rest_framework 2.0.0.beta1 → 2.0.0.beta3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6551a744b8574c83f8b5a482e32337e2ea554e4c572baf7c207af3bcda26fb38
-  data.tar.gz: d26a407bcf834d76a6f1d63e7ca22eafe05cd90197a50d53b016e178a2d92dd4
+  metadata.gz: 7cedfa02dac90388b712f4e15e29d07a40e45df23847bebf5da02eea03862e75
+  data.tar.gz: 2de9c962810e9473dd5eb68c2ee42da764ed793e341049a49d9f4ca8d34fa48e
 SHA512:
-  metadata.gz: b66138a6abd154cc8df980b6a533273dc5f6e5fd07bcb6d381e73254018cc065a1a2b01c6ae086f0eb6274a11501624a80f56ffd0f58657aa4f7c62145b74f7c
-  data.tar.gz: 8222dd29fb6de099e6f555438dcf1328a251a28f20076837176938ebc555a4c1f3d52df0acc77507150f6217058ce8f9dfa53f003641c1ab0e3914d515505348
+  metadata.gz: f52b1b1075fef181d9e771df56f1c088c73601d600606411974febb1bb544facacc7d16d83c2b34929acc0d0f44a0e518098a3a121fcdf27f7e5f12be3a5d8ca
+  data.tar.gz: c08ffc3af87bb7d7337dd1a908c7c6199fa3e70328b06dbebd1a691a0c3f235224b0119026eda4274f555385254383d2a7a29719b339f5c487f0ee82a7b2bcd2

data/README.md

@@ -202,8 +202,10 @@ changes; the migration checklist that follows walks through updating an existing
 - **Delegated actions wrap their result under a `return` key**, and raise on a missing or non-public
   target instead of silently 404-ing.
 - **Removed** `rrf_finalize` and the `auto_finalize` / `freeze_config` hooks.
-- **Security hardening** — per-element read-only stripping on bulk writes, an ordering-oracle fix,
-  sanitized `StatementInvalid` messages, and safer query-filter parsing.
+- **Security hardening** — `find_by`, filtering, ordering, and search are scoped to serialized,
+  non-`write_only` fields (so hidden/secret columns can't be used as lookup/enumeration keys), plus
+  per-element read-only stripping on bulk writes, an ordering-oracle fix, sanitized
+  `StatementInvalid` messages, and safer query-filter parsing.
 
 ### Migrating from Older Versions
 
@@ -217,8 +219,8 @@ See the guide for details on each item.
 - [ ] Render custom actions with `render(api: ...)`, replacing the older `api_response(...)` /
       `render_api(...)`.
 - [ ] Replace `rest_resource` / `rest_resources` / `rest_root` with `rest_route`.
-  - Fold any dedicated root controller into the namespace's base controller, which now serves the
-    root via `index_content` (the standalone `root` action and `rest_root` are gone).
+- [ ] Fold any dedicated root controller into the namespace's base controller, which now serves the
+      root via `index_content` (the standalone `root` action and `rest_root` are gone).
 - [ ] Rename `singleton_controller` → `singular`.
 - [ ] Remove `rrf_finalize` calls and the `auto_finalize` / `freeze_config` config (all gone).
 - [ ] Expect paginated `index` responses by default (`self.paginator_class = nil` restores a bare

data/VERSION

@@ -1 +1 @@
-2.0.0.beta1
+2.0.0.beta3

data/lib/rest_framework/controller.rb

@@ -253,33 +253,29 @@ module RESTFramework::Controller
       self.model&.human_attribute_name(s, default: default_title) || default_title
     end
 
-    # Get the available fields. Fallback to this controller's model columns, or an empty array. This
-    # should always return an array of strings.
-    def get_fields(input_fields: nil)
-      input_fields ||= self.fields
-
-      # If fields is a hash, then parse it.
-      if input_fields.is_a?(Hash)
-        return RESTFramework::Utils.parse_fields_hash(
-          input_fields,
+    # Resolve the `fields` config to an array of strings. Memoized, since `fields` and the flags it
+    # depends on are class-level config fixed at load time.
+    def get_fields
+      @get_fields ||= if self.fields.is_a?(Hash)
+        RESTFramework::Utils.parse_fields_hash(
+          self.fields,
           self.model,
           exclude_associations: self.exclude_associations,
           action_text: self.enable_action_text,
           active_storage: self.enable_active_storage,
         )
-      elsif !input_fields
-        # Otherwise, if fields is nil, then fallback to columns.
-        return self.model ? RESTFramework::Utils.fields_for(
+      elsif self.fields
+        self.fields.map(&:to_s)
+      elsif self.model
+        RESTFramework::Utils.fields_for(
           self.model,
           exclude_associations: self.exclude_associations,
           action_text: self.enable_action_text,
           active_storage: self.enable_active_storage,
-        ) : []
-      elsif input_fields
-        input_fields = input_fields.map(&:to_s)
+        )
+      else
+        []
       end
-
-      input_fields
     end
 
     # Get a full field configuration, including defaults and inferred values.
@@ -647,7 +643,27 @@ module RESTFramework::Controller
   end
 
   def get_fields
-    self.class.get_fields(input_fields: self.class.fields)
+    self.class.get_fields
+  end
+
+  def readable_fields
+    cfg = self.class.field_configuration
+    self.get_fields.reject { |f| cfg[f]&.[](:write_only) }
+  end
+
+  # `readable_fields` restricted to real columns, for query surfaces that build SQL directly
+  # (find_by, search) and would raise on a virtual/method field.
+  def readable_columns
+    self.readable_fields & self.class.model.column_names
+  end
+
+  # `readable_fields` restricted to columns and associations, for surfaces that also resolve dotted
+  # `association.sub_field` paths (filtering, ordering). Excludes virtual/method fields, which have
+  # no column to order or filter by.
+  def readable_columns_or_associations
+    cfg = self.class.field_configuration
+    columns = self.class.model.column_names
+    self.readable_fields.select { |f| f.in?(columns) || cfg[f]&.[](:kind) == "association" }
   end
 
   # Get a hash of strong parameters for the current action.
@@ -657,7 +673,8 @@ module RESTFramework::Controller
     @_get_allowed_parameters = self.class.allowed_parameters
     return @_get_allowed_parameters if @_get_allowed_parameters
 
-    # Assemble strong parameters.
+    # Assemble strong parameters. Read-only fields are permitted here and stripped later per-action
+    # by `_rrf_strip_read_only_fields` (which keeps the primary key on bulk update to find records).
     variations = []
     hash_variations = {}
     reflections = self.class.model.reflections
@@ -868,9 +885,10 @@ module RESTFramework::Controller
     # Find by another column if it's permitted.
     if find_by_param = self.class.find_by_query_param.presence
       if find_by = request.query_parameters[find_by_param].presence
-        find_by_fields = (
-          self.class.find_by_fields&.map(&:to_s) || self.class.model.columns_hash.keys
-        )
+        # Default to readable columns: excluding write_only keeps hidden values from being used as
+        # lookup keys, and restricting to real columns keeps virtual/method fields from reaching a
+        # doomed `find_by(<not a column>)` (which would raise on the DB).
+        find_by_fields = self.class.find_by_fields&.map(&:to_s) || self.readable_columns
 
         # A `find_by` was explicitly requested, so it must be a permitted field.
         raise ActiveRecord::RecordNotFound unless find_by.in?(find_by_fields)

data/lib/rest_framework/filters/ordering_filter.rb

@@ -1,7 +1,8 @@
 # A filter backend which handles ordering of the recordset.
 class RESTFramework::Filters::OrderingFilter < RESTFramework::Filters::BaseFilter
   def _get_fields
-    @controller.class.ordering_fields&.map(&:to_s) || @controller.get_fields
+    # Always return a list of strings; `@controller.readable_columns_or_associations` already does.
+    @controller.class.ordering_fields&.map(&:to_s) || @controller.readable_columns_or_associations
   end
 
   # Convert the ordering param into an `[ordering, references]` pair: the ordering config for

data/lib/rest_framework/filters/query_filter.rb

@@ -43,8 +43,8 @@ class RESTFramework::Filters::QueryFilter < RESTFramework::Filters::BaseFilter
   ARRAY_PREDICATES = %i[in not].freeze
 
   def _get_fields
-    # Always return a list of strings; `@controller.get_fields` already does this.
-    @controller.class.filter_fields&.map(&:to_s) || @controller.get_fields
+    # Always return a list of strings; `@controller.readable_columns_or_associations` already does.
+    @controller.class.filter_fields&.map(&:to_s) || @controller.readable_columns_or_associations
   end
 
   # Helper to find a variation of a field using a predicate. For example, there could be a field

data/lib/rest_framework/filters/search_filter.rb

@@ -1,13 +1,9 @@
 class RESTFramework::Filters::SearchFilter < RESTFramework::Filters::BaseFilter
   def _get_fields
-    if search_fields = @controller.class.search_fields
-      return search_fields&.map(&:to_s)
-    end
-
-    columns = @controller.class.model.column_names
-    @controller.get_fields.select { |f|
-      f.in?(RESTFramework.config.search_columns) && f.in?(columns)
-    }
+    # Always return a list of strings; `@controller.readable_columns` already does.
+    @controller.class.search_fields&.map(&:to_s) || (
+      @controller.readable_columns & RESTFramework.config.search_columns
+    )
   end
 
   # Filter data according to the request query parameters.

data/lib/rest_framework/serializers/native_serializer.rb

@@ -184,6 +184,39 @@ class RESTFramework::Serializers::NativeSerializer < RESTFramework::Serializers:
       (ref.klass.method_defined?(field) && !ref.klass.reflect_on_association(field.to_sym))
   end
 
+  # Recursively translate an association's fields into a `serializable_hash` config
+  # (`only`/`methods`/`include`). Columns go to `only` and plain methods to `methods`; a field that
+  # is itself an association is recursed into (as a nested `include`) only when it has its own entry
+  # in `field_config[:field_config]`. Otherwise it falls through to a method and serializes as
+  # before (its full `as_json`), so deeper nesting is opt-in and never narrows the default output.
+  def _build_association_config(model, fields, field_config)
+    nested = field_config[:field_config] || {}
+    only = []
+    methods = []
+    includes = {}
+
+    fields.each do |sf|
+      sf = sf.to_s
+      sub_field_config = nested[sf.to_sym] || nested[sf]
+
+      if sf.in?(model.column_names)
+        only << sf
+      elsif sub_field_config && (ref = model.reflect_on_association(sf.to_sym)) && !ref.polymorphic?
+        sub_fields = sub_field_config[:fields]&.map(&:to_s) ||
+          RESTFramework::Utils.association_fields_for(ref)
+        includes[sf] = self._build_association_config(ref.klass, sub_fields, sub_field_config)
+      elsif model.method_defined?(sf)
+        methods << sf
+      else
+        only << sf
+      end
+    end
+
+    config = { only: only, methods: methods }
+    config[:include] = includes if includes.any?
+    config
+  end
+
   # Get a serializer configuration from the controller. `@controller` and `@model` must be set.
   def _get_controller_serializer_config
     columns = []
@@ -208,16 +241,13 @@ class RESTFramework::Serializers::NativeSerializer < RESTFramework::Serializers:
       if f.in?(column_names)
         columns << f
       elsif ref = reflections[f]
-        sub_columns = []
-        sub_methods = []
-        self._effective_association_fields(f, ref, field_config).each do |sf|
-          if !ref.polymorphic? && sf.in?(ref.klass.column_names)
-            sub_columns << sf
-          else
-            sub_methods << sf
-          end
+        effective_fields = self._effective_association_fields(f, ref, field_config)
+        sub_config = if ref.polymorphic?
+          # No single target class to introspect, so serialize every field as a method.
+          { only: [], methods: effective_fields }
+        else
+          self._build_association_config(ref.klass, effective_fields, field_config)
         end
-        sub_config = { only: sub_columns, methods: sub_methods }
 
         # Apply certain rules regarding collection associations.
         if ref.collection?

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rest_framework
 version: !ruby/object:Gem::Version
-  version: 2.0.0.beta1
+  version: 2.0.0.beta3
 platform: ruby
 authors:
 - Gregory N. Schmit
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-31 00:00:00.000000000 Z
+date: 2026-08-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails