ransack 3.2.1 → 4.1.0

data/lib/polyamorous/activerecord_6.1_ruby_2/join_dependency.rb

@@ -56,11 +56,21 @@ module Polyamorous
     private
 
     def table_aliases_for(parent, node)
+      @joined_tables ||= {}
       node.reflection.chain.map { |reflection|
-        alias_tracker.aliased_table_for(reflection.klass.arel_table) do
-          root = reflection == node.reflection
-          name = reflection.alias_candidate(parent.table_name)
-          root ? name : "#{name}_join"
+        table, terminated = @joined_tables[reflection]
+        root = reflection == node.reflection
+
+        if table && (!root || !terminated)
+          @joined_tables[reflection] = [table, true] if root
+          table
+        else
+          table = alias_tracker.aliased_table_for(reflection.klass.arel_table) do
+            name = reflection.alias_candidate(parent.table_name)
+            root ? name : "#{name}_join"
+          end
+          @joined_tables[reflection] ||= [table, root] if join_type == Arel::Nodes::OuterJoin
+          table
         end
       }
     end

data/lib/ransack/adapters/active_record/base.rb

@@ -35,12 +35,7 @@ module Ransack
         # For overriding with a whitelist array of strings.
         #
         def ransackable_attributes(auth_object = nil)
-          @ransackable_attributes ||= if Ransack::SUPPORTS_ATTRIBUTE_ALIAS
-            column_names + _ransackers.keys + _ransack_aliases.keys +
-            attribute_aliases.keys
-          else
-            column_names + _ransackers.keys + _ransack_aliases.keys
-          end
+          @ransackable_attributes ||= deprecated_ransackable_list(:ransackable_attributes)
         end
 
         # Ransackable_associations, by default, returns the names
@@ -48,7 +43,7 @@ module Ransack
         # For overriding with a whitelist array of strings.
         #
         def ransackable_associations(auth_object = nil)
-          @ransackable_associations ||= reflect_on_all_associations.map { |a| a.name.to_s }
+          @ransackable_associations ||= deprecated_ransackable_list(:ransackable_associations)
         end
 
         # Ransortable_attributes, by default, returns the names
@@ -75,6 +70,82 @@ module Ransack
           []
         end
 
+        # Bare list of all potentially searchable attributes. Searchable attributes
+        # need to be explicitly allowlisted through the `ransackable_attributes`
+        # method in each model, but if you're allowing almost everything to be
+        # searched, this list can be used as a base for exclusions.
+        #
+        def authorizable_ransackable_attributes
+          if Ransack::SUPPORTS_ATTRIBUTE_ALIAS
+            column_names + _ransackers.keys + _ransack_aliases.keys +
+            attribute_aliases.keys
+          else
+            column_names + _ransackers.keys + _ransack_aliases.keys
+          end.uniq
+        end
+
+        # Bare list of all potentially searchable associations. Searchable
+        # associations need to be explicitly allowlisted through the
+        # `ransackable_associations` method in each model, but if you're
+        # allowing almost everything to be searched, this list can be used as a
+        # base for exclusions.
+        #
+        def authorizable_ransackable_associations
+          reflect_on_all_associations.map { |a| a.name.to_s }
+        end
+
+        private
+
+        def deprecated_ransackable_list(method)
+          list_type = method.to_s.delete_prefix("ransackable_")
+
+          if explicitly_defined?(method)
+            warn_deprecated <<~ERROR
+              Ransack's builtin `#{method}` method is deprecated and will result
+              in an error in the future. If you want to authorize the full list
+              of searchable #{list_type} for this model, use
+              `authorizable_#{method}` instead of delegating to `super`.
+            ERROR
+
+            public_send("authorizable_#{method}")
+          else
+            raise <<~MESSAGE
+              Ransack needs #{name} #{list_type} explicitly allowlisted as
+              searchable. Define a `#{method}` class method in your `#{name}`
+              model, watching out for items you DON'T want searchable (for
+              example, `encrypted_password`, `password_reset_token`, `owner` or
+              other sensitive information). You can use the following as a base:
+
+              ```ruby
+              class #{name} < ApplicationRecord
+
+                # ...
+
+                def self.#{method}(auth_object = nil)
+                  #{public_send("authorizable_#{method}").sort.inspect}
+                end
+
+                # ...
+
+              end
+              ```
+            MESSAGE
+          end
+        end
+
+        def explicitly_defined?(method)
+          definer_ancestor = singleton_class.ancestors.find do |ancestor|
+            ancestor.instance_methods(false).include?(method)
+          end
+
+          definer_ancestor != Ransack::Adapters::ActiveRecord::Base
+        end
+
+        def warn_deprecated(message)
+          caller_location = caller_locations.find { |location| !location.path.start_with?(File.expand_path("../..", __dir__)) }
+
+          warn "DEPRECATION WARNING: #{message.squish} (called at #{caller_location.path}:#{caller_location.lineno})"
+        end
       end
     end
   end

data/lib/ransack/adapters/active_record/context.rb

@@ -12,8 +12,9 @@ module Ransack
 
         def type_for(attr)
           return nil unless attr && attr.valid?
+          relation     = attr.arel_attribute.relation
           name         = attr.arel_attribute.name.to_s
-          table        = attr.arel_attribute.relation.table_name
+          table        = relation.respond_to?(:table_name) ? relation.table_name : relation.name
           schema_cache = self.klass.connection.schema_cache
           unless schema_cache.send(:data_source_exists?, table)
             raise "No table named #{table} exists."

data/lib/ransack/configuration.rb

@@ -27,15 +27,15 @@ module Ransack
     self.predicates = PredicateCollection.new
 
     self.options = {
-      :search_key => :q,
-      :ignore_unknown_conditions => true,
-      :hide_sort_order_indicators => false,
-      :up_arrow => '▼'.freeze,
-      :down_arrow => '▲'.freeze,
-      :default_arrow => nil,
-      :sanitize_scope_args => true,
-      :postgres_fields_sort_option => nil,
-      :strip_whitespace => true
+      search_key: :q,
+      ignore_unknown_conditions: true,
+      hide_sort_order_indicators: false,
+      up_arrow: '▼'.freeze,
+      down_arrow: '▲'.freeze,
+      default_arrow: nil,
+      sanitize_scope_args: true,
+      postgres_fields_sort_option: nil,
+      strip_whitespace: true
     }
 
     def configure
@@ -55,11 +55,11 @@ module Ransack
         compound_name = name + suffix
         self.predicates[compound_name] = Predicate.new(
           opts.merge(
-            :name => compound_name,
-            :arel_predicate => arel_predicate_with_suffix(
+            name: compound_name,
+            arel_predicate: arel_predicate_with_suffix(
               opts[:arel_predicate], suffix
               ),
-            :compound => true
+            compound: true
           )
         )
       end if compounds
@@ -101,6 +101,19 @@ module Ransack
       self.options[:ignore_unknown_conditions] = boolean
     end
 
+    # By default Ransack ignores empty predicates. Ransack can also fallback to
+    # a default predicate by setting it in an initializer file
+    # like `config/initializers/ransack.rb` as follows:
+    #
+    # Ransack.configure do |config|
+    #   # Use the 'eq' predicate if an unknown predicate is passed
+    #   config.default_predicate = 'eq'
+    # end
+    #
+    def default_predicate=(name)
+      self.options[:default_predicate] = name
+    end
+
     # By default, Ransack displays sort order indicator arrows with HTML codes:
     #
     #   up_arrow:   '▼'

data/lib/ransack/constants.rb

@@ -47,5 +47,130 @@ module Ransack
 
     RANSACK_SLASH_SEARCHES = 'ransack/searches'.freeze
     RANSACK_SLASH_SEARCHES_SLASH_SEARCH = 'ransack/searches/search'.freeze
+
+    DISTINCT = 'DISTINCT '.freeze
+
+    DERIVED_PREDICATES = [
+      [CONT, {
+        arel_predicate: 'matches'.freeze,
+        formatter: proc { |v| "%#{escape_wildcards(v)}%" }
+        }
+      ],
+      ['not_cont'.freeze, {
+        arel_predicate: 'does_not_match'.freeze,
+        formatter: proc { |v| "%#{escape_wildcards(v)}%" }
+        }
+      ],
+      ['i_cont'.freeze, {
+        arel_predicate: 'matches'.freeze,
+        formatter: proc { |v| "%#{escape_wildcards(v.downcase)}%" },
+        case_insensitive: true
+        }
+      ],
+      ['not_i_cont'.freeze, {
+        arel_predicate: 'does_not_match'.freeze,
+        formatter: proc { |v| "%#{escape_wildcards(v.downcase)}%" },
+        case_insensitive: true
+        }
+      ],
+      ['start'.freeze, {
+        arel_predicate: 'matches'.freeze,
+        formatter: proc { |v| "#{escape_wildcards(v)}%" }
+        }
+      ],
+      ['not_start'.freeze, {
+        arel_predicate: 'does_not_match'.freeze,
+        formatter: proc { |v| "#{escape_wildcards(v)}%" }
+        }
+      ],
+      ['end'.freeze, {
+        arel_predicate: 'matches'.freeze,
+        formatter: proc { |v| "%#{escape_wildcards(v)}" }
+        }
+      ],
+      ['not_end'.freeze, {
+        arel_predicate: 'does_not_match'.freeze,
+        formatter: proc { |v| "%#{escape_wildcards(v)}" }
+        }
+      ],
+      ['true'.freeze, {
+        arel_predicate: proc { |v| v ? EQ : NOT_EQ },
+        compounds: false,
+        type: :boolean,
+        validator: proc { |v| BOOLEAN_VALUES.include?(v) },
+        formatter: proc { |v| true }
+        }
+      ],
+      ['not_true'.freeze, {
+        arel_predicate: proc { |v| v ? NOT_EQ : EQ },
+        compounds: false,
+        type: :boolean,
+        validator: proc { |v| BOOLEAN_VALUES.include?(v) },
+        formatter: proc { |v| true }
+        }
+      ],
+      ['false'.freeze, {
+        arel_predicate: proc { |v| v ? EQ : NOT_EQ },
+        compounds: false,
+        type: :boolean,
+        validator: proc { |v| BOOLEAN_VALUES.include?(v) },
+        formatter: proc { |v| false }
+        }
+      ],
+      ['not_false'.freeze, {
+        arel_predicate: proc { |v| v ? NOT_EQ : EQ },
+        compounds: false,
+        type: :boolean,
+        validator: proc { |v| BOOLEAN_VALUES.include?(v) },
+        formatter: proc { |v| false }
+        }
+      ],
+      ['present'.freeze, {
+        arel_predicate: proc { |v| v ? NOT_EQ_ALL : EQ_ANY },
+        compounds: false,
+        type: :boolean,
+        validator: proc { |v| BOOLEAN_VALUES.include?(v) },
+        formatter: proc { |v| [nil, ''.freeze].freeze }
+        }
+      ],
+      ['blank'.freeze, {
+        arel_predicate: proc { |v| v ? EQ_ANY : NOT_EQ_ALL },
+        compounds: false,
+        type: :boolean,
+        validator: proc { |v| BOOLEAN_VALUES.include?(v) },
+        formatter: proc { |v| [nil, ''.freeze].freeze }
+        }
+      ],
+      ['null'.freeze, {
+        arel_predicate: proc { |v| v ? EQ : NOT_EQ },
+        compounds: false,
+        type: :boolean,
+        validator: proc { |v| BOOLEAN_VALUES.include?(v) },
+        formatter: proc { |v| nil }
+        }
+      ],
+      ['not_null'.freeze, {
+        arel_predicate: proc { |v| v ? NOT_EQ : EQ },
+        compounds: false,
+        type: :boolean,
+        validator: proc { |v| BOOLEAN_VALUES.include?(v) },
+        formatter: proc { |v| nil } }
+      ]
+    ].freeze
+
+  module_function
+    # replace % \ to \% \\
+    def escape_wildcards(unescaped)
+      case ActiveRecord::Base.connection.adapter_name
+      when "Mysql2".freeze
+        # Necessary for MySQL
+        unescaped.to_s.gsub(/([\\%_])/, '\\\\\\1')
+      when "PostgreSQL".freeze
+        # Necessary for PostgreSQL
+        unescaped.to_s.gsub(/([\\%_.])/, '\\\\\\1')
+      else
+        unescaped
+      end
+    end
   end
 end

data/lib/ransack/context.rb

@@ -1,19 +1,24 @@
 require 'ransack/visitor'
-Ransack::Adapters.object_mapper.require_context
 
 module Ransack
   class Context
     attr_reader :search, :object, :klass, :base, :engine, :arel_visitor
     attr_accessor :auth_object, :search_key
+    attr_reader :arel_visitor
 
     class << self
 
       def for_class(klass, options = {})
-        raise "not implemented"
+        if klass < ActiveRecord::Base
+          Adapters::ActiveRecord::Context.new(klass, options)
+        end
       end
 
       def for_object(object, options = {})
-        raise "not implemented"
+        case object
+        when ActiveRecord::Relation
+          Adapters::ActiveRecord::Context.new(object.klass, options)
+        end
       end
 
       def for(object, options = {})
@@ -30,11 +35,35 @@ module Ransack
     end # << self
 
     def initialize(object, options = {})
-      raise "not implemented"
+      @object = relation_for(object)
+      @klass = @object.klass
+      @join_dependency = join_dependency(@object)
+      @join_type = options[:join_type] || Polyamorous::OuterJoin
+      @search_key = options[:search_key] || Ransack.options[:search_key]
+      @associations_pot = {}
+      @tables_pot = {}
+      @lock_associations = []
+
+      @base = @join_dependency.instance_variable_get(:@join_root)
+    end
+
+    def bind_pair_for(key)
+      @bind_pairs ||= {}
+
+      @bind_pairs[key] ||= begin
+        parent, attr_name = get_parent_and_attribute_name(key.to_s)
+        [parent, attr_name] if parent && attr_name
+      end
     end
 
     def klassify(obj)
-      raise "not implemented"
+      if Class === obj && ::ActiveRecord::Base > obj
+        obj
+      elsif obj.respond_to? :klass
+        obj.klass
+      else
+        raise ArgumentError, "Don't know how to klassify #{obj.inspect}"
+      end
     end
 
     # Convert a string representing a chain of associations and an attribute

data/lib/ransack/helpers/form_builder.rb

@@ -33,7 +33,7 @@ module Ransack
         text = args.first
         i18n = options[:i18n] || {}
         text ||= object.translate(
-          method, i18n.reverse_merge(:include_associations => true)
+          method, i18n.reverse_merge(include_associations: true)
           ) if object.respond_to? :translate
         super(method, text, options, &block)
       end
@@ -240,7 +240,7 @@ module Ransack
       def get_attribute_element(action, base)
         begin
           [
-            Translate.association(base, :context => object.context),
+            Translate.association(base, context: object.context),
             collection_for_base(action, base)
           ]
         rescue UntraversableAssociationError
@@ -253,7 +253,7 @@ module Ransack
           [
             attr_from_base_and_column(base, c),
             Translate.attribute(
-              attr_from_base_and_column(base, c), :context => object.context
+              attr_from_base_and_column(base, c), context: object.context
             )
           ]
         end

data/lib/ransack/helpers/form_helper.rb

@@ -129,7 +129,7 @@ module Ransack
         end
 
         def url_options
-          @params.merge(
+          @params.except(:host).merge(
             @options.except(:class, :data, :host).merge(
               @search.context.search_key => search_and_sort_params))
         end
@@ -180,7 +180,8 @@ module Ransack
           end
 
           def search_params
-            @params[@search.context.search_key].presence || {}
+            query_params = @params[@search.context.search_key]
+            query_params.is_a?(Hash) ? query_params : {}
           end
 
           def sort_params

data/lib/ransack/nodes/attribute.rb

@@ -5,8 +5,8 @@ module Ransack
 
       attr_reader :name, :ransacker_args
 
-      delegate :blank?, :present?, :to => :name
-      delegate :engine, :to => :context
+      delegate :blank?, :present?, to: :name
+      delegate :engine, to: :context
 
       def initialize(context, name = nil, ransacker_args = [])
         super(context)

data/lib/ransack/nodes/condition.rb

@@ -2,8 +2,8 @@ module Ransack
   module Nodes
     class Condition < Node
       i18n_word :attribute, :predicate, :combinator, :value
-      i18n_alias :a => :attribute, :p => :predicate,
-                 :m => :combinator, :v => :value
+      i18n_alias a: :attribute, p: :predicate,
+                 m: :combinator, v: :value
 
       attr_accessor :predicate
 
@@ -15,10 +15,10 @@ module Ransack
           if attributes.size > 0 && predicate
             condition = self.new(context)
             condition.build(
-              :a => attributes,
-              :p => predicate.name,
-              :m => combinator,
-              :v => predicate.wants_array ? Array(values) : [values]
+              a: attributes,
+              p: predicate.name,
+              m: combinator,
+              v: predicate.wants_array ? Array(values) : [values]
             )
             # TODO: Figure out what to do with multiple types of attributes,
             # if anything. Tempted to go with "garbage in, garbage out" here.
@@ -283,12 +283,85 @@ module Ransack
         predicate.negative?
       end
 
+      def arel_predicate
+        predicate = attributes.map { |attribute|
+          association = attribute.parent
+          if negative? && attribute.associated_collection?
+            query = context.build_correlated_subquery(association)
+            context.remove_association(association)
+            if self.predicate_name == 'not_null' && self.value
+              query.where(format_predicate(attribute))
+              Arel::Nodes::In.new(context.primary_key, Arel.sql(query.to_sql))
+            else
+              query.where(format_predicate(attribute).not)
+              Arel::Nodes::NotIn.new(context.primary_key, Arel.sql(query.to_sql))
+            end
+          else
+            format_predicate(attribute)
+          end
+        }.reduce(combinator_method)
+
+        if replace_right_node?(predicate)
+          # Replace right node object to plain integer value in order to avoid
+          # ActiveModel::RangeError from Arel::Node::Casted.
+          # The error can be ignored here because RDBMSs accept large numbers
+          # in condition clauses.
+          plain_value = predicate.right.value
+          predicate.right = plain_value
+        end
+
+        predicate
+      end
+
       private
 
+      def combinator_method
+        combinator === Constants::OR ? :or : :and
+      end
+
+      def format_predicate(attribute)
+        arel_pred = arel_predicate_for_attribute(attribute)
+        arel_values = formatted_values_for_attribute(attribute)
+        predicate = attr_value_for_attribute(attribute).public_send(arel_pred, arel_values)
+
+        if in_predicate?(predicate)
+          predicate.right = predicate.right.map do |pr|
+            casted_array?(pr) ? format_values_for(pr) : pr
+          end
+        end
+
+        predicate
+      end
+
+      def in_predicate?(predicate)
+        return unless defined?(Arel::Nodes::Casted)
+        predicate.class == Arel::Nodes::In || predicate.class == Arel::Nodes::NotIn
+      end
+
+      def casted_array?(predicate)
+        predicate.value.is_a?(Array) && predicate.is_a?(Arel::Nodes::Casted)
+      end
+
+      def format_values_for(predicate)
+        predicate.value.map do |val|
+          val.is_a?(String) ? Arel::Nodes.build_quoted(val) : val
+        end
+      end
+
+      def replace_right_node?(predicate)
+        return false unless predicate.is_a?(Arel::Nodes::Binary)
+
+        arel_node = predicate.right
+        return false unless arel_node.is_a?(Arel::Nodes::Casted)
+
+        relation, name = arel_node.attribute.values
+        attribute_type = relation.type_for_attribute(name).type
+        attribute_type == :integer && arel_node.value.is_a?(Integer)
+      end
+
       def valid_combinator?
         attributes.size < 2 || Constants::AND_OR.include?(combinator)
       end
-
     end
   end
 end

data/lib/ransack/nodes/grouping.rb

@@ -7,9 +7,9 @@ module Ransack
       alias :m= :combinator=
 
       i18n_word :condition, :and, :or
-      i18n_alias :c => :condition, :n => :and, :o => :or
+      i18n_alias c: :condition, n: :and, o: :or
 
-      delegate :each, :to => :values
+      delegate :each, to: :values
 
       def initialize(context, combinator = nil)
         super(context)
@@ -22,7 +22,7 @@ module Ransack
 
       def translate(key, options = {})
         super or Translate.attribute(
-          key.to_s, options.merge(:context => context)
+          key.to_s, options.merge(context: context)
         )
       end
 

data/lib/ransack/nodes/node.rb

@@ -2,7 +2,7 @@ module Ransack
   module Nodes
     class Node
       attr_reader :context
-      delegate :contextualize, :to => :context
+      delegate :contextualize, to: :context
       class_attribute :i18n_words
       class_attribute :i18n_aliases
       self.i18n_words = []

data/lib/ransack/nodes/value.rb

@@ -2,7 +2,7 @@ module Ransack
   module Nodes
     class Value < Node
       attr_accessor :value
-      delegate :present?, :blank?, :to => :value
+      delegate :present?, :blank?, to: :value
 
       def initialize(context, value = nil)
         super(context)

data/lib/ransack/predicate.rb

@@ -10,7 +10,7 @@ module Ransack
       end
 
       def named(name)
-        Ransack.predicates[name.to_s]
+        Ransack.predicates[(name || Ransack.options[:default_predicate]).to_s]
       end
 
       def detect_and_strip_from_string!(str)

data/lib/ransack/ransacker.rb

@@ -3,7 +3,7 @@ module Ransack
 
     attr_reader :name, :type, :formatter, :args
 
-    delegate :call, :to => :@callable
+    delegate :call, to: :@callable
 
     def initialize(klass, name, opts = {}, &block)
       @klass, @name = klass, name

data/lib/ransack/search.rb

@@ -1,6 +1,11 @@
-require 'ransack/nodes'
+require 'ransack/nodes/bindable'
+require 'ransack/nodes/node'
+require 'ransack/nodes/attribute'
+require 'ransack/nodes/value'
+require 'ransack/nodes/condition'
+require 'ransack/nodes/sort'
+require 'ransack/nodes/grouping'
 require 'ransack/context'
-Ransack::Adapters.object_mapper.require_search
 require 'ransack/naming'
 
 module Ransack
@@ -9,10 +14,10 @@ module Ransack
 
     attr_reader :base, :context
 
-    delegate :object, :klass, :to => :context
+    delegate :object, :klass, to: :context
     delegate :new_grouping, :new_condition,
              :build_grouping, :build_condition,
-             :translate, :to => :base
+             :translate, to: :base
 
     def initialize(object, params = {}, options = {})
       strip_whitespace = options.fetch(:strip_whitespace, Ransack.options[:strip_whitespace])

data/lib/ransack/translate.rb

@@ -66,7 +66,7 @@ module Ransack
             [:"ransack.associations.#{i18n_key(context.klass)}.#{key}"]
           end
         defaults << context.traverse(key).model_name.human
-        options = { :count => 1, :default => defaults }
+        options = { count: 1, default: defaults }
         I18n.translate(defaults.shift, **options)
       end
 
@@ -149,7 +149,7 @@ module Ransack
       end
 
       def i18n_key(klass)
-        raise "not implemented"
+        klass.model_name.i18n_key
       end
     end
   end