rails_admin_next 2.1.0 → 2.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 821ddc2c14943ce137265d8c99d9784492cde1b2041dab27a1b5651795ce3cd4
-  data.tar.gz: f3c9d9906d117bb55e0eb4c2fcfc585d129b98c1bb2b32689fdd2a734f656d90
+  metadata.gz: 373f306f26c44449a2adeabf854452a3592fdef08eb87ffb31c818f7ce662ddb
+  data.tar.gz: 435fbec5b7817f3f1d7b53eacf233f04208c27de4a87e5eb15fdd6585f395328
 SHA512:
-  metadata.gz: 993ba29f1ae5ce41e276c0637660c791c0f3a6a47379082143b15079052c4f43ebc7a24a0d00f7433b4c0c1c37359154e0ef4ae3bf1c5a95340ac78472fca376
-  data.tar.gz: fa8ef20e12e1a670877e0d8f8719d87967e0398a11063d30e58a70a5bdff77984dc04e70695b7f12dfd7f632e04606388e4fd08c027b4e57dcc1121f2eec458c
+  metadata.gz: ea6a58ab5f4276088b29bde851ef2802316f370a208d50c0619dc3c6a2218e981f690b959f1776d8b6d74687a703595887f798b1ef11866b398fd4ec5e4d90e0
+  data.tar.gz: 5e43c1a785d4bbc4bcfa06aea22a24989d2e5832ad7de1cef45e388f7a2f002823da4f50421dd1fbe9d4121b0324f05409194ea6f7f75f0751881c713253ca7e

data/docs/UPGRADING.md

@@ -30,7 +30,8 @@ end
 ```
 
 - **`ApplicationPolicy`.** The adapter falls back to `::ApplicationPolicy` for the dashboard
-  (record `nil`) and for any model without its own policy.
+  (record `nil`) and for any model without a policy of its own or a parent model's (see
+  [STI subclasses use their parent model's policy](#sti-subclasses-use-their-parent-models-policy)).
 - **Action predicates.** The adapter calls each action's authorization key with a `?`
   suffix: `dashboard?`, `index?`, `show?`, `new?`, `edit?`, `export?`, `destroy?`,
   `history?` and `show_in_app?`. Saving a new record also calls `create?`, and saving an
@@ -49,10 +50,10 @@ end
 Three differences from CanCanCan to check before switching:
 
 - **One `Scope` bounds every list.** The adapter passes no action to the `Scope`, so the same
-  scope bounds index, export, bulk delete and the dashboard count. Bulk destroy deletes every
-  selected record that `Scope` returns, with no per-record `destroy?` check. If an ability
-  allowed destroy or export on fewer records than read, resolve the `Scope` to the narrowest
-  of them, or stay on a custom adapter whose `query` honours the action.
+  scope bounds index, export, bulk delete and the dashboard count. Bulk delete also asks
+  `destroy?` of each selected record, but export does not. If an ability allowed export on
+  fewer records than read, resolve the `Scope` to the narrowest of them, or stay on a custom
+  adapter whose `query` honours the action.
 - **Nothing checks `:access, :rails_admin`.** Admin access is decided by the same policies,
   and the `ApplicationPolicy` fallback, that the rest of the app uses. If those admit
   ordinary users, gate admin entry separately: in `config.authenticate_with`, or with
@@ -537,8 +538,8 @@ erroring.
 ## Pundit: a model with no policy Scope lists nothing
 
 A model whose policy defines no `Scope` used to list every record. It now lists none: the
-list, export, bulk delete and dashboard count all return an empty set. Bulk delete deletes
-whatever the scope returns, with no per-record check, so "no Scope" can't mean "everything".
+list, export, bulk delete and dashboard count all return an empty set, so "no Scope" can't
+mean "everything".
 
 This holds only when no `Scope` constant resolves. A policy that subclasses `ApplicationPolicy`
 without its own `Scope` inherits `ApplicationPolicy::Scope`: Pundit's generated `resolve` there
@@ -576,9 +577,11 @@ change how a ported Pundit policy behaves:
 
 - `new?` is an alias of `create?` unless the policy defines `new?` itself.
 - A rule the policy does not define resolves to `manage?`, which is `false` on
-  `ActionPolicy::Base`, instead of raising.
+  `ActionPolicy::Base`, instead of raising. That includes a mistyped `authorization_key`,
+  so a policy whose `manage?` is true lets that action through.
 
-A model with no policy, and the dashboard, are checked against `ApplicationPolicy`. Lists,
+A model with no policy of its own or a parent model's, and the dashboard, are checked against
+`ApplicationPolicy`. Lists,
 export, bulk delete and dashboard counts use the policy's default `relation_scope`; a model
 with no policy, no relation scope, or only named ones lists nothing. To prefill new records,
 define `attributes_for(action)` on the policy, as with Pundit.
@@ -713,6 +716,15 @@ own model, its `additional_scope` defaults to `nil`, and it no longer reads the
 `associated_collection` picker params. Custom actions that listed picker records through
 it should call `association_entries(model_config, collection_scope)` instead.
 
+## Bulk delete checks `destroy?` on each record
+
+Bulk delete now asks the policy's `destroy?` (or the rule named by the action's
+`authorization_key`) of every selected record, as the single delete does, with both Pundit
+and ActionPolicy. A record it refuses is left out of the confirmation
+page, is not destroyed, and counts in the "failed to be deleted" message. Before, bulk
+delete honoured only the scope, so a `destroy?` rule that reads the record, such as
+`!record.locked?`, stopped the single delete but not the bulk one.
+
 ## `associated_collection_scope` runs after the list sort
 
 Association pickers apply `associated_collection_scope` after the picked model's list sort,
@@ -737,6 +749,22 @@ Every admin page now ends with a small, muted "Made in Tokyo with ❤️ and
 content. It is not shown inside modals. To hide it, set `config.show_footer = false` in your
 initializer.
 
+## STI subclasses use their parent model's policy
+
+Both the Pundit and the ActionPolicy adapter used to check an STI subclass with no policy of its
+own against `ApplicationPolicy`, and to list none of its records. Such a subclass now takes the
+nearest parent model's policy, for its rules and its scope alike, before `ApplicationPolicy`:
+a `Hardball < Ball` with no `HardballPolicy` uses `BallPolicy`. A subclass that defines its own
+policy still uses it, and lists nothing if that policy has no scope.
+
+If `ApplicationPolicy` granted a subclass what its parent's policy denies, it is now denied. If
+`ApplicationPolicy` denied a subclass what its parent's policy grants, it is now granted, and the
+subclass lists what the parent's scope returns. Either way, give the subclass its own policy to
+keep the old access.
+
+The walk follows Ruby class inheritance, not the `type` column: a concrete subclass of a model
+takes that model's policy even when it is not STI.
+
 ## Removed: options deprecated before RailsAdmin 3.0
 
 These six were deprecated upstream between 2019-07 and 2022-01 and had no effect for

data/lib/rails_admin_next/config/actions/bulk_delete.rb

@@ -16,8 +16,10 @@ module RailsAdminNext
 
         register_instance_option :controller do
           proc do
+            destroyable = ->(object) { @authorization_adapter.nil? || @authorization_adapter.authorized?(@action.authorization_key, @abstract_model, object) }
+
             if request.post? # BULK DELETE
-              @objects = list_entries(@model_config, :destroy)
+              @objects = list_entries(@model_config, :destroy).select(&destroyable)
 
               if @objects.blank?
                 flash[:error] = t("admin.flash.error", name: pluralize(0, @model_config.label, plural: @model_config.label_plural), action: t("admin.actions.delete.done"))
@@ -37,6 +39,8 @@ module RailsAdminNext
                   # Rescue per record: dependent: :restrict_with_exception raises, and an
                   # escaping raise would abandon every record behind it in the batch.
                   destroyed, not_destroyed = Array.wrap(@objects).partition do |object|
+                    next false unless destroyable.call(object)
+
                     object.destroy
                     object.destroyed?
                   rescue ActiveRecord::DeleteRestrictionError

data/lib/rails_admin_next/extensions/action_policy/authorization_adapter.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "rails_admin_next/extensions/model_lineage"
+
 module RailsAdminNext
   module Extensions
     module ActionPolicy
@@ -44,8 +46,11 @@ module RailsAdminNext
         def query(_action, abstract_model)
           @controller.skip_verify_authorized_scoped! if @controller.respond_to?(:skip_verify_authorized_scoped!)
           model = abstract_model.model
-          authorized_scope(model.all, type: :active_record_relation, with: ::ActionPolicy.lookup(model))
-        rescue ::ActionPolicy::NotFound, ::ActionPolicy::UnknownScopeType, ::ActionPolicy::UnknownNamedScope
+          policy_class = model_policy_class(model)
+          return model.none unless policy_class
+
+          authorized_scope(model.all, type: :active_record_relation, with: policy_class)
+        rescue ::ActionPolicy::UnknownScopeType, ::ActionPolicy::UnknownNamedScope
           abstract_model.model.none
         end
 
@@ -61,7 +66,11 @@ module RailsAdminNext
         end
 
         def policy_class_for(record)
-          ::ActionPolicy.lookup(record, default: ::ApplicationPolicy)
+          model_policy_class(record) || ::ApplicationPolicy
+        end
+
+        def model_policy_class(record)
+          [record, *ModelLineage.superclasses(record)].lazy.filter_map { ::ActionPolicy.lookup(it, allow_nil: true) }.first
         end
 
         # A Symbol, because ActionPolicy keys its rule aliases (new? -> create?) by Symbol and a

data/lib/rails_admin_next/extensions/model_lineage.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module RailsAdminNext
+  module Extensions
+    # Pundit and ActionPolicy look a policy up by the record's own class name only, so without
+    # walking these an STI subclass with no policy skips its parent model's for ApplicationPolicy.
+    module ModelLineage
+      def self.superclasses(record)
+        model = record.is_a?(Class) ? record : record.class
+        model.ancestors.grep(Class).drop(1).take_while { it < ::ActiveRecord::Base && !it.abstract_class? }
+      end
+    end
+  end
+end

data/lib/rails_admin_next/extensions/pundit/authorization_adapter.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "rails_admin_next/extensions/model_lineage"
+
 module RailsAdminNext
   module Extensions
     module Pundit
@@ -45,8 +47,7 @@ module RailsAdminNext
         # This is called when needing to scope a database query. It is called within the list
         # and bulk_delete/destroy actions and should return a scope which limits the records
         # to those which the user can perform the given action on. A model with no policy
-        # Scope gets no records: bulk_delete deletes whatever this returns without a
-        # per-record check, so a forgotten Scope must not mean "everything".
+        # Scope gets no records, so a forgotten Scope must not mean "everything".
         def query(_action, abstract_model)
           @controller.send(:policy_scope, abstract_model.model.all)
         rescue ::Pundit::NotDefinedError
@@ -66,7 +67,16 @@ module RailsAdminNext
         def policy(record)
           @controller.send(:policy, record)
         rescue ::Pundit::NotDefinedError
-          ::ApplicationPolicy.new(@controller.send(:pundit_user), record)
+          policy_class = ModelLineage.superclasses(record).lazy.filter_map { host_policy(it)&.class }.first
+          (policy_class || ::ApplicationPolicy).new(@controller.send(:pundit_user), record)
+        end
+
+        # Through the controller, so a host override of policy (e.g. namespacing) also picks the
+        # parent model's policy.
+        def host_policy(model)
+          @controller.send(:policy, model)
+        rescue ::Pundit::NotDefinedError
+          nil
         end
 
         # action_policy defines ActiveRecord::Relation#policy_class as nil, which hides every
@@ -78,7 +88,8 @@ module RailsAdminNext
         end
 
         def model_scope(model)
-          scope_class = ::Pundit::PolicyFinder.new(model).scope
+          finder = [model, *ModelLineage.superclasses(model)].lazy.map { ::Pundit::PolicyFinder.new(it) }.find(&:policy)
+          scope_class = finder&.scope
           return model.none unless scope_class
 
           @controller.instance_variable_set(:@_pundit_policy_scoped, true)

data/lib/rails_admin_next/version.rb

@@ -6,7 +6,7 @@ module RailsAdminNext
     # the tag's version over these constants at build time, so the in-repo values are only
     # the floor a local `gem build` produces.
     MAJOR = 2
-    MINOR = 1
+    MINOR = 2
     PATCH = 0
     PRE = nil
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails_admin_next
 version: !ruby/object:Gem::Version
-  version: 2.1.0
+  version: 2.2.0
 platform: ruby
 authors:
 - Daniel López Prat
@@ -288,6 +288,7 @@ files:
 - lib/rails_admin_next/extensions/action_policy.rb
 - lib/rails_admin_next/extensions/action_policy/authorization_adapter.rb
 - lib/rails_admin_next/extensions/controller_extension.rb
+- lib/rails_admin_next/extensions/model_lineage.rb
 - lib/rails_admin_next/extensions/paper_trail.rb
 - lib/rails_admin_next/extensions/paper_trail/auditing_adapter.rb
 - lib/rails_admin_next/extensions/pundit.rb