ransack 5.0.2 → 6.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e1da5ebd35a1352f55541bdc21342c512b6209e385546e8e217c38c4dea79ad5
-  data.tar.gz: 61525c16d6c5e02c57575e72edd28eb9b6376a53bf791e1fda60b2581a95049d
+  metadata.gz: ab7bd0c932988849a454c8178e7676022783c3bddb36f8e8d951c11aaf24de7c
+  data.tar.gz: c076572a9ea5b4084fe9754bfc53cdcfa33667f8b2837ed1880fc11c1b855345
 SHA512:
-  metadata.gz: 0bcdd2aeda080a80a469e591a27b5a4dfa5dadf36b3de1e62a037de661c01e3d8092d4f60d5d458097cace0a1ce87434590a9914651dfd74f899f7d03a144367
-  data.tar.gz: 7aea600100c4ea0001ffed5c84729e950ecb7ccc5421fb853886031585c1a3486377c15facef12c43796a9c5072069972303aa74c868daf24ebfc235e7a49900
+  metadata.gz: 01de2b357a7c9f782d5e3ca9fb705ef4ccbd0b01a291fd90537903f2d514b4da3734fc6fba0425e9b908b78d2c073ba1cfde886c22f55432c68b739b14dc7336
+  data.tar.gz: e3f13fdd795a2bfd0b37a4d7788ea9437f445c05a25185bc22e1e85efa84e0bbe47d63613d09f9d7b3690a75e9ccf05bcec63944e3804436de97247c230b3834

data/README.md

@@ -1,10 +1,9 @@
-# ![Ransack](./docs/static/logo/ransack-h.png "Ransack")
+# ![Ransack](./docs/assets/logo/ransack-h.png "Ransack")
 
 [![Build Status](https://github.com/activerecord-hackery/ransack/workflows/test/badge.svg)](https://github.com/activerecord-hackery/ransack/actions)
 [![Gem Version](https://badge.fury.io/rb/ransack.svg)](http://badge.fury.io/rb/ransack)
 [![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/activerecord-hackery/ransack)
 [![Code Climate](https://codeclimate.com/github/activerecord-hackery/ransack/badges/gpa.svg)](https://codeclimate.com/github/activerecord-hackery/ransack)
-[![Backers on Open Collective](https://opencollective.com/ransack/backers/badge.svg)](#backers) [![Sponsors on Open Collective](https://opencollective.com/ransack/sponsors/badge.svg)](#sponsors)
 
 # Introduction
 
@@ -14,7 +13,7 @@ There are advanced searching solutions around, like ElasticSearch or Algolia. **
 
 Ready to move beyond the basics? Use **advanced features** like i18n and extensive configuration options.
 
-Ransack is supported for Rails 8.1, 8.0, 7.2 on Ruby 3.1 and later.
+Ransack is supported for Rails 8.1, 8.0, 7.2 on Ruby 3.2 and later.
 
 ## Installation
 
@@ -34,7 +33,7 @@ gem 'ransack', :github => 'activerecord-hackery/ransack', :branch => 'main'
 
 ### Documentation
 
-There is [extensive documentation on Ransack](https://activerecord-hackery.github.io/ransack/), which is a [Docusaurus](https://docusaurus.io/) project and run as a GitHub Pages site. Alternatively there is [AI Generated documentation](https://deepwiki.com/activerecord-hackery/ransack/1-overview) produced by [devin.ai](https://devin.ai/).
+There is [extensive documentation on Ransack](https://activerecord-hackery.github.io/ransack/), built with [Jekyll](https://jekyllrb.com/) and [Just the Docs](https://just-the-docs.com/) from the Markdown under `docs/` and published as a GitHub Pages site. Alternatively there is [AI Generated documentation](https://deepwiki.com/activerecord-hackery/ransack/1-overview) produced by [devin.ai](https://devin.ai/).
 
 This [gist](https://gist.github.com/raghubetina/d5fc3df67ddbadcac271) has a quick-start cheatsheet, created by [@raghubetina](https://gist.github.com/raghubetina)
 
@@ -51,7 +50,6 @@ This [gist](https://gist.github.com/raghubetina/d5fc3df67ddbadcac271) has a quic
 
 To support the project:
 
-* Consider supporting us via [Open Collective](https://opencollective.com/ransack/backers/badge.svg)
 * Use Ransack in your apps, and let us know if you encounter anything that's
 broken or missing. A failing spec to demonstrate the issue is awesome. A pull
 request with passing tests is even better!
@@ -63,6 +61,16 @@ directly related to bug reports, pull requests, or documentation improvements.
 to you. The more people who are using the project, the quicker we can find and
 fix bugs!
 
+## Ransack for enterprise
+
+Available as part of the [Tidelift Subscription](https://tidelift.com/subscription/pkg/rubygems-ransack?utm_source=rubygems-ransack&utm_medium=referral&utm_campaign=enterprise&utm_term=repo).
+
+The maintainers of Ransack and thousands of other packages are working with Tidelift to deliver commercial support and maintenance for the open source dependencies you use to build your applications. Save time, reduce risk, and improve code health, while paying the maintainers of the exact dependencies you use. [Learn more.](https://tidelift.com/subscription/pkg/rubygems-ransack?utm_source=rubygems-ransack&utm_medium=referral&utm_campaign=enterprise&utm_term=repo)
+
+## Security contact information
+
+To report a security vulnerability, please use the [Tidelift security contact](https://tidelift.com/security). Tidelift will coordinate the fix and disclosure. See the [Security Policy](.github/SECURITY.md) for supported versions.
+
 ## Contributors
 
 Ransack was created by [Ernie Miller](http://twitter.com/erniemiller) and is developed and maintained by:
@@ -78,25 +86,3 @@ Alumni Maintainers
 
 This project exists thanks to all the people who contribute. <img src="https://opencollective.com/ransack/contributors.svg?width=890&button=false" />
 
-
-## Backers
-
-Thank you to all our backers! 🙏 [[Become a backer](https://opencollective.com/ransack#backer)]
-
-<a href="https://opencollective.com/ransack#backers" target="_blank"><img src="https://opencollective.com/ransack/backers.svg?width=890" /></a>
-
-
-## Sponsors
-
-Support this project by becoming a sponsor. Your logo will show up here with a link to your website. [[Become a sponsor](https://opencollective.com/ransack#sponsor)]
-
-<a href="https://opencollective.com/ransack/sponsor/0/website" target="_blank"><img src="https://opencollective.com/ransack/sponsor/0/avatar.svg" /></a>
-<a href="https://opencollective.com/ransack/sponsor/1/website" target="_blank"><img src="https://opencollective.com/ransack/sponsor/1/avatar.svg" /></a>
-<a href="https://opencollective.com/ransack/sponsor/2/website" target="_blank"><img src="https://opencollective.com/ransack/sponsor/2/avatar.svg" /></a>
-<a href="https://opencollective.com/ransack/sponsor/3/website" target="_blank"><img src="https://opencollective.com/ransack/sponsor/3/avatar.svg" /></a>
-<a href="https://opencollective.com/ransack/sponsor/4/website" target="_blank"><img src="https://opencollective.com/ransack/sponsor/4/avatar.svg" /></a>
-<a href="https://opencollective.com/ransack/sponsor/5/website" target="_blank"><img src="https://opencollective.com/ransack/sponsor/5/avatar.svg" /></a>
-<a href="https://opencollective.com/ransack/sponsor/6/website" target="_blank"><img src="https://opencollective.com/ransack/sponsor/6/avatar.svg" /></a>
-<a href="https://opencollective.com/ransack/sponsor/7/website" target="_blank"><img src="https://opencollective.com/ransack/sponsor/7/avatar.svg" /></a>
-<a href="https://opencollective.com/ransack/sponsor/8/website" target="_blank"><img src="https://opencollective.com/ransack/sponsor/8/avatar.svg" /></a>
-<a href="https://opencollective.com/ransack/sponsor/9/website" target="_blank"><img src="https://opencollective.com/ransack/sponsor/9/avatar.svg" /></a>

data/lib/ransack/active_record/base.rb

@@ -0,0 +1,154 @@
+module Ransack
+  module ActiveRecord
+    # Extended onto ActiveRecord::Base: the `ransack` entry point, the
+    # `ransacker` and `ransack_alias` declarations, and the allowlist methods
+    # every model must define before it can be searched.
+    module Base
+
+      def self.extended(base)
+        base.class_eval do
+          class_attribute :_ransackers
+          class_attribute :_ransack_aliases
+          self._ransackers ||= {}
+          self._ransack_aliases ||= {}
+        end
+      end
+
+      def ransack(params = {}, options = {})
+        Search.new(self, params, options)
+      end
+
+      def ransack!(params = {}, options = {})
+        ransack(params, options.merge(ignore_unknown_conditions: false))
+      end
+
+      def ransacker(name, opts = {}, &block)
+        self._ransackers = _ransackers.merge name.to_s => Ransacker
+          .new(self, name, opts, &block)
+      end
+
+      def ransack_alias(new_name, old_name)
+        self._ransack_aliases = _ransack_aliases.merge new_name.to_s =>
+          old_name.to_s
+      end
+
+      # Ransackable_attributes, by default, returns all column names
+      # and any defined ransackers as an array of strings.
+      # For overriding with a whitelist array of strings.
+      #
+      def ransackable_attributes(auth_object = nil)
+        @ransackable_attributes ||= deprecated_ransackable_list(:ransackable_attributes)
+      end
+
+      # Ransackable_associations, by default, returns the names
+      # of all associations as an array of strings.
+      # For overriding with a whitelist array of strings.
+      #
+      def ransackable_associations(auth_object = nil)
+        @ransackable_associations ||= deprecated_ransackable_list(:ransackable_associations)
+      end
+
+      # Ransortable_attributes, by default, returns the names
+      # of all attributes available for sorting as an array of strings.
+      # For overriding with a whitelist array of strings.
+      #
+      def ransortable_attributes(auth_object = nil)
+        ransackable_attributes(auth_object)
+      end
+
+      # Ransackable_scopes, by default, returns an empty array
+      # i.e. no class methods/scopes are authorized.
+      # For overriding with a whitelist array of *symbols*.
+      #
+      def ransackable_scopes(auth_object = nil)
+        []
+      end
+
+      # ransack_scope_skip_sanitize_args, by default, returns an empty array.
+      # i.e. use the sanitize_scope_args setting to determine if args should be converted.
+      # For overriding with a list of scopes which should be passed the args as-is.
+      #
+      def ransackable_scopes_skip_sanitize_args
+        []
+      end
+
+      # Bare list of all potentially searchable attributes. Searchable attributes
+      # need to be explicitly allowlisted through the `ransackable_attributes`
+      # method in each model, but if you're allowing almost everything to be
+      # searched, this list can be used as a base for exclusions.
+      #
+      def authorizable_ransackable_attributes
+        (column_names + _ransackers.keys + _ransack_aliases.keys +
+          attribute_aliases.keys).uniq
+      end
+
+      # Bare list of all potentially searchable associations. Searchable
+      # associations need to be explicitly allowlisted through the
+      # `ransackable_associations` method in each model, but if you're
+      # allowing almost everything to be searched, this list can be used as a
+      # base for exclusions.
+      #
+      def authorizable_ransackable_associations
+        reflect_on_all_associations.map { |a| a.name.to_s }
+      end
+
+      # Whether this model, or a superclass of it, defines `method` itself
+      # rather than inheriting Ransack's default. The search context asks
+      # before trusting permitted strong parameters: a model with a list of
+      # its own always applies it, and only a model without one lets the
+      # controller's permit list be the boundary (#1403).
+      def ransackable_list_defined?(method)
+        definer_ancestor = singleton_class.ancestors.find do |ancestor|
+          ancestor.instance_methods(false).include?(method)
+        end
+
+        definer_ancestor != Ransack::ActiveRecord::Base
+      end
+
+      private
+
+      def deprecated_ransackable_list(method)
+        list_type = method.to_s.delete_prefix("ransackable_")
+
+        if ransackable_list_defined?(method)
+          warn_deprecated <<~ERROR
+            Ransack's builtin `#{method}` method is deprecated and will result
+            in an error in the future. If you want to authorize the full list
+            of searchable #{list_type} for this model, use
+            `authorizable_#{method}` instead of delegating to `super`.
+          ERROR
+
+          public_send("authorizable_#{method}")
+        else
+          raise <<~MESSAGE
+            Ransack needs #{name} #{list_type} explicitly allowlisted as
+            searchable. Define a `#{method}` class method in your `#{name}`
+            model, watching out for items you DON'T want searchable (for
+            example, `encrypted_password`, `password_reset_token`, `owner` or
+            other sensitive information). You can use the following as a base:
+
+            ```ruby
+            class #{name} < ApplicationRecord
+
+              # ...
+
+              def self.#{method}(auth_object = nil)
+                #{public_send("authorizable_#{method}").sort.inspect}
+              end
+
+              # ...
+
+            end
+            ```
+          MESSAGE
+        end
+      end
+
+      def warn_deprecated(message)
+        caller_location = caller_locations.find { |location| !location.path.start_with?(File.expand_path("../..", __dir__)) }
+
+        warn "DEPRECATION WARNING: #{message.squish} (called at #{caller_location.path}:#{caller_location.lineno})"
+      end
+    end
+  end
+end