rest_framework 0.8.3 → 0.8.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4a54e0539466e7981ab8ba95a1877ad705b46279309c1d3bfd2cfd038e916b2b
-  data.tar.gz: c26e553c6b4b5435545ffb5fa71c59720f42303347b35336077c764b00fd889d
+  metadata.gz: 8bbc760b6f4694137002e90cf81453f1e07cd86ffd69a8318646db54b31144b6
+  data.tar.gz: 41ce57cbee20b11453d332e03fbdf54118ba7b7f1ceeaa5b3b02d118675c6a3d
 SHA512:
-  metadata.gz: 79a80f7d7b3ab044203b612fc8ed453c3a7490a17e9e53adb8386719b9d6944838e78ce343d3596ac8c370cc6dc122d2ede66ec2afce7ffaa9dc635ed23146ad
-  data.tar.gz: 2943c3779a404ff67f64f6c38001c9de828f3f536c79da1663b02dad0f4c6b20fa36fcd0e4310cbffda48dc4db6c329d09c5e7c48d93e62dc53a157b86e75eef
+  metadata.gz: 59fdf66ab6dd1c457a9551ed1a9ab0724fc2079be1c28ec2ebc08eada94390fe66e3722ab278a6d5fba7c55aed9a4a75dca0e3ea498cd183832d70553f6db9d7
+  data.tar.gz: e3e2f6b3c3ff29e03d8c9c3a058996bea5de44acfae449a065278a000b98b22b536892dd2d4e3e46b65d9c94cee85aedd1f9928e697e39afd4c491b33ae33504

data/VERSION

@@ -1 +1 @@
-0.8.3
+0.8.5

data/lib/rest_framework/controller_mixins/base.rb

@@ -112,7 +112,7 @@ module RESTFramework::BaseControllerMixin
 
     # Get a hash of metadata to be rendered in the `OPTIONS` response. Cache the result.
     def get_options_metadata
-      return @_base_options_metadata ||= {
+      return {
         title: self.get_title,
         description: self.description,
         renders: [

data/lib/rest_framework/controller_mixins/models.rb

@@ -285,9 +285,9 @@ module RESTFramework::BaseModelControllerMixin
       }.to_h
     end
 
-    # Get a hash of metadata to be rendered in the `OPTIONS` response. Cache the result.
+    # Get a hash of metadata to be rendered in the `OPTIONS` response.
     def get_options_metadata
-      return super().merge(
+      return super.merge(
         {
           fields: self.get_fields_metadata,
           callbacks: self._process_action_callbacks.as_json,
@@ -439,10 +439,13 @@ module RESTFramework::BaseModelControllerMixin
     return super || RESTFramework::NativeSerializer
   end
 
-  # Get filtering backends, defaulting to using `ModelFilter` and `ModelOrderingFilter`.
+  # Get filtering backends, defaulting to using `ModelFilter`, `ModelOrderingFilter`, and
+  # `ModelSearchFilter`.
   def get_filter_backends
     return self.class.filter_backends || [
-      RESTFramework::ModelFilter, RESTFramework::ModelOrderingFilter
+      RESTFramework::ModelFilter,
+      RESTFramework::ModelOrderingFilter,
+      RESTFramework::ModelSearchFilter,
     ]
   end
 

data/lib/rest_framework/filters.rb

@@ -14,7 +14,7 @@ class RESTFramework::ModelFilter < RESTFramework::BaseFilter
   # Get a list of filterset fields for the current action. Fallback to columns because we don't want
   # to try filtering by any query parameter because that could clash with other query parameters.
   def _get_fields
-    return @_get_fields ||= (
+    return (
       @controller.class.filterset_fields || @controller.get_fields(fallback: true)
     ).map(&:to_s)
   end
@@ -69,9 +69,7 @@ class RESTFramework::ModelOrderingFilter < RESTFramework::BaseFilter
   # Get a list of ordering fields for the current action. Do not fallback to columns in case the
   # user wants to order by a virtual column.
   def _get_fields
-    return @_get_fields ||= (
-      @controller.class.ordering_fields || @controller.get_fields
-    )&.map(&:to_s)
+    return (@controller.class.ordering_fields || @controller.get_fields)&.map(&:to_s)
   end
 
   # Convert ordering string to an ordering configuration.
@@ -117,25 +115,43 @@ end
 
 # Multi-field text searching on models.
 class RESTFramework::ModelSearchFilter < RESTFramework::BaseFilter
-  # Get a list of search fields for the current action. Fallback to columns because we need an
-  # explicit list of columns to search on, so `nil` is useless in this context.
+  DEFAULT_SEARCH_COLUMNS = %w[name email title description note]
+
+  # Get a list of search fields for the current action. Fallback to columns but only grab a few
+  # common string-like columns by default.
   def _get_fields
-    return @controller.class.search_fields || @controller.get_fields(fallback: true)
+    if search_fields = @controller.class.search_fields
+      return search_fields
+    end
+
+    columns = @controller.class.get_model.columns_hash.keys
+    return @controller.get_fields(fallback: true).select { |f|
+      f.in?(DEFAULT_SEARCH_COLUMNS) && f.in?(columns)
+    }
   end
 
   # Filter data according to the request query parameters.
   def get_filtered_data(data)
-    fields = self._get_fields
     search = @controller.request.query_parameters[@controller.class.search_query_param]
 
-    # Ensure we use array conditions to prevent SQL injection.
-    if search.present? && !fields.empty?
-      return data.where(
-        fields.map { |f|
-          "CAST(#{f} AS VARCHAR) #{@controller.class.search_ilike ? "ILIKE" : "LIKE"} ?"
-        }.join(" OR "),
-        *(["%#{search}%"] * fields.length),
-      )
+    if search.present?
+      if fields = self._get_fields.presence
+        # MySQL doesn't support casting to VARCHAR, so we need to use CHAR instead.
+        data_type = if data.connection.adapter_name =~ /mysql/i
+          "CHAR"
+        else
+          # Sufficient for both PostgreSQL and SQLite.
+          "VARCHAR"
+        end
+
+        # Ensure we pass user input as arguments to prevent SQL injection.
+        return data.where(
+          fields.map { |f|
+            "CAST(#{f} AS #{data_type}) #{@controller.class.search_ilike ? "ILIKE" : "LIKE"} ?"
+          }.join(" OR "),
+          *(["%#{search}%"] * fields.length),
+        )
+      end
     end
 
     return data

data/lib/rest_framework/utils.rb

@@ -1,6 +1,5 @@
 module RESTFramework::Utils
   HTTP_METHOD_ORDERING = %w(GET POST PUT PATCH DELETE OPTIONS HEAD)
-  LABEL_FIELDS = %w(name label login title email username url)
 
   # Convert `extra_actions` hash to a consistent format: `{path:, methods:, kwargs:}`, and
   # additional metadata fields.
@@ -186,14 +185,15 @@ module RESTFramework::Utils
   def self.sub_fields_for(ref)
     if !ref.polymorphic? && model = ref.klass
       sub_fields = [model.primary_key].flatten.compact
+      label_fields = RESTFramework.config.label_fields
 
       # Preferrably find a database column to use as label.
-      if match = LABEL_FIELDS.find { |f| f.in?(model.column_names) }
+      if match = label_fields.find { |f| f.in?(model.column_names) }
         return sub_fields + [match]
       end
 
       # Otherwise, find a method.
-      if match = LABEL_FIELDS.find { |f| model.method_defined?(f) }
+      if match = label_fields.find { |f| model.method_defined?(f) }
         return sub_fields + [match]
       end
 

data/lib/rest_framework.rb

@@ -26,6 +26,8 @@ module RESTFramework
       ActiveStorage::Attachment
       ActiveStorage::Blob
     ).freeze
+    DEFAULT_LABEL_FIELDS = %w(name label login title email username url).freeze
+    DEFAULT_SEARCH_COLUMNS = DEFAULT_LABEL_FIELDS + %w(description note).freeze
 
     # Do not run `rrf_finalize` on controllers automatically using a `TracePoint` hook. This is a
     # performance option and must be global because we have to determine this before any
@@ -47,15 +49,23 @@ module RESTFramework
     # Whether the backtrace should be shown in rescued errors.
     attr_accessor :show_backtrace
 
-    # Option to disable `rescue_from` on the controller mixins.
+    # Disable `rescue_from` on the controller mixins.
     attr_accessor :disable_rescue_from
 
-    # Options to exclude certain classes from being added by default as association fields.
+    # Exclude certain classes from being added by default as association fields.
     attr_accessor :exclude_association_classes
 
+    # The default label fields to use when generating labels for `has_many` associations.
+    attr_accessor :label_fields
+
+    # The default search columns to use when generating search filters.
+    attr_accessor :search_columns
+
     def initialize
       self.show_backtrace = Rails.env.development?
       self.exclude_association_classes = DEFAULT_EXCLUDE_ASSOCIATION_CLASSES
+      self.label_fields = DEFAULT_LABEL_FIELDS
+      self.search_columns = DEFAULT_SEARCH_COLUMNS
     end
   end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rest_framework
 version: !ruby/object:Gem::Version
-  version: 0.8.3
+  version: 0.8.5
 platform: ruby
 authors:
 - Gregory N. Schmit
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-01-25 00:00:00.000000000 Z
+date: 2023-02-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails