ransack 2.3.0 → 4.1.0

data/lib/polyamorous/activerecord_6.1_ruby_2/join_association.rb

@@ -0,0 +1,70 @@
+module Polyamorous
+  module JoinAssociationExtensions
+    include SwappingReflectionClass
+    def self.prepended(base)
+      base.class_eval { attr_reader :join_type }
+    end
+
+    def initialize(reflection, children, polymorphic_class = nil, join_type = Arel::Nodes::InnerJoin)
+      @join_type = join_type
+      if polymorphic_class && ::ActiveRecord::Base > polymorphic_class
+        swapping_reflection_klass(reflection, polymorphic_class) do |reflection|
+          super(reflection, children)
+          self.reflection.options[:polymorphic] = true
+        end
+      else
+        super(reflection, children)
+      end
+    end
+
+    # Same as #join_constraints, but instead of constructing tables from the
+    # given block, uses the ones passed
+    def join_constraints_with_tables(foreign_table, foreign_klass, join_type, alias_tracker, tables)
+      joins = []
+      chain = []
+
+      reflection.chain.each.with_index do |reflection, i|
+        table = tables[i]
+
+        @table ||= table
+        chain << [reflection, table]
+      end
+
+      # The chain starts with the target table, but we want to end with it here (makes
+      # more sense in this context), so we reverse
+      chain.reverse_each do |reflection, table|
+        klass = reflection.klass
+
+        join_scope = reflection.join_scope(table, foreign_table, foreign_klass)
+
+        unless join_scope.references_values.empty?
+          join_dependency = join_scope.construct_join_dependency(
+            join_scope.eager_load_values | join_scope.includes_values, Arel::Nodes::OuterJoin
+          )
+          join_scope.joins!(join_dependency)
+        end
+
+        arel = join_scope.arel(alias_tracker.aliases)
+        nodes = arel.constraints.first
+
+        if nodes.is_a?(Arel::Nodes::And)
+          others = nodes.children.extract! do |node|
+            !Arel.fetch_attribute(node) { |attr| attr.relation.name == table.name }
+          end
+        end
+
+        joins << table.create_join(table, table.create_on(nodes), join_type)
+
+        if others && !others.empty?
+          joins.concat arel.join_sources
+          append_constraints(joins.last, others)
+        end
+
+        # The current table in this iteration becomes the foreign table in the next
+        foreign_table, foreign_klass = table, klass
+      end
+
+      joins
+    end
+  end
+end

data/{polyamorous/lib/polyamorous/activerecord_6.0_ruby_2 → lib/polyamorous/activerecord_6.1_ruby_2}/join_dependency.rb

@@ -1,5 +1,3 @@
-# active_record_6.0_ruby_2/join_dependency.rb
-
 module Polyamorous
   module JoinDependencyExtensions
     # Replaces ActiveRecord::Associations::JoinDependency#build
@@ -29,14 +27,18 @@ module Polyamorous
       end
     end
 
-    def join_constraints(joins_to_add, alias_tracker)
+    def join_constraints(joins_to_add, alias_tracker, references)
       @alias_tracker = alias_tracker
+      @joined_tables = {}
+      @references = {}
+
+      references.each do |table_name|
+        @references[table_name.to_sym] = table_name if table_name.is_a?(String)
+      end
 
-      construct_tables!(join_root)
       joins = make_join_constraints(join_root, join_type)
 
       joins.concat joins_to_add.flat_map { |oj|
-        construct_tables!(oj.join_root)
         if join_root.match?(oj.join_root) && join_root.table.name == oj.join_root.table.name
           walk join_root, oj.join_root, oj.join_type
         else
@@ -45,14 +47,33 @@ module Polyamorous
       }
     end
 
+    def construct_tables_for_association!(join_root, association)
+      tables = table_aliases_for(join_root, association)
+      association.table = tables.first
+      tables
+    end
+
     private
-      def make_constraints(parent, child, join_type = Arel::Nodes::OuterJoin)
-        foreign_table = parent.table
-        foreign_klass = parent.base_klass
-        join_type = child.join_type || join_type if join_type == Arel::Nodes::InnerJoin
-        joins = child.join_constraints(foreign_table, foreign_klass, join_type, alias_tracker)
-        joins.concat child.children.flat_map { |c| make_constraints(child, c, join_type) }
-      end
+
+    def table_aliases_for(parent, node)
+      @joined_tables ||= {}
+      node.reflection.chain.map { |reflection|
+        table, terminated = @joined_tables[reflection]
+        root = reflection == node.reflection
+
+        if table && (!root || !terminated)
+          @joined_tables[reflection] = [table, true] if root
+          table
+        else
+          table = alias_tracker.aliased_table_for(reflection.klass.arel_table) do
+            name = reflection.alias_candidate(parent.table_name)
+            root ? name : "#{name}_join"
+          end
+          @joined_tables[reflection] ||= [table, root] if join_type == Arel::Nodes::OuterJoin
+          table
+        end
+      }
+    end
 
     module ClassMethods
       # Prepended before ActiveRecord::Associations::JoinDependency#walk_tree

data/lib/polyamorous/activerecord_6.1_ruby_2/reflection.rb

@@ -0,0 +1,11 @@
+module Polyamorous
+  module ReflectionExtensions
+    def join_scope(table, foreign_table, foreign_klass)
+     if respond_to?(:polymorphic?) && polymorphic?
+        super.where!(foreign_table[foreign_type].eq(klass.name))
+      else
+        super
+      end
+    end
+  end
+end

data/lib/polyamorous/activerecord_7.0_ruby_2/join_association.rb

@@ -0,0 +1 @@
+require 'polyamorous/activerecord_6.1_ruby_2/join_association'

data/lib/polyamorous/activerecord_7.0_ruby_2/join_dependency.rb

@@ -0,0 +1 @@
+require 'polyamorous/activerecord_6.1_ruby_2/join_dependency'

data/lib/polyamorous/activerecord_7.0_ruby_2/reflection.rb

@@ -0,0 +1 @@
+require 'polyamorous/activerecord_6.1_ruby_2/reflection'

data/lib/polyamorous/activerecord_7.1_ruby_2/join_association.rb

@@ -0,0 +1 @@
+require 'polyamorous/activerecord_6.1_ruby_2/join_association'

data/lib/polyamorous/activerecord_7.1_ruby_2/join_dependency.rb

@@ -0,0 +1 @@
+require 'polyamorous/activerecord_6.1_ruby_2/join_dependency'

data/lib/polyamorous/activerecord_7.1_ruby_2/reflection.rb

@@ -0,0 +1 @@
+require 'polyamorous/activerecord_6.1_ruby_2/reflection'

data/{polyamorous/lib → lib/polyamorous}/polyamorous.rb

@@ -11,17 +11,12 @@ if defined?(::ActiveRecord)
   require 'polyamorous/join'
   require 'polyamorous/swapping_reflection_class'
 
-  ar_version = ::ActiveRecord::VERSION::STRING[0,3]
-  ar_version = ::ActiveRecord::VERSION::STRING[0,5] if ar_version >= "5.2" && ::ActiveRecord.version < ::Gem::Version.new("6.0")
-  ar_version = "5.2.1" if ::ActiveRecord::VERSION::STRING >= "5.2.1" && ::ActiveRecord.version < ::Gem::Version.new("6.0")
-  %w(join_association join_dependency).each do |file|
+  ar_version = ::ActiveRecord::VERSION::STRING[0, 3]
+  %w(join_association join_dependency reflection).each do |file|
     require "polyamorous/activerecord_#{ar_version}_ruby_2/#{file}"
   end
 
-  if ar_version >= "5.2.0"
-    require "polyamorous/activerecord_#{ar_version}_ruby_2/reflection.rb"
-    ::ActiveRecord::Reflection::AbstractReflection.send(:prepend, Polyamorous::ReflectionExtensions)
-  end
+  ActiveRecord::Reflection::AbstractReflection.send(:prepend, Polyamorous::ReflectionExtensions)
 
   Polyamorous::JoinDependency.send(:prepend, Polyamorous::JoinDependencyExtensions)
   Polyamorous::JoinDependency.singleton_class.send(:prepend, Polyamorous::JoinDependencyExtensions::ClassMethods)

data/lib/ransack/adapters/active_record/base.rb

@@ -4,7 +4,6 @@ module Ransack
       module Base
 
         def self.extended(base)
-          alias :search :ransack unless base.respond_to? :search
           base.class_eval do
             class_attribute :_ransackers
             class_attribute :_ransack_aliases
@@ -14,10 +13,13 @@ module Ransack
         end
 
         def ransack(params = {}, options = {})
-          ActiveSupport::Deprecation.warn("#search is deprecated and will be removed in 2.3, please use #ransack instead") if __callee__ == :search
           Search.new(self, params, options)
         end
 
+        def ransack!(params = {}, options = {})
+          ransack(params, options.merge(ignore_unknown_conditions: false))
+        end
+
         def ransacker(name, opts = {}, &block)
           self._ransackers = _ransackers.merge name.to_s => Ransacker
             .new(self, name, opts, &block)
@@ -33,12 +35,7 @@ module Ransack
         # For overriding with a whitelist array of strings.
         #
         def ransackable_attributes(auth_object = nil)
-          @ransackable_attributes ||= if Ransack::SUPPORTS_ATTRIBUTE_ALIAS
-            column_names + _ransackers.keys + _ransack_aliases.keys +
-            attribute_aliases.keys
-          else
-            column_names + _ransackers.keys + _ransack_aliases.keys
-          end
+          @ransackable_attributes ||= deprecated_ransackable_list(:ransackable_attributes)
         end
 
         # Ransackable_associations, by default, returns the names
@@ -46,7 +43,7 @@ module Ransack
         # For overriding with a whitelist array of strings.
         #
         def ransackable_associations(auth_object = nil)
-          @ransackable_associations ||= reflect_on_all_associations.map { |a| a.name.to_s }
+          @ransackable_associations ||= deprecated_ransackable_list(:ransackable_associations)
         end
 
         # Ransortable_attributes, by default, returns the names
@@ -66,13 +63,89 @@ module Ransack
         end
 
         # ransack_scope_skip_sanitize_args, by default, returns an empty array.
-        # i.e. use the sanitize_scope_args setting to determin if args should be converted.
+        # i.e. use the sanitize_scope_args setting to determine if args should be converted.
         # For overriding with a list of scopes which should be passed the args as-is.
         #
         def ransackable_scopes_skip_sanitize_args
           []
         end
 
+        # Bare list of all potentially searchable attributes. Searchable attributes
+        # need to be explicitly allowlisted through the `ransackable_attributes`
+        # method in each model, but if you're allowing almost everything to be
+        # searched, this list can be used as a base for exclusions.
+        #
+        def authorizable_ransackable_attributes
+          if Ransack::SUPPORTS_ATTRIBUTE_ALIAS
+            column_names + _ransackers.keys + _ransack_aliases.keys +
+            attribute_aliases.keys
+          else
+            column_names + _ransackers.keys + _ransack_aliases.keys
+          end.uniq
+        end
+
+        # Bare list of all potentially searchable associations. Searchable
+        # associations need to be explicitly allowlisted through the
+        # `ransackable_associations` method in each model, but if you're
+        # allowing almost everything to be searched, this list can be used as a
+        # base for exclusions.
+        #
+        def authorizable_ransackable_associations
+          reflect_on_all_associations.map { |a| a.name.to_s }
+        end
+
+        private
+
+        def deprecated_ransackable_list(method)
+          list_type = method.to_s.delete_prefix("ransackable_")
+
+          if explicitly_defined?(method)
+            warn_deprecated <<~ERROR
+              Ransack's builtin `#{method}` method is deprecated and will result
+              in an error in the future. If you want to authorize the full list
+              of searchable #{list_type} for this model, use
+              `authorizable_#{method}` instead of delegating to `super`.
+            ERROR
+
+            public_send("authorizable_#{method}")
+          else
+            raise <<~MESSAGE
+              Ransack needs #{name} #{list_type} explicitly allowlisted as
+              searchable. Define a `#{method}` class method in your `#{name}`
+              model, watching out for items you DON'T want searchable (for
+              example, `encrypted_password`, `password_reset_token`, `owner` or
+              other sensitive information). You can use the following as a base:
+
+              ```ruby
+              class #{name} < ApplicationRecord
+
+                # ...
+
+                def self.#{method}(auth_object = nil)
+                  #{public_send("authorizable_#{method}").sort.inspect}
+                end
+
+                # ...
+
+              end
+              ```
+            MESSAGE
+          end
+        end
+
+        def explicitly_defined?(method)
+          definer_ancestor = singleton_class.ancestors.find do |ancestor|
+            ancestor.instance_methods(false).include?(method)
+          end
+
+          definer_ancestor != Ransack::Adapters::ActiveRecord::Base
+        end
+
+        def warn_deprecated(message)
+          caller_location = caller_locations.find { |location| !location.path.start_with?(File.expand_path("../..", __dir__)) }
+
+          warn "DEPRECATION WARNING: #{message.squish} (called at #{caller_location.path}:#{caller_location.lineno})"
+        end
       end
     end
   end

data/lib/ransack/adapters/active_record/context.rb

@@ -1,26 +1,20 @@
 require 'ransack/context'
-require 'polyamorous'
+require 'polyamorous/polyamorous'
 
 module Ransack
   module Adapters
     module ActiveRecord
       class Context < ::Ransack::Context
 
-        def initialize(object, options = {})
-          super
-          if ::ActiveRecord::VERSION::STRING < Constants::RAILS_5_2
-            @arel_visitor = @engine.connection.visitor
-          end
-        end
-
         def relation_for(object)
           object.all
         end
 
         def type_for(attr)
           return nil unless attr && attr.valid?
+          relation     = attr.arel_attribute.relation
           name         = attr.arel_attribute.name.to_s
-          table        = attr.arel_attribute.relation.table_name
+          table        = relation.respond_to?(:table_name) ? relation.table_name : relation.name
           schema_cache = self.klass.connection.schema_cache
           unless schema_cache.send(:data_source_exists?, table)
             raise "No table named #{table} exists."
@@ -49,6 +43,17 @@ module Ransack
               if scope_or_sort.is_a?(Symbol)
                 relation = relation.send(scope_or_sort)
               else
+                case Ransack.options[:postgres_fields_sort_option]
+                when :nulls_first
+                  scope_or_sort = scope_or_sort.direction == :asc ? Arel.sql("#{scope_or_sort.to_sql} NULLS FIRST") : Arel.sql("#{scope_or_sort.to_sql} NULLS LAST")
+                when :nulls_last
+                  scope_or_sort = scope_or_sort.direction == :asc ? Arel.sql("#{scope_or_sort.to_sql} NULLS LAST") : Arel.sql("#{scope_or_sort.to_sql} NULLS FIRST")
+                when :nulls_always_first
+                  scope_or_sort = Arel.sql("#{scope_or_sort.to_sql} NULLS FIRST")
+                when :nulls_always_last
+                  scope_or_sort = Arel.sql("#{scope_or_sort.to_sql} NULLS LAST")
+                end
+
                 relation = relation.order(scope_or_sort)
               end
             end
@@ -104,26 +109,15 @@ module Ransack
         # JoinDependency to track table aliases.
         #
         def join_sources
-          base, joins =
-          if ::ActiveRecord::VERSION::STRING > Constants::RAILS_5_2_0
+          base, joins = begin
             alias_tracker = ::ActiveRecord::Associations::AliasTracker.create(self.klass.connection, @object.table.name, [])
-            constraints   = if ::Gem::Version.new(::ActiveRecord::VERSION::STRING) >= ::Gem::Version.new(Constants::RAILS_6_0)
-              @join_dependency.join_constraints(@object.joins_values, alias_tracker)
-            else
-              @join_dependency.join_constraints(@object.joins_values, @join_type, alias_tracker)
-            end
+            constraints   = @join_dependency.join_constraints(@object.joins_values, alias_tracker, @object.references_values)
 
             [
               Arel::SelectManager.new(@object.table),
               constraints
             ]
-          else
-            [
-              Arel::SelectManager.new(@object.table),
-              @join_dependency.join_constraints(@object.joins_values, @join_type)
-            ]
           end
-          joins = joins.collect(&:joins).flatten if ::ActiveRecord::VERSION::STRING < Constants::RAILS_5_2
           joins.each do |aliased_join|
             base.from(aliased_join)
           end
@@ -144,6 +138,7 @@ module Ransack
             stashed.eql?(association)
           }
           @object.joins_values.delete_if { |jd|
+            jd.instance_variables.include?(:@join_root) &&
             jd.instance_variable_get(:@join_root).children.map(&:object_id) == [association.object_id]
           }
         end
@@ -186,16 +181,31 @@ module Ransack
         private
 
         def extract_correlated_key(join_root)
-          correlated_key = join_root.right.expr.left
-
-          if correlated_key.is_a? Arel::Nodes::And
-            correlated_key = correlated_key.left.left
-          elsif correlated_key.is_a? Arel::Nodes::Equality
-            correlated_key = correlated_key.left
-          elsif correlated_key.is_a? Arel::Nodes::Grouping
-            correlated_key = join_root.right.expr.right.left
+          case join_root
+          when Arel::Nodes::OuterJoin
+            # one of join_root.right/join_root.left is expected to be Arel::Nodes::On
+            if join_root.right.is_a?(Arel::Nodes::On)
+              extract_correlated_key(join_root.right.expr)
+            elsif join_root.left.is_a?(Arel::Nodes::On)
+              extract_correlated_key(join_root.left.expr)
+            else
+              raise 'Ransack encountered an unexpected arel structure'
+            end
+          when Arel::Nodes::Equality
+            pk = primary_key
+            if join_root.left == pk
+              join_root.right
+            elsif join_root.right == pk
+              join_root.left
+            else
+              nil
+            end
+          when Arel::Nodes::And
+            extract_correlated_key(join_root.left) || extract_correlated_key(join_root.right)
           else
-            correlated_key
+            # eg parent was Arel::Nodes::And and the evaluated side was one of
+            # Arel::Nodes::Grouping or MultiTenant::TenantEnforcementClause
+            nil
           end
         end
 
@@ -268,28 +278,11 @@ module Ransack
 
           join_list = join_nodes + convert_join_strings_to_ast(relation.table, string_joins)
 
-          if ::ActiveRecord::VERSION::STRING < Constants::RAILS_5_2_0
-            join_dependency = Polyamorous::JoinDependency.new(relation.klass, association_joins, join_list)
-            join_nodes.each do |join|
-              join_dependency.send(:alias_tracker).aliases[join.left.name.downcase] = 1
-            end
-          elsif ::ActiveRecord::VERSION::STRING == Constants::RAILS_5_2_0
-            alias_tracker = ::ActiveRecord::Associations::AliasTracker.create(self.klass.connection, relation.table.name, join_list)
-            join_dependency = Polyamorous::JoinDependency.new(relation.klass, relation.table, association_joins, alias_tracker)
-            join_nodes.each do |join|
-              join_dependency.send(:alias_tracker).aliases[join.left.name.downcase] = 1
-            end
-          else
-            alias_tracker = ::ActiveRecord::Associations::AliasTracker.create(self.klass.connection, relation.table.name, join_list)
-            join_dependency = if ::Gem::Version.new(::ActiveRecord::VERSION::STRING) >= ::Gem::Version.new(Constants::RAILS_6_0)
-              Polyamorous::JoinDependency.new(relation.klass, relation.table, association_joins, Arel::Nodes::OuterJoin)
-            else
-              Polyamorous::JoinDependency.new(relation.klass, relation.table, association_joins)
-            end
-            join_dependency.instance_variable_set(:@alias_tracker, alias_tracker)
-            join_nodes.each do |join|
-              join_dependency.send(:alias_tracker).aliases[join.left.name.downcase] = 1
-            end
+          alias_tracker = ::ActiveRecord::Associations::AliasTracker.create(self.klass.connection, relation.table.name, join_list)
+          join_dependency = Polyamorous::JoinDependency.new(relation.klass, relation.table, association_joins, Arel::Nodes::OuterJoin)
+          join_dependency.instance_variable_set(:@alias_tracker, alias_tracker)
+          join_nodes.each do |join|
+            join_dependency.send(:alias_tracker).aliases[join.left.name.downcase] = 1
           end
           join_dependency
         end
@@ -313,38 +306,13 @@ module Ransack
         end
 
         def build_association(name, parent = @base, klass = nil)
-          if ::Gem::Version.new(::ActiveRecord::VERSION::STRING) >= ::Gem::Version.new(Constants::RAILS_6_0)
-            jd = Polyamorous::JoinDependency.new(
-              parent.base_klass,
-              parent.table,
-              Polyamorous::Join.new(name, @join_type, klass),
-              @join_type
-            )
-            found_association = jd.instance_variable_get(:@join_root).children.last
-          elsif ::Gem::Version.new(::ActiveRecord::VERSION::STRING) < ::Gem::Version.new(Constants::RAILS_5_2_0)
-            jd = Polyamorous::JoinDependency.new(
-              parent.base_klass,
-              Polyamorous::Join.new(name, @join_type, klass),
-              []
-            )
-            found_association = jd.join_root.children.last
-          elsif ::ActiveRecord::VERSION::STRING == Constants::RAILS_5_2_0
-            alias_tracker = ::ActiveRecord::Associations::AliasTracker.create(self.klass.connection, parent.table.name, [])
-            jd = Polyamorous::JoinDependency.new(
-              parent.base_klass,
-              parent.table,
-              Polyamorous::Join.new(name, @join_type, klass),
-              alias_tracker
-            )
-            found_association = jd.instance_variable_get(:@join_root).children.last
-          else
-            jd = Polyamorous::JoinDependency.new(
-              parent.base_klass,
-              parent.table,
-              Polyamorous::Join.new(name, @join_type, klass)
-            )
-            found_association = jd.instance_variable_get(:@join_root).children.last
-          end
+          jd = Polyamorous::JoinDependency.new(
+            parent.base_klass,
+            parent.table,
+            Polyamorous::Join.new(name, @join_type, klass),
+            @join_type
+          )
+          found_association = jd.instance_variable_get(:@join_root).children.last
 
           @associations_pot[found_association] = parent
 
@@ -353,11 +321,7 @@ module Ransack
           @join_dependency.instance_variable_get(:@join_root).children.push found_association
 
           # Builds the arel nodes properly for this association
-          if ::ActiveRecord::VERSION::STRING > Constants::RAILS_5_2_0
-            @join_dependency.send(:construct_tables!, jd.instance_variable_get(:@join_root))
-          else
-            @join_dependency.send(:construct_tables!, jd.instance_variable_get(:@join_root), found_association)
-          end
+          @tables_pot[found_association] = @join_dependency.construct_tables_for_association!(jd.instance_variable_get(:@join_root), found_association)
 
           # Leverage the stashed association functionality in AR
           @object = @object.joins(jd)
@@ -367,32 +331,13 @@ module Ransack
         def extract_joins(association)
           parent = @join_dependency.instance_variable_get(:@join_root)
           reflection = association.reflection
-          join_constraints = if ::ActiveRecord::VERSION::STRING < Constants::RAILS_5_1
-                               association.join_constraints(
-                                 parent.table,
-                                 parent.base_klass,
-                                 association,
-                                 Arel::Nodes::OuterJoin,
-                                 association.tables,
-                                 reflection.scope_chain,
-                                 reflection.chain
-                               )
-                             elsif ::ActiveRecord::VERSION::STRING <= Constants::RAILS_5_2_0
-                               association.join_constraints(
-                                 parent.table,
-                                 parent.base_klass,
-                                 Arel::Nodes::OuterJoin,
-                                 association.tables,
-                                 reflection.chain
-                               )
-                             else
-                               association.join_constraints(
-                                 parent.table,
-                                 parent.base_klass,
-                                 Arel::Nodes::OuterJoin,
-                                 @join_dependency.instance_variable_get(:@alias_tracker)
-                               )
-                             end
+          join_constraints = association.join_constraints_with_tables(
+                               parent.table,
+                               parent.base_klass,
+                               Arel::Nodes::OuterJoin,
+                               @join_dependency.instance_variable_get(:@alias_tracker),
+                               @tables_pot[association]
+                             )
           join_constraints.to_a.flatten
         end
       end