rails_admin_next 2.0.1 → 2.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f52de80007a2b162a4a4874efa2606e2ec24a056f63a2efbd3603f30867d0e8f
-  data.tar.gz: aa67aa9fbe010180f5313cebe83a569fdeb1808d1e936b86ee9201ff05b25f7e
+  metadata.gz: 373f306f26c44449a2adeabf854452a3592fdef08eb87ffb31c818f7ce662ddb
+  data.tar.gz: 435fbec5b7817f3f1d7b53eacf233f04208c27de4a87e5eb15fdd6585f395328
 SHA512:
-  metadata.gz: 40f67da005ec5b1c3b5d8825dc0b6d7a8bb92d01ba93c035f8371353b557fee9e1b0b76a7275a9f100ad79e4eb1b5a74dd59cd438ef79fb692bea50bc17c401e
-  data.tar.gz: 4204094e7e91124b1df69629a853988b4cc16284bf49003b59e13f486f33566ce3392f148c2a6d89e33ca24cb46d35c2e4c48c9b822e4fe95eba1513e23c514e
+  metadata.gz: ea6a58ab5f4276088b29bde851ef2802316f370a208d50c0619dc3c6a2218e981f690b959f1776d8b6d74687a703595887f798b1ef11866b398fd4ec5e4d90e0
+  data.tar.gz: 5e43c1a785d4bbc4bcfa06aea22a24989d2e5832ad7de1cef45e388f7a2f002823da4f50421dd1fbe9d4121b0324f05409194ea6f7f75f0751881c713253ca7e

data/README.md

@@ -192,7 +192,8 @@ The `admin.*` I18n namespace is likewise unchanged.
 the same `<key>?` rules the Pundit adapter calls (`index?`, `show?`, `new?`, `edit?`,
 `destroy?`, `export?`, `history?`, `show_in_app?`, `dashboard?`), and scopes lists, export
 and bulk delete through the policy's default `relation_scope`. A model with no policy, or a
-policy with no default relation scope, lists nothing. Bundle `action_policy` yourself; see
+policy with no default relation scope, lists nothing. Policies that declare context beyond
+`user` get it from `authorize_with :action_policy, context: {...}`. Bundle `action_policy` yourself; see
 the "ActionPolicy adapter" section of [docs/UPGRADING.md](docs/UPGRADING.md).
 
 ## Frontend and assets

data/app/controllers/rails_admin_next/application_controller.rb

@@ -28,12 +28,17 @@ module RailsAdminNext
 
     def get_model
       @model_name = to_model_name(params[:model_name])
-      raise RailsAdminNext::ModelNotFound unless (@abstract_model = RailsAdminNext::AbstractModel.new(@model_name))
-      raise RailsAdminNext::ModelNotFound if (@model_config = @abstract_model.config).excluded?
+      raise RailsAdminNext::ModelNotFound unless (@abstract_model = visible_abstract_model(@model_name))
 
+      @model_config = @abstract_model.config
       @properties = @abstract_model.properties
     end
 
+    def visible_abstract_model(model_name)
+      abstract_model = RailsAdminNext::AbstractModel.new(model_name)
+      abstract_model if abstract_model && !abstract_model.config.excluded?
+    end
+
     def get_object
       raise RailsAdminNext::ObjectNotFound unless (@object = @abstract_model.get(params[:id], @model_config.scope))
     end

data/app/controllers/rails_admin_next/main_controller.rb

@@ -231,9 +231,9 @@ module RailsAdminNext
     end
 
     def get_association_scope_from_params
-      return nil unless params[:associated_collection].present?
+      return nil unless params[:associated_collection].present? && params[:source_abstract_model].present?
+      return nil unless (source_abstract_model = visible_abstract_model(to_model_name(params[:source_abstract_model])))
 
-      source_abstract_model = RailsAdminNext::AbstractModel.new(to_model_name(params[:source_abstract_model]))
       source_model_config = source_abstract_model.config
       action = params[:current_action].in?(%w[create update]) ? params[:current_action] : "edit"
       field = source_model_config.send(action).fields.detect { |f| f.name == params[:associated_collection].to_sym }

data/docs/UPGRADING.md

@@ -30,7 +30,8 @@ end
 ```
 
 - **`ApplicationPolicy`.** The adapter falls back to `::ApplicationPolicy` for the dashboard
-  (record `nil`) and for any model without its own policy.
+  (record `nil`) and for any model without a policy of its own or a parent model's (see
+  [STI subclasses use their parent model's policy](#sti-subclasses-use-their-parent-models-policy)).
 - **Action predicates.** The adapter calls each action's authorization key with a `?`
   suffix: `dashboard?`, `index?`, `show?`, `new?`, `edit?`, `export?`, `destroy?`,
   `history?` and `show_in_app?`. Saving a new record also calls `create?`, and saving an
@@ -49,10 +50,10 @@ end
 Three differences from CanCanCan to check before switching:
 
 - **One `Scope` bounds every list.** The adapter passes no action to the `Scope`, so the same
-  scope bounds index, export, bulk delete and the dashboard count. Bulk destroy deletes every
-  selected record that `Scope` returns, with no per-record `destroy?` check. If an ability
-  allowed destroy or export on fewer records than read, resolve the `Scope` to the narrowest
-  of them, or stay on a custom adapter whose `query` honours the action.
+  scope bounds index, export, bulk delete and the dashboard count. Bulk delete also asks
+  `destroy?` of each selected record, but export does not. If an ability allowed export on
+  fewer records than read, resolve the `Scope` to the narrowest of them, or stay on a custom
+  adapter whose `query` honours the action.
 - **Nothing checks `:access, :rails_admin`.** Admin access is decided by the same policies,
   and the `ApplicationPolicy` fallback, that the rest of the app uses. If those admit
   ordinary users, gate admin entry separately: in `config.authenticate_with`, or with
@@ -74,13 +75,17 @@ end
 ```
 
 The module defines an `AuthorizationAdapter` class. `authorize_with` builds it with
-`new(controller, *args, &block)` and it answers:
+`new(controller, *args, **options, &block)` and it answers:
 
 - `authorize(action, abstract_model, object)`: raises when the action is denied.
 - `authorized?(action, abstract_model, object)`: returns a boolean, for links and buttons.
 - `query(action, abstract_model)`: returns the scope lists, export and bulk actions read from.
 - `attributes_for(action, abstract_model)`: returns the attributes a new record starts with.
 - `self.setup` (optional): runs once when `authorize_with` names the key.
+- `self.validate_options!(*args, **options)` (optional): receives the extra arguments while the
+  config block runs; raise `ArgumentError` there so a misconfigured option fails at boot. A
+  subclass of a built-in adapter inherits its `validate_options!`, so one that takes options of
+  its own overrides it.
 
 `lib/rails_admin_next/extensions/pundit/authorization_adapter.rb` in the gem is the template.
 The removed CanCanCan adapter is a starting point you can copy:
@@ -533,8 +538,8 @@ erroring.
 ## Pundit: a model with no policy Scope lists nothing
 
 A model whose policy defines no `Scope` used to list every record. It now lists none: the
-list, export, bulk delete and dashboard count all return an empty set. Bulk delete deletes
-whatever the scope returns, with no per-record check, so "no Scope" can't mean "everything".
+list, export, bulk delete and dashboard count all return an empty set, so "no Scope" can't
+mean "everything".
 
 This holds only when no `Scope` constant resolves. A policy that subclasses `ApplicationPolicy`
 without its own `Scope` inherits `ApplicationPolicy::Scope`: Pundit's generated `resolve` there
@@ -572,9 +577,11 @@ change how a ported Pundit policy behaves:
 
 - `new?` is an alias of `create?` unless the policy defines `new?` itself.
 - A rule the policy does not define resolves to `manage?`, which is `false` on
-  `ActionPolicy::Base`, instead of raising.
+  `ActionPolicy::Base`, instead of raising. That includes a mistyped `authorization_key`,
+  so a policy whose `manage?` is true lets that action through.
 
-A model with no policy, and the dashboard, are checked against `ApplicationPolicy`. Lists,
+A model with no policy of its own or a parent model's, and the dashboard, are checked against
+`ApplicationPolicy`. Lists,
 export, bulk delete and dashboard counts use the policy's default `relation_scope`; a model
 with no policy, no relation scope, or only named ones lists nothing. To prefill new records,
 define `attributes_for(action)` on the policy, as with Pundit.
@@ -596,6 +603,39 @@ class PlayerPolicy < ApplicationPolicy
 end
 ```
 
+### Authorization context beyond the user
+
+A policy that declares more context than `user`, such as a tenant's `authorize :account`,
+needs the adapter to supply it. Pass each key as a block:
+
+```ruby
+RailsAdminNext.config do |config|
+  config.authorize_with :action_policy, context: {account: -> { _current_user.account }}
+end
+```
+
+Each block runs on the admin controller once per request, the first time anything is
+authorized, whichever policy is checked; a block should return `nil` rather than raise for a
+user with no such context. A helper from your own controller, such as `current_account`, is
+only available there when `config.parent_controller` names that controller:
+
+```ruby
+config.parent_controller = "::ApplicationController"
+config.authorize_with :action_policy, context: {account: -> { current_account }}
+```
+
+The value is an authorization input, so derive it from the signed-in user, or check the user's
+membership when it comes from request data such as `params` or the subdomain. The relation scope
+only narrows lists, export and bulk actions: show, edit, delete and history load the record by
+id and check the rule alone, so a tenant rule such as `update?` must compare `record` with
+`account` itself.
+
+`user` always comes from `current_user_method` and is rejected inside `context:`. A key that is
+not a Symbol, a value that is not a block taking no arguments, or an unknown option raises
+`ArgumentError` while the config block runs. A key a policy declares that the host omits, or
+whose block returns `nil`, raises `ActionPolicy::AuthorizationContextMissing` on the request
+unless the policy declares it with `allow_nil:` or `optional:`.
+
 ## An `:enum` field with no option source offers no options
 
 An `:enum` field takes its options from `enum_method`, which defaults to `<name>_enum` on the
@@ -676,6 +716,15 @@ own model, its `additional_scope` defaults to `nil`, and it no longer reads the
 `associated_collection` picker params. Custom actions that listed picker records through
 it should call `association_entries(model_config, collection_scope)` instead.
 
+## Bulk delete checks `destroy?` on each record
+
+Bulk delete now asks the policy's `destroy?` (or the rule named by the action's
+`authorization_key`) of every selected record, as the single delete does, with both Pundit
+and ActionPolicy. A record it refuses is left out of the confirmation
+page, is not destroyed, and counts in the "failed to be deleted" message. Before, bulk
+delete honoured only the scope, so a `destroy?` rule that reads the record, such as
+`!record.locked?`, stopped the single delete but not the bulk one.
+
 ## `associated_collection_scope` runs after the list sort
 
 Association pickers apply `associated_collection_scope` after the picked model's list sort,
@@ -700,6 +749,22 @@ Every admin page now ends with a small, muted "Made in Tokyo with ❤️ and
 content. It is not shown inside modals. To hide it, set `config.show_footer = false` in your
 initializer.
 
+## STI subclasses use their parent model's policy
+
+Both the Pundit and the ActionPolicy adapter used to check an STI subclass with no policy of its
+own against `ApplicationPolicy`, and to list none of its records. Such a subclass now takes the
+nearest parent model's policy, for its rules and its scope alike, before `ApplicationPolicy`:
+a `Hardball < Ball` with no `HardballPolicy` uses `BallPolicy`. A subclass that defines its own
+policy still uses it, and lists nothing if that policy has no scope.
+
+If `ApplicationPolicy` granted a subclass what its parent's policy denies, it is now denied. If
+`ApplicationPolicy` denied a subclass what its parent's policy grants, it is now granted, and the
+subclass lists what the parent's scope returns. Either way, give the subclass its own policy to
+keep the old access.
+
+The walk follows Ruby class inheritance, not the `type` column: a concrete subclass of a model
+takes that model's policy even when it is not STI.
+
 ## Removed: options deprecated before RailsAdmin 3.0
 
 These six were deprecated upstream between 2019-07 and 2022-01 and had no effect for

data/docs/security.md

@@ -20,6 +20,9 @@ destructive-action controls itself; a few things are left for the host to opt in
   `relation_scope`, lists no records. A rule the policy does not define (`history?`,
   `show_in_app?`, `export?`, a custom authorization key) resolves to the policy's `manage?`, so a
   permissive `manage?` grants every admin action the policy leaves undefined.
+- **ActionPolicy context fails loudly.** A context key a policy declares that the host omits, or
+  whose block returns `nil`, raises `ActionPolicy::AuthorizationContextMissing` on every adapter
+  check rather than listing or allowing anything; `user` cannot be replaced through `context:`.
 - **Destructive actions.** `delete` and `bulk_delete` render a confirmation page and additionally
   carry `data-turbo-confirm` on the destructive submit (Turbo's confirmation, not `@rails/ujs`).
 - **Mass assignment.** Submitted attributes are sliced to the model config's `visible_fields`

data/lib/rails_admin_next/config/actions/bulk_delete.rb

@@ -16,8 +16,10 @@ module RailsAdminNext
 
         register_instance_option :controller do
           proc do
+            destroyable = ->(object) { @authorization_adapter.nil? || @authorization_adapter.authorized?(@action.authorization_key, @abstract_model, object) }
+
             if request.post? # BULK DELETE
-              @objects = list_entries(@model_config, :destroy)
+              @objects = list_entries(@model_config, :destroy).select(&destroyable)
 
               if @objects.blank?
                 flash[:error] = t("admin.flash.error", name: pluralize(0, @model_config.label, plural: @model_config.label_plural), action: t("admin.actions.delete.done"))
@@ -37,6 +39,8 @@ module RailsAdminNext
                   # Rescue per record: dependent: :restrict_with_exception raises, and an
                   # escaping raise would abandon every record behind it in the batch.
                   destroyed, not_destroyed = Array.wrap(@objects).partition do |object|
+                    next false unless destroyable.call(object)
+
                     object.destroy
                     object.destroyed?
                   rescue ActiveRecord::DeleteRestrictionError

data/lib/rails_admin_next/config.rb

@@ -190,13 +190,25 @@ module RailsAdminNext
       #     config.authorize_with :action_policy
       #   end
       #
+      # @example ActionPolicy with authorization context beyond the user
+      #   RailsAdminNext.config do |config|
+      #     config.authorize_with :action_policy, context: {account: -> { _current_user.account }}
+      #   end
+      #
+      # An adapter may define a class method validate_options!, which receives the extra arguments
+      # while this config block runs, so a misconfigured option fails at boot.
+      #
       # A custom adapter is registered with
       # RailsAdminNext.add_extension(key, mod, authorization: true) before it is named here.
       # See docs/UPGRADING.md for the adapter contract.
       #
       # @see RailsAdminNext::Config::DEFAULT_AUTHORIZE
-      def authorize_with(*args, &block)
+      def authorize_with(*args, **options, &block)
         extension = args.shift
+        if extension.nil? && options.any?
+          raise ArgumentError, "authorize_with options need an adapter key, such as authorize_with(:action_policy, **options)"
+        end
+
         if extension
           klass = RailsAdminNext::AUTHORIZATION_ADAPTERS.fetch(extension) do
             raise ArgumentError, "Unknown authorization adapter #{extension.inspect}. " \
@@ -206,8 +218,9 @@ module RailsAdminNext
               "(no per-record checks or list scoping). See docs/UPGRADING.md."
           end
           klass.setup if klass.respond_to? :setup
+          klass.validate_options!(*args, **options) if klass.respond_to? :validate_options!
           @authorize = proc do
-            @authorization_adapter = klass.new(*([self] + args).compact, &block)
+            @authorization_adapter = klass.new(*([self] + args).compact, **options, &block)
           end
         elsif block
           @authorize = block

data/lib/rails_admin_next/extensions/action_policy/authorization_adapter.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "rails_admin_next/extensions/model_lineage"
+
 module RailsAdminNext
   module Extensions
     module ActionPolicy
@@ -11,8 +13,19 @@ module RailsAdminNext
           authorize :user, through: -> { @controller._current_user }
         end
 
-        def initialize(controller)
+        def self.validate_options!(context: {})
+          context.each do |key, value|
+            raise ArgumentError, "ActionPolicy context key #{key.inspect} must be a Symbol" unless key.is_a?(Symbol)
+            raise ArgumentError, "ActionPolicy context #{key.inspect} is the current user; set it with config.current_user_method" if key == :user
+            unless value.is_a?(Proc) && value.parameters.none? { |type, _| type in :req | :keyreq }
+              raise ArgumentError, "ActionPolicy context #{key.inspect} must be a block taking no arguments, run on the admin controller"
+            end
+          end
+        end
+
+        def initialize(controller, context: {})
           @controller = controller
+          @context = context
         end
 
         def authorize(action, abstract_model = nil, model_object = nil)
@@ -33,8 +46,11 @@ module RailsAdminNext
         def query(_action, abstract_model)
           @controller.skip_verify_authorized_scoped! if @controller.respond_to?(:skip_verify_authorized_scoped!)
           model = abstract_model.model
-          authorized_scope(model.all, type: :active_record_relation, with: ::ActionPolicy.lookup(model))
-        rescue ::ActionPolicy::NotFound, ::ActionPolicy::UnknownScopeType, ::ActionPolicy::UnknownNamedScope
+          policy_class = model_policy_class(model)
+          return model.none unless policy_class
+
+          authorized_scope(model.all, type: :active_record_relation, with: policy_class)
+        rescue ::ActionPolicy::UnknownScopeType, ::ActionPolicy::UnknownNamedScope
           abstract_model.model.none
         end
 
@@ -45,8 +61,16 @@ module RailsAdminNext
 
         private
 
+        def build_authorization_context
+          super.merge(@context.transform_values { @controller.instance_exec(&it) })
+        end
+
         def policy_class_for(record)
-          ::ActionPolicy.lookup(record, default: ::ApplicationPolicy)
+          model_policy_class(record) || ::ApplicationPolicy
+        end
+
+        def model_policy_class(record)
+          [record, *ModelLineage.superclasses(record)].lazy.filter_map { ::ActionPolicy.lookup(it, allow_nil: true) }.first
         end
 
         # A Symbol, because ActionPolicy keys its rule aliases (new? -> create?) by Symbol and a

data/lib/rails_admin_next/extensions/model_lineage.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module RailsAdminNext
+  module Extensions
+    # Pundit and ActionPolicy look a policy up by the record's own class name only, so without
+    # walking these an STI subclass with no policy skips its parent model's for ApplicationPolicy.
+    module ModelLineage
+      def self.superclasses(record)
+        model = record.is_a?(Class) ? record : record.class
+        model.ancestors.grep(Class).drop(1).take_while { it < ::ActiveRecord::Base && !it.abstract_class? }
+      end
+    end
+  end
+end

data/lib/rails_admin_next/extensions/pundit/authorization_adapter.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "rails_admin_next/extensions/model_lineage"
+
 module RailsAdminNext
   module Extensions
     module Pundit
@@ -12,6 +14,10 @@ module RailsAdminNext
           RailsAdminNext::Extensions::ControllerExtension.include defined?(::Pundit::Authorization) ? ::Pundit::Authorization : ::Pundit
         end
 
+        # Pundit takes no options, so any passed to authorize_with fail at boot.
+        def self.validate_options!
+        end
+
         # See the +authorize_with+ config method for where the initialization happens.
         def initialize(controller)
           @controller = controller
@@ -41,8 +47,7 @@ module RailsAdminNext
         # This is called when needing to scope a database query. It is called within the list
         # and bulk_delete/destroy actions and should return a scope which limits the records
         # to those which the user can perform the given action on. A model with no policy
-        # Scope gets no records: bulk_delete deletes whatever this returns without a
-        # per-record check, so a forgotten Scope must not mean "everything".
+        # Scope gets no records, so a forgotten Scope must not mean "everything".
         def query(_action, abstract_model)
           @controller.send(:policy_scope, abstract_model.model.all)
         rescue ::Pundit::NotDefinedError
@@ -62,7 +67,16 @@ module RailsAdminNext
         def policy(record)
           @controller.send(:policy, record)
         rescue ::Pundit::NotDefinedError
-          ::ApplicationPolicy.new(@controller.send(:pundit_user), record)
+          policy_class = ModelLineage.superclasses(record).lazy.filter_map { host_policy(it)&.class }.first
+          (policy_class || ::ApplicationPolicy).new(@controller.send(:pundit_user), record)
+        end
+
+        # Through the controller, so a host override of policy (e.g. namespacing) also picks the
+        # parent model's policy.
+        def host_policy(model)
+          @controller.send(:policy, model)
+        rescue ::Pundit::NotDefinedError
+          nil
         end
 
         # action_policy defines ActiveRecord::Relation#policy_class as nil, which hides every
@@ -74,7 +88,8 @@ module RailsAdminNext
         end
 
         def model_scope(model)
-          scope_class = ::Pundit::PolicyFinder.new(model).scope
+          finder = [model, *ModelLineage.superclasses(model)].lazy.map { ::Pundit::PolicyFinder.new(it) }.find(&:policy)
+          scope_class = finder&.scope
           return model.none unless scope_class
 
           @controller.instance_variable_set(:@_pundit_policy_scoped, true)

data/lib/rails_admin_next/version.rb

@@ -6,8 +6,8 @@ module RailsAdminNext
     # the tag's version over these constants at build time, so the in-repo values are only
     # the floor a local `gem build` produces.
     MAJOR = 2
-    MINOR = 0
-    PATCH = 1
+    MINOR = 2
+    PATCH = 0
     PRE = nil
 
     class << self

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails_admin_next
 version: !ruby/object:Gem::Version
-  version: 2.0.1
+  version: 2.2.0
 platform: ruby
 authors:
 - Daniel López Prat
@@ -288,6 +288,7 @@ files:
 - lib/rails_admin_next/extensions/action_policy.rb
 - lib/rails_admin_next/extensions/action_policy/authorization_adapter.rb
 - lib/rails_admin_next/extensions/controller_extension.rb
+- lib/rails_admin_next/extensions/model_lineage.rb
 - lib/rails_admin_next/extensions/paper_trail.rb
 - lib/rails_admin_next/extensions/paper_trail/auditing_adapter.rb
 - lib/rails_admin_next/extensions/pundit.rb