rest_framework 2.0.0.beta3 → 2.0.0.beta4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7cedfa02dac90388b712f4e15e29d07a40e45df23847bebf5da02eea03862e75
-  data.tar.gz: 2de9c962810e9473dd5eb68c2ee42da764ed793e341049a49d9f4ca8d34fa48e
+  metadata.gz: 4b09674d62848416f77b39e23bc7b586e105786c7605320ad61761fe76ebc033
+  data.tar.gz: d8242a8db125185c3b1d778f4b4f2697a174d0bf17f796329cc4a0dfa11be99e
 SHA512:
-  metadata.gz: f52b1b1075fef181d9e771df56f1c088c73601d600606411974febb1bb544facacc7d16d83c2b34929acc0d0f44a0e518098a3a121fcdf27f7e5f12be3a5d8ca
-  data.tar.gz: c08ffc3af87bb7d7337dd1a908c7c6199fa3e70328b06dbebd1a691a0c3f235224b0119026eda4274f555385254383d2a7a29719b339f5c487f0ee82a7b2bcd2
+  metadata.gz: 8399d7751f5116a6196853e64c704f153c33e0a79923fa6fa0c12a3867f0669f3f7651f6ea4528b5bd976a76ea7e2e2604a87fcb1c39116d0148c79e34d36d30
+  data.tar.gz: f32a2db5595e8aee9dc069aa4fcaf6f96fffc35cb69b4ebc2d76589951a5dc1fdcdeae46631ad5af1506dbb365d07749461e12702ca8b36d7f1afa12e3922e83

data/VERSION

@@ -1 +1 @@
-2.0.0.beta3
+2.0.0.beta4

data/lib/rest_framework/controller.rb

@@ -651,6 +651,15 @@ module RESTFramework::Controller
     self.get_fields.reject { |f| cfg[f]&.[](:write_only) }
   end
 
+  # The fields a client may write (create/update): `get_fields` minus read_only fields. Excluding
+  # them here — before strong parameters expand associations into `_id`/`_ids`/`_attributes` keys —
+  # keeps a read_only association from ever producing a permitted (and otherwise unstrippable, since
+  # those keys don't match a field name) assignment key.
+  def writable_fields
+    cfg = self.class.field_configuration
+    self.get_fields.reject { |f| cfg[f]&.[](:read_only) }
+  end
+
   # `readable_fields` restricted to real columns, for query surfaces that build SQL directly
   # (find_by, search) and would raise on a virtual/method field.
   def readable_columns
@@ -673,12 +682,14 @@ module RESTFramework::Controller
     @_get_allowed_parameters = self.class.allowed_parameters
     return @_get_allowed_parameters if @_get_allowed_parameters
 
-    # Assemble strong parameters. Read-only fields are permitted here and stripped later per-action
-    # by `_rrf_strip_read_only_fields` (which keeps the primary key on bulk update to find records).
+    # Assemble strong parameters from writable fields only, so read-only fields never produce a
+    # permitted key — including the `_id`/`_ids`/`_attributes` variations an association expands
+    # into, which a later key-name-based filter couldn't catch. Bulk update re-permits the primary
+    # key (see `get_body_params`) since it needs it to locate each record.
     variations = []
     hash_variations = {}
     reflections = self.class.model.reflections
-    @_get_allowed_parameters = self.get_fields.map { |f|
+    @_get_allowed_parameters = self.writable_fields.map { |f|
       f = f.to_s
       config = self.class.field_configuration[f]
 
@@ -823,37 +834,12 @@ module RESTFramework::Controller
       body_params[k].unshift(*v)
     end
 
-    # Filter read-only fields. For bulk actions the permitted structure is `{ _json: [...] }`, so we
-    # strip read-only keys from each element rather than the top-level hash (whose only key is
-    # `_json`). Bulk update keeps the primary key, which it needs to locate each record.
-    if bulk_action
-      keep = bulk_action == :update ? [ pk.to_s ] : []
-      body_params[:_json]&.each do |element|
-        next unless element.is_a?(ActionController::Parameters)
-
-        self._rrf_strip_read_only_fields(element, keep: keep)
-      end
-    else
-      self._rrf_strip_read_only_fields(body_params)
-    end
-
     body_params
   end
   alias_method :get_create_params, :get_body_params
   alias_method :get_update_params, :get_body_params
   alias_method :get_destroy_params, :get_body_params
 
-  # Remove read-only fields from a permitted params hash in place. `keep` lists field names to
-  # preserve even when read-only (e.g. the primary key on bulk update, used to locate records).
-  def _rrf_strip_read_only_fields(params, keep: [])
-    params.delete_if do |f, _|
-      next false if f.in?(keep)
-
-      cfg = self.class.field_configuration[f]
-      cfg && cfg[:read_only]
-    end
-  end
-
   # Get the set of records this controller has access to.
   def get_recordset
     return self.class.recordset if self.class.recordset

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rest_framework
 version: !ruby/object:Gem::Version
-  version: 2.0.0.beta3
+  version: 2.0.0.beta4
 platform: ruby
 authors:
 - Gregory N. Schmit
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-01 00:00:00.000000000 Z
+date: 2026-08-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails