rhino-rails 4.6.0 → 4.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3c800a5e70d40849b886fdd638cc4214fa4bd782965de5a94394a6fa0319cb38
-  data.tar.gz: e967104d44d640b9645f579022f14831d36150e763497e25ecfbd2b391ec76b1
+  metadata.gz: ec046eac08bcbf895ec331091f9204e4abba36bf712dc2d283b2c91a02f36671
+  data.tar.gz: 9b72423cd739ed788cf2554b08aa7ba5f5d1dcbc4739689058bf6566b940f0f4
 SHA512:
-  metadata.gz: 717d3ad2ef05fe9ead1918baa1d52d61e865f0b3cd95925173df147ae41ba66786a88971eeed21ef5729103d07312c4b3fdb0ffd5ed2a398e140e3abeebca670
-  data.tar.gz: 0e20f9f6ee200c2643c691c4bac35a6acc6eb091103539b3271133c67f4093bae017bc5ce3b0955b2966ef1be1c688e30c4c17e28dd16566116e9beab5bee34e
+  metadata.gz: adc4639f14af9208841959882a089595573f910a67168551eca6c1cd6eb9d73e3f29523ad8ec49b0ce91e95692ca43b08c29a7d2b121605193c2e51d13b9a686
+  data.tar.gz: 7e6eb9a292a199dbf2f1c42b1e6970c3f99b7bc0df49d1b5318f5987ef1a5b5b070dc4cf01b613bbf035d40d001c8bfd8bf0c3dd1e27141f008da37b48689807

data/lib/rhino/controllers/resources_controller.rb

@@ -193,7 +193,7 @@ module Rhino
 
     # POST /api/{slug}/:id/restore
     def restore
-      record = find_by_route_key(model_class.discarded)
+      record = find_by_route_key(organization_scoped(model_class.discarded))
       authorize record, :restore?, policy_class: policy_for(record)
 
       record.undiscard!
@@ -204,7 +204,7 @@ module Rhino
 
     # DELETE /api/{slug}/:id/force-delete
     def force_delete
-      record = find_by_route_key(model_class.discarded)
+      record = find_by_route_key(organization_scoped(model_class.discarded))
       authorize record, :force_delete?, policy_class: policy_for(record)
 
       record.destroy!
@@ -487,14 +487,22 @@ module Rhino
     # ------------------------------------------------------------------
 
     def find_record
-      scope = model_class.all
-
+      find_by_route_key(organization_scoped(model_class.all))
+    end
+
+    # Apply organization scoping to +relation+ for member-endpoint lookups
+    # (show/update/destroy/restore/force_delete). Delegates to the same lenient
+    # (non-strict) mechanisms index uses — organization-is-self,
+    # for_organization, organization_id column, auto-detected belongs_to path
+    # (incl. nested) — so records with an indirect tenant chain cannot be
+    # fetched cross-tenant by id/route key. Without an org context
+    # (single-tenant apps / non-tenant route groups) the relation is returned
+    # unchanged, and models with no scoping mechanism stay reachable as before.
+    def organization_scoped(relation)
       org = current_organization
-      if org && model_class.column_names.include?("organization_id")
-        scope = scope.where(organization_id: org.id)
-      end
+      return relation unless org
 
-      find_by_route_key(scope)
+      Rhino::ScopesToOrganization.scope_to_organization(relation, model_class, org)
     end
 
     # Column matched against the :id URL segment. Resolution chain:

data/lib/rhino/scopes_to_organization.rb

@@ -30,9 +30,11 @@ module Rhino
         )
       end
 
-      # Check for scopeForOrganization
+      # Check for scopeForOrganization. Merge into the incoming relation instead
+      # of replacing it so upstream conditions (e.g. `.discarded` for
+      # restore/force-delete lookups) are preserved alongside the org filter.
       if model_class.respond_to?(:for_organization)
-        return model_class.for_organization(organization)
+        return relation.merge(model_class.for_organization(organization))
       end
 
       # Check for organization_id column
@@ -69,11 +71,16 @@ module Rhino
 
     def scope_through_relationship(relation, model_class, organization, relationship_path, strict: false)
       if relationship_path.include?(".")
-        # Nested path: 'post.blog' -> joins(post: :blog).where(organizations: { id: org.id })
+        # Nested path: 'post.blog' -> joins(post: { blog: :organization })
+        #                             .where(organizations: { id: org.id })
+        # The inject already folds every path segment (outermost first) around
+        # the trailing :organization association, so the chain is passed to
+        # joins as-is — re-wrapping it in parts.first would double-nest the
+        # first segment and raise ActiveRecord::ConfigurationError.
         parts = relationship_path.split(".")
         join_chain = parts.reverse.inject(:organization) { |inner, outer| { outer.to_sym => inner } }
 
-        relation.joins(join_chain.is_a?(Symbol) ? join_chain : parts.first.to_sym => join_chain)
+        relation.joins(join_chain)
                 .where(organizations: { id: organization.id })
       else
         # Single relationship

data/lib/rhino/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Rhino
-  VERSION = "4.6.0"
+  VERSION = "4.6.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rhino-rails
 version: !ruby/object:Gem::Version
-  version: 4.6.0
+  version: 4.6.1
 platform: ruby
 authors:
 - Bruno Cipolla