rest_framework 2.0.0.beta1 → 2.0.0.beta2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6551a744b8574c83f8b5a482e32337e2ea554e4c572baf7c207af3bcda26fb38
-  data.tar.gz: d26a407bcf834d76a6f1d63e7ca22eafe05cd90197a50d53b016e178a2d92dd4
+  metadata.gz: 639dcc597e17e5148cde3f7511637913be7b431899f59a5cc7f504533969233e
+  data.tar.gz: 0c732ab6c80f9c06b29e4a30e29087ff4fa65206df15b7826ffd9f0d2781b774
 SHA512:
-  metadata.gz: b66138a6abd154cc8df980b6a533273dc5f6e5fd07bcb6d381e73254018cc065a1a2b01c6ae086f0eb6274a11501624a80f56ffd0f58657aa4f7c62145b74f7c
-  data.tar.gz: 8222dd29fb6de099e6f555438dcf1328a251a28f20076837176938ebc555a4c1f3d52df0acc77507150f6217058ce8f9dfa53f003641c1ab0e3914d515505348
+  metadata.gz: 656e302db2252a27a30508e1f5c1d2caf2d603288d4ca3e2ec0995355a4a6501b18bc8320463a17113568a562ead98c3896c949a00aa03cc83a6c71f2f62d738
+  data.tar.gz: f760d0140360ca1856dca0ab87b8de1903e09fd7cc442c1b40c9150b7abaf312f43ae67a52a5d0881af9e1f98489a074a82ebaef87b527c99e6e8f7175c67740

data/README.md

@@ -202,8 +202,10 @@ changes; the migration checklist that follows walks through updating an existing
 - **Delegated actions wrap their result under a `return` key**, and raise on a missing or non-public
   target instead of silently 404-ing.
 - **Removed** `rrf_finalize` and the `auto_finalize` / `freeze_config` hooks.
-- **Security hardening** — per-element read-only stripping on bulk writes, an ordering-oracle fix,
-  sanitized `StatementInvalid` messages, and safer query-filter parsing.
+- **Security hardening** — `find_by`, filtering, ordering, and search are scoped to serialized,
+  non-`write_only` fields (so hidden/secret columns can't be used as lookup/enumeration keys), plus
+  per-element read-only stripping on bulk writes, an ordering-oracle fix, sanitized
+  `StatementInvalid` messages, and safer query-filter parsing.
 
 ### Migrating from Older Versions
 
@@ -217,8 +219,8 @@ See the guide for details on each item.
 - [ ] Render custom actions with `render(api: ...)`, replacing the older `api_response(...)` /
       `render_api(...)`.
 - [ ] Replace `rest_resource` / `rest_resources` / `rest_root` with `rest_route`.
-  - Fold any dedicated root controller into the namespace's base controller, which now serves the
-    root via `index_content` (the standalone `root` action and `rest_root` are gone).
+- [ ] Fold any dedicated root controller into the namespace's base controller, which now serves the
+      root via `index_content` (the standalone `root` action and `rest_root` are gone).
 - [ ] Rename `singleton_controller` → `singular`.
 - [ ] Remove `rrf_finalize` calls and the `auto_finalize` / `freeze_config` config (all gone).
 - [ ] Expect paginated `index` responses by default (`self.paginator_class = nil` restores a bare

data/VERSION

@@ -1 +1 @@
-2.0.0.beta1
+2.0.0.beta2

data/lib/rest_framework/controller.rb

@@ -253,33 +253,29 @@ module RESTFramework::Controller
       self.model&.human_attribute_name(s, default: default_title) || default_title
     end
 
-    # Get the available fields. Fallback to this controller's model columns, or an empty array. This
-    # should always return an array of strings.
-    def get_fields(input_fields: nil)
-      input_fields ||= self.fields
-
-      # If fields is a hash, then parse it.
-      if input_fields.is_a?(Hash)
-        return RESTFramework::Utils.parse_fields_hash(
-          input_fields,
+    # Resolve the `fields` config to an array of strings. Memoized, since `fields` and the flags it
+    # depends on are class-level config fixed at load time.
+    def get_fields
+      @get_fields ||= if self.fields.is_a?(Hash)
+        RESTFramework::Utils.parse_fields_hash(
+          self.fields,
           self.model,
           exclude_associations: self.exclude_associations,
           action_text: self.enable_action_text,
           active_storage: self.enable_active_storage,
         )
-      elsif !input_fields
-        # Otherwise, if fields is nil, then fallback to columns.
-        return self.model ? RESTFramework::Utils.fields_for(
+      elsif self.fields
+        self.fields.map(&:to_s)
+      elsif self.model
+        RESTFramework::Utils.fields_for(
           self.model,
           exclude_associations: self.exclude_associations,
           action_text: self.enable_action_text,
           active_storage: self.enable_active_storage,
-        ) : []
-      elsif input_fields
-        input_fields = input_fields.map(&:to_s)
+        )
+      else
+        []
       end
-
-      input_fields
     end
 
     # Get a full field configuration, including defaults and inferred values.
@@ -647,7 +643,27 @@ module RESTFramework::Controller
   end
 
   def get_fields
-    self.class.get_fields(input_fields: self.class.fields)
+    self.class.get_fields
+  end
+
+  def readable_fields
+    cfg = self.class.field_configuration
+    self.get_fields.reject { |f| cfg[f]&.[](:write_only) }
+  end
+
+  # `readable_fields` restricted to real columns, for query surfaces that build SQL directly
+  # (find_by, search) and would raise on a virtual/method field.
+  def readable_columns
+    self.readable_fields & self.class.model.column_names
+  end
+
+  # `readable_fields` restricted to columns and associations, for surfaces that also resolve dotted
+  # `association.sub_field` paths (filtering, ordering). Excludes virtual/method fields, which have
+  # no column to order or filter by.
+  def readable_columns_or_associations
+    cfg = self.class.field_configuration
+    columns = self.class.model.column_names
+    self.readable_fields.select { |f| f.in?(columns) || cfg[f]&.[](:kind) == "association" }
   end
 
   # Get a hash of strong parameters for the current action.
@@ -657,7 +673,8 @@ module RESTFramework::Controller
     @_get_allowed_parameters = self.class.allowed_parameters
     return @_get_allowed_parameters if @_get_allowed_parameters
 
-    # Assemble strong parameters.
+    # Assemble strong parameters. Read-only fields are permitted here and stripped later per-action
+    # by `_rrf_strip_read_only_fields` (which keeps the primary key on bulk update to find records).
     variations = []
     hash_variations = {}
     reflections = self.class.model.reflections
@@ -868,9 +885,10 @@ module RESTFramework::Controller
     # Find by another column if it's permitted.
     if find_by_param = self.class.find_by_query_param.presence
       if find_by = request.query_parameters[find_by_param].presence
-        find_by_fields = (
-          self.class.find_by_fields&.map(&:to_s) || self.class.model.columns_hash.keys
-        )
+        # Default to readable columns: excluding write_only keeps hidden values from being used as
+        # lookup keys, and restricting to real columns keeps virtual/method fields from reaching a
+        # doomed `find_by(<not a column>)` (which would raise on the DB).
+        find_by_fields = self.class.find_by_fields&.map(&:to_s) || self.readable_columns
 
         # A `find_by` was explicitly requested, so it must be a permitted field.
         raise ActiveRecord::RecordNotFound unless find_by.in?(find_by_fields)

data/lib/rest_framework/filters/ordering_filter.rb

@@ -1,7 +1,8 @@
 # A filter backend which handles ordering of the recordset.
 class RESTFramework::Filters::OrderingFilter < RESTFramework::Filters::BaseFilter
   def _get_fields
-    @controller.class.ordering_fields&.map(&:to_s) || @controller.get_fields
+    # Always return a list of strings; `@controller.readable_columns_or_associations` already does.
+    @controller.class.ordering_fields&.map(&:to_s) || @controller.readable_columns_or_associations
   end
 
   # Convert the ordering param into an `[ordering, references]` pair: the ordering config for

data/lib/rest_framework/filters/query_filter.rb

@@ -43,8 +43,8 @@ class RESTFramework::Filters::QueryFilter < RESTFramework::Filters::BaseFilter
   ARRAY_PREDICATES = %i[in not].freeze
 
   def _get_fields
-    # Always return a list of strings; `@controller.get_fields` already does this.
-    @controller.class.filter_fields&.map(&:to_s) || @controller.get_fields
+    # Always return a list of strings; `@controller.readable_columns_or_associations` already does.
+    @controller.class.filter_fields&.map(&:to_s) || @controller.readable_columns_or_associations
   end
 
   # Helper to find a variation of a field using a predicate. For example, there could be a field

data/lib/rest_framework/filters/search_filter.rb

@@ -1,13 +1,9 @@
 class RESTFramework::Filters::SearchFilter < RESTFramework::Filters::BaseFilter
   def _get_fields
-    if search_fields = @controller.class.search_fields
-      return search_fields&.map(&:to_s)
-    end
-
-    columns = @controller.class.model.column_names
-    @controller.get_fields.select { |f|
-      f.in?(RESTFramework.config.search_columns) && f.in?(columns)
-    }
+    # Always return a list of strings; `@controller.readable_columns` already does.
+    @controller.class.search_fields&.map(&:to_s) || (
+      @controller.readable_columns & RESTFramework.config.search_columns
+    )
   end
 
   # Filter data according to the request query parameters.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rest_framework
 version: !ruby/object:Gem::Version
-  version: 2.0.0.beta1
+  version: 2.0.0.beta2
 platform: ruby
 authors:
 - Gregory N. Schmit