rest_framework 0.8.3 → 0.8.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4a54e0539466e7981ab8ba95a1877ad705b46279309c1d3bfd2cfd038e916b2b
-  data.tar.gz: c26e553c6b4b5435545ffb5fa71c59720f42303347b35336077c764b00fd889d
+  metadata.gz: 333e3109a118ca9b6069e4856d77ec85baf217b8f0e835f6f1426c93674822bd
+  data.tar.gz: e187f2d6f01b5eb69d358fb0f5da134120c4a04c76eb06e8c181deb16a6d317a
 SHA512:
-  metadata.gz: 79a80f7d7b3ab044203b612fc8ed453c3a7490a17e9e53adb8386719b9d6944838e78ce343d3596ac8c370cc6dc122d2ede66ec2afce7ffaa9dc635ed23146ad
-  data.tar.gz: 2943c3779a404ff67f64f6c38001c9de828f3f536c79da1663b02dad0f4c6b20fa36fcd0e4310cbffda48dc4db6c329d09c5e7c48d93e62dc53a157b86e75eef
+  metadata.gz: 875514cb611fe74eaddeda88c2e48dcb7e28246274b8e191c7e13410998ce462c0a6dff1cbdc0cc9140a3e6e56026aecbcfbc4c002d230e36f7c315bebd5c84a
+  data.tar.gz: b82c26a854b08314c4e56d2a29532570289fad186d2f0019421f6214f1ad35fa60e4730a5b2d8c06b0bd776f28c291cb1d33740131f2f030912c527eca3dcc87

data/VERSION

@@ -1 +1 @@
-0.8.3
+0.8.4

data/lib/rest_framework/controller_mixins/models.rb

@@ -439,10 +439,13 @@ module RESTFramework::BaseModelControllerMixin
     return super || RESTFramework::NativeSerializer
   end
 
-  # Get filtering backends, defaulting to using `ModelFilter` and `ModelOrderingFilter`.
+  # Get filtering backends, defaulting to using `ModelFilter`, `ModelOrderingFilter`, and
+  # `ModelSearchFilter`.
   def get_filter_backends
     return self.class.filter_backends || [
-      RESTFramework::ModelFilter, RESTFramework::ModelOrderingFilter
+      RESTFramework::ModelFilter,
+      RESTFramework::ModelOrderingFilter,
+      RESTFramework::ModelSearchFilter,
     ]
   end
 

data/lib/rest_framework/filters.rb

@@ -117,25 +117,35 @@ end
 
 # Multi-field text searching on models.
 class RESTFramework::ModelSearchFilter < RESTFramework::BaseFilter
-  # Get a list of search fields for the current action. Fallback to columns because we need an
-  # explicit list of columns to search on, so `nil` is useless in this context.
+  DEFAULT_SEARCH_COLUMNS = %w[name email title description note]
+
+  # Get a list of search fields for the current action. Fallback to columns but only grab a few
+  # common string-like columns by default.
   def _get_fields
-    return @controller.class.search_fields || @controller.get_fields(fallback: true)
+    if search_fields = @controller.class.search_fields
+      return search_fields
+    end
+
+    columns = @controller.class.get_model.columns_hash.keys
+    return @controller.get_fields(fallback: true).select { |f|
+      f.in?(DEFAULT_SEARCH_COLUMNS) && f.in?(columns)
+    }
   end
 
   # Filter data according to the request query parameters.
   def get_filtered_data(data)
-    fields = self._get_fields
     search = @controller.request.query_parameters[@controller.class.search_query_param]
 
-    # Ensure we use array conditions to prevent SQL injection.
-    if search.present? && !fields.empty?
-      return data.where(
-        fields.map { |f|
-          "CAST(#{f} AS VARCHAR) #{@controller.class.search_ilike ? "ILIKE" : "LIKE"} ?"
-        }.join(" OR "),
-        *(["%#{search}%"] * fields.length),
-      )
+    if search.present?
+      if fields = self._get_fields.presence
+        # Ensure we pass user input as arguments to prevent SQL injection.
+        return data.where(
+          fields.map { |f|
+            "CAST(#{f} AS VARCHAR) #{@controller.class.search_ilike ? "ILIKE" : "LIKE"} ?"
+          }.join(" OR "),
+          *(["%#{search}%"] * fields.length),
+        )
+      end
     end
 
     return data

data/lib/rest_framework/utils.rb

@@ -1,6 +1,5 @@
 module RESTFramework::Utils
   HTTP_METHOD_ORDERING = %w(GET POST PUT PATCH DELETE OPTIONS HEAD)
-  LABEL_FIELDS = %w(name label login title email username url)
 
   # Convert `extra_actions` hash to a consistent format: `{path:, methods:, kwargs:}`, and
   # additional metadata fields.
@@ -186,14 +185,15 @@ module RESTFramework::Utils
   def self.sub_fields_for(ref)
     if !ref.polymorphic? && model = ref.klass
       sub_fields = [model.primary_key].flatten.compact
+      label_fields = RESTFramework.config.label_fields
 
       # Preferrably find a database column to use as label.
-      if match = LABEL_FIELDS.find { |f| f.in?(model.column_names) }
+      if match = label_fields.find { |f| f.in?(model.column_names) }
         return sub_fields + [match]
       end
 
       # Otherwise, find a method.
-      if match = LABEL_FIELDS.find { |f| model.method_defined?(f) }
+      if match = label_fields.find { |f| model.method_defined?(f) }
         return sub_fields + [match]
       end
 

data/lib/rest_framework.rb

@@ -26,6 +26,8 @@ module RESTFramework
       ActiveStorage::Attachment
       ActiveStorage::Blob
     ).freeze
+    DEFAULT_LABEL_FIELDS = %w(name label login title email username url).freeze
+    DEFAULT_SEARCH_COLUMNS = DEFAULT_LABEL_FIELDS + %w(description note).freeze
 
     # Do not run `rrf_finalize` on controllers automatically using a `TracePoint` hook. This is a
     # performance option and must be global because we have to determine this before any
@@ -50,12 +52,20 @@ module RESTFramework
     # Option to disable `rescue_from` on the controller mixins.
     attr_accessor :disable_rescue_from
 
-    # Options to exclude certain classes from being added by default as association fields.
+    # Option to exclude certain classes from being added by default as association fields.
     attr_accessor :exclude_association_classes
 
+    # Option for the default label fields to use when generating labels for `has_many` associations.
+    attr_accessor :label_fields
+
+    # Option for the default search columns to use when generating search filters.
+    attr_accessor :search_columns
+
     def initialize
       self.show_backtrace = Rails.env.development?
       self.exclude_association_classes = DEFAULT_EXCLUDE_ASSOCIATION_CLASSES
+      self.label_fields = DEFAULT_LABEL_FIELDS
+      self.search_columns = DEFAULT_SEARCH_COLUMNS
     end
   end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rest_framework
 version: !ruby/object:Gem::Version
-  version: 0.8.3
+  version: 0.8.4
 platform: ruby
 authors:
 - Gregory N. Schmit
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-01-25 00:00:00.000000000 Z
+date: 2023-01-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails