rhino-rails 4.6.1 → 4.7.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ec046eac08bcbf895ec331091f9204e4abba36bf712dc2d283b2c91a02f36671
-  data.tar.gz: 9b72423cd739ed788cf2554b08aa7ba5f5d1dcbc4739689058bf6566b940f0f4
+  metadata.gz: 632861555ee3e2508a90ec546b6cb0412368bc141a7d387b2f92698531605b86
+  data.tar.gz: 91b3ad79b1c0b0b492f1f3003e906ce11e9f3fa62e81b067ecfb9c0b7740a025
 SHA512:
-  metadata.gz: adc4639f14af9208841959882a089595573f910a67168551eca6c1cd6eb9d73e3f29523ad8ec49b0ce91e95692ca43b08c29a7d2b121605193c2e51d13b9a686
-  data.tar.gz: 7e6eb9a292a199dbf2f1c42b1e6970c3f99b7bc0df49d1b5318f5987ef1a5b5b070dc4cf01b613bbf035d40d001c8bfd8bf0c3dd1e27141f008da37b48689807
+  metadata.gz: 2c5fee208f22ae88b0531f4075e6183d6d0a17137c43423e7f491dbf341848764ce16418feca131b13c45c4295f6b4a3507eebb52e1e30b2f887dcbcfdd624c1
+  data.tar.gz: 83468b5afe671a2b0313778e57c2f053747129156d643bb85d5543513ea2d02aa6c2b63c4b70bb5f04613cb79bbb21544ba142bb4f127ebf56247581aab4c079

data/lib/rhino/commands/export_postman_command.rb

@@ -175,10 +175,26 @@ module Rhino
           allowed_fields: model_class.try(:allowed_fields) || [],
           allowed_includes: model_class.try(:allowed_includes) || [],
           allowed_search: model_class.try(:allowed_search) || [],
+          # Computed attributes: names only (the callables never leave the server).
+          collection_computed_attributes: computed_names(model_class.try(:rhino_collection_computed_attributes)),
+          record_computed_attributes: computed_names(record_computed_declaration(model_class)),
           default_sort: model_class.try(:default_sort_field)
         }
       end
 
+      def computed_names(declared)
+        declared.is_a?(Hash) ? declared.keys.map(&:to_s) : []
+      end
+
+      # Instantiating is safe (no DB round trip) and is the only way to read an
+      # instance-level declaration; a model that cannot be instantiated simply
+      # exports no record-level examples.
+      def record_computed_declaration(model_class)
+        model_class.new.try(:rhino_record_computed_attributes)
+      rescue StandardError
+        {}
+      end
+
       def build_action_folders(slug, meta, group_prefix)
         folders = []
         base = base_path(slug, group_prefix)
@@ -190,6 +206,10 @@ module Rhino
         folders << { name: "Update", item: build_update_requests(base) } unless except.include?("update")
         folders << { name: "Destroy", item: build_destroy_requests(base) } unless except.include?("destroy")
 
+        if Array(meta[:collection_computed_attributes]).any? && !except.include?("computed")
+          folders << { name: "Computed Attributes", item: build_computed_requests(base, meta) }
+        end
+
         if meta[:uses_soft_deletes]
           folders << { name: "Trashed", item: build_trashed_requests(base) } unless except.include?("trashed")
           folders << { name: "Restore", item: build_restore_requests(base) } unless except.include?("restore")
@@ -231,6 +251,11 @@ module Rhino
                                    { "fields[#{slug}]" => meta[:allowed_fields].first(5).join(",") }, headers)
         end
 
+        Array(meta[:record_computed_attributes]).each do |attribute|
+          requests << request_item("With computed attribute #{attribute}", "GET", base,
+                                   { computed_attributes: attribute }, headers)
+        end
+
         unless meta[:allowed_search].empty?
           requests << request_item("Search", "GET", base, { search: "example" }, headers)
         end
@@ -249,6 +274,11 @@ module Rhino
           requests << request_item("Show with include", "GET", path, { include: meta[:allowed_includes].first.to_s }, headers)
         end
 
+        Array(meta[:record_computed_attributes]).each do |attribute|
+          requests << request_item("Show with computed attribute #{attribute}", "GET", path,
+                                   { computed_attributes: attribute }, headers)
+        end
+
         requests
       end
 
@@ -268,6 +298,26 @@ module Rhino
         [request_item("Delete by ID", "DELETE", path, {}, default_headers)]
       end
 
+      # Requests for GET {resource}/computed — the collection-level aggregates.
+      def build_computed_requests(base, meta)
+        headers = default_headers
+        path = "#{base}/computed"
+        attributes = Array(meta[:collection_computed_attributes])
+
+        requests = [request_item("All computed attributes", "GET", path, {}, headers)]
+
+        attributes.each do |attribute|
+          requests << request_item("Computed: #{attribute}", "GET", path, { attributes: attribute }, headers)
+        end
+
+        if attributes.size > 1
+          requests << request_item("Computed: multiple attributes", "GET", path,
+                                   { attributes: attributes.join(",") }, headers)
+        end
+
+        requests
+      end
+
       def build_trashed_requests(base)
         [request_item("List trashed", "GET", "#{base}/trashed", {}, default_headers)]
       end

data/lib/rhino/concerns/has_rhino.rb

@@ -101,6 +101,9 @@ module Rhino
         self.rhino_middleware_actions_map = actions_hash.transform_keys(&:to_s)
       end
 
+      # CRUD actions to exclude from route registration.
+      # Valid values: :index, :show, :store, :update, :destroy, :trashed,
+      # :restore, :forceDelete, :computed.
       def rhino_except_actions(*actions)
         self.rhino_except_actions_list = actions.map(&:to_s)
       end

data/lib/rhino/concerns/hidable_columns.rb

@@ -59,6 +59,31 @@ module Rhino
       def rhino_additional_hidden(*columns)
         self.additional_hidden_columns = columns.map(&:to_s)
       end
+
+      # Override this method to declare COLLECTION-level computed attributes,
+      # served by <tt>GET /api/{resource}/computed?attributes=a,b</tt>.
+      #
+      # Each callable receives the fully scoped relation (organization scope,
+      # default/global scopes, <tt>?scope=</tt>, <tt>?filter[]=</tt> and
+      # <tt>?search=</tt> already applied) plus the current user, and is
+      # evaluated ONCE for the whole collection — not once per row. This is the
+      # cheap way to expose aggregates such as counts.
+      #
+      # Declaring at least one attribute here is what registers the
+      # <tt>/computed</tt> route for the model.
+      #
+      # @example
+      #   def self.rhino_collection_computed_attributes
+      #     {
+      #       'active_users_count' => ->(scope, _user) { scope.where(status: 'active').count },
+      #       'blocked_users_count' => ->(scope, _user) { scope.where(status: 'blocked').count }
+      #     }
+      #   end
+      #
+      # @return [Hash{String => #call}]
+      def rhino_collection_computed_attributes
+        {}
+      end
     end
 
     # Get the list of columns to hide for the current user.
@@ -84,7 +109,7 @@ module Rhino
     # to add computed/virtual attributes to the JSON response.
     #
     # @return [Hash]
-    def as_rhino_json
+    def as_rhino_json(computed_attributes: [])
       user = rhino_current_user
       hidden = hidden_columns_for(user)
       result = as_json(except: hidden)
@@ -93,6 +118,13 @@ module Rhino
       computed = rhino_computed_attributes
       result.merge!(computed) if computed.is_a?(Hash) && computed.any?
 
+      # Merge the OPT-IN record-level computed attributes the client selected via
+      # ?computed_attributes=. Nothing here is evaluated unless it was asked for
+      # by name, so declaring an expensive attribute costs nothing on requests
+      # that don't want it. Merged before policy filtering, so the blacklist and
+      # whitelist below still govern them.
+      result.merge!(rhino_resolve_record_computed_attributes(computed_attributes, user))
+
       # Apply blacklist to the final hash (covers DB columns from as_json
       # overrides AND computed attributes from rhino_computed_attributes)
       hidden_set = Set.new(hidden)
@@ -132,8 +164,62 @@ module Rhino
       {}
     end
 
+    # Override this method to declare OPT-IN record-level computed attributes.
+    #
+    # Unlike +rhino_computed_attributes+, nothing here is evaluated unless the
+    # client names it in <tt>?computed_attributes=a,b</tt> on index/show/trashed
+    # — so expensive per-row work is only paid for when it is actually wanted.
+    #
+    # Return a hash of attribute name => callable. The callable may accept
+    # zero, one (record) or two (record, user) arguments.
+    #
+    # @example
+    #   def rhino_record_computed_attributes
+    #     {
+    #       'open_tickets_count' => ->(record, _user) { record.tickets.where(closed_at: nil).count },
+    #       'full_name' => ->(record, _user) { "#{record.first_name} #{record.last_name}" }
+    #     }
+    #   end
+    #
+    # @return [Hash{String => #call}]
+    def rhino_record_computed_attributes
+      {}
+    end
+
     private
 
+    # Evaluate the selected opt-in record-level computed attributes.
+    #
+    # Names that are not declared are silently skipped — the controller has
+    # already rejected unknown/forbidden names with a 403, and a direct
+    # +as_rhino_json+ caller must not be able to force an arbitrary call.
+    def rhino_resolve_record_computed_attributes(names, user)
+      return {} if names.blank?
+
+      declared = rhino_record_computed_attributes
+      return {} unless declared.is_a?(Hash) && declared.any?
+
+      Array(names).each_with_object({}) do |name, memo|
+        key = name.to_s
+        next unless declared.key?(key)
+
+        memo[key] = rhino_call_computed(declared[key], self, user)
+      end
+    end
+
+    # Invoke a declared callable, tolerating lambdas of arity 0, 1 or 2.
+    # Ruby lambdas are strict about arity, so the arity is honoured rather than
+    # forcing every declaration to accept both arguments.
+    def rhino_call_computed(entry, record, user)
+      return entry unless entry.respond_to?(:call)
+
+      case entry.try(:arity)
+      when 0 then entry.call
+      when 1 then entry.call(record)
+      else entry.call(record, user)
+      end
+    end
+
     # Resolves the current user from RequestStore.
     # @return [Object, nil]
     def rhino_current_user

data/lib/rhino/concerns/route_group_context.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+module Rhino
+  # Places a custom (non-Rhino) controller into a Rhino route group, so the
+  # resource-scope resolver knows whether the request has a tenant boundary.
+  #
+  # Rhino's own generated controllers already publish their group; a controller
+  # you write yourself is outside that chain, so include this concern in it:
+  #
+  #   class Admin::DashboardController < ApplicationController
+  #     include Rhino::RouteGroupContext
+  #     rhino_route_group :admin
+  #
+  #     def summary
+  #       # :admin is declared `tenant: false`, so this spans every organization
+  #       # instead of raising Rhino::MissingTenantContext.
+  #       render json: { tasks: Rhino.query(Task).count }
+  #     end
+  #   end
+  #
+  # Without an explicit `rhino_route_group`, the group is read from the route's
+  # own `route_group` default:
+  #
+  #   get "/api/admin/dashboard", to: "admin/dashboard#summary",
+  #                               defaults: { route_group: "admin" }
+  module RouteGroupContext
+    extend ActiveSupport::Concern
+
+    included do
+      # Inheritable, so a base controller can declare the group for a whole
+      # namespace and subclasses may override it.
+      class_attribute :rhino_route_group_name, instance_writer: false, default: nil
+
+      before_action :rhino_set_route_group
+    end
+
+    class_methods do
+      # Declare the route group this controller's actions belong to.
+      def rhino_route_group(name)
+        self.rhino_route_group_name = name.to_s
+      end
+    end
+
+    private
+
+    # Publish the group for Rhino::Context (and therefore for Rhino.query, the
+    # policies and the permission resolver) for the rest of this request.
+    def rhino_set_route_group
+      return unless defined?(RequestStore)
+
+      # An explicit declaration wins; otherwise fall back to the route's own
+      # `route_group` default, which only exists once a request is bound.
+      resolved = rhino_route_group_name.presence
+      resolved ||= params[:route_group].presence if request
+
+      RequestStore.store[:rhino_route_group] = resolved
+    end
+  end
+end

data/lib/rhino/configuration.rb

@@ -62,7 +62,15 @@ module Rhino
     # captures the subdomain and feeds organization resolution exactly like the
     # path-prefix ":organization" does. Groups without a domain (nil/blank)
     # match any host (default, fully backward compatible).
-    def route_group(name, prefix: "", domain: nil, middleware: [], models: :all, auth: false, hooks: nil)
+    #
+    # The optional `tenant:` keyword declares whether the group has a tenant
+    # boundary. It defaults to true: Rhino.query inside the group fails closed,
+    # raising Rhino::MissingTenantContext when an organization-scopable model is
+    # queried with no organization resolved. Pass `tenant: false` for a group
+    # that legitimately spans every organization — a back office or admin group
+    # whose operators see all tenants' rows.
+    def route_group(name, prefix: "", domain: nil, middleware: [], models: :all, auth: false, hooks: nil,
+                    tenant: true)
       normalized_domain = domain.to_s.strip
       normalized_domain = nil if normalized_domain.empty?
 
@@ -72,10 +80,26 @@ module Rhino
         middleware: Array(middleware),
         models: models,
         auth: !!auth,
-        hooks: hooks
+        hooks: hooks,
+        tenant: tenant != false
       }
     end
 
+    # Whether the named route group has a tenant boundary, i.e. whether
+    # Rhino.query must fail closed inside it. Only a group that explicitly
+    # declares `tenant: false` does not; every other answer — an unknown group,
+    # an untagged route, or no group at all (jobs, rake tasks, console) — is
+    # true, so the resolver keeps failing closed wherever the group is not
+    # provably non-tenant.
+    def group_tenant?(name)
+      return true if name.nil? || name.to_s.empty?
+
+      group = @route_groups[name.to_sym]
+      return true unless group
+
+      group.fetch(:tenant, true) != false
+    end
+
     # Resolve a model class from its slug
     def resolve_model(slug)
       klass_name = @models[slug.to_sym]

data/lib/rhino/context.rb

@@ -30,6 +30,16 @@ module Rhino
       end
     end
 
+    # The route group serving the current request, as stashed into RequestStore
+    # by Rhino's own controllers and by Rhino::RouteGroupContext in custom ones.
+    # Nil outside a request or when the route carries no group.
+    def route_group
+      return nil unless defined?(RequestStore)
+
+      value = RequestStore.store[:rhino_route_group]
+      value.nil? || value.to_s.empty? ? nil : value
+    end
+
     # Run +block+ with the given user/organization installed into RequestStore.
     # Snapshots the prior RequestStore user+org, sets the new ones, yields, and
     # restores the snapshot in an ensure. Returns the block's value.

data/lib/rhino/controllers/resources_controller.rb

@@ -42,6 +42,9 @@ module Rhino
     def index
       authorize model_class, :index?, policy_class: policy_for(model_class)
 
+      computed = resolve_requested_computed_attributes
+      return if performed?
+
       builder = QueryBuilder.new(model_class, params: params, named_scopes: true)
       apply_organization_scope(builder)
       builder.build
@@ -52,9 +55,9 @@ module Rhino
       if per_page.present? || pagination_enabled
         result = builder.paginate
         set_pagination_headers(result[:pagination])
-        render json: { data: serialize_collection(result[:items]) }
+        render json: { data: serialize_collection(result[:items], computed) }
       else
-        render json: { data: serialize_collection(builder.to_scope) }
+        render json: { data: serialize_collection(builder.to_scope, computed) }
       end
     end
 
@@ -98,6 +101,9 @@ module Rhino
       record = find_record
       authorize record, :show?, policy_class: policy_for(record)
 
+      computed = resolve_requested_computed_attributes
+      return if performed?
+
       # Apply includes if requested
       if params[:include].present?
         auth_response = authorize_includes
@@ -111,7 +117,7 @@ module Rhino
         record = builder.to_scope.first!
       end
 
-      render json: serialize_record(record)
+      render json: serialize_record(record, computed)
     end
 
     # PUT /api/{slug}/:id
@@ -175,6 +181,9 @@ module Rhino
     def trashed
       authorize model_class, :view_trashed?, policy_class: policy_for(model_class)
 
+      computed = resolve_requested_computed_attributes
+      return if performed?
+
       builder = QueryBuilder.new(model_class.discarded, params: params, named_scopes: true)
       apply_organization_scope(builder)
       builder.build
@@ -185,10 +194,47 @@ module Rhino
       if per_page.present? || pagination_enabled
         result = builder.paginate
         set_pagination_headers(result[:pagination])
-        render json: { data: serialize_collection(result[:items]) }
+        render json: { data: serialize_collection(result[:items], computed) }
       else
-        render json: { data: serialize_collection(builder.to_scope) }
+        render json: { data: serialize_collection(builder.to_scope, computed) }
+      end
+    end
+
+    # GET /api/{slug}/computed?attributes=a,b
+    #
+    # Collection-level computed attributes: each declared callable is evaluated
+    # ONCE over the whole (scoped + filtered) relation instead of once per row,
+    # which is what makes aggregates such as `active_users_count` cheap.
+    #
+    # The relation handed to each callable has the organization scope, the
+    # model's default scopes, `?scope=`, `?filter[]=` and `?search=` already
+    # applied — so the numbers describe exactly the set `index` would have
+    # listed. Sorting, sparse fieldsets, includes and pagination are
+    # deliberately NOT applied.
+    #
+    # Omitting `?attributes=` returns every declared attribute the policy allows.
+    def computed
+      authorize model_class, :index?, policy_class: policy_for(model_class)
+
+      declared = collection_computed_attributes
+      names = resolve_requested_collection_attributes(declared)
+      return if performed?
+
+      builder = QueryBuilder.new(model_class, params: params, named_scopes: true)
+      apply_organization_scope(builder)
+      builder.build_for_computed
+
+      scope = builder.to_scope
+      user = current_user
+
+      data = names.each_with_object({}) do |name, memo|
+        # Each attribute gets the base relation; ActiveRecord relations are
+        # immutable under chaining, so one callable's constraints can never
+        # leak into the next one's result.
+        memo[name] = call_computed_attribute(declared[name], scope, user)
       end
+
+      render json: { data: data }
     end
 
     # POST /api/{slug}/:id/restore
@@ -599,16 +645,130 @@ module Rhino
     # Serialization
     # ------------------------------------------------------------------
 
-    def serialize_record(record)
+    # ------------------------------------------------------------------
+    # Computed attributes
+    # ------------------------------------------------------------------
+
+    # The model's declared collection-level computed attributes (name => callable).
+    def collection_computed_attributes
+      declared = model_class.try(:rhino_collection_computed_attributes)
+      declared.is_a?(Hash) ? declared.transform_keys(&:to_s) : {}
+    end
+
+    # Parse and authorize `?attributes=a,b` for the /computed endpoint.
+    #
+    # Renders a 403 and returns [] on a bad/denied name. An undeclared name and
+    # a policy-denied name produce the SAME error, so the endpoint never reveals
+    # which attributes a model declares.
+    def resolve_requested_collection_attributes(declared)
+      raw = params[:attributes]
+
+      # Reject non-scalar input (?attributes[]=x) before any lookup.
+      if raw.present? && !raw.is_a?(String)
+        render json: { message: "Computed attributes are not allowed" }, status: :forbidden
+        return []
+      end
+
+      user = current_user
+
+      if raw.blank?
+        # No selection: every declared attribute the policy allows.
+        return declared.keys.select { |name| computed_attribute_allowed?(name, user) }
+      end
+
+      names = parse_attribute_list(raw)
+
+      names.each do |name|
+        next if declared.key?(name) && computed_attribute_allowed?(name, user)
+
+        render json: { message: "Computed attribute '#{name}' is not allowed" }, status: :forbidden
+        return []
+      end
+
+      names
+    end
+
+    # Parse and authorize `?computed_attributes=a,b` for index/show/trashed —
+    # the OPT-IN record-level computed attributes. Absent or blank means "none",
+    # which is byte-for-byte the pre-feature behavior.
+    def resolve_requested_computed_attributes
+      raw = params[:computed_attributes]
+      return [] if raw.nil? || raw == ""
+
+      unless raw.is_a?(String)
+        render json: { message: "Computed attributes are not allowed" }, status: :forbidden
+        return []
+      end
+
+      names = parse_attribute_list(raw)
+      return [] if names.empty?
+
+      declared = model_class.new.try(:rhino_record_computed_attributes)
+      declared = declared.is_a?(Hash) ? declared.transform_keys(&:to_s) : {}
+
+      user = current_user
+
+      names.each do |name|
+        next if declared.key?(name) && computed_attribute_allowed?(name, user)
+
+        render json: { message: "Computed attribute '#{name}' is not allowed" }, status: :forbidden
+        return []
+      end
+
+      names
+    end
+
+    # Split a comma-separated attribute list, dropping blanks and duplicates.
+    def parse_attribute_list(raw)
+      raw.to_s.split(",").map(&:strip).reject(&:empty?).uniq
+    end
+
+    # Whether the policy lets this user see a computed attribute.
+    #
+    # Computed attributes go through the SAME gate as columns:
+    # +hidden_attributes_for_show+ blacklists, and +permitted_attributes_for_show+
+    # whitelists unless it returns the ['*'] default.
+    def computed_attribute_allowed?(name, user)
+      policy = policy_for(model_class).new(user, model_class)
+
+      if policy.respond_to?(:hidden_attributes_for_show)
+        hidden = Array(policy.hidden_attributes_for_show(user)).map(&:to_s)
+        return false if hidden.include?(name)
+      end
+
+      return true unless policy.respond_to?(:permitted_attributes_for_show)
+
+      permitted = policy.permitted_attributes_for_show(user)
+      return true if permitted.nil? || permitted == ["*"]
+
+      Array(permitted).map(&:to_s).include?(name)
+    rescue StandardError
+      # Policy resolution failed — serialization applies the same filters again
+      # downstream, so nothing can leak through this fallback.
+      true
+    end
+
+    # Invoke a declared callable, tolerating lambdas of arity 0, 1 or 2.
+    def call_computed_attribute(entry, scope, user)
+      return entry unless entry.respond_to?(:call)
+
+      case entry.try(:arity)
+      when 0 then entry.call
+      when 1 then entry.call(scope)
+      else entry.call(scope, user)
+      end
+    end
+
+    def serialize_record(record, computed_attributes = [])
       if record.respond_to?(:as_rhino_json)
-        record.as_rhino_json
+        record.as_rhino_json(computed_attributes: computed_attributes)
       else
         record.as_json
       end
     end
 
-    def serialize_collection(records)
-      records.map { |r| serialize_record(r) }
+    def serialize_collection(records, computed_attributes = [])
+      records.map { |r| serialize_record(r, computed_attributes) }
     end
 
     # ------------------------------------------------------------------

data/lib/rhino/engine.rb

@@ -22,6 +22,7 @@ module Rhino
       require "rhino/concerns/hidable_columns"
       require "rhino/concerns/has_uuid"
       require "rhino/concerns/has_auto_scope"
+      require "rhino/concerns/route_group_context"
 
       # Policies
       require "rhino/policies/resource_policy"

data/lib/rhino/missing_tenant_context.rb

@@ -4,5 +4,14 @@ module Rhino
   # Raised by Rhino.query (and the explicit builder) when an organization-scopable
   # model is queried with no organization context available. Fail-closed: the
   # resolver never returns an unscoped relation for a tenant-scopable model.
-  class MissingTenantContext < StandardError; end
+  class MissingTenantContext < StandardError
+    def initialize(model_class = nil)
+      super(
+        "Rhino.query(#{model_class}) requires an organization context but none is set. " \
+        "Use Rhino.for_user(...).in_organization(...) outside a tenant request, or declare " \
+        "the route group serving this request non-tenant with `tenant: false` if it " \
+        "legitimately spans every organization."
+      )
+    end
+  end
 end

data/lib/rhino/query.rb

@@ -20,7 +20,10 @@ module Rhino
     # (BelongsToOrganization / HasAutoScope read RequestStore at BUILD time).
     #
     # Fail closed: an org-scopable model with no org context RAISES
-    # Rhino::MissingTenantContext rather than returning an unscoped relation.
+    # Rhino::MissingTenantContext rather than returning an unscoped relation —
+    # unless the request is served by a route group declared non-tenant
+    # (`tenant: false`), where a query legitimately spans every organization. An
+    # explicit organization is always honored, in every group.
     def query(model_class)
       org = Rhino::Context.organization
 
@@ -28,9 +31,11 @@ module Rhino
       relation = model_class.all
 
       if Rhino::ScopesToOrganization.organization_scoped?(model_class)
-        raise Rhino::MissingTenantContext, model_class.name unless org
-
-        relation = Rhino::ScopesToOrganization.scope_to_organization(relation, model_class, org, strict: true)
+        if org
+          relation = Rhino::ScopesToOrganization.scope_to_organization(relation, model_class, org, strict: true)
+        elsif Rhino.config.group_tenant?(Rhino::Context.route_group)
+          raise Rhino::MissingTenantContext, model_class.name
+        end
       end
 
       relation

data/lib/rhino/query_builder.rb

@@ -33,6 +33,17 @@ module Rhino
       self
     end
 
+    # Apply only the modifications that define WHICH rows are in the set:
+    # named scope, filters and search. Sorting, sparse fieldsets, includes and
+    # pagination are irrelevant to an aggregate over the collection and are
+    # deliberately skipped — a `select` in particular would break `count`.
+    def build_for_computed
+      apply_named_scope if @named_scopes
+      apply_filters
+      apply_search
+      self
+    end
+
     # Get the final ActiveRecord relation.
     def to_scope
       @scope

data/lib/rhino/routes.rb

@@ -187,6 +187,14 @@ module Rhino
 
                 except_actions = model_class.try(:rhino_except_actions_list) || []
 
+                # The /computed endpoint exists only for models that actually
+                # declare collection-level computed attributes. Models that
+                # don't are byte-for-byte unchanged — in particular
+                # `/{slug}/computed` keeps resolving to show() for a record
+                # whose route key is literally "computed".
+                declared_computed = model_class.try(:rhino_collection_computed_attributes)
+                has_computed = declared_computed.is_a?(Hash) && declared_computed.any?
+
                 route_prefix = [group_prefix, slug.to_s].reject(&:blank?).join("/")
 
                 # Each model's CRUD routes live inside a path scope. When the
@@ -202,6 +210,11 @@ module Rhino
                     post "/", to: "rhino/resources#store", as: "rhino_#{group_name}_#{slug}_store"
                   end
 
+                  # Registered BEFORE the :id routes so the literal segment wins.
+                  if has_computed && !except_actions.include?("computed")
+                    get "computed", to: "rhino/resources#computed", as: "rhino_#{group_name}_#{slug}_computed"
+                  end
+
                   if model_class.try(:uses_soft_deletes?)
                     unless except_actions.include?("trashed")
                       get "trashed", to: "rhino/resources#trashed", as: "rhino_#{group_name}_#{slug}_trashed"

data/lib/rhino/templates/rhino.rb

@@ -44,6 +44,22 @@ Rhino.configure do |config|
   # the path prefix ':organization' does. Groups without a domain match any host.
   # config.route_group :admin, prefix: '', domain: 'admin.example.com', models: :all
   # config.route_group :tenant, prefix: '', domain: '{organization}.example.com', models: :all
+  #
+  # The optional `tenant:` keyword declares whether a group has a tenant
+  # boundary. It defaults to true: Rhino.query inside the group fails closed,
+  # raising Rhino::MissingTenantContext when an organization-scopable model is
+  # queried with no organization resolved. Pass `tenant: false` for a group that
+  # legitimately spans every organization — a back office whose operators see all
+  # tenants' rows. There, Rhino.query applies no organization filter and does not
+  # raise; the models' own scopes and the policies still apply, and an explicit
+  # Rhino.for_user(u).in_organization(org) still scopes.
+  # config.route_group :admin, prefix: 'admin', tenant: false, models: :all
+  #
+  # Custom (non-Rhino) controllers publish their group by including
+  # Rhino::RouteGroupContext and declaring `rhino_route_group :admin`, or by
+  # tagging the route with `defaults: { route_group: 'admin' }`. Outside a
+  # request (jobs, rake tasks) no group resolves and the resolver keeps failing
+  # closed.
 
   # config.route_group :default, prefix: '', middleware: [], models: :all
 

data/lib/rhino/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Rhino
-  VERSION = "4.6.1"
+  VERSION = "4.7.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rhino-rails
 version: !ruby/object:Gem::Version
-  version: 4.6.1
+  version: 4.7.2
 platform: ruby
 authors:
 - Bruno Cipolla
@@ -215,6 +215,7 @@ files:
 - lib/rhino/concerns/has_uuid.rb
 - lib/rhino/concerns/has_validation.rb
 - lib/rhino/concerns/hidable_columns.rb
+- lib/rhino/concerns/route_group_context.rb
 - lib/rhino/configuration.rb
 - lib/rhino/context.rb
 - lib/rhino/controllers/auth_controller.rb