ransack 3.0.0 → 4.0.0

data/lib/polyamorous/activerecord_6.1_ruby_2/reflection.rb

@@ -1 +1,11 @@
-require 'polyamorous/activerecord_6.0_ruby_2/reflection'
+module Polyamorous
+  module ReflectionExtensions
+    def join_scope(table, foreign_table, foreign_klass)
+     if respond_to?(:polymorphic?) && polymorphic?
+        super.where!(foreign_table[foreign_type].eq(klass.name))
+      else
+        super
+      end
+    end
+  end
+end

data/lib/polyamorous/activerecord_7.1_ruby_2/join_association.rb

@@ -0,0 +1 @@
+require 'polyamorous/activerecord_6.1_ruby_2/join_association'

data/lib/polyamorous/activerecord_7.1_ruby_2/join_dependency.rb

@@ -0,0 +1 @@
+require 'polyamorous/activerecord_6.1_ruby_2/join_dependency'

data/lib/polyamorous/activerecord_7.1_ruby_2/reflection.rb

@@ -0,0 +1 @@
+require 'polyamorous/activerecord_6.1_ruby_2/reflection'

data/lib/ransack/adapters/active_record/base.rb

@@ -35,12 +35,7 @@ module Ransack
         # For overriding with a whitelist array of strings.
         #
         def ransackable_attributes(auth_object = nil)
-          @ransackable_attributes ||= if Ransack::SUPPORTS_ATTRIBUTE_ALIAS
-            column_names + _ransackers.keys + _ransack_aliases.keys +
-            attribute_aliases.keys
-          else
-            column_names + _ransackers.keys + _ransack_aliases.keys
-          end
+          @ransackable_attributes ||= deprecated_ransackable_list(:ransackable_attributes)
         end
 
         # Ransackable_associations, by default, returns the names
@@ -48,7 +43,7 @@ module Ransack
         # For overriding with a whitelist array of strings.
         #
         def ransackable_associations(auth_object = nil)
-          @ransackable_associations ||= reflect_on_all_associations.map { |a| a.name.to_s }
+          @ransackable_associations ||= deprecated_ransackable_list(:ransackable_associations)
         end
 
         # Ransortable_attributes, by default, returns the names
@@ -75,6 +70,82 @@ module Ransack
           []
         end
 
+        # Bare list of all potentially searchable attributes. Searchable attributes
+        # need to be explicitly allowlisted through the `ransackable_attributes`
+        # method in each model, but if you're allowing almost everything to be
+        # searched, this list can be used as a base for exclusions.
+        #
+        def authorizable_ransackable_attributes
+          if Ransack::SUPPORTS_ATTRIBUTE_ALIAS
+            column_names + _ransackers.keys + _ransack_aliases.keys +
+            attribute_aliases.keys
+          else
+            column_names + _ransackers.keys + _ransack_aliases.keys
+          end.uniq
+        end
+
+        # Bare list of all potentially searchable associations. Searchable
+        # associations need to be explicitly allowlisted through the
+        # `ransackable_associations` method in each model, but if you're
+        # allowing almost everything to be searched, this list can be used as a
+        # base for exclusions.
+        #
+        def authorizable_ransackable_associations
+          reflect_on_all_associations.map { |a| a.name.to_s }
+        end
+
+        private
+
+        def deprecated_ransackable_list(method)
+          list_type = method.to_s.delete_prefix("ransackable_")
+
+          if explicitly_defined?(method)
+            warn_deprecated <<~ERROR
+              Ransack's builtin `#{method}` method is deprecated and will result
+              in an error in the future. If you want to authorize the full list
+              of searchable #{list_type} for this model, use
+              `authorizable_#{method}` instead of delegating to `super`.
+            ERROR
+
+            public_send("authorizable_#{method}")
+          else
+            raise <<~MESSAGE
+              Ransack needs #{name} #{list_type} explicitly allowlisted as
+              searchable. Define a `#{method}` class method in your `#{name}`
+              model, watching out for items you DON'T want searchable (for
+              example, `encrypted_password`, `password_reset_token`, `owner` or
+              other sensitive information). You can use the following as a base:
+
+              ```ruby
+              class #{name} < ApplicationRecord
+
+                # ...
+
+                def self.#{method}(auth_object = nil)
+                  #{public_send("authorizable_#{method}").sort.inspect}
+                end
+
+                # ...
+
+              end
+              ```
+            MESSAGE
+          end
+        end
+
+        def explicitly_defined?(method)
+          definer_ancestor = singleton_class.ancestors.find do |ancestor|
+            ancestor.instance_methods(false).include?(method)
+          end
+
+          definer_ancestor != Ransack::Adapters::ActiveRecord::Base
+        end
+
+        def warn_deprecated(message)
+          caller_location = caller_locations.find { |location| !location.path.start_with?(File.expand_path("../..", __dir__)) }
+
+          warn "DEPRECATION WARNING: #{message.squish} (called at #{caller_location.path}:#{caller_location.lineno})"
+        end
       end
     end
   end

data/lib/ransack/adapters/active_record/context.rb

@@ -110,13 +110,7 @@ module Ransack
         def join_sources
           base, joins = begin
             alias_tracker = ::ActiveRecord::Associations::AliasTracker.create(self.klass.connection, @object.table.name, [])
-            constraints   = if ::Gem::Version.new(::ActiveRecord::VERSION::STRING) >= ::Gem::Version.new(Constants::RAILS_6_1)
-              @join_dependency.join_constraints(@object.joins_values, alias_tracker, @object.references_values)
-            elsif ::Gem::Version.new(::ActiveRecord::VERSION::STRING) >= ::Gem::Version.new(Constants::RAILS_6_0)
-              @join_dependency.join_constraints(@object.joins_values, alias_tracker)
-            else
-              @join_dependency.join_constraints(@object.joins_values, @join_type, alias_tracker)
-            end
+            constraints   = @join_dependency.join_constraints(@object.joins_values, alias_tracker, @object.references_values)
 
             [
               Arel::SelectManager.new(@object.table),
@@ -284,11 +278,7 @@ module Ransack
           join_list = join_nodes + convert_join_strings_to_ast(relation.table, string_joins)
 
           alias_tracker = ::ActiveRecord::Associations::AliasTracker.create(self.klass.connection, relation.table.name, join_list)
-          join_dependency = if ::Gem::Version.new(::ActiveRecord::VERSION::STRING) >= ::Gem::Version.new(Constants::RAILS_6_0)
-            Polyamorous::JoinDependency.new(relation.klass, relation.table, association_joins, Arel::Nodes::OuterJoin)
-          else
-            Polyamorous::JoinDependency.new(relation.klass, relation.table, association_joins)
-          end
+          join_dependency = Polyamorous::JoinDependency.new(relation.klass, relation.table, association_joins, Arel::Nodes::OuterJoin)
           join_dependency.instance_variable_set(:@alias_tracker, alias_tracker)
           join_nodes.each do |join|
             join_dependency.send(:alias_tracker).aliases[join.left.name.downcase] = 1
@@ -315,22 +305,13 @@ module Ransack
         end
 
         def build_association(name, parent = @base, klass = nil)
-          if ::Gem::Version.new(::ActiveRecord::VERSION::STRING) >= ::Gem::Version.new(Constants::RAILS_6_0)
-            jd = Polyamorous::JoinDependency.new(
-              parent.base_klass,
-              parent.table,
-              Polyamorous::Join.new(name, @join_type, klass),
-              @join_type
-            )
-            found_association = jd.instance_variable_get(:@join_root).children.last
-          else
-            jd = Polyamorous::JoinDependency.new(
-              parent.base_klass,
-              parent.table,
-              Polyamorous::Join.new(name, @join_type, klass)
-            )
-            found_association = jd.instance_variable_get(:@join_root).children.last
-          end
+          jd = Polyamorous::JoinDependency.new(
+            parent.base_klass,
+            parent.table,
+            Polyamorous::Join.new(name, @join_type, klass),
+            @join_type
+          )
+          found_association = jd.instance_variable_get(:@join_root).children.last
 
           @associations_pot[found_association] = parent
 
@@ -339,11 +320,7 @@ module Ransack
           @join_dependency.instance_variable_get(:@join_root).children.push found_association
 
           # Builds the arel nodes properly for this association
-          if ::Gem::Version.new(::ActiveRecord::VERSION::STRING) >= ::Gem::Version.new(Constants::RAILS_6_1)
-            @tables_pot[found_association] = @join_dependency.construct_tables_for_association!(jd.instance_variable_get(:@join_root), found_association)
-          else
-            @join_dependency.send(:construct_tables!, jd.instance_variable_get(:@join_root))
-          end
+          @tables_pot[found_association] = @join_dependency.construct_tables_for_association!(jd.instance_variable_get(:@join_root), found_association)
 
           # Leverage the stashed association functionality in AR
           @object = @object.joins(jd)
@@ -353,22 +330,13 @@ module Ransack
         def extract_joins(association)
           parent = @join_dependency.instance_variable_get(:@join_root)
           reflection = association.reflection
-          join_constraints = if ::Gem::Version.new(::ActiveRecord::VERSION::STRING) >= ::Gem::Version.new(Constants::RAILS_6_1)
-                               association.join_constraints_with_tables(
-                                 parent.table,
-                                 parent.base_klass,
-                                 Arel::Nodes::OuterJoin,
-                                 @join_dependency.instance_variable_get(:@alias_tracker),
-                                 @tables_pot[association]
-                               )
-                             else
-                               association.join_constraints(
-                                 parent.table,
-                                 parent.base_klass,
-                                 Arel::Nodes::OuterJoin,
-                                 @join_dependency.instance_variable_get(:@alias_tracker)
-                               )
-                             end
+          join_constraints = association.join_constraints_with_tables(
+                               parent.table,
+                               parent.base_klass,
+                               Arel::Nodes::OuterJoin,
+                               @join_dependency.instance_variable_get(:@alias_tracker),
+                               @tables_pot[association]
+                             )
           join_constraints.to_a.flatten
         end
       end

data/lib/ransack/configuration.rb

@@ -27,15 +27,15 @@ module Ransack
     self.predicates = PredicateCollection.new
 
     self.options = {
-      :search_key => :q,
-      :ignore_unknown_conditions => true,
-      :hide_sort_order_indicators => false,
-      :up_arrow => '▼'.freeze,
-      :down_arrow => '▲'.freeze,
-      :default_arrow => nil,
-      :sanitize_scope_args => true,
-      :postgres_fields_sort_option => nil,
-      :strip_whitespace => true
+      search_key: :q,
+      ignore_unknown_conditions: true,
+      hide_sort_order_indicators: false,
+      up_arrow: '▼'.freeze,
+      down_arrow: '▲'.freeze,
+      default_arrow: nil,
+      sanitize_scope_args: true,
+      postgres_fields_sort_option: nil,
+      strip_whitespace: true
     }
 
     def configure
@@ -55,11 +55,11 @@ module Ransack
         compound_name = name + suffix
         self.predicates[compound_name] = Predicate.new(
           opts.merge(
-            :name => compound_name,
-            :arel_predicate => arel_predicate_with_suffix(
+            name: compound_name,
+            arel_predicate: arel_predicate_with_suffix(
               opts[:arel_predicate], suffix
               ),
-            :compound => true
+            compound: true
           )
         )
       end if compounds
@@ -101,6 +101,19 @@ module Ransack
       self.options[:ignore_unknown_conditions] = boolean
     end
 
+    # By default Ransack ignores empty predicates. Ransack can also fallback to
+    # a default predicate by setting it in an initializer file
+    # like `config/initializers/ransack.rb` as follows:
+    #
+    # Ransack.configure do |config|
+    #   # Use the 'eq' predicate if an unknown predicate is passed
+    #   config.default_predicate = 'eq'
+    # end
+    #
+    def default_predicate=(name)
+      self.options[:default_predicate] = name
+    end
+
     # By default, Ransack displays sort order indicator arrows with HTML codes:
     #
     #   up_arrow:   '▼'

data/lib/ransack/constants.rb

@@ -45,10 +45,132 @@ module Ransack
     NOT_EQ_ALL          = 'not_eq_all'.freeze
     CONT                = 'cont'.freeze
 
-    RAILS_6_0           = '6.0.0'.freeze
-    RAILS_6_1           = '6.1.0'.freeze
-
     RANSACK_SLASH_SEARCHES = 'ransack/searches'.freeze
     RANSACK_SLASH_SEARCHES_SLASH_SEARCH = 'ransack/searches/search'.freeze
+
+    DISTINCT = 'DISTINCT '.freeze
+
+    DERIVED_PREDICATES = [
+      [CONT, {
+        arel_predicate: 'matches'.freeze,
+        formatter: proc { |v| "%#{escape_wildcards(v)}%" }
+        }
+      ],
+      ['not_cont'.freeze, {
+        arel_predicate: 'does_not_match'.freeze,
+        formatter: proc { |v| "%#{escape_wildcards(v)}%" }
+        }
+      ],
+      ['i_cont'.freeze, {
+        arel_predicate: 'matches'.freeze,
+        formatter: proc { |v| "%#{escape_wildcards(v.downcase)}%" },
+        case_insensitive: true
+        }
+      ],
+      ['not_i_cont'.freeze, {
+        arel_predicate: 'does_not_match'.freeze,
+        formatter: proc { |v| "%#{escape_wildcards(v.downcase)}%" },
+        case_insensitive: true
+        }
+      ],
+      ['start'.freeze, {
+        arel_predicate: 'matches'.freeze,
+        formatter: proc { |v| "#{escape_wildcards(v)}%" }
+        }
+      ],
+      ['not_start'.freeze, {
+        arel_predicate: 'does_not_match'.freeze,
+        formatter: proc { |v| "#{escape_wildcards(v)}%" }
+        }
+      ],
+      ['end'.freeze, {
+        arel_predicate: 'matches'.freeze,
+        formatter: proc { |v| "%#{escape_wildcards(v)}" }
+        }
+      ],
+      ['not_end'.freeze, {
+        arel_predicate: 'does_not_match'.freeze,
+        formatter: proc { |v| "%#{escape_wildcards(v)}" }
+        }
+      ],
+      ['true'.freeze, {
+        arel_predicate: proc { |v| v ? EQ : NOT_EQ },
+        compounds: false,
+        type: :boolean,
+        validator: proc { |v| BOOLEAN_VALUES.include?(v) },
+        formatter: proc { |v| true }
+        }
+      ],
+      ['not_true'.freeze, {
+        arel_predicate: proc { |v| v ? NOT_EQ : EQ },
+        compounds: false,
+        type: :boolean,
+        validator: proc { |v| BOOLEAN_VALUES.include?(v) },
+        formatter: proc { |v| true }
+        }
+      ],
+      ['false'.freeze, {
+        arel_predicate: proc { |v| v ? EQ : NOT_EQ },
+        compounds: false,
+        type: :boolean,
+        validator: proc { |v| BOOLEAN_VALUES.include?(v) },
+        formatter: proc { |v| false }
+        }
+      ],
+      ['not_false'.freeze, {
+        arel_predicate: proc { |v| v ? NOT_EQ : EQ },
+        compounds: false,
+        type: :boolean,
+        validator: proc { |v| BOOLEAN_VALUES.include?(v) },
+        formatter: proc { |v| false }
+        }
+      ],
+      ['present'.freeze, {
+        arel_predicate: proc { |v| v ? NOT_EQ_ALL : EQ_ANY },
+        compounds: false,
+        type: :boolean,
+        validator: proc { |v| BOOLEAN_VALUES.include?(v) },
+        formatter: proc { |v| [nil, ''.freeze].freeze }
+        }
+      ],
+      ['blank'.freeze, {
+        arel_predicate: proc { |v| v ? EQ_ANY : NOT_EQ_ALL },
+        compounds: false,
+        type: :boolean,
+        validator: proc { |v| BOOLEAN_VALUES.include?(v) },
+        formatter: proc { |v| [nil, ''.freeze].freeze }
+        }
+      ],
+      ['null'.freeze, {
+        arel_predicate: proc { |v| v ? EQ : NOT_EQ },
+        compounds: false,
+        type: :boolean,
+        validator: proc { |v| BOOLEAN_VALUES.include?(v) },
+        formatter: proc { |v| nil }
+        }
+      ],
+      ['not_null'.freeze, {
+        arel_predicate: proc { |v| v ? NOT_EQ : EQ },
+        compounds: false,
+        type: :boolean,
+        validator: proc { |v| BOOLEAN_VALUES.include?(v) },
+        formatter: proc { |v| nil } }
+      ]
+    ].freeze
+
+  module_function
+    # replace % \ to \% \\
+    def escape_wildcards(unescaped)
+      case ActiveRecord::Base.connection.adapter_name
+      when "Mysql2".freeze
+        # Necessary for MySQL
+        unescaped.to_s.gsub(/([\\%_])/, '\\\\\\1')
+      when "PostgreSQL".freeze
+        # Necessary for PostgreSQL
+        unescaped.to_s.gsub(/([\\%_.])/, '\\\\\\1')
+      else
+        unescaped
+      end
+    end
   end
 end

data/lib/ransack/context.rb

@@ -1,19 +1,24 @@
 require 'ransack/visitor'
-Ransack::Adapters.object_mapper.require_context
 
 module Ransack
   class Context
     attr_reader :search, :object, :klass, :base, :engine, :arel_visitor
     attr_accessor :auth_object, :search_key
+    attr_reader :arel_visitor
 
     class << self
 
       def for_class(klass, options = {})
-        raise "not implemented"
+        if klass < ActiveRecord::Base
+          Adapters::ActiveRecord::Context.new(klass, options)
+        end
       end
 
       def for_object(object, options = {})
-        raise "not implemented"
+        case object
+        when ActiveRecord::Relation
+          Adapters::ActiveRecord::Context.new(object.klass, options)
+        end
       end
 
       def for(object, options = {})
@@ -30,11 +35,35 @@ module Ransack
     end # << self
 
     def initialize(object, options = {})
-      raise "not implemented"
+      @object = relation_for(object)
+      @klass = @object.klass
+      @join_dependency = join_dependency(@object)
+      @join_type = options[:join_type] || Polyamorous::OuterJoin
+      @search_key = options[:search_key] || Ransack.options[:search_key]
+      @associations_pot = {}
+      @tables_pot = {}
+      @lock_associations = []
+
+      @base = @join_dependency.instance_variable_get(:@join_root)
+    end
+
+    def bind_pair_for(key)
+      @bind_pairs ||= {}
+
+      @bind_pairs[key] ||= begin
+        parent, attr_name = get_parent_and_attribute_name(key.to_s)
+        [parent, attr_name] if parent && attr_name
+      end
     end
 
     def klassify(obj)
-      raise "not implemented"
+      if Class === obj && ::ActiveRecord::Base > obj
+        obj
+      elsif obj.respond_to? :klass
+        obj.klass
+      else
+        raise ArgumentError, "Don't know how to klassify #{obj.inspect}"
+      end
     end
 
     # Convert a string representing a chain of associations and an attribute

data/lib/ransack/helpers/form_builder.rb

@@ -33,7 +33,7 @@ module Ransack
         text = args.first
         i18n = options[:i18n] || {}
         text ||= object.translate(
-          method, i18n.reverse_merge(:include_associations => true)
+          method, i18n.reverse_merge(include_associations: true)
           ) if object.respond_to? :translate
         super(method, text, options, &block)
       end
@@ -240,7 +240,7 @@ module Ransack
       def get_attribute_element(action, base)
         begin
           [
-            Translate.association(base, :context => object.context),
+            Translate.association(base, context: object.context),
             collection_for_base(action, base)
           ]
         rescue UntraversableAssociationError
@@ -253,7 +253,7 @@ module Ransack
           [
             attr_from_base_and_column(base, c),
             Translate.attribute(
-              attr_from_base_and_column(base, c), :context => object.context
+              attr_from_base_and_column(base, c), context: object.context
             )
           ]
         end

data/lib/ransack/helpers/form_helper.rb

@@ -129,8 +129,8 @@ module Ransack
         end
 
         def url_options
-          @params.merge(
-            @options.except(:class).merge(
+          @params.except(:host).merge(
+            @options.except(:class, :data, :host).merge(
               @search.context.search_key => search_and_sort_params))
         end
 
@@ -180,7 +180,8 @@ module Ransack
           end
 
           def search_params
-            @params[@search.context.search_key].presence || {}
+            query_params = @params[@search.context.search_key]
+            query_params.is_a?(Hash) ? query_params : {}
           end
 
           def sort_params

data/lib/ransack/nodes/attribute.rb

@@ -5,8 +5,8 @@ module Ransack
 
       attr_reader :name, :ransacker_args
 
-      delegate :blank?, :present?, :to => :name
-      delegate :engine, :to => :context
+      delegate :blank?, :present?, to: :name
+      delegate :engine, to: :context
 
       def initialize(context, name = nil, ransacker_args = [])
         super(context)

data/lib/ransack/nodes/condition.rb

@@ -2,8 +2,8 @@ module Ransack
   module Nodes
     class Condition < Node
       i18n_word :attribute, :predicate, :combinator, :value
-      i18n_alias :a => :attribute, :p => :predicate,
-                 :m => :combinator, :v => :value
+      i18n_alias a: :attribute, p: :predicate,
+                 m: :combinator, v: :value
 
       attr_accessor :predicate
 
@@ -15,10 +15,10 @@ module Ransack
           if attributes.size > 0 && predicate
             condition = self.new(context)
             condition.build(
-              :a => attributes,
-              :p => predicate.name,
-              :m => combinator,
-              :v => predicate.wants_array ? Array(values) : [values]
+              a: attributes,
+              p: predicate.name,
+              m: combinator,
+              v: predicate.wants_array ? Array(values) : [values]
             )
             # TODO: Figure out what to do with multiple types of attributes,
             # if anything. Tempted to go with "garbage in, garbage out" here.
@@ -283,12 +283,85 @@ module Ransack
         predicate.negative?
       end
 
+      def arel_predicate
+        predicate = attributes.map { |attribute|
+          association = attribute.parent
+          if negative? && attribute.associated_collection?
+            query = context.build_correlated_subquery(association)
+            context.remove_association(association)
+            if self.predicate_name == 'not_null' && self.value
+              query.where(format_predicate(attribute))
+              Arel::Nodes::In.new(context.primary_key, Arel.sql(query.to_sql))
+            else
+              query.where(format_predicate(attribute).not)
+              Arel::Nodes::NotIn.new(context.primary_key, Arel.sql(query.to_sql))
+            end
+          else
+            format_predicate(attribute)
+          end
+        }.reduce(combinator_method)
+
+        if replace_right_node?(predicate)
+          # Replace right node object to plain integer value in order to avoid
+          # ActiveModel::RangeError from Arel::Node::Casted.
+          # The error can be ignored here because RDBMSs accept large numbers
+          # in condition clauses.
+          plain_value = predicate.right.value
+          predicate.right = plain_value
+        end
+
+        predicate
+      end
+
       private
 
+      def combinator_method
+        combinator === Constants::OR ? :or : :and
+      end
+
+      def format_predicate(attribute)
+        arel_pred = arel_predicate_for_attribute(attribute)
+        arel_values = formatted_values_for_attribute(attribute)
+        predicate = attr_value_for_attribute(attribute).public_send(arel_pred, arel_values)
+
+        if in_predicate?(predicate)
+          predicate.right = predicate.right.map do |pr|
+            casted_array?(pr) ? format_values_for(pr) : pr
+          end
+        end
+
+        predicate
+      end
+
+      def in_predicate?(predicate)
+        return unless defined?(Arel::Nodes::Casted)
+        predicate.class == Arel::Nodes::In || predicate.class == Arel::Nodes::NotIn
+      end
+
+      def casted_array?(predicate)
+        predicate.value.is_a?(Array) && predicate.is_a?(Arel::Nodes::Casted)
+      end
+
+      def format_values_for(predicate)
+        predicate.value.map do |val|
+          val.is_a?(String) ? Arel::Nodes.build_quoted(val) : val
+        end
+      end
+
+      def replace_right_node?(predicate)
+        return false unless predicate.is_a?(Arel::Nodes::Binary)
+
+        arel_node = predicate.right
+        return false unless arel_node.is_a?(Arel::Nodes::Casted)
+
+        relation, name = arel_node.attribute.values
+        attribute_type = relation.type_for_attribute(name).type
+        attribute_type == :integer && arel_node.value.is_a?(Integer)
+      end
+
       def valid_combinator?
         attributes.size < 2 || Constants::AND_OR.include?(combinator)
       end
-
     end
   end
 end