rhino-rails 4.8.0 → 4.8.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9e5e5a25c72952be8b915169fd2f5320476a1414b20aba43428c636e92513188
-  data.tar.gz: 48af3696d7a56d92fc1e9f7e270077f108579bf1e2701542e563d6a75f94dd4e
+  metadata.gz: c77838e9b0818c083a66439097840287fdfadcd94fe17f7e403b9a1c00e08322
+  data.tar.gz: 698536e45e86aed2abd48ba646c0ebc4e821511838c79db07e6525413ace80c5
 SHA512:
-  metadata.gz: '099ea8dc9ecea149b1fd30cd56446fb107d474478cb669d39dbc1bb2d01a16a1669160f6912658da035fa9dc62e26a4639962ad9f661848919ca3b15178f59da'
-  data.tar.gz: d9423c888d912f451312d5c0b3243dd1a1b43493ee4fb60378fafa17127c9f22f445cd0161197492e08543ce6946d2202cfef1a8891f7847e5677374f96c7991
+  metadata.gz: 52ec8339ccd944fcb4b3c071bc4829acaf37c1d401abfce18bec28648eac3005d7ca18c407ad3784bc541dcd16cf3238144c8ebd7bbc58ada65b8537f64e0515
+  data.tar.gz: '096db647db3f380fe23621e6fc31496321e857a80ce22911bc2133a7877a7e607a49be3e60cb08f88594030c784b9b3a6d3e8f9415969ed0188bfb11569e3ffc'

data/lib/rhino/configuration.rb

@@ -9,6 +9,12 @@ module Rhino
     # model that does not declare its own +rhino_route_key+. Default nil =
     # primary key (today's behavior, fully backward compatible).
     attr_accessor :route_key
+    # How many client-selectable named scopes one request may combine with the
+    # bracket form (?scope[a]=&scope[b][x]=1). Each scope is an arbitrary query
+    # fragment that may add joins or subqueries, so the number is capped: a
+    # request over the cap is refused with 403 "Too many scopes requested".
+    # Default 3 — a base scope, a window, and one more predicate.
+    attr_reader :max_scopes_per_request
     attr_reader :auth
 
     def initialize
@@ -33,6 +39,14 @@ module Rhino
       @client_path = nil
       @mobile_path = nil
       @route_key = nil
+      @max_scopes_per_request = 3
+    end
+
+    # A non-numeric or non-positive value would lock every scope out of every
+    # request, so it falls back to the default instead.
+    def max_scopes_per_request=(value)
+      value = value.to_i if value.respond_to?(:to_i)
+      @max_scopes_per_request = value.is_a?(Integer) && value.positive? ? value : 3
     end
 
     # Auth configuration accessor. Merges supplied keys over defaults so a host

data/lib/rhino/query_builder.rb

@@ -12,10 +12,12 @@ module Rhino
   #   - Fields:       ?fields[posts]=id,title,status
   #   - Includes:     ?include=user,comments
   class QueryBuilder
-    # How many named scopes one request may combine. Scopes are arbitrary query
-    # fragments, so stacking many of them is a good way to build an accidental
-    # cross join; three covers every real listing.
-    MAX_SCOPES_PER_REQUEST = 3
+    # Fallback for how many named scopes one request may combine, used when no
+    # Rhino configuration is reachable. Apps set +config.max_scopes_per_request+.
+    #
+    # Scopes are arbitrary query fragments, so stacking many of them is a good
+    # way to build an accidental cross join; three covers every real listing.
+    DEFAULT_MAX_SCOPES_PER_REQUEST = 3
 
     attr_reader :scope, :model_class, :params
 
@@ -109,7 +111,7 @@ module Rhino
           { raw.to_s => "" }
         end
 
-      raise Rhino::ScopeNotAllowedError, "Too many scopes requested" if requested.size > MAX_SCOPES_PER_REQUEST
+      raise Rhino::ScopeNotAllowedError, "Too many scopes requested" if requested.size > max_scopes_per_request
 
       permitted = permitted_scope_names
 
@@ -132,6 +134,14 @@ module Rhino
       end
     end
 
+    # How many named scopes this app allows in one request.
+    def max_scopes_per_request
+      configured = Rhino.config.try(:max_scopes_per_request)
+      configured.is_a?(Integer) && configured.positive? ? configured : DEFAULT_MAX_SCOPES_PER_REQUEST
+    rescue StandardError
+      DEFAULT_MAX_SCOPES_PER_REQUEST
+    end
+
     # Run one already-authorized named scope, passing the bound arguments in the
     # order the model declared them.
     def run_named_scope(name, entry, args)

data/lib/rhino/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Rhino
-  VERSION = "4.8.0"
+  VERSION = "4.8.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rhino-rails
 version: !ruby/object:Gem::Version
-  version: 4.8.0
+  version: 4.8.1
 platform: ruby
 authors:
 - Bruno Cipolla