite it to `:rails_admin_next`, which fails authorization.
 - Action authorization keys (`:dashboard`, `:index`, `:show`, `:new`, `:edit`, `:export`, `:destroy`, `:history`, `:show_in_app`).
 - The `admin.*` I18n namespace.
 
@@ -75,9 +75,10 @@ Icons take logical names, never Font Awesome classes: `link_icon :show_in_app` o
 
 ## Authorization and history
 
-- `config.authorize_with :cancancan` uses the app's `Ability`. Keep the `:rails_admin` subject (see Naming).
+- Pundit and ActionPolicy are the built-in adapters. `RailsAdminNext.add_extension(key, mod, authorization: true)` registers a custom one before the config block names its key; copy `<gem>/lib/rails_admin_next/extensions/pundit/authorization_adapter.rb` as the template. An unregistered key raises `ArgumentError` at boot.
 - `config.authorize_with :pundit` calls the record's policy with `<action>?` methods (`index?`, `edit?`, `dashboard?`) and scopes lists with `policy_scope`.
-- `config.authorize_with do ... end` runs a custom block as a before filter.
+- `config.authorize_with :action_policy` checks the same `<action>?` rules with `allowed_to?` and scopes lists with the policy's default `relation_scope`. `new?` resolves to `create?` and undefined rules to `manage?`. A model with no policy is checked against `ApplicationPolicy`, and one with no default relation scope lists nothing.
+- `config.authorize_with do ... end` runs a custom block as a before filter. It gates admin entry only: no per-record checks or list scoping.
 - `config.authenticate_with do ... end` and `config.current_user_method do ... end` wire in the app's authentication, such as Devise or Warden.
 - `config.audit_with :paper_trail` turns on the history action. Read the "History / audit table" section of `<gem>/docs/UPGRADING.md` first.
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails_admin_next
 version: !ruby/object:Gem::Version
-  version: 1.3.0
+  version: 2.0.0
 platform: ruby
 authors:
 - Daniel López Prat
@@ -285,8 +285,8 @@ files:
 - lib/rails_admin_next/config/sections/update.rb
 - lib/rails_admin_next/engine.rb
 - lib/rails_admin_next/extension.rb
-- lib/rails_admin_next/extensions/cancancan.rb
-- lib/rails_admin_next/extensions/cancancan/authorization_adapter.rb
+- lib/rails_admin_next/extensions/action_policy.rb
+- lib/rails_admin_next/extensions/action_policy/authorization_adapter.rb
 - lib/rails_admin_next/extensions/controller_extension.rb
 - lib/rails_admin_next/extensions/paper_trail.rb
 - lib/rails_admin_next/extensions/paper_trail/auditing_adapter.rb

data/lib/rails_admin_next/extensions/cancancan/authorization_adapter.rb

@@ -1,90 +0,0 @@
-# frozen_string_literal: true
-
-module RailsAdminNext
-  module Extensions
-    module CanCanCan
-      # This adapter is for the CanCanCan[https://github.com/CanCanCommunity/cancancan] authorization library.
-      class AuthorizationAdapter
-        module ControllerExtension
-          def current_ability
-            # use _current_user instead of default current_user so it works with
-            # whatever current user method is defined with RailsAdminNext
-            @current_ability ||= ability_class.new(_current_user)
-          end
-        end
-
-        include RailsAdminNext::Config::Configurable
-
-        def self.setup
-          RailsAdminNext::Extensions::ControllerExtension.include ControllerExtension
-        end
-
-        # See the +authorize_with+ config method for where the initialization happens.
-        def initialize(controller, ability = nil, &block)
-          @controller = controller
-          ability_class { ability } if ability
-          instance_eval(&block) if block
-
-          adapter = self
-          ControllerExtension.define_method(:ability_class) do
-            adapter.ability_class
-          end
-          @controller.current_ability.authorize! :access, :rails_admin
-        end
-
-        register_instance_option :ability_class do
-          Ability
-        end
-
-        # This method is called in every controller action and should raise an exception
-        # when the authorization fails. The first argument is the name of the controller
-        # action as a symbol (:create, :bulk_delete, etc.). The second argument is the
-        # AbstractModel instance that applies. The third argument is the actual model
-        # instance if it is available.
-        def authorize(action, abstract_model = nil, model_object = nil)
-          return unless action
-
-          action, subject = resolve_action_and_subject(action, abstract_model, model_object)
-          @controller.current_ability.authorize!(action, subject)
-        end
-
-        # This method is called primarily from the view to determine whether the given user
-        # has access to perform the action on a given model. It should return true when authorized.
-        # This takes the same arguments as +authorize+. The difference is that this will
-        # return a boolean whereas +authorize+ will raise an exception when not authorized.
-        def authorized?(action, abstract_model = nil, model_object = nil)
-          return unless action
-
-          action, subject = resolve_action_and_subject(action, abstract_model, model_object)
-          @controller.current_ability.can?(action, subject)
-        end
-
-        # This is called when needing to scope a database query. It is called within the list
-        # and bulk_delete/destroy actions and should return a scope which limits the records
-        # to those which the user can perform the given action on.
-        def query(action, abstract_model)
-          abstract_model.model.accessible_by(@controller.current_ability, action)
-        end
-
-        # This is called in the new/create actions to determine the initial attributes for new
-        # records. It should return a hash of attributes which match what the user
-        # is authorized to create.
-        def attributes_for(action, abstract_model)
-          @controller.current_ability.attributes_for(action, abstract_model&.model)
-        end
-
-        private
-
-        def resolve_action_and_subject(action, abstract_model, model_object)
-          subject = model_object || abstract_model&.model
-          if subject
-            [action, subject]
-          else
-            # For :dashboard compatibility
-            [:read, action]
-          end
-        end
-      end
-    end
-  end
-end

data/lib/rails_admin_next/extensions/cancancan.rb

@@ -1,5 +0,0 @@
-# frozen_string_literal: true
-
-require "rails_admin_next/extensions/cancancan/authorization_adapter"
-
-RailsAdminNext.add_extension(:cancancan, RailsAdminNext::Extensions::CanCanCan, authorization: true)