rails_ai_admin 0.1.0

data/lib/rails_ai_admin/outbox/delivery_context.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+module RailsAiAdmin
+  module Outbox
+    class DeliveryContext
+      attr_reader :record, :generation
+
+      def initialize(item, context, resource, record, authorization:)
+        @item, @context, @resource, @record, @authorization = item, context, resource, record, authorization
+        @generation, @used, @completed = item.generation, false, false
+        @effect_mutex = Mutex.new
+      end
+
+      %i[actor tenant actor_ref tenant_ref security_version time_zone].each do |method|
+        define_method(method) { @context.public_send(method) }
+      end
+
+      def delivery_key = "raa:work:#{@item.id}"
+      def effect_completed? = @completed
+
+      def assert_current!
+        current = WorkItem.where(id: @item.id, status: "running", lease_owner: @item.lease_owner, generation: generation)
+          .where("lease_expires_at > ?", Time.current).exists?
+        raise Dispatcher::LeaseLost unless current
+        true
+      end
+
+      def effect(request:)
+        @effect_mutex.synchronize do
+          raise ConfigurationError, "Each Work item permits exactly one effect" if @used
+          @used = true
+        end
+        raise ConfigurationError, "External effects cannot run in a database transaction" if WorkItem.connection.transaction_open?
+        digest = RequestDigest.call(request)
+        @context, @resource, @record = @authorization.call
+        owned = WorkItem.where(id: @item.id, status: "running", lease_owner: @item.lease_owner, generation: generation)
+          .where("lease_expires_at > ?", Time.current)
+        previous = owned.pick(:effect_digest)
+        raise Dispatcher::Blocked, "REQUEST_CHANGED" if previous && previous != digest
+        changed = ActiveRecord::Base.while_preventing_writes(false) do
+          owned.where("(effect_generation IS NULL OR effect_generation < ?) AND (effect_digest IS NULL OR effect_digest = ?)", generation, digest)
+            .update_all(effect_started_at: Time.current, effect_digest: digest, effect_generation: generation, updated_at: Time.current)
+        end
+        raise Dispatcher::LeaseLost if changed.zero?
+        result = yield self
+        @completed = true
+        result
+      end
+    end
+  end
+end

data/lib/rails_ai_admin/outbox/dispatcher.rb

@@ -0,0 +1,189 @@
+# frozen_string_literal: true
+
+module RailsAiAdmin
+  module Outbox
+    # Fencing protects database receipts. Replaying external requests still needs
+    # the downstream system to honor the stable delivery key.
+    class Dispatcher
+      Result = Data.define(:work_ref, :status, :code) do
+        def success? = status == "succeeded"
+      end
+      class Blocked < StandardError
+        attr_reader :code
+        def initialize(code)
+          @code = code
+          super(code)
+        end
+      end
+      class LeaseLost < StandardError; end
+
+      def run(work_ref)
+        raise ConfigurationError, "Outbox delivery cannot run inside a database transaction" if WorkItem.connection.transaction_open?
+        item = claim(work_ref)
+        return item if item.is_a?(Result)
+        return Result.new(work_ref, "missing", "NOT_FOUND") unless item
+        definition = RailsAiAdmin.work_registry.fetch(item.kind)
+        authorization = -> { authorize(item) }
+        context, resource, record = ActiveRecord::Base.while_preventing_writes { authorization.call }
+        values = InputSchema.new(definition.handler_class.input).coerce(item.payload, time_zone: context.time_zone)
+        raise Blocked, "PAYLOAD_INVALID" unless values.valid? && InputSchema.digest(values.values) == item.payload_digest
+        delivery = DeliveryContext.new(item, context, resource, record, authorization: authorization)
+        ActiveRecord::Base.while_preventing_writes { definition.handler_class.new.perform(delivery, values.values) }
+        raise ConfigurationError, "Work must complete exactly one ctx.effect" unless delivery.effect_completed?
+        finish(item, "succeeded", "OK")
+      rescue AccessDenied
+        delivery&.effect_completed? ? finish(item, "succeeded", "POST_EFFECT_CALLBACK_FAILED") : fail_delivery(item, "AUTHORIZATION_REVOKED", denied: true)
+      rescue Blocked => error
+        delivery&.effect_completed? ? finish(item, "succeeded", "POST_EFFECT_CALLBACK_FAILED") : fail_delivery(item, error.code, reconcile: true)
+      rescue LeaseLost
+        fence_lost(item)
+      rescue StandardError
+        raise unless item.is_a?(WorkItem)
+        delivery&.effect_completed? ? finish(item, "succeeded", "POST_EFFECT_CALLBACK_FAILED") : fail_delivery(item, "DELIVERY_FAILED")
+      end
+
+      def scan_pending!(limit: 100, inline: false)
+        raise ArgumentError, "limit must be between 1 and 1000" unless limit.is_a?(Integer) && (1..1000).cover?(limit)
+        now = Time.current
+        due = WorkItem.where(status: "pending").where("next_attempt_at IS NULL OR next_attempt_at <= ? OR deadline_at <= ?", now, now)
+        stale = WorkItem.where(status: "running").where("lease_expires_at IS NULL OR lease_expires_at <= ?", now)
+        ids = due.or(stale).order(:created_at, :id).limit(limit).pluck(:id)
+        ids.count do |id|
+          if inline
+            run(id)
+            true
+          else
+            !!DeliveryJob.perform_later(id)
+          end
+        end
+      end
+
+      private
+
+      def claim(work_ref)
+        WorkItem.transaction do
+          item = WorkItem.lock.find_by(id: work_ref)
+          next unless item
+          now = Time.current
+          unless %w[pending running].include?(item.status)
+            next Result.new(item.id, item.status, item.last_code || "TERMINAL")
+          end
+          if item.status == "running" && item.lease_expires_at && item.lease_expires_at > now
+            next Result.new(item.id, item.status, "IN_PROGRESS")
+          end
+          if item.deadline_at <= now
+            terminal = item.effect_started_at ? "reconciliation_required" : "failed"
+            item.update!(status: terminal, last_code: "WORK_EXPIRED", completed_at: now)
+            next Result.new(item.id, terminal, "WORK_EXPIRED")
+          end
+          if item.status == "pending" && item.next_attempt_at && item.next_attempt_at > now
+            next Result.new(item.id, item.status, "BACKOFF")
+          end
+          begin
+            definition = RailsAiAdmin.work_registry.fetch(item.kind)
+            valid = item.handler_version == definition.fingerprint
+          rescue ConfigurationError, NameError
+            valid = false
+          end
+          unless valid
+            item.update!(status: "reconciliation_required", last_code: "HANDLER_CHANGED", completed_at: now)
+            next Result.new(item.id, item.status, item.last_code)
+          end
+          if item.effect_started_at && !definition.handler_class.idempotent
+            item.update!(status: "reconciliation_required", last_code: "OUTCOME_UNKNOWN", completed_at: now)
+            next Result.new(item.id, item.status, item.last_code)
+          end
+          if item.attempts >= definition.handler_class.max_attempts
+            item.update!(status: item.effect_started_at ? "reconciliation_required" : "failed", last_code: "ATTEMPTS_EXHAUSTED", completed_at: now)
+            next Result.new(item.id, item.status, item.last_code)
+          end
+          item.update!(status: "running", lease_owner: SecureRandom.uuid, generation: item.generation + 1,
+            attempts: item.attempts + 1, lease_expires_at: now + definition.handler_class.lease_duration,
+            next_attempt_at: nil, last_code: nil)
+          item
+        end
+      rescue ActiveRecord::Deadlocked, ActiveRecord::LockWaitTimeout
+        Result.new(work_ref, "pending", "CONFLICT")
+      rescue ActiveRecord::StatementInvalid => error
+        raise unless defined?(SQLite3::BusyException) && error.cause.is_a?(SQLite3::BusyException)
+        Result.new(work_ref, "pending", "CONFLICT")
+      end
+
+      def authorize(item)
+        begin
+          work = RailsAiAdmin.work_registry.fetch(item.kind)
+          valid = work.fingerprint == item.handler_version
+        rescue ConfigurationError, NameError
+          valid = false
+        end
+        raise Blocked, "HANDLER_CHANGED" unless valid
+        run = OperationRun.find(item.operation_run_id)
+        raise Blocked, "OPERATION_NOT_COMMITTED" unless run.status == "succeeded"
+        resolver = RailsAiAdmin.configuration.context_adapter&.constantize&.new
+        raise Blocked, "JOB_CONTEXT_NOT_CONFIGURED" unless resolver&.respond_to?(:resolve_job)
+        context = resolver.resolve_job(actor_ref: run.actor_ref, tenant_ref: run.tenant_ref, security_version: run.security_version)
+        unless context.is_a?(Context) && context.actor_ref == run.actor_ref && context.tenant_ref == run.tenant_ref && context.security_version == run.security_version
+          raise AccessDenied
+        end
+        resource = RailsAiAdmin.registry.fetch(run.resource_key)
+        unless resource.model_class.connection_pool.equal?(WorkItem.connection_pool) && OperationRun.connection_pool.equal?(WorkItem.connection_pool)
+          raise Blocked, "CONNECTION_CHANGED"
+        end
+        definition = RailsAiAdmin.operation_registry.fetch(resource, run.operation)
+        raise Blocked, "OPERATION_CHANGED" unless run.operation_version == Operations::RunnerFingerprint.call(resource, definition)
+        access = Authorization::Access.new(context, resource)
+        record = access.relation.find_by(resource.model_class.primary_key => run.record_id)
+        raise AccessDenied unless record
+        access.authorize_delivery!(run.operation, item.kind, record)
+        policy = RailsAiAdmin.work_registry.fetch(item.kind).handler_class.record_version_policy
+        raise Blocked, "RECORD_CHANGED" if policy == :exact && item.expected_version != RecordVersion.of(record)
+        # The admission TTL has been consumed. Delivery has its own deadline.
+        raise Blocked, "WORK_EXPIRED" unless item.deadline_at > Time.current
+        [ context, resource, record ]
+      end
+
+      def owned(item)
+        WorkItem.where(id: item.id, status: "running", lease_owner: item.lease_owner, generation: item.generation)
+      end
+
+      def finish(item, status, code)
+        changed = owned(item).where("lease_expires_at > ?", Time.current).update_all(status: status, last_code: code,
+          lease_owner: nil, lease_expires_at: nil, completed_at: Time.current, updated_at: Time.current)
+        changed.zero? ? fence_lost(item) : Result.new(item.id, status, code)
+      end
+
+      def fail_delivery(item, code, denied: false, reconcile: false)
+        return Result.new(nil, "missing", "NOT_FOUND") unless item.is_a?(WorkItem)
+        current = WorkItem.find(item.id)
+        unknown = current.effect_started_at.present?
+        definition = RailsAiAdmin.work_registry.fetch(item.kind)
+        terminal = if reconcile || (unknown && (denied || !definition.handler_class.idempotent))
+          "reconciliation_required"
+        elsif denied
+          "cancelled"
+        elsif current.attempts >= definition.handler_class.max_attempts
+          unknown ? "reconciliation_required" : "failed"
+        else
+          "pending"
+        end
+        if terminal == "pending"
+          changed = owned(item).where("lease_expires_at > ?", Time.current).update_all(status: terminal, last_code: code,
+            next_attempt_at: Time.current + [ 2**current.attempts, 300 ].min, lease_owner: nil, lease_expires_at: nil, updated_at: Time.current)
+          changed.zero? ? fence_lost(item) : Result.new(item.id, terminal, code)
+        else
+          finish(item, terminal, code)
+        end
+      end
+
+      def fence_lost(item)
+        return Result.new(nil, "missing", "NOT_FOUND") unless item.is_a?(WorkItem)
+        # Only this expired generation may become uncertain. Never overwrite a
+        # newer worker's pending/success state with a stale response.
+        owned(item).where("lease_expires_at <= ?", Time.current).where.not(effect_started_at: nil).update_all(
+          status: "reconciliation_required", last_code: "OUTCOME_UNKNOWN", completed_at: Time.current, updated_at: Time.current)
+        current = WorkItem.find_by(id: item.id)
+        Result.new(item.id, current&.status || "missing", "FENCED")
+      end
+    end
+  end
+end

data/lib/rails_ai_admin/outbox/registry.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module RailsAiAdmin
+  module Outbox
+    class Registry
+      Definition = Data.define(:kind, :handler_name) do
+        def handler_class
+          klass = handler_name.constantize
+          raise ConfigurationError, "Work handler must inherit RailsAiAdmin::Work" unless klass.is_a?(Class) && klass < Work
+          klass
+        end
+
+        def fingerprint
+          InputSchema.digest(handler: handler_name, version: handler_class.version, fields: handler_class.input.map(&:contract),
+            idempotent: handler_class.idempotent, lease: handler_class.lease_duration, attempts: handler_class.max_attempts,
+            max_age: handler_class.max_age, record_version: handler_class.record_version_policy)
+        end
+      end
+
+      def initialize(handlers)
+        @entries = handlers.to_h do |kind, name|
+          definition = Definition.new(kind.to_s, name)
+          definition.handler_class.validate!
+          [ kind.to_s, definition ]
+        end.freeze
+        freeze
+      end
+
+      def fetch(kind)
+        @entries.fetch(kind.to_s) { raise ConfigurationError, "Unregistered outbox work kind" }
+      end
+
+      def definitions = @entries.values
+    end
+  end
+end

data/lib/rails_ai_admin/outbox/request_digest.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module RailsAiAdmin
+  module Outbox
+    # Unlike typed input digests, request fingerprints have no type-marker domain.
+    # Accept only plain JSON data and reject keys that collide after normalization.
+    module RequestDigest
+      def self.call(request)
+        raise ConfigurationError, "Effect request must be an object" unless request.is_a?(Hash)
+        body = JSON.generate(normalize(request))
+        raise ConfigurationError, "Effect request exceeds 16384 bytes" if body.bytesize > 16_384
+        Digest::SHA256.hexdigest(body)
+      rescue JSON::GeneratorError
+        raise ConfigurationError, "Effect request must contain valid JSON data", cause: nil
+      end
+
+      def self.normalize(value, depth = 0)
+        raise ConfigurationError, "Effect request nesting is too deep" if depth > 8
+        case value
+        when Hash
+          normalized = {}
+          value.each do |key, entry|
+            unless key.is_a?(String) || key.is_a?(Symbol)
+              raise ConfigurationError, "Effect request keys must be strings or symbols"
+            end
+            name = key.to_s
+            raise ConfigurationError, "Effect request has duplicate normalized keys" if normalized.key?(name)
+            normalized[name] = normalize(entry, depth + 1)
+          end
+          normalized.sort.to_h
+        when Array then value.map { |entry| normalize(entry, depth + 1) }
+        when String, Integer, TrueClass, FalseClass, NilClass then value
+        when Float
+          raise ConfigurationError, "Effect request numbers must be finite" unless value.finite?
+          value
+        else
+          raise ConfigurationError, "Serialize typed values to plain JSON scalars before effect admission"
+        end
+      end
+    end
+  end
+end

data/lib/rails_ai_admin/outbox/writer.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module RailsAiAdmin
+  module Outbox
+    # Persists intent in Runner's transaction; never contacts a queue/provider.
+    class Writer
+      def initialize(context, run, resource)
+        @context, @run, @resource = context, run, resource
+      end
+
+      def enqueue(kind, key: kind, input: nil, **attributes)
+        unless OperationRun.connection.transaction_open? && @run.status == "running" && @run.actor_ref == @context.actor_ref && @run.tenant_ref == @context.tenant_ref
+          raise ConfigurationError, "Outbox enqueue requires the active operation transaction"
+        end
+        raise ConfigurationError, "Work key must be a bounded string" unless key.is_a?(String) && key.match?(/\A[a-zA-Z0-9][a-zA-Z0-9_.:-]{0,99}\z/)
+        raise ConfigurationError, "Use input or keyword attributes, not both" if input && attributes.any?
+        definition = RailsAiAdmin.work_registry.fetch(kind)
+        result = InputSchema.new(definition.handler_class.input).coerce(input || attributes, time_zone: @context.time_zone)
+        raise ConfigurationError, "Invalid outbox payload" unless result.valid?
+        payload = result.values.transform_values do |value|
+          case value
+          when BigDecimal then value.to_s("F")
+          when Time, ActiveSupport::TimeWithZone then value.utc.iso8601(6)
+          when Date then value.iso8601
+          else value
+          end
+        end
+        raise ConfigurationError, "Outbox payload exceeds 4096 bytes" if JSON.generate(payload).bytesize > 4096
+        digest = InputSchema.digest(result.values)
+        existing = WorkItem.find_by(operation_run_id: @run.id, work_key: key)
+        if existing
+          unless existing.kind == kind.to_s && existing.payload_digest == digest && existing.handler_version == definition.fingerprint
+            raise AccessDenied, "IDEMPOTENCY_CONFLICT"
+          end
+          return existing.id
+        end
+        WorkItem.create!(id: SecureRandom.uuid, operation_run_id: @run.id, work_key: key,
+          kind: kind.to_s, payload: payload, payload_digest: digest, handler_version: definition.fingerprint,
+          deadline_at: Time.current + definition.handler_class.max_age).id
+      end
+    end
+  end
+end

data/lib/rails_ai_admin/presentation/association_panel.rb

@@ -0,0 +1,90 @@
+# frozen_string_literal: true
+
+module RailsAiAdmin
+  module Presentation
+    # Builds readonly has_many panels for one parent record. Children come only
+    # from the child resource's current policy relation, narrowed by the child's
+    # own belongs_to column; nothing here writes or widens a grant.
+    module AssociationPanel
+      MAX_PANELS = 10
+      MAX_LIMIT = 50
+      NAME = /\A[a-z][a-z0-9_]*\z/
+      Row = Data.define(:id, :label, :linked)
+      # list_filter is the canonical list filter for "view all", present only
+      # while the child's reference field carries a current filter grant.
+      # list_params is the complete list state for that link: like the panel,
+      # it shows every child, not the child's default list tab (RAA-006).
+      # unscoped_list is true when the child has a granted default list tab.
+      # new_prefill is the prefill for the child's new form when the actor may
+      # create a child with a writable reference back to this record.
+      Panel = Data.define(:name, :label, :resource_key, :rows, :more, :list_filter, :unscoped_list, :single, :new_prefill) do
+        def list_params
+          return unless list_filter
+          unscoped_list ? { filter: list_filter, scope: Queries::NamedScope::NONE } : { filter: list_filter }
+        end
+      end
+
+      Definition = Data.define(:name, :resource, :explicit_via, :label, :limit, :single) do
+        def self.build(name, resource:, via:, label:, limit:, single: false)
+          names = [ name, resource ] + (via.nil? ? [] : [ via ])
+          unless names.all? { |value| (value.is_a?(Symbol) || value.is_a?(String)) && value.to_s.match?(NAME) && value.to_s.length <= 100 } &&
+              (label.nil? || label.is_a?(String) && label.valid_encoding? && label.length.between?(1, 80)) &&
+              limit.is_a?(Integer) && limit.between?(1, MAX_LIMIT)
+            raise ConfigurationError, "has_many needs stable names, an optional short plain label and a limit of 1..#{MAX_LIMIT}"
+          end
+          new(name.to_sym, resource.to_sym, via&.to_sym, label&.dup&.freeze, single ? 1 : limit, single)
+        end
+
+        # Defaults to the parent model's underscored name, as Rails does.
+        def via(parent) = explicit_via || parent.model.to_s.demodulize.underscore.to_sym
+        def caption = label || name.to_s.humanize
+      end
+
+      class << self
+        def build(context, parent, record)
+          parent.has_many_declarations.filter_map { |definition| panel(context, parent, record, definition) }
+        end
+
+        private
+
+        def panel(context, parent, record, definition)
+          child = RailsAiAdmin.registry.fetch(definition.resource)
+          access = Authorization::Access.new(context, child)
+          access.authorize!(:index)
+          field = child.fields.find { |candidate| candidate.name == definition.via(parent) }
+          target = Fields::Association.validate!(child, field)
+          unless target.model_class == parent.model_class
+            raise ConfigurationError, "has_many #{definition.name} must point back to the #{parent.key} model"
+          end
+          # Listing children by parent reveals each child's reference value.
+          return unless access.fields(:read, view: :index).include?(field)
+          model = child.model_class
+          records = access.relation.where(field.column => record.id)
+            .reorder(model.arel_table[model.primary_key].asc).limit(definition.limit + 1).to_a
+          rows = records.first(definition.limit).map do |child_record|
+            linked = begin
+              access.authorize!(:show, child_record)
+            rescue AccessDenied
+              false
+            end
+            Row.new(child_record.id.to_s.freeze, access.record_label(child_record, view: :index).freeze, linked)
+          end
+          filter = access.fields(:filter).include?(field) ? { field.name.to_s => { "eq" => record.id.to_s } }.freeze : nil
+          Panel.new(definition.name, definition.caption, child.key, rows.freeze, records.size > definition.limit, filter,
+            access.named_scopes.any?(&:default?), definition.single, creatable(access, field, record))
+        rescue AccessDenied
+          nil
+        end
+
+        def creatable(access, field, record)
+          child = access.relation.new
+          access.authorize!(:create, child)
+          return unless access.fields(:write, child, operation: :create).include?(field)
+          { field.name.to_s => record.id.to_s }.freeze
+        rescue AccessDenied
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/rails_ai_admin/presentation/audit_log.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+module RailsAiAdmin
+  module Presentation
+    # Recent audit events across the resources whose view_audit_log? grant
+    # this actor holds, for the current tenant only. Field names follow each
+    # resource's current read and write grants; the rest are counted.
+    class AuditLog
+      PAGE_SIZE = 50
+      STATUSES = %w[succeeded rejected].freeze
+      Entry = Data.define(:id, :at, :resource, :record_id, :operation, :status, :code, :origin, :actor_ref, :fields, :hidden_fields)
+      Page = Data.define(:entries, :older)
+      CURSOR = /\A[1-9][0-9]{0,18}\z/
+
+      attr_reader :resources
+
+      def initialize(context)
+        @context = context
+        @resources = RailsAiAdmin.registry.resources.select do |resource|
+          Authorization::Access.new(context, resource).authorize_audit_log!
+        rescue AccessDenied
+          false
+        end
+        raise AccessDenied if @resources.empty?
+      end
+
+      # Filters are exact values; unknown ones are an invalid query.
+      def page(resource: nil, operation: nil, status: nil, actor: nil, before: nil)
+        keys = @resources.map { |entry| entry.key.to_s }
+        valid = (resource.nil? || keys.include?(resource)) && (status.nil? || STATUSES.include?(status)) &&
+          (operation.nil? || operation.is_a?(String) && operation.match?(/\A[a-z][a-z0-9_]{0,63}\z/)) &&
+          (actor.nil? || actor.is_a?(String) && actor.bytesize <= 150 && !actor.match?(/[[:cntrl:]]/)) &&
+          (before.nil? || before.is_a?(String) && before.match?(CURSOR))
+        raise AccessDenied, "INVALID_QUERY" unless valid
+        scope = AuditEvent.where(tenant_ref: @context.tenant_ref, resource_key: resource || keys)
+        scope = scope.where(operation: operation) if operation
+        scope = scope.where(status: status) if status
+        scope = scope.where(actor_ref: actor) if actor
+        scope = scope.where(AuditEvent.arel_table[:id].lt(Integer(before, 10))) if before
+        events = scope.order(id: :desc).limit(PAGE_SIZE + 1).to_a
+        by_key = @resources.index_by { |entry| entry.key.to_s }
+        labels = Hash.new { |hash, key| hash[key] = visible_labels(by_key.fetch(key)) }
+        entries = events.first(PAGE_SIZE).map do |event|
+          names = Array(event.changed_fields).grep(String)
+          shown = names.filter_map { |name| labels[event.resource_key][name] }
+          Entry.new(event.id, event.created_at, by_key.fetch(event.resource_key), event.record_id, event.operation, event.status,
+            event.code, event.origin, event.actor_ref, shown.freeze, names.size - shown.size)
+        end
+        Page.new(entries.freeze, events.size > PAGE_SIZE ? entries.last.id : nil)
+      end
+
+      private
+
+      def visible_labels(resource)
+        access = Authorization::Access.new(@context, resource)
+        fields = access.fields(:read) | access.fields(:write, operation: :update)
+        fields.to_h { |field| [ field.name.to_s, field.label ] }
+      rescue AccessDenied
+        {}
+      end
+    end
+  end
+end

data/lib/rails_ai_admin/presentation/csv_export.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+module RailsAiAdmin
+  module Presentation
+    # The current list (search, list tab, filters and sort) as CSV, through
+    # the same grants as the pages: rows from the index relation and each
+    # record's show grant, columns and values from its read grant.
+    class CsvExport
+      BATCH = 500
+      # A spreadsheet runs a cell that starts with these as a formula
+      # (CSV injection); such cells get a leading apostrophe.
+      FORMULA = /\A[=+\-@\t\r]/
+      # Number and time text is produced by coercion and cannot be a formula.
+      NUMERIC = %i[integer decimal date datetime time].freeze
+      Result = Data.define(:body, :rows, :fields, :too_many)
+
+      def initialize(context, resource, limit: RailsAiAdmin.configuration.export_limit)
+        @context, @resource, @limit = context, resource, limit
+        @access = Authorization::Access.new(context, resource)
+      end
+
+      def call(search: nil, sort: nil, direction: "asc", scope: nil, filters: nil)
+        @access.authorize_export!
+        relation = Queries::List.new(@context, @resource).relation(search: search, sort: sort, direction: direction, scope: scope, filters: filters)
+        return Result.new(nil, 0, [], true) if relation.except(:order).limit(@limit + 1).count > @limit
+        fields = @access.fields(:read, nil, view: :show)
+        references = Fields::Association.new(@context, @resource)
+        lines = [ line(fields.map(&:label)) ]
+        # One query per list field and batch instead of one per row.
+        lists = fields.select { |field| field.scalar_type == :references }.map(&:name)
+        relation = relation.preload(*lists) if lists.any?
+        rows = 0
+        offset = 0
+        loop do
+          records = relation.offset(offset).limit(BATCH).to_a
+          break if records.empty?
+          offset += records.size
+          fields.select { |field| field.scalar_type == :belongs_to }.each do |field|
+            references.prime(field, records.filter_map { |record| record.has_attribute?(field.column) ? record.read_attribute(field.column)&.to_s : nil })
+          end
+          records.each do |record|
+            values = @access.project(record, view: :show)
+            lines << line(fields.map { |field| values.key?(field.name.to_s) ? cell(field, values[field.name.to_s], references) : "" })
+            rows += 1
+          rescue AccessDenied
+            # Left out like an unavailable row on the list page (RAA-001).
+            next
+          end
+          break if records.size < BATCH || offset >= @limit
+        end
+        # The byte order mark lets spreadsheet programs read UTF-8.
+        Result.new("#{lines.join}", rows, fields.map { |field| field.name.to_s }, false)
+      end
+
+      private
+
+      def cell(field, value, references)
+        return "" if value.nil?
+        text = if field.plugin?
+          field.format(value, time_zone: @context.time_zone)
+        else
+          case field.scalar_type
+          when :date then value.iso8601
+          when :datetime then value.in_time_zone(@context.time_zone).iso8601
+          when :decimal then field.format_decimal(value)
+          when :json then JSON.generate(value)
+          when :file then value.filename
+          when :files then Array(value).map(&:filename).join("; ")
+          when :references
+            references.prime(field, Array(value))
+            Array(value).map { |id| references.reference(field, id).label.to_s }.join("; ")
+          when :belongs_to then references.reference(field, value.to_s).label.to_s
+          else field.format(value, time_zone: @context.time_zone)
+          end
+        end
+        text = text.to_s
+        !NUMERIC.include?(field.scalar_type) && text.match?(FORMULA) ? "'#{text}" : text
+      end
+
+      def line(cells)
+        "#{cells.map { |cell| %("#{cell.to_s.gsub('"', '""')}") }.join(',')}\r\n"
+      end
+    end
+  end
+end