rest_framework 2.0.0.beta2 → 2.0.0.beta4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 639dcc597e17e5148cde3f7511637913be7b431899f59a5cc7f504533969233e
-  data.tar.gz: 0c732ab6c80f9c06b29e4a30e29087ff4fa65206df15b7826ffd9f0d2781b774
+  metadata.gz: 4b09674d62848416f77b39e23bc7b586e105786c7605320ad61761fe76ebc033
+  data.tar.gz: d8242a8db125185c3b1d778f4b4f2697a174d0bf17f796329cc4a0dfa11be99e
 SHA512:
-  metadata.gz: 656e302db2252a27a30508e1f5c1d2caf2d603288d4ca3e2ec0995355a4a6501b18bc8320463a17113568a562ead98c3896c949a00aa03cc83a6c71f2f62d738
-  data.tar.gz: f760d0140360ca1856dca0ab87b8de1903e09fd7cc442c1b40c9150b7abaf312f43ae67a52a5d0881af9e1f98489a074a82ebaef87b527c99e6e8f7175c67740
+  metadata.gz: 8399d7751f5116a6196853e64c704f153c33e0a79923fa6fa0c12a3867f0669f3f7651f6ea4528b5bd976a76ea7e2e2604a87fcb1c39116d0148c79e34d36d30
+  data.tar.gz: f32a2db5595e8aee9dc069aa4fcaf6f96fffc35cb69b4ebc2d76589951a5dc1fdcdeae46631ad5af1506dbb365d07749461e12702ca8b36d7f1afa12e3922e83

data/VERSION

@@ -1 +1 @@
-2.0.0.beta2
+2.0.0.beta4

data/lib/rest_framework/controller.rb

@@ -651,6 +651,15 @@ module RESTFramework::Controller
     self.get_fields.reject { |f| cfg[f]&.[](:write_only) }
   end
 
+  # The fields a client may write (create/update): `get_fields` minus read_only fields. Excluding
+  # them here — before strong parameters expand associations into `_id`/`_ids`/`_attributes` keys —
+  # keeps a read_only association from ever producing a permitted (and otherwise unstrippable, since
+  # those keys don't match a field name) assignment key.
+  def writable_fields
+    cfg = self.class.field_configuration
+    self.get_fields.reject { |f| cfg[f]&.[](:read_only) }
+  end
+
   # `readable_fields` restricted to real columns, for query surfaces that build SQL directly
   # (find_by, search) and would raise on a virtual/method field.
   def readable_columns
@@ -673,12 +682,14 @@ module RESTFramework::Controller
     @_get_allowed_parameters = self.class.allowed_parameters
     return @_get_allowed_parameters if @_get_allowed_parameters
 
-    # Assemble strong parameters. Read-only fields are permitted here and stripped later per-action
-    # by `_rrf_strip_read_only_fields` (which keeps the primary key on bulk update to find records).
+    # Assemble strong parameters from writable fields only, so read-only fields never produce a
+    # permitted key — including the `_id`/`_ids`/`_attributes` variations an association expands
+    # into, which a later key-name-based filter couldn't catch. Bulk update re-permits the primary
+    # key (see `get_body_params`) since it needs it to locate each record.
     variations = []
     hash_variations = {}
     reflections = self.class.model.reflections
-    @_get_allowed_parameters = self.get_fields.map { |f|
+    @_get_allowed_parameters = self.writable_fields.map { |f|
       f = f.to_s
       config = self.class.field_configuration[f]
 
@@ -823,37 +834,12 @@ module RESTFramework::Controller
       body_params[k].unshift(*v)
     end
 
-    # Filter read-only fields. For bulk actions the permitted structure is `{ _json: [...] }`, so we
-    # strip read-only keys from each element rather than the top-level hash (whose only key is
-    # `_json`). Bulk update keeps the primary key, which it needs to locate each record.
-    if bulk_action
-      keep = bulk_action == :update ? [ pk.to_s ] : []
-      body_params[:_json]&.each do |element|
-        next unless element.is_a?(ActionController::Parameters)
-
-        self._rrf_strip_read_only_fields(element, keep: keep)
-      end
-    else
-      self._rrf_strip_read_only_fields(body_params)
-    end
-
     body_params
   end
   alias_method :get_create_params, :get_body_params
   alias_method :get_update_params, :get_body_params
   alias_method :get_destroy_params, :get_body_params
 
-  # Remove read-only fields from a permitted params hash in place. `keep` lists field names to
-  # preserve even when read-only (e.g. the primary key on bulk update, used to locate records).
-  def _rrf_strip_read_only_fields(params, keep: [])
-    params.delete_if do |f, _|
-      next false if f.in?(keep)
-
-      cfg = self.class.field_configuration[f]
-      cfg && cfg[:read_only]
-    end
-  end
-
   # Get the set of records this controller has access to.
   def get_recordset
     return self.class.recordset if self.class.recordset

data/lib/rest_framework/serializers/native_serializer.rb

@@ -184,6 +184,39 @@ class RESTFramework::Serializers::NativeSerializer < RESTFramework::Serializers:
       (ref.klass.method_defined?(field) && !ref.klass.reflect_on_association(field.to_sym))
   end
 
+  # Recursively translate an association's fields into a `serializable_hash` config
+  # (`only`/`methods`/`include`). Columns go to `only` and plain methods to `methods`; a field that
+  # is itself an association is recursed into (as a nested `include`) only when it has its own entry
+  # in `field_config[:field_config]`. Otherwise it falls through to a method and serializes as
+  # before (its full `as_json`), so deeper nesting is opt-in and never narrows the default output.
+  def _build_association_config(model, fields, field_config)
+    nested = field_config[:field_config] || {}
+    only = []
+    methods = []
+    includes = {}
+
+    fields.each do |sf|
+      sf = sf.to_s
+      sub_field_config = nested[sf.to_sym] || nested[sf]
+
+      if sf.in?(model.column_names)
+        only << sf
+      elsif sub_field_config && (ref = model.reflect_on_association(sf.to_sym)) && !ref.polymorphic?
+        sub_fields = sub_field_config[:fields]&.map(&:to_s) ||
+          RESTFramework::Utils.association_fields_for(ref)
+        includes[sf] = self._build_association_config(ref.klass, sub_fields, sub_field_config)
+      elsif model.method_defined?(sf)
+        methods << sf
+      else
+        only << sf
+      end
+    end
+
+    config = { only: only, methods: methods }
+    config[:include] = includes if includes.any?
+    config
+  end
+
   # Get a serializer configuration from the controller. `@controller` and `@model` must be set.
   def _get_controller_serializer_config
     columns = []
@@ -208,16 +241,13 @@ class RESTFramework::Serializers::NativeSerializer < RESTFramework::Serializers:
       if f.in?(column_names)
         columns << f
       elsif ref = reflections[f]
-        sub_columns = []
-        sub_methods = []
-        self._effective_association_fields(f, ref, field_config).each do |sf|
-          if !ref.polymorphic? && sf.in?(ref.klass.column_names)
-            sub_columns << sf
-          else
-            sub_methods << sf
-          end
+        effective_fields = self._effective_association_fields(f, ref, field_config)
+        sub_config = if ref.polymorphic?
+          # No single target class to introspect, so serialize every field as a method.
+          { only: [], methods: effective_fields }
+        else
+          self._build_association_config(ref.klass, effective_fields, field_config)
         end
-        sub_config = { only: sub_columns, methods: sub_methods }
 
         # Apply certain rules regarding collection associations.
         if ref.collection?

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rest_framework
 version: !ruby/object:Gem::Version
-  version: 2.0.0.beta2
+  version: 2.0.0.beta4
 platform: ruby
 authors:
 - Gregory N. Schmit
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-31 00:00:00.000000000 Z
+date: 2026-08-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails