rest_framework 1.1.0 → 2.0.0.beta1

data/lib/rest_framework/controller.rb

@@ -3,9 +3,7 @@
 # module rather than defining a separate submodule.
 module RESTFramework::Controller
   RRF_BASE_CONFIG = {
-    extra_actions: nil,
-    extra_member_actions: nil,
-    singleton_controller: nil,
+    singular: nil,
 
     # Options related to metadata and display.
     title: nil,
@@ -14,30 +12,38 @@ module RESTFramework::Controller
     inflect_acronyms: RESTFramework.config.inflect_acronyms,
     openapi_include_children: false,
 
-    # Core attributes related to models.
+    # Options related to models.
     model: nil,
     recordset: nil,
-    excluded_actions: nil,
-    bulk: false,
 
-    # Attributes for configuring record fields.
+    # Bulk configuration.
+    #
+    # When `bulk` is truthy, it enables the default bulk behavior (`:default`), which is per-record
+    # processing (e.g., `create` for each record). When `bulk` is set to `:raw`, it enables single
+    # SQL query behavior (e.g., `insert_all` for bulk create) which skips validations/callbacks.
+    bulk: false,
+    bulk_partial: false,
+    bulk_partial_query_param: "bulk_partial".freeze,
+    bulk_allow_mode_override: false,
+    bulk_mode_query_param: "bulk_mode".freeze,
+    bulk_max_size: nil,
+    bulk_max_raw_size: nil,
+
+    # Configuring record fields.
     fields: nil,
     field_config: nil,
     read_only_fields: RESTFramework.config.read_only_fields,
     write_only_fields: RESTFramework.config.write_only_fields,
     hidden_fields: nil,
 
-    # Attributes for finding records.
+    # Finding records.
     find_by_fields: nil,
     find_by_query_param: "find_by".freeze,
 
-    # Options for what should be included/excluded from default fields.
-    exclude_associations: false,
-
-    # Options for handling request body parameters.
+    # Handling request body parameters.
     allowed_parameters: nil,
 
-    # Attributes for the default native serializer.
+    # Options for the default native serializer.
     native_serializer_config: nil,
     native_serializer_singular_config: nil,
     native_serializer_plural_config: nil,
@@ -45,11 +51,28 @@ module RESTFramework::Controller
     native_serializer_except_query_param: "except".freeze,
     native_serializer_include_query_param: "include".freeze,
     native_serializer_exclude_query_param: "exclude".freeze,
-    native_serializer_associations_limit: nil,
-    native_serializer_associations_limit_query_param: "associations_limit".freeze,
-    native_serializer_include_associations_count: false,
 
-    # Attributes for filtering, ordering, and searching.
+    # Options for including associations and collection counts.
+    exclude_associations: false,
+    include_association_count: false,
+
+    # The number of records serialized per collection association, so responses are bounded out of
+    # the box (`nil` = unlimited). With `enable_association_queries`, a client can raise it for a
+    # given association via `?<prefix>.<name>.limit=N` or `limit=all` (`none`/`0` are aliases), both
+    # capped at `association_limit_max` (the "all" forms yield the cap). Set the max to `nil` to let
+    # a client request unlimited records.
+    association_limit: 10,
+    association_limit_max: 100,
+
+    # Let clients request extra fields for a serialized association via
+    # `?<prefix>.<association>.fields=a,b,c`. The allowlist keeps an association from ever exposing
+    # more than its own endpoint would: an explicit per-association `requestable_fields` in
+    # `field_config`, else the fields the associated model's sibling controller serializes.
+    # Off/secure by default.
+    enable_association_queries: false,
+    association_query_prefix: "associations".freeze,
+
+    # Options for filtering, ordering, and searching.
     filter_backends: [
       RESTFramework::QueryFilter,
       RESTFramework::OrderingFilter,
@@ -81,12 +104,16 @@ module RESTFramework::Controller
     serialize_to_json: true,
     serialize_to_xml: true,
 
-    # Options related to pagination.
-    paginator_class: nil,
+    # Options related to pagination. Pagination is on by default (page-number based) with a capped
+    # page size, so responses are bounded out of the box; set `paginator_class = nil` to disable.
+    paginator_class: RESTFramework::PageNumberPaginator,
     page_size: 20,
-    page_query_param: "page",
-    page_size_query_param: "page_size",
-    max_page_size: nil,
+    page_query_param: "page".freeze,
+    page_size_query_param: "page_size".freeze,
+    max_page_size: 40,
+    # Whether the page-number paginator computes the total record count to report `count` and
+    # `total_pages`. Set to `false` on large tables to skip that query.
+    page_total_count: true,
 
     # Option to disable serializer adapters by default, mainly introduced because Active Model
     # Serializers will do things like serialize `[]` into `{"":[]}`.
@@ -96,27 +123,119 @@ module RESTFramework::Controller
     enable_action_text: false,
     enable_active_storage: false,
   }
-  BASE64_REGEX = /data:(.*);base64,(.*)/
-  BASE64_TRANSLATE = ->(field, value) {
-    return value unless BASE64_REGEX.match?(value)
 
-    _, content_type, payload = value.match(BASE64_REGEX).to_a
+  # Exceptions to be rescued and handled by returning a reasonable error response.
+  RRF_RESCUED_EXCEPTIONS = [
+    RESTFramework::InvalidBulkParametersError,
+    RESTFramework::BulkRecordErrorsError,
+  ].freeze
+  RRF_RESCUED_RAILS_EXCEPTIONS = [
+    ActionController::ParameterMissing,
+    ActionController::UnpermittedParameters,
+    ActionDispatch::Http::Parameters::ParseError,
+    ActiveRecord::AssociationTypeMismatch,
+    ActiveRecord::NotNullViolation,
+    ActiveRecord::RecordNotFound,
+    ActiveRecord::RecordInvalid,
+    ActiveRecord::RecordNotSaved,
+    ActiveRecord::RecordNotDestroyed,
+    ActiveRecord::RecordNotUnique,
+    ActiveRecord::StatementInvalid,
+    ActiveModel::UnknownAttributeError,
+  ].freeze
+
+  # Anchored regex with non-greedy content_type match to prevent over-matching on malicious input.
+  RRF_BASE64_REGEX = /\Adata:([^;]*);base64,(.*)\z/m
+  RRF_BASE64_TRANSLATE = ->(field, value) {
+    return value unless RRF_BASE64_REGEX.match?(value)
+
+    _, content_type, payload = value.match(RRF_BASE64_REGEX).to_a
     {
       io: StringIO.new(Base64.decode64(payload)),
       content_type: content_type,
       filename: "file_#{field}#{Rack::Mime::MIME_TYPES.invert[content_type]}",
     }
   }
-  ACTIVESTORAGE_KEYS = [ :io, :content_type, :filename, :identify, :key ]
-
-  # Default action for API root.
-  def root
-    render(api: { message: "This is the API root." })
-  end
+  RRF_ACTIVESTORAGE_KEYS = [ :io, :content_type, :filename, :identify, :key ]
 
   module ClassMethods
     IGNORE_VALIDATORS_WITH_KEYS = [ :if, :unless ].freeze
 
+    # Thread-local key toggled by `propagate` while its block runs.
+    RRF_PROPAGATING_KEY = :rrf_propagating
+
+    # Define one or more class-level configuration attributes. Assignments are **local by default**:
+    #
+    #   self.x = value               # applies to this controller ONLY; descendants don't inherit it
+    #   propagate { self.x = value } # applies to this controller AND all descendants
+    #
+    # This gives a single, uniform rule (an assignment is local unless wrapped in `propagate`), so
+    # there's no per-attribute "does this inherit?" knowledge to carry around. Values are stored in
+    # closures on redefined singleton methods (the same mechanism as `class_attribute`), never in
+    # instance variables, so there is exactly one interface for configuration: the setter.
+    #
+    # Only singleton (class-level) methods are defined, so config never leaks to controller
+    # instances (which would risk colliding with action methods).
+    def rrf_class_attribute(*names, default: nil)
+      names.each do |name|
+        # Propagating baseline: every controller sees the default until it's overridden. This lives
+        # in the propagated module (see `rrf_propagated_module`) rather than directly on the
+        # singleton class, so a local assignment can coexist with it via `super`.
+        rrf_propagated_module.define_method(name) { default }
+
+        # Parity with `class_attribute`, which also defines a predicate.
+        singleton_class.define_method("#{name}?") { !!public_send(name) }
+
+        singleton_class.define_method("#{name}=") do |value|
+          if Thread.current[RRF_PROPAGATING_KEY]
+            # Propagate: descendants inherit this getter via the module in the singleton chain. It's
+            # kept separate from any local getter (defined directly on the singleton class) so a
+            # subsequent local assignment doesn't clobber the value propagated to descendants.
+            rrf_propagated_module.define_method(name) { value }
+          else
+            # Local: `value` for this class only; descendants fall back through `super` to the
+            # nearest propagated ancestor value, or the default.
+            klass = self
+            singleton_class.define_method(name) do
+              if equal?(klass)
+                value
+              elsif defined?(super)
+                super()
+              else
+                default
+              end
+            end
+          end
+        end
+      end
+    end
+
+    # The per-class module holding this class's propagated attribute getters (and the default
+    # baseline). It's included into the singleton class so descendants inherit propagated values
+    # through the singleton-class chain, while local assignments—defined directly on the singleton
+    # class—take precedence for the class itself and can `super()` back into this module. Created
+    # lazily and memoized per class (instance variables aren't inherited, so each class gets its
+    # own).
+    def rrf_propagated_module
+      @rrf_propagated_module ||= Module.new.tap { |mod| singleton_class.include(mod) }
+    end
+
+    # Run a block in which configuration setters (`self.x = value`) propagate to descendant
+    # controllers instead of applying locally. Use this on a shared base controller for settings you
+    # want every subclass to inherit:
+    #
+    #   propagate do
+    #     self.paginator_class = RESTFramework::PageNumberPaginator
+    #     self.page_size = 30
+    #   end
+    def propagate
+      previous = Thread.current[RRF_PROPAGATING_KEY]
+      Thread.current[RRF_PROPAGATING_KEY] = true
+      yield
+    ensure
+      Thread.current[RRF_PROPAGATING_KEY] = previous
+    end
+
     # By default, this is the name of the controller class, titleized and with any custom inflection
     # acronyms applied.
     def get_title
@@ -134,21 +253,6 @@ module RESTFramework::Controller
       self.model&.human_attribute_name(s, default: default_title) || default_title
     end
 
-    # Define any behavior to execute at the end of controller definition.
-    # :nocov:
-    def rrf_finalize
-      if RESTFramework.config.freeze_config
-        self::RRF_BASE_CONFIG.keys.each { |k|
-          v = self.send(k)
-          v.freeze if v.is_a?(Hash) || v.is_a?(Array)
-        }
-      end
-
-      self.setup_delegation if self.model
-      # self.setup_channel if self.model
-    end
-    # :nocov:
-
     # Get the available fields. Fallback to this controller's model columns, or an empty array. This
     # should always return an array of strings.
     def get_fields(input_fields: nil)
@@ -269,17 +373,22 @@ module RESTFramework::Controller
         if ref = reflections[f]
           cfg[:kind] = "association"
 
-          # Determine sub-fields for associations.
+          # Determine the association's fields.
           if ref.polymorphic?
             ref_columns = {}
           else
             ref_columns = ref.klass.columns_hash
           end
-          cfg[:sub_fields] ||= RESTFramework::Utils.sub_fields_for(ref)
-          cfg[:sub_fields] = cfg[:sub_fields].map(&:to_s)
+          cfg[:fields] ||= RESTFramework::Utils.association_fields_for(ref)
+          cfg[:fields] = cfg[:fields].map(&:to_s)
 
-          # Very basic metadata about sub-fields.
-          cfg[:sub_fields_metadata] = cfg[:sub_fields].map { |sf|
+          # Strings, to match `:fields` when intersecting requested fields against the allowlist.
+          if cfg[:requestable_fields]
+            cfg[:requestable_fields] = cfg[:requestable_fields].map(&:to_s)
+          end
+
+          # Very basic metadata about the association's fields.
+          cfg[:association_fields_metadata] = cfg[:fields].map { |sf|
             v = {}
 
             if ref_columns[sf]
@@ -342,13 +451,6 @@ module RESTFramework::Controller
           # Update `required` if we find a presence validator.
           cfg[:required] = true if kind == :presence
 
-          # Resolve procs (and lambdas), and symbols for certain arguments.
-          if options[:in].is_a?(Proc)
-            options = options.merge(in: options[:in].call)
-          elsif options[:in].is_a?(Symbol)
-            options = options.merge(in: self.model.send(options[:in]))
-          end
-
           cfg[:validators] ||= {}
           cfg[:validators][kind] ||= []
           cfg[:validators][kind] << options
@@ -356,39 +458,42 @@ module RESTFramework::Controller
 
         next [ f, cfg ]
       }.to_h.compact.with_indifferent_access
-    end
 
-    # Only for model controllers.
-    def setup_delegation
-      # Delegate extra actions.
-      self.extra_actions&.each do |action, config|
-        next unless config.is_a?(Hash) && config.dig(:metadata, :delegate)
-        next unless self.model.respond_to?(action)
+      # Compile each association's requestable-fields allowlist once (see
+      # `enable_association_queries`). This runs as a second pass, after `@field_configuration` is
+      # memoized, because resolving a sibling's fields reads its `field_configuration` — and a
+      # self-referential or mutual association would otherwise recurse into this build.
+      if self.enable_association_queries
+        @field_configuration.each do |_f, cfg|
+          next unless cfg[:kind] == "association"
 
-        self.define_method(action) do
-          if self.model.method(action).parameters.last&.first == :keyrest
-            render(api: self.model.send(action, **params))
-          else
-            render(api: self.model.send(action))
-          end
+          cfg[:requestable_fields] ||= self.association_requestable_fields(cfg[:reflection])
         end
       end
 
-      # Delegate extra member actions.
-      self.extra_member_actions&.each do |action, config|
-        next unless config.is_a?(Hash) && config.dig(:metadata, :delegate)
-        next unless self.model.method_defined?(action)
-
-        self.define_method(action) do
-          record = self.get_record
+      @field_configuration
+    end
 
-          if record.method(action).parameters.last&.first == :keyrest
-            render(api: record.send(action, **params))
-          else
-            render(api: record.send(action))
-          end
-        end
-      end
+    # The fields a consumer may request for an association beyond its defaults, derived from the
+    # associated model's sibling controller: what that controller serializes, so the association can
+    # never expose more than its own endpoint would. Empty unless the sibling is discoverable and
+    # introspectable — a custom serializer makes its `get_fields` meaningless. Hidden fields are
+    # included (retrievable via `?only=` there); write-only fields and nested associations aren't.
+    def association_requestable_fields(ref)
+      return [] if ref.polymorphic?
+
+      sibling = RESTFramework::Utils.controller_for_model(self, ref.klass)
+      return [] unless sibling
+      return [] if sibling.serializer_class ||
+        sibling.native_serializer_config ||
+        sibling.native_serializer_singular_config ||
+        sibling.native_serializer_plural_config
+
+      cfg = sibling.field_configuration
+      sibling.get_fields.reject { |sf|
+        c = cfg[sf]
+        c.nil? || c[:write_only] || c[:kind] == "association"
+      }
     end
   end
 
@@ -400,59 +505,25 @@ module RESTFramework::Controller
     # By default, the layout should be set to `rest_framework`.
     base.layout("rest_framework")
 
-    # Add class attributes unless they already exist.
+    # Materialize config with `rrf_class_attribute` (local by default) rather than `class_attribute`
+    # (always inherited).
     RRF_BASE_CONFIG.each do |a, default|
       next if base.respond_to?(a)
 
-      # Don't leak class attributes to the instance to avoid conflicting with action methods.
-      base.class_attribute(a, default: default, instance_accessor: false)
-    end
-
-    # Alias `extra_actions` to `extra_collection_actions`.
-    unless base.respond_to?(:extra_collection_actions)
-      base.singleton_class.alias_method(:extra_collection_actions, :extra_actions)
-      base.singleton_class.alias_method(:extra_collection_actions=, :extra_actions=)
+      base.rrf_class_attribute(a, default: default)
     end
 
     # Skip CSRF since this is an API.
     begin
       base.skip_before_action(:verify_authenticity_token)
-    rescue
+    rescue ArgumentError
+      # The callback may not exist if forgery protection isn't enabled; this is expected.
       nil
     end
 
-    # Handle some common exceptions.
-    unless RESTFramework.config.disable_rescue_from
-      base.rescue_from(
-        ActionController::ParameterMissing,
-        ActionController::UnpermittedParameters,
-        ActionDispatch::Http::Parameters::ParseError,
-        ActiveRecord::AssociationTypeMismatch,
-        ActiveRecord::NotNullViolation,
-        ActiveRecord::RecordNotFound,
-        ActiveRecord::RecordInvalid,
-        ActiveRecord::RecordNotSaved,
-        ActiveRecord::RecordNotDestroyed,
-        ActiveRecord::RecordNotUnique,
-        ActiveModel::UnknownAttributeError,
-        with: :rrf_error_handler,
-      )
-    end
-
-    # Use `TracePoint` hook to automatically call `rrf_finalize`.
-    if RESTFramework.config.auto_finalize
-      # :nocov:
-      TracePoint.trace(:end) do |t|
-        next if base != t.self
-
-        base.rrf_finalize
-
-        # It's important to disable the trace once we've found the end of the base class definition,
-        # for performance.
-        t.disable
-      end
-      # :nocov:
-    end
+    # Handle exceptions.
+    base.rescue_from(*RRF_RESCUED_EXCEPTIONS, with: :rrf_error_handler)
+    base.rescue_from(*RRF_RESCUED_RAILS_EXCEPTIONS, with: :rrf_error_handler)
   end
 
   def get_serializer_class
@@ -470,13 +541,23 @@ module RESTFramework::Controller
     status = case e
     when ActiveRecord::RecordNotFound
       404
+    when RESTFramework::BulkRecordErrorsError
+      422
     else
       400
     end
 
-    render(
-      api: {
-        message: e.message,
+    # `StatementInvalid` messages commonly embed SQL fragments and schema details, so don't leak
+    # them to clients unless backtraces are explicitly enabled.
+    message = if e.is_a?(ActiveRecord::StatementInvalid) && !RESTFramework.config.show_backtrace
+      "Invalid query."
+    else
+      e.message
+    end
+
+    render_api(
+      {
+        message: message,
         errors: e.try(:record).try(:errors),
         exception: RESTFramework.config.show_backtrace ? e.full_message : nil,
       }.compact,
@@ -561,11 +642,8 @@ module RESTFramework::Controller
     end
   end
 
-  # Compatibility alias for deprecated `api_response`.
-  alias_method :api_response, :render_api
-
   def options
-    render(api: self.openapi_document)
+    render_api(self.openapi_document)
   end
 
   def get_fields
@@ -594,13 +672,13 @@ module RESTFramework::Controller
 
       # ActiveStorage Integration: `has_one_attached`
       if self.class.enable_active_storage && reflections.key?("#{f}_attachment")
-        hash_variations[f] = ACTIVESTORAGE_KEYS
+        hash_variations[f] = RRF_ACTIVESTORAGE_KEYS
         next f
       end
 
       # ActiveStorage Integration: `has_many_attached`
       if self.class.enable_active_storage && reflections.key?("#{f}_attachments")
-        hash_variations[f] = ACTIVESTORAGE_KEYS
+        hash_variations[f] = RRF_ACTIVESTORAGE_KEYS
         next nil
       end
 
@@ -618,7 +696,7 @@ module RESTFramework::Controller
         # TODO: Consider adjusting this based on `nested_attributes_options`.
         if self.class.permit_nested_attributes_assignment
           hash_variations["#{f}_attributes"] = (
-            config[:sub_fields] + [ "_destroy" ]
+            config[:fields] + [ "_destroy" ]
           )
         end
 
@@ -636,7 +714,7 @@ module RESTFramework::Controller
   end
 
   # Use strong parameters to filter the request body.
-  def get_body_params(bulk_mode: nil)
+  def get_body_params(bulk_action: nil)
     data = self.request.request_parameters
     pk = self.class.model&.primary_key
     allowed_params = self.get_allowed_parameters
@@ -645,15 +723,17 @@ module RESTFramework::Controller
     # assignment ActiveRecord API or the nested assignment ActiveRecord API. Note that there is no
     # need to check for `permit_id_assignment` or `permit_nested_attributes_assignment` here, since
     # that is enforced by strong parameters generated by `get_allowed_parameters`.
-    self.class.model.reflections.each do |name, ref|
-      if payload = data[name]
-        if payload.is_a?(Hash) || (payload.is_a?(Array) && payload.all? { |x| x.is_a?(Hash) })
-          # Assume nested attributes assignment.
-          attributes_key = "#{name}_attributes"
-          data[attributes_key] = data.delete(name) unless data[attributes_key]
-        elsif id_field = RESTFramework::Utils.id_field_for(name, ref)
-          # Assume id/ids assignment.
-          data[id_field] = data.delete(name) unless data[id_field]
+    if !bulk_action && self.class.model
+      self.class.model.reflections.each do |name, ref|
+        if payload = data[name]
+          if payload.is_a?(Hash) || (payload.is_a?(Array) && payload.all? { |x| x.is_a?(Hash) })
+            # Assume nested attributes assignment.
+            attributes_key = "#{name}_attributes"
+            data[attributes_key] = data.delete(name) unless data[attributes_key]
+          elsif id_field = RESTFramework::Utils.id_field_for(name, ref)
+            # Assume id/ids assignment.
+            data[id_field] = data.delete(name) unless data[id_field]
+          end
         end
       end
     end
@@ -669,12 +749,12 @@ module RESTFramework::Controller
     #
     # rubocop:enable Layout/LineLength
     has_many_attached_scalar_data = {}
-    if self.class.enable_active_storage
+    if !bulk_action && self.class.enable_active_storage && self.class.model
       self.class.model.attachment_reflections.keys.each do |k|
         if data[k].is_a?(Array)
           data[k] = data[k].map { |v|
             if v.is_a?(String)
-              v = BASE64_TRANSLATE.call(k, v)
+              v = RRF_BASE64_TRANSLATE.call(k, v)
 
               # Remember scalars because Rails strong params will remove it.
               if v.is_a?(String)
@@ -694,7 +774,7 @@ module RESTFramework::Controller
             data[k][:io] = StringIO.new(Base64.decode64(data[k][:io]))
           end
         elsif data[k].is_a?(String)
-          data[k] = BASE64_TRANSLATE.call(k, data[k])
+          data[k] = RRF_BASE64_TRANSLATE.call(k, data[k])
         end
       end
     end
@@ -703,9 +783,16 @@ module RESTFramework::Controller
     # parameters to the `_json` key of the request body.
     body_params = if allowed_params == true
       ActionController::Parameters.new(data).permit!
-    elsif bulk_mode
-      pk = bulk_mode == :update ? [ pk ] : []
-      ActionController::Parameters.new(data).permit({ _json: allowed_params + pk })
+    elsif bulk_action
+      if bulk_action == :create
+        ActionController::Parameters.new(data).permit({ _json: allowed_params })
+      elsif bulk_action == :update
+        ActionController::Parameters.new(data).permit({ _json: allowed_params + [ pk ] })
+      elsif bulk_action == :destroy
+        ActionController::Parameters.new(data).permit({ _json: [] })
+      else
+        raise ArgumentError, "Invalid bulk action: #{bulk_action}"
+      end
     else
       ActionController::Parameters.new(data).permit(*allowed_params)
     end
@@ -719,16 +806,36 @@ module RESTFramework::Controller
       body_params[k].unshift(*v)
     end
 
-    # Filter read-only fields.
-    body_params.delete_if do |f, _|
-      cfg = self.class.field_configuration[f]
-      cfg && cfg[:read_only]
+    # Filter read-only fields. For bulk actions the permitted structure is `{ _json: [...] }`, so we
+    # strip read-only keys from each element rather than the top-level hash (whose only key is
+    # `_json`). Bulk update keeps the primary key, which it needs to locate each record.
+    if bulk_action
+      keep = bulk_action == :update ? [ pk.to_s ] : []
+      body_params[:_json]&.each do |element|
+        next unless element.is_a?(ActionController::Parameters)
+
+        self._rrf_strip_read_only_fields(element, keep: keep)
+      end
+    else
+      self._rrf_strip_read_only_fields(body_params)
     end
 
     body_params
   end
   alias_method :get_create_params, :get_body_params
   alias_method :get_update_params, :get_body_params
+  alias_method :get_destroy_params, :get_body_params
+
+  # Remove read-only fields from a permitted params hash in place. `keep` lists field names to
+  # preserve even when read-only (e.g. the primary key on bulk update, used to locate records).
+  def _rrf_strip_read_only_fields(params, keep: [])
+    params.delete_if do |f, _|
+      next false if f.in?(keep)
+
+      cfg = self.class.field_configuration[f]
+      cfg && cfg[:read_only]
+    end
+  end
 
   # Get the set of records this controller has access to.
   def get_recordset
@@ -760,13 +867,16 @@ module RESTFramework::Controller
 
     # Find by another column if it's permitted.
     if find_by_param = self.class.find_by_query_param.presence
-      if find_by = params[find_by_param].presence
-        find_by_fields = self.class.find_by_fields&.map(&:to_s)
+      if find_by = request.query_parameters[find_by_param].presence
+        find_by_fields = (
+          self.class.find_by_fields&.map(&:to_s) || self.class.model.columns_hash.keys
+        )
 
-        if !find_by_fields || find_by.in?(find_by_fields)
-          is_pk = false unless find_by_key == find_by
-          find_by_key = find_by
-        end
+        # A `find_by` was explicitly requested, so it must be a permitted field.
+        raise ActiveRecord::RecordNotFound unless find_by.in?(find_by_fields)
+
+        is_pk = false unless find_by_key == find_by
+        find_by_key = find_by
       end
     end
 
@@ -799,6 +909,7 @@ module RESTFramework::Controller
   end
 end
 
+require_relative "controller/actions"
 require_relative "controller/bulk"
 require_relative "controller/crud"
 require_relative "controller/openapi"