rest_framework 2.0.0.rc1 → 2.0.0.rc2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 827c588ec16bebf728f1bc186d0b716488be2a13d7d653fec82ff3c1bd3d7a75
-  data.tar.gz: f1447d4d393e9ab18fc82a2edeb1b366d7236ad46a00aa5e1adedb294262f3a9
+  metadata.gz: 358f030b86e0232e68278653fae211e71cf1efe419c7050119118d36169b1e2b
+  data.tar.gz: 7b28aa42477c3a4eb9aad33dbdc78220e12fe5a4f359b701cee0dde999e1aa84
 SHA512:
-  metadata.gz: 818d459d7b6897e777edb7d403e23087c19d2a18c8002cb8fc343381c514b7aa49da625f460d0fd06a181d76fe55308ec2642f493f4627aef82d98d341775014
-  data.tar.gz: 50226b18ddd51c61a88952c2637c3ea0c622ef59385ddcaff8b231dc0b2aabcacbe6fb5dd9a7db5d4d49bc67600c1d543781e9065cb37faa2344998186df3018
+  metadata.gz: 69483cd5c46acd3e01e64af5336ce9e3b230448d66e159804fe3af706d1670d6ec32d60c03bf9dde682e846759aa0769898cb12e46b8b73e25167765fb739a80
+  data.tar.gz: fb65b66a849de488b55ea19e085cc33d7e06ca5bffc70c0cc24788970fbbe9921e017f1bd196bc374b51a904cf4df22b5ba3f4e9b97abb8a59010e401bf07b57

data/README.md

@@ -253,7 +253,16 @@ See the guide for details on each item.
       array).
 - [ ] Rename config: `sub_fields` → `fields`, `native_serializer_associations_limit[_max]` →
       `association_limit[_max]`, `native_serializer_include_associations_count` →
-      `include_association_count`; the `?associations_limit=N` param is gone.
+      `include_association_count`, `native_serializer_{only,except,include,exclude}_query_param` →
+      `{only,except,include,exclude}_query_param`; the `?associations_limit=N` param is gone.
+- [ ] Move `field_config` into `fields`: it's now the `config:` key of the `fields` hash
+      (`self.fields = { only: [...], config: { email: { label: "Email Address" } } }`). A field
+      named in `config:` is implicitly part of the set. An association's `fields:` takes the same
+      spec form (an array, or an `only:`/`include:`/`exclude:`/`config:` hash), replacing the old
+      nested `field_config:` key.
+- [ ] Replace the `native_serializer_config` / `native_serializer_singular_config` /
+      `native_serializer_plural_config` attributes with a custom `serializer_class` — a
+      `NativeSerializer` subclass carrying `config` / `singular_config` / `plural_config`.
 - [ ] Note client-visible behavior changes: delegated actions wrap their result under a `return`
       key; a non-permitted `find_by` returns `404`; `update_all` / `destroy_all` are plural-only;
       ordering/pagination read from the query string only.

data/lib/rest_framework/controller/openapi.rb

@@ -183,9 +183,11 @@ module RESTFramework::Controller
           v[:writeOnly] = true if cfg[:write_only]
           v[:default] = cfg[:default] if cfg.key?(:default)
 
-          if enum_variants = cfg[:enum_variants]
-            v[:enum] = enum_variants.keys
-            v[:"x-rrf-enum_variants"] = enum_variants
+          if (options = cfg[:options]).present?
+            # Emit `oneOf` for options, but also emit `enum` for true ActiveRecord enums, since some
+            # older tooling reads `enum` but not `oneOf`.
+            v[:oneOf] = options.map { |value, label| { const: value, title: label } }
+            v[:enum] = options.keys if cfg[:enum]
           end
 
           if validators = cfg[:validators]

data/lib/rest_framework/controller.rb

@@ -26,9 +26,10 @@ module RESTFramework::Controller
     bulk_max_size: nil,
     bulk_max_raw_size: nil,
 
-    # Configuring record fields.
+    # Configuring record fields. `fields` is the single source of truth: an Array (sugar for
+    # `only:`), or a Hash of `only:`/`include:`/`exclude:`/`except:` (set membership) plus `config:`
+    # (per-field configuration, keyed by field name).
     fields: nil,
-    field_config: nil,
     read_only_fields: RESTFramework.config.read_only_fields,
     write_only_fields: RESTFramework.config.write_only_fields,
     hidden_fields: nil,
@@ -40,32 +41,19 @@ module RESTFramework::Controller
     # Handling request body parameters.
     allowed_parameters: nil,
 
-    # Options for the default native serializer.
-    native_serializer_config: nil,
-    native_serializer_singular_config: nil,
-    native_serializer_plural_config: nil,
-    native_serializer_only_query_param: "only".freeze,
-    native_serializer_except_query_param: "except".freeze,
-    native_serializer_include_query_param: "include".freeze,
-    native_serializer_exclude_query_param: "exclude".freeze,
+    # Query params for the default native serializer's field selection.
+    only_query_param: "only".freeze,
+    except_query_param: "except".freeze,
+    include_query_param: "include".freeze,
+    exclude_query_param: "exclude".freeze,
 
     # Options for including associations and collection counts.
     exclude_associations: false,
     include_association_count: false,
 
-    # The number of records serialized per collection association, so responses are bounded out of
-    # the box (`nil` = unlimited). With `enable_association_queries`, a client can raise it for a
-    # given association via `?<prefix>.<name>.limit=N` or `limit=all` (`none`/`0` are aliases), both
-    # capped at `association_limit_max` (the "all" forms yield the cap). Set the max to `nil` to let
-    # a client request unlimited records.
+    # Options for association serialization.
     association_limit: 10,
     association_limit_max: 100,
-
-    # Let clients request extra fields for a serialized association via
-    # `?<prefix>.<association>.fields=a,b,c`. The allowlist keeps an association from ever exposing
-    # more than its own endpoint would: an explicit per-association `requestable_fields` in
-    # `field_config`, else the fields the associated model's sibling controller serializes.
-    # Off/secure by default.
     enable_association_queries: false,
     association_query_prefix: "associations".freeze,
 
@@ -95,10 +83,6 @@ module RESTFramework::Controller
     # Option for `recordset.create` vs `Model.create` behavior.
     create_from_recordset: true,
 
-    # Options for scoped nested routing.
-    scope_nested_by_parent: true,
-    scope_nested_through_controllers: true,
-
     # Options related to serialization.
     rescue_unknown_format_with: :json,
     serializer_class: nil,
@@ -283,7 +267,8 @@ module RESTFramework::Controller
     def field_configuration
       return @field_configuration if @field_configuration
 
-      field_config = self.field_config&.with_indifferent_access || {}
+      field_config = (self.fields.is_a?(Hash) ? self.fields[:config] : nil)
+        &.with_indifferent_access || {}
       columns = self.model.columns_hash
       column_defaults = self.model.column_defaults
       reflections = self.model.reflections
@@ -342,9 +327,9 @@ module RESTFramework::Controller
           if type = attribute.type
             cfg[:type] ||= type.type if type.type
 
-            # Get enum variants.
             if type.is_a?(ActiveRecord::Enum::EnumType)
-              cfg[:enum_variants] = type.send(:mapping)
+              cfg[:enum] = true
+              cfg[:options] ||= type.send(:mapping).invert
 
               # TranslateEnum Integration:
               translate_method = "translated_#{f.pluralize}"
@@ -365,8 +350,15 @@ module RESTFramework::Controller
           else
             ref_columns = ref.klass.columns_hash
           end
-          cfg[:fields] ||= RESTFramework::Utils.association_fields_for(ref)
-          cfg[:fields] = cfg[:fields].map(&:to_s)
+          # The association's `fields` config is itself a spec (Array or `only:`/`include:`/
+          # `exclude:`/`config:` Hash). Resolve its membership to a name array (consumed by the
+          # serializer, filters, and OpenAPI) and stash any nested `config:` for the serializer's
+          # recursion.
+          spec = RESTFramework::Utils.normalize_field_spec(cfg[:fields])
+          cfg[:fields] = RESTFramework::Utils.resolve_field_names(
+            spec, RESTFramework::Utils.association_fields_for(ref)
+          )
+          cfg[:field_config] = spec[:config] if spec[:config]
 
           # Strings, to match `:fields` when intersecting requested fields against the allowlist.
           if cfg[:requestable_fields]
@@ -479,17 +471,14 @@ module RESTFramework::Controller
     # The fields a consumer may request for an association beyond its defaults, derived from the
     # associated model's sibling controller: what that controller serializes, so the association can
     # never expose more than its own endpoint would. Empty unless the sibling is discoverable and
-    # introspectable — a custom serializer makes its `get_fields` meaningless. Hidden fields are
-    # included (retrievable via `?only=` there); write-only fields and nested associations aren't.
+    # introspectable — a custom `serializer_class` makes its `get_fields` meaningless. Hidden fields
+    # are included (retrievable via `?only=` there); write-only and nested associations aren't.
     def association_requestable_fields(ref)
       return [] if ref.polymorphic?
 
       sibling = RESTFramework::Utils.controller_for_model(self, ref.klass)
       return [] unless sibling
-      return [] if sibling.serializer_class ||
-        sibling.native_serializer_config ||
-        sibling.native_serializer_singular_config ||
-        sibling.native_serializer_plural_config
+      return [] if sibling.serializer_class
 
       cfg = sibling.field_configuration
       sibling.get_fields.reject { |sf|
@@ -686,15 +675,35 @@ module RESTFramework::Controller
       self.readable_fields.select do |f|
         next true if f.in?(columns)
 
-        # Skip polymorphic associations: they can't be JOINed, so filtering or ordering through them
-        # (e.g. `?favorite.name=x` or `?ordering=favorite.name`) would raise. This method is the
-        # safe field surface for those query features.
+        # Skip polymorphic associations: they can't be JOINed, so filtering or ordering *through*
+        # them (e.g. `?favorite.name=x`) would raise. Their backing `*_id`/`*_type` columns are
+        # still filterable/orderable via `readable_polymorphic_columns`.
         field = cfg[f]
         field&.[](:kind) == "association" && !field[:reflection]&.polymorphic?
       end
     end
   end
 
+  # Map each readable polymorphic `belongs_to`'s dotted `<name>.id`/`<name>.type` path to its
+  # backing `*_id`/`*_type` column. These columns live on the base table, so — unlike the
+  # association itself, which can't be JOINed — they filter and order like any other column. The
+  # dotted path mirrors the serialized shape, so clients filter with `?favorite.type=Genre`.
+  def readable_polymorphic_columns
+    @_readable_polymorphic_columns ||= begin
+      cfg = self.class.field_configuration
+      self.readable_fields.each_with_object({}) do |f, map|
+        field = cfg[f]
+        next unless field&.[](:kind) == "association"
+
+        ref = field[:reflection]
+        next unless ref&.polymorphic?
+
+        map["#{f}.id"] = ref.foreign_key
+        map["#{f}.type"] = ref.foreign_type
+      end
+    end
+  end
+
   # Get a hash of strong parameters for the current action.
   def get_allowed_parameters
     return @_get_allowed_parameters if defined?(@_get_allowed_parameters)
@@ -906,13 +915,14 @@ module RESTFramework::Controller
   # `Movie.find(movie_id).genres.find(genre_id).tracks`. Every link is enforced (a broken one raises
   # `RecordNotFound` -> 404), and each association is resolved from its parent, so `belongs_to`,
   # `has_many`, and `has_and_belongs_to_many` children all work. Each parent is looked up via its
-  # own controller's recordset (see `scope_nested_through_controllers`), so per-level access scoping
-  # is enforced. Returns `nil` when there is no nested parent, or a `<name>_id` param can't connect.
+  # own controller's recordset, so per-level access scoping is enforced. Returns `nil` when there is
+  # no nested parent, or a `<name>_id` param can't connect. Override `get_recordset` to scope
+  # differently.
   def _rrf_nested_parent_recordset
     # Set on an ad-hoc parent instance below, so evaluating a parent's `get_recordset` doesn't
     # recurse back into nested scoping (we want the parent's own scope, not to re-nest it).
     return nil if @_rrf_scoping_parent
-    return nil unless self.class.scope_nested_by_parent && request
+    return nil unless request
 
     # `<name>_id` path parameters that name a model, in route order (outermost parent first).
     parents = request.path_parameters.filter_map { |key, value|
@@ -950,11 +960,9 @@ module RESTFramework::Controller
   end
 
   # A parent's recordset for the nested-scope walk: its own controller's `get_recordset` (so that
-  # controller's access scoping is reused), or the bare model when the feature is off or no sibling
-  # controller is found. The ad-hoc instance shares this request and skips its own nested scoping.
+  # controller's access scoping is reused), or the bare model when no sibling controller is found.
+  # The ad-hoc instance shares this request and skips its own nested scoping.
   def _rrf_parent_recordset(model)
-    return model.all unless self.class.scope_nested_through_controllers
-
     controller = RESTFramework::Utils.controller_for_model(self.class, model)
     return model.all unless controller
 

data/lib/rest_framework/filters/base_filter.rb

@@ -7,6 +7,16 @@ class RESTFramework::Filters::BaseFilter
     raise NotImplementedError
   end
 
+  # The controller's polymorphic `<assoc>.id`/`<assoc>.type` → backing-column map, gated by a custom
+  # field allowlist when the subclass defines one (`filter_fields`/`ordering_fields`). This keeps a
+  # restricted allowlist restrictive: a polymorphic path is honored only if it is also listed there.
+  def _polymorphic_columns(custom_fields)
+    map = @controller.readable_polymorphic_columns
+    return map unless custom_fields
+
+    map.slice(*custom_fields.map(&:to_s))
+  end
+
   # True when `v` is a query-parameter value safe to feed into `where`, string
   # operations, or `split` — i.e. a String or an Array of Strings. Guards against
   # nested-hash inputs like `?field[evil]=x`, which Rack parses into a Hash and

data/lib/rest_framework/filters/ordering_filter.rb

@@ -12,6 +12,7 @@ class RESTFramework::Filters::OrderingFilter < RESTFramework::Filters::BaseFilte
 
     # Ensure ordering_fields are strings since the split param will be strings.
     fields = self._get_fields
+    poly_columns = self._polymorphic_columns(@controller.class.ordering_fields)
     order_string = @controller.request.query_parameters[param]
 
     # Reject nested-hash inputs like `?ordering[evil]=x` (Rack parses these into
@@ -38,6 +39,13 @@ class RESTFramework::Filters::OrderingFilter < RESTFramework::Filters::BaseFilte
         next
       end
 
+      # A polymorphic association's `<name>.id`/`<name>.type` maps to a backing column on the base
+      # table, so it orders directly with no JOIN (unlike other sub-fields).
+      if real_column = poly_columns[column]
+        ordering[real_column] = direction
+        next
+      end
+
       # A dotted `association.sub_field` token. The root must be an allowlisted association field,
       # and the sub-field must be one of that association's allowlisted fields. Otherwise a client
       # could order by (and infer, via an ordering oracle) a column that is never serialized.

data/lib/rest_framework/filters/query_filter.rb

@@ -57,6 +57,7 @@ class RESTFramework::Filters::QueryFilter < RESTFramework::Filters::BaseFilter
   # query config in the form of: `[base_query, pred_queries, includes]`.
   def _get_query_config
     fields = self._get_fields
+    poly_columns = self._polymorphic_columns(@controller.class.filter_fields)
     includes = []
 
     # Predicate queries must be added to a separate list because multiple predicates can be used.
@@ -75,10 +76,18 @@ class RESTFramework::Filters::QueryFilter < RESTFramework::Filters::BaseFilter
         next [ field, v ]
       end
 
+      # A polymorphic association's `<name>.id`/`<name>.type` maps to a backing column on the base
+      # table, so it filters directly with no JOIN (unlike other sub-fields).
+      if column = poly_columns[field]
+        next [ column, v ]
+      end
+
       # First, try to parse a simple predicate and check if it is filterable.
       pred_field, predicate = self.parse_predicate(field)
       if predicate && pred_field.in?(fields)
         field = pred_field
+      elsif predicate && (column = poly_columns[pred_field])
+        field = column
       else
         # Last, try to parse a sub-field or sub-field w/predicate.
         root_field, sub_field = field.split(".", 2)

data/lib/rest_framework/serializers/native_serializer.rb

@@ -44,10 +44,10 @@ class RESTFramework::Serializers::NativeSerializer < RESTFramework::Serializers:
     return @fields if defined?(@fields)
     return nil unless base_fields = @controller&.get_fields
 
-    only_param = @controller.class.native_serializer_only_query_param
-    except_param = @controller.class.native_serializer_except_query_param
-    include_param = @controller.class.native_serializer_include_query_param
-    exclude_param = @controller.class.native_serializer_exclude_query_param
+    only_param = @controller.class.only_query_param
+    except_param = @controller.class.except_query_param
+    include_param = @controller.class.include_query_param
+    exclude_param = @controller.class.exclude_query_param
 
     only = EXTRACT_FROM_QUERY.call(only_param, @controller)
     except = EXTRACT_FROM_QUERY.call(except_param, @controller)
@@ -98,35 +98,20 @@ class RESTFramework::Serializers::NativeSerializer < RESTFramework::Serializers:
     self.config
   end
 
-  # Get a native serializer configuration from the controller.
-  def get_controller_native_serializer_config
-    return nil unless @controller
-
-    if @many == true
-      controller_serializer = @controller.class.native_serializer_plural_config
-    elsif @many == false
-      controller_serializer = @controller.class.native_serializer_singular_config
-    end
-
-    controller_serializer || @controller.class.native_serializer_config
-  end
-
   # The record cap for a collection association (`nil` = unlimited). The default is applied even
   # when the feature is off, so responses are always bounded. `key?` (not `||`) reads the
   # `field_config` override so an explicit `nil` there means unlimited/uncapped rather than falling
   # back to the controller default.
   def _effective_association_limit(association_name, field_config)
-    controller = @controller&.class
+    klass = @controller&.class
 
-    default = field_config.key?(:limit) ?
-      field_config[:limit] : controller&.association_limit
-    return default unless controller&.enable_association_queries
+    default = field_config.key?(:limit) ? field_config[:limit] : klass&.association_limit
+    return default unless klass&.enable_association_queries
 
     requested = self._requested_association_limit(association_name)
     return default if requested.nil?
 
-    max = field_config.key?(:limit_max) ?
-      field_config[:limit_max] : controller.association_limit_max
+    max = field_config.key?(:limit_max) ? field_config[:limit_max] : klass.association_limit_max
 
     # `all` means "as many as allowed" — the cap, or unlimited when the cap is `nil`.
     return max if requested == :all
@@ -187,10 +172,10 @@ class RESTFramework::Serializers::NativeSerializer < RESTFramework::Serializers:
   # Recursively translate an association's fields into a `serializable_hash` config
   # (`only`/`methods`/`include`). Columns go to `only` and plain methods to `methods`; a field that
   # is itself an association is recursed into (as a nested `include`) only when it has its own entry
-  # in `field_config[:field_config]`. Otherwise it falls through to a method and serializes as
-  # before (its full `as_json`), so deeper nesting is opt-in and never narrows the default output.
-  def _build_association_config(model, fields, field_config)
-    nested = field_config[:field_config] || {}
+  # in `nested` (the per-field `config:` map). Otherwise it falls through to a method and serializes
+  # as before (its full `as_json`), so deeper nesting is opt-in and never narrows the output.
+  def _build_association_config(model, fields, nested)
+    nested ||= {}
     only = []
     methods = []
     includes = {}
@@ -202,9 +187,11 @@ class RESTFramework::Serializers::NativeSerializer < RESTFramework::Serializers:
       if sf.in?(model.column_names)
         only << sf
       elsif sub_field_config && (ref = model.reflect_on_association(sf.to_sym)) && !ref.polymorphic?
-        sub_fields = sub_field_config[:fields]&.map(&:to_s) ||
-          RESTFramework::Utils.association_fields_for(ref)
-        includes[sf] = self._build_association_config(ref.klass, sub_fields, sub_field_config)
+        sub_spec = RESTFramework::Utils.normalize_field_spec(sub_field_config[:fields])
+        sub_fields = RESTFramework::Utils.resolve_field_names(
+          sub_spec, RESTFramework::Utils.association_fields_for(ref)
+        )
+        includes[sf] = self._build_association_config(ref.klass, sub_fields, sub_spec[:config])
       elsif model.method_defined?(sf)
         methods << sf
       else
@@ -242,24 +229,27 @@ class RESTFramework::Serializers::NativeSerializer < RESTFramework::Serializers:
         columns << f
       elsif ref = reflections[f]
         # A polymorphic `belongs_to` has no single target class to introspect, so serialize it via a
-        # method that always emits the `type` (from the `*_type` column) alongside the id, plus a
-        # label when the target has one. Filtering/ordering skip polymorphic associations (see
-        # `readable_columns_or_associations`), so consumer-driven field/limit requests don't apply.
+        # method that emits the `type` (from the `*_type` column) and id, a label when the target
+        # has one, and any other configured `fields` the target responds to. Consumer-driven
+        # field/limit requests don't apply (they need one target class; see the serializer method).
         if ref.polymorphic?
           foreign_type = ref.foreign_type
+          fields = field_config[:fields]
           serializer_methods[f] = f
           includes_map[f] = f.to_sym
           self.define_singleton_method(f) do |record|
             next nil unless target = record.send(f)
 
-            RESTFramework::Utils.serialize_polymorphic(target, record.send(foreign_type))
+            RESTFramework::Utils.serialize_polymorphic(target, record.send(foreign_type), fields)
           end
 
           next
         end
 
         effective_fields = self._effective_association_fields(f, ref, field_config)
-        sub_config = self._build_association_config(ref.klass, effective_fields, field_config)
+        sub_config = self._build_association_config(
+          ref.klass, effective_fields, field_config[:field_config]
+        )
 
         # Apply certain rules regarding collection associations.
         if ref.collection?
@@ -355,11 +345,6 @@ class RESTFramework::Serializers::NativeSerializer < RESTFramework::Serializers:
       return local_config.deep_dup
     end
 
-    # Return a serializer config if one is defined on the controller.
-    if serializer_config = self.get_controller_native_serializer_config
-      return serializer_config.deep_dup
-    end
-
     # If the config wasn't determined, build a serializer config from controller fields.
     if @model && self.fields
       return self._get_controller_serializer_config

data/lib/rest_framework/utils.rb

@@ -96,27 +96,50 @@ module RESTFramework::Utils
     s
   end
 
-  # Parse fields hashes.
+  # A `fields` spec's structural (non-`config`) keys, i.e. those that shape set membership.
+  FIELD_SPEC_KEYS = [ :only, :except, :include, :exclude, :config ].freeze
+
+  # Normalize a field spec — an Array, a Hash, or nil — into a canonical
+  # `{only:, include:, exclude:, config:}` Hash containing only the keys that are present. A plain
+  # Array is sugar for `only:`. `except:` is an alias of `exclude:`; the two are merged.
+  def self.normalize_field_spec(spec)
+    return {} if spec.nil?
+    return { only: spec } unless spec.is_a?(Hash)
+
+    exclude = (Array(spec[:exclude]) + Array(spec[:except])).presence
+    { only: spec[:only], include: spec[:include], exclude: exclude, config: spec[:config] }.compact
+  end
+
+  # Resolve a field spec (Array | Hash | nil) to an ordered array of string field names: start from
+  # `base` unless `only:` replaces it, then apply `include:`. Any field named in `config:` is
+  # implicitly part of the set (so a configured field never needs to be listed twice). `exclude:` is
+  # applied last, so it can still drop a field that `config:`/`include:` would otherwise add.
+  def self.resolve_field_names(spec, base)
+    spec = self.normalize_field_spec(spec)
+    names = (spec[:only] || base).map(&:to_s)
+    names += spec[:include].map(&:to_s) if spec[:include]
+    names |= spec[:config].keys.map(&:to_s) if spec[:config]
+    names -= spec[:exclude].map(&:to_s) if spec[:exclude]
+    names
+  end
+
+  # Resolve a top-level `fields` hash to an ordered array of string field names, using the model's
+  # default fields as the base. The `config:` key carries per-field configuration and is ignored for
+  # membership.
   def self.parse_fields_hash(h, model, exclude_associations:, action_text:, active_storage:)
-    parsed_fields = h[:only] || (
-      model ? self.fields_for(
-        model,
-        exclude_associations: exclude_associations,
-        action_text: action_text,
-        active_storage: active_storage,
-      ) : []
-    )
-    parsed_fields += h[:include].map(&:to_s) if h[:include]
-    parsed_fields -= h[:exclude].map(&:to_s) if h[:exclude]
-    parsed_fields -= h[:except].map(&:to_s) if h[:except]
+    base = model ? self.fields_for(
+      model,
+      exclude_associations: exclude_associations,
+      action_text: action_text,
+      active_storage: active_storage,
+    ) : []
 
     # Warn for any unknown keys.
-    (h.keys - [ :only, :except, :include, :exclude ]).each do |k|
+    (h.keys.map(&:to_sym) - FIELD_SPEC_KEYS).each do |k|
       Rails.logger.warn("RRF: Unknown key in fields hash: #{k}.")
     end
 
-    # We should always return strings, not symbols.
-    parsed_fields.map(&:to_s)
+    self.resolve_field_names(h, base)
   end
 
   # Get the fields for a given model, including not just columns (which includes foreign keys), but
@@ -188,13 +211,24 @@ module RESTFramework::Utils
   # Serialize a polymorphic association's target as `{<pk> => id, "type" => type}`, plus a label
   # entry when the target responds to one of the configured `label_fields`. The type comes from the
   # parent's `*_type` column, so it matches exactly what is stored (and what a reverse lookup uses).
-  def self.serialize_polymorphic(target, type)
+  #
+  # `fields` are the association's configured fields. `id`/`type` are always emitted above; any
+  # other field is resolved against the target and included when it responds to it, so a field
+  # absent on a target class (e.g. `price` on a `Genre`) is omitted rather than serialized as nil.
+  def self.serialize_polymorphic(target, type, fields = nil)
     result = {}
     Array(target.class.primary_key).each { |pk| result[pk] = target.public_send(pk) }
     result["type"] = type
 
     if label = RESTFramework.config.label_fields.find { |f| target.respond_to?(f) }
-      result[label] = target.public_send(label)
+      result[label.to_s] = target.public_send(label)
+    end
+
+    Array(fields).each do |f|
+      f = f.to_s
+      next if f.in?(%w[id type]) || result.key?(f)
+
+      result[f] = target.public_send(f) if target.respond_to?(f)
     end
 
     result

data/lib/rest_framework/version.rb

@@ -1,3 +1,3 @@
 module RESTFramework
-  VERSION = "2.0.0.rc1"
+  VERSION = "2.0.0.rc2"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rest_framework
 version: !ruby/object:Gem::Version
-  version: 2.0.0.rc1
+  version: 2.0.0.rc2
 platform: ruby
 authors:
 - Gregory N. Schmit
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-12 00:00:00.000000000 Z
+date: 2026-08-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails