wor-simple_crud 0.3.1 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e280efd8ead44768d16e0ba663e25a40d6972b53e253281d1c7eac0735421b64
-  data.tar.gz: 78625a2a759ca5fda1e7d41e421db92ed721f2e2c343524f0580cd810d32ac7a
+  metadata.gz: dbcb6881c359fa3b5c4ce518871a4f378d92e0698ab7d57dc489315f2f25b80b
+  data.tar.gz: 62cf8cbd6df845cd23a388e9b2a1f8ebfdae784ff91f4e57268688bce0c0bf87
 SHA512:
-  metadata.gz: 406a83cc98deaa7fa3ba5f7ccb9a12486a903b6aef81bddd0a5f4f9c595ffa64e7414cb8a718d4a4fe96f987fcefaf34a8b201cbe16aab4db2721eea0bd19397
-  data.tar.gz: 7177530ba1a01fcf526c406a14f3bf64bfcf895ce5675f4acca5f24f28c57db90859ddab43866d314f70e723cfebda24bc5930d64ac66a01d29bc6246792c04a
+  metadata.gz: 4406326eab40876599274e927df02c9c3470d3f753dcd5f0f150b67a7b3087e2a965ec0fd18ad1e007bada514954f9a665d573d18da98bf7c93aee3ffebc1637
+  data.tar.gz: 1deddc698fb6008531d59e5656675086a309dbc26177b403c023e7743463425626b8e977785f6ef2cbe122d4f251ad697944d1c71f665e498666feecedbae792

data/CHANGELOG.md

@@ -1,5 +1,20 @@
 ## Change log
 
+### V0.4.0
+
+Breaking:
+* Blocks given to `simple_crud_for` no longer imply `html: true`. HTML controllers with render blocks must pass `html: true` explicitly.
+
+New options:
+* `authenticate_headers:` controls whether shared examples set auth headers and run the unauthorized test, independent of `authenticate:`. Defaults to `authenticate:`. Set `authenticate: false, authenticate_headers: true` when a base-controller `before_action` handles auth so the lambda skips the call but tests still cover the auth path.
+* `simple_crud_defaults(options)` sets option defaults at the controller level. Subclasses inherit. Per-action options override. Precedence: gem defaults < controller defaults < per-action options.
+
+Fixes:
+* Use `RSpec.shared_examples` instead of the top-level alias, which is unavailable with `config.disable_monkey_patching!`.
+* Auto-require `SimpleCrud::Authorization::Adapter` on `require 'simple_crud'`.
+* Remove `cattr_accessor :params, :permitted` (thread-unsafe, never read by the gem). Remove the `set_params` boilerplate from host controllers.
+* Raise a clear error when `owner_association` names an attribute the model doesn't have, instead of a bare `NoMethodError` from FactoryBot.
+
 ### V0.3.1
 
 Shared examples configuration:

data/README.md

@@ -18,6 +18,7 @@ SimpleCrud
         - [Serializer](#serializer)
         - [HTML](#html)
         - [Finder](#finder)
+      - [Controller-level defaults](#controller-level-defaults)
       - [Shared examples](#shared-examples)
   - [Contributing](#contributing)
   - [Releases](#releases)
@@ -68,12 +69,6 @@ Before SimpleCrud can be used, some boilerplate is needed. Add the following to
 include Pundit::Authorization
 include Wor::Paginate
 extend SimpleCrudController
-
-before_action :set_params
-
-def set_params
-  SimpleCrudController.params = params
-end
 ```
 
 (Skip `include Pundit::Authorization` / `include Wor::Paginate` if you're using a different adapter, or `authorize: false` / `paginate: false` everywhere.)
@@ -105,7 +100,8 @@ simple_crud_for :index, paginate: false, authorize: false, serializer: CustomSer
 
 - Paginate: whether it should paginate or not. `true` paginates via the configured pagination adapter (wor-paginate by default), `false` doesn't paginate
 - Authorize: whether it should check authorization via the configured authorization adapter (Pundit by default)
-- Authenticate: whether it should use Devise to check for a current_user
+- Authenticate: whether the generated action calls `authenticate_user!`. `true` (default) or `false`
+- Authenticate_headers: whether shared examples set auth headers and run the unauthorized test. Defaults to `authenticate:`. Set independently when a base-controller `before_action` handles auth and the lambda should skip `authenticate_user!`
 - Serializer: specify a particular serializer you should use
 - Html: renders the action's ERB template instead of JSON (valid for `:index`, `:show`, `:new`, `:edit`, `:create`, `:update` and `:destroy`). Only meaningful in controllers that render templates
 - Scope: only valid for `:index`. A `Proc`/`lambda` taking `current_user` (plus the controller's `params` if it takes a second argument) that returns the relation to list, overriding the default `policy_scope`. The user is resolved via `SimpleCrud::Config.user_method` (`:current_user` by default; set it to e.g. `:current_admin`)
@@ -114,6 +110,22 @@ simple_crud_for :index, paginate: false, authorize: false, serializer: CustomSer
 - Raise_on_invalid: only valid for `:create` and `:update`. Keeps the strict `create!`/`update!` semantics (raising on invalid input) instead of returning `422` with the validation errors
 - Redirect: only valid for HTML-mode `:create`, `:update` and `:destroy`. A `Proc`/`lambda` (called with the record) or a literal path used as the success redirect target. Defaults to the record (`:create`/`:update`) or the model's collection path (`:destroy`)
 
+#### Controller-level defaults
+
+`simple_crud_defaults` sets option defaults for every `simple_crud_for` in the controller. Subclasses inherit; per-action options override.
+
+```ruby
+class Api::BaseController < ActionController::API
+  extend SimpleCrudController
+  simple_crud_defaults authorize: false, authenticate: false, authenticate_headers: true
+end
+
+class Api::PostsController < Api::BaseController
+  simple_crud_for :show                    # inherits defaults
+  simple_crud_for :create, authorize: true # overrides for this action only
+end
+```
+
 You'll need a few things so they work correctly:
 
 ### Options
@@ -247,7 +259,13 @@ end
 ```
 
 #### Authenticate
-SimpleCrud will assume a current_user method. Future versions will support a custom model. Defining a current_user method in ApplicationController should work if you're using a different model, as of now.
+`authenticate: true` (default) calls `authenticate_user!` inside the generated action. `authenticate: false` skips it.
+
+If your base controller already runs `before_action :authenticate_user!`, set `authenticate: false` to avoid a double call and `authenticate_headers: true` so shared examples still cover the auth path:
+
+```ruby
+simple_crud_defaults authenticate: false, authenticate_headers: true
+```
 
 #### Serializer
 The name of the serializer, by default, is the name of the model followed by Serializer, as is the standard for [ActiveModelSerializers](https://github.com/rails-api/active_model_serializers). It's possible to just pass a custom serializer class though. As for the serializer itself, it's a standard serializer, with the gotcha that you need to include `:id` for the SimpleCrud examples to work.
@@ -279,16 +297,22 @@ simple_crud_for :update, html: true
 simple_crud_for :destroy, html: true
 ```
 
-Or pass a block that renders explicitly, overriding the auto-render. The block receives the records for `:index`, the record for `:show`/`:new`, or the record plus a saved flag for `:create`/`:update`/`:destroy`. Passing a block also implies `html: true` for the shared examples (so a server-rendered block is asserted as HTML); if your block renders JSON instead, pass `html: false` explicitly:
+Or pass a block that renders explicitly, overriding the auto-render. The block receives the records for `:index`, the record for `:show`/`:new`, or the record plus a saved flag for `:create`/`:update`/`:destroy`. Blocks do not change the `html:` default; pass it explicitly so the shared examples know which request format to use:
 
 ```ruby
-simple_crud_for :index do |records|
+# Server-rendered block: pass html: true so shared examples send HTML requests
+simple_crud_for :index, html: true do |records|
   render :index, locals: { models: records }
 end
 
-simple_crud_for :create do |record, saved|
+simple_crud_for :create, html: true do |record, saved|
   saved ? redirect_to(record) : render(:new, locals: { model: record })
 end
+
+# API block: html: false is the default
+simple_crud_for :show, html: false do |record|
+  render json: record.as_json(only: %i[id name])
+end
 ```
 
 #### Build
@@ -320,7 +344,7 @@ simple_crud_for :destroy, finder: ->(params) { current_user.models.find(params[:
 When omitted it defaults to `klass.find(params[:id])`, and `not_found` is still returned whenever the finder finds no record.
 
 ### Shared examples
-While optional, using the included shared examples saves you from writing the standard test cases for the methods. You can even use them if you didn't use `simple_crud_for`, as a set of basic tests. To include them, just add `require 'simple_crud/rspec'` to your `rails_helper.rb` file and add the lines you need to your `*_spec.rb` files:
+While optional, using the included shared examples saves you from writing the standard test cases for the methods. You can even use them if you didn't use `simple_crud_for`, as a set of basic tests. To include them, add `require 'simple_crud/rspec'` to your `rails_helper.rb` **after** `require "rspec/rails"`, then add the lines you need to your `*_spec.rb` files:
 ```ruby
 require 'rails_helper'
 

data/lib/simple_crud/rspec/helpers/controller_options.rb

@@ -10,9 +10,14 @@ module SimpleCrud
           described_class.instance_variable_get(:@simple_crud_metadata)[method][option]
         end
 
-        %i[paginate authorize authenticate serializer html finder scope build raise_on_invalid block].each do |option|
+        %i[paginate authorize authenticate serializer html finder scope build raise_on_invalid block
+           authenticate_headers].each do |option|
           define_method("check_#{option}") { |method| get_option(method, option) }
         end
+
+        def check_authenticate(method)
+          check_authenticate_headers(method)
+        end
       end
     end
   end

data/lib/simple_crud/rspec/helpers/models.rb

@@ -15,7 +15,22 @@ module SimpleCrud
         end
 
         def model
-          @model ||= create_record(model_class, model_attributes)
+          @model ||= begin
+            validate_owner_association!
+            create_record(model_class, model_attributes)
+          end
+        end
+
+        def validate_owner_association!
+          assoc = owner_association
+          return unless assoc
+
+          klass = model_class_object
+          return if klass.method_defined?("#{assoc}=") || klass.column_names.include?(assoc.to_s)
+
+          raise "simple_crud: owner_association is :#{assoc} but #{klass} has no #{assoc}= setter. " \
+                'Set `simple_crud: { owner_association: nil }` in your describe block or ' \
+                'override model_attributes directly.'
         end
 
         def model_attributes

data/lib/simple_crud/simple_crud_controller.rb

@@ -11,12 +11,12 @@ module SimpleCrudController
   # Include, not extend: controllers gain these by extending SimpleCrudController.
   include SimpleCrud::ActionLambdas
 
-  cattr_accessor :params, :permitted
-
   # Possible options:
   ### authorize: check authorization via Config.authorization_adapter (Pundit by default)
   ### paginate: paginate the list via Config.pagination_adapter (wor-paginate by default)
-  ### authenticate: use devise to authenticate
+  ### authenticate: true calls authenticate_user! inside the action lambda; false skips it
+  ### authenticate_headers: whether shared examples set auth headers and run the unauthorized
+  ###   test (defaults to authenticate:); set independently when a base-controller before_action handles auth
   ### serializer: use a particular serializer (both each_serializer and serializer)
   ### html: render the action's ERB template instead of JSON (index/show/new/edit/create/update/destroy)
   ### finder: custom record lookup (Proc/lambda or Symbol) for :show/:update/:destroy/:edit
@@ -26,7 +26,6 @@ module SimpleCrudController
   ### A block given to simple_crud_for renders explicitly: it receives the records for :index,
   ### the record for :show/:new/:edit, or the record and a saved flag for :create/:update/:destroy
   def simple_crud_for(method, parameters = {}, &block)
-    parameters[:html] = true if block && !parameters.key?(:html)
     parameters[:block] = true if block
     parameters = parameters_with_defaults(parameters)
     klass = simple_crud_controller_model
@@ -37,12 +36,28 @@ module SimpleCrudController
     write_metadata(method, parameters)
   end
 
+  def simple_crud_defaults(options = {})
+    @simple_crud_defaults = simple_crud_inherited_defaults.merge(options)
+  end
+
+  def simple_crud_inherited_defaults
+    ancestors.each do |ancestor|
+      next unless ancestor.instance_variable_defined?(:@simple_crud_defaults)
+
+      return ancestor.instance_variable_get(:@simple_crud_defaults)
+    end
+    {}
+  end
+
   def parameters_with_defaults(parameters)
     defaults = {
-      authorize: true, paginate: true, authenticate: true, serializer: nil,
-      html: false, finder: nil, scope: nil, build: nil, raise_on_invalid: false
+      authorize: true, paginate: true, authenticate: true, authenticate_headers: nil,
+      serializer: nil, html: false, finder: nil, scope: nil, build: nil, raise_on_invalid: false
     }
-    defaults.each { |key, value| parameters[key] = value unless parameters.key?(key) }
+    defaults.merge(simple_crud_inherited_defaults).each do |key, value|
+      parameters[key] = value unless parameters.key?(key)
+    end
+    parameters[:authenticate_headers] = parameters[:authenticate] if parameters[:authenticate_headers].nil?
     parameters
   end
 

data/lib/simple_crud/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module SimpleCrud
-  VERSION = '0.3.1'
+  VERSION = '0.4.0'
 end

data/lib/simple_crud.rb

@@ -2,6 +2,7 @@
 
 require_relative 'simple_crud/version'
 require_relative 'simple_crud/config'
+require_relative 'simple_crud/authorization/adapter'
 require_relative 'simple_crud/simple_crud_controller'
 
 # Simplified CRUD endpoints for Rails API controllers.

data/lib/spec/shared_examples/authorization_adapter_authorize.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-shared_examples 'authorization adapter #authorize' do |record_class, denied_error|
+RSpec.shared_examples 'authorization adapter #authorize' do |record_class, denied_error|
   it 'passes for a record the adapter allows' do
     expect { adapter.authorize(controller, record_class.new(1)) }.not_to raise_error
   end

data/lib/spec/shared_examples/simple_crud_for_create.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-shared_examples 'simple crud for create' do
+RSpec.shared_examples 'simple crud for create' do
   describe 'POST #create' do
     context 'without authenticated user' do
       subject!(:req) do

data/lib/spec/shared_examples/simple_crud_for_create_with_block.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-shared_examples 'simple crud for create with block' do
+RSpec.shared_examples 'simple crud for create with block' do
   describe 'POST #create with a render block' do
     context 'when successfully creating a record' do
       include_context 'with authenticated user' if check_authenticate(:create)

data/lib/spec/shared_examples/simple_crud_for_create_with_build.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-shared_examples 'simple crud for create with build' do
+RSpec.shared_examples 'simple crud for create with build' do
   describe 'POST #create with a build hook' do
     include_context 'with authenticated user' if check_authenticate(:create)
 

data/lib/spec/shared_examples/simple_crud_for_destroy.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-shared_examples 'simple crud for destroy' do
+RSpec.shared_examples 'simple crud for destroy' do
   describe 'DELETE #destroy' do
     context 'without authenticated user' do
       subject!(:req) do

data/lib/spec/shared_examples/simple_crud_for_destroy_with_block.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-shared_examples 'simple crud for destroy with block' do
+RSpec.shared_examples 'simple crud for destroy with block' do
   describe 'DELETE #destroy with a render block' do
     include_context 'with authenticated user' if check_authenticate(:destroy)
 

data/lib/spec/shared_examples/simple_crud_for_destroy_with_finder.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-shared_examples 'simple crud for destroy with finder' do
+RSpec.shared_examples 'simple crud for destroy with finder' do
   describe 'DELETE #destroy with a custom finder' do
     include_context 'with authenticated user' if check_authenticate(:destroy)
 

data/lib/spec/shared_examples/simple_crud_for_edit.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-shared_examples 'simple crud for edit' do
+RSpec.shared_examples 'simple crud for edit' do
   describe 'GET #edit' do
     subject(:edit_request) { get :edit, params: with_route_params(edit_params), format: request_format(:edit) }
 

data/lib/spec/shared_examples/simple_crud_for_index.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-shared_examples 'simple crud for index' do
+RSpec.shared_examples 'simple crud for index' do
   describe 'GET #index' do
     let(:created_models) { create_records(model_class, 10, model_attributes) }
 

data/lib/spec/shared_examples/simple_crud_for_index_with_block.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-shared_examples 'simple crud for index with block' do
+RSpec.shared_examples 'simple crud for index with block' do
   describe 'GET #index with a render block' do
     let(:created_models) { create_records(model_class, 2, model_attributes) }
 

data/lib/spec/shared_examples/simple_crud_for_index_with_scope.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-shared_examples 'simple crud for index with scope' do
+RSpec.shared_examples 'simple crud for index with scope' do
   let(:request_params) { {} }
   let(:my_models) { create_records(model_class, 2, scoped_attributes) }
   let(:other_models) { create_records(model_class, 3, other_scoped_attributes) }

data/lib/spec/shared_examples/simple_crud_for_new.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-shared_examples 'simple crud for new' do
+RSpec.shared_examples 'simple crud for new' do
   describe 'GET #new' do
     include_examples 'simple crud without authenticated user', :new
     include_examples 'simple crud when not authorized', :new, :get

data/lib/spec/shared_examples/simple_crud_for_new_with_block.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-shared_examples 'simple crud for new with block' do
+RSpec.shared_examples 'simple crud for new with block' do
   describe 'GET #new with a render block' do
     include_context 'with authenticated user' if check_authenticate(:new)
 

data/lib/spec/shared_examples/simple_crud_for_new_with_build.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-shared_examples 'simple crud for new with build' do
+RSpec.shared_examples 'simple crud for new with build' do
   describe 'GET #new with a build hook' do
     include_context 'with authenticated user' if check_authenticate(:new)
 

data/lib/spec/shared_examples/simple_crud_for_show.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-shared_examples 'simple crud for show' do
+RSpec.shared_examples 'simple crud for show' do
   describe 'GET #show' do
     subject(:show_request) { get :show, params: with_route_params(show_params), format: request_format(:show) }
 

data/lib/spec/shared_examples/simple_crud_for_show_with_block.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-shared_examples 'simple crud for show with block' do
+RSpec.shared_examples 'simple crud for show with block' do
   describe 'GET #show with a render block' do
     include_context 'with authenticated user' if check_authenticate(:show)
 

data/lib/spec/shared_examples/simple_crud_for_show_with_finder.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-shared_examples 'simple crud for show with finder' do
+RSpec.shared_examples 'simple crud for show with finder' do
   describe 'GET #show with a custom finder' do
     include_context 'with authenticated user' if check_authenticate(:show)
 

data/lib/spec/shared_examples/simple_crud_for_update.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-shared_examples 'simple crud for update' do
+RSpec.shared_examples 'simple crud for update' do
   describe 'PUT #update' do
     context 'without authenticated user' do
       subject!(:req) do

data/lib/spec/shared_examples/simple_crud_for_update_with_finder.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-shared_examples 'simple crud for update with finder' do
+RSpec.shared_examples 'simple crud for update with finder' do
   describe 'PUT #update with a custom finder' do
     include_context 'with authenticated user' if check_authenticate(:update)
 

data/lib/spec/shared_examples/simple_crud_not_found_with_finder.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-shared_examples 'simple crud not found with finder' do |http_method, action|
+RSpec.shared_examples 'simple crud not found with finder' do |http_method, action|
   context 'when the model does not exist' do
     before do
       send(http_method, action, params: with_route_params(finder_key => "nonexistent-#{finder_key}"),

data/lib/spec/shared_examples/simple_crud_renders_template.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-shared_examples 'simple crud renders template' do |template, status = :ok|
+RSpec.shared_examples 'simple crud renders template' do |template, status = :ok|
   it "renders the #{template} template", :aggregate_failures do
     expect(response).to have_http_status(resolve(status))
     expect(response).to render_template(template) if assert_html_template

data/lib/spec/shared_examples/simple_crud_when_not_authorized.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-shared_examples 'simple crud when not authorized' do |action, verb, request_params = {}|
+RSpec.shared_examples 'simple crud when not authorized' do |action, verb, request_params = {}|
   if check_authorize(action)
     context 'when not authorized' do
       include_context 'with authenticated user' if check_authenticate(action)

data/lib/spec/shared_examples/simple_crud_without_authenticated_user.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-shared_examples 'simple crud without authenticated user' do |action|
+RSpec.shared_examples 'simple crud without authenticated user' do |action|
   context 'without authenticated user' do
     subject!(:req) { get action, params: with_route_params({}) }
 

data/lib/spec/shared_examples/unauthorized_when_not_logged_in.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-shared_examples 'unauthorized when not logged in' do
+RSpec.shared_examples 'unauthorized when not logged in' do
   context 'when the user is not logged in' do
     it 'returns the unauthenticated status' do
       req

data/spec/dummy/app/controllers/block/dummy_models_controller.rb

@@ -5,12 +5,7 @@ module Block
     include Wor::Paginate
     extend SimpleCrudController
 
-    before_action :set_params
-    def set_params
-      SimpleCrudController.params = params
-    end
-
-    simple_crud_for :index, paginate: false, authenticate: false, authorize: false do |records|
+    simple_crud_for :index, html: true, paginate: false, authenticate: false, authorize: false do |records|
       render :index, locals: { models: records }
     end
   end

data/spec/dummy/app/controllers/block_new/dummy_models_controller.rb

@@ -2,7 +2,7 @@
 
 module BlockNew
   class DummyModelsController < BlockModes::BaseController
-    simple_crud_for :new, authenticate: false, authorize: false do |record|
+    simple_crud_for :new, html: true, authenticate: false, authorize: false do |record|
       render_model(record, :new)
     end
   end

data/spec/dummy/app/controllers/block_redirect/dummy_models_controller.rb

@@ -2,7 +2,7 @@
 
 module BlockRedirect
   class DummyModelsController < HtmlModes::BaseController
-    simple_crud_for :destroy, authenticate: false, authorize: false do |_record, destroyed|
+    simple_crud_for :destroy, html: true, authenticate: false, authorize: false do |_record, destroyed|
       if destroyed
         redirect_to action: :show, notice: 'removed'
       else

data/spec/dummy/app/controllers/block_show/dummy_models_controller.rb

@@ -2,7 +2,7 @@
 
 module BlockShow
   class DummyModelsController < BlockModes::BaseController
-    simple_crud_for :show, authenticate: false, authorize: false do |record|
+    simple_crud_for :show, html: true, authenticate: false, authorize: false do |record|
       render_model(record, :show)
     end
   end

data/spec/dummy/app/controllers/built/dummy_models_controller.rb

@@ -6,11 +6,6 @@ module Built
     include Pundit::Authorization
     extend SimpleCrudController
 
-    before_action :set_params
-    def set_params
-      SimpleCrudController.params = params
-    end
-
     def dummy_model_params
       params.permit(:name, :something, :user_id, :slug)
     end

data/spec/dummy/app/controllers/dummy_models_controller.rb

@@ -6,11 +6,6 @@ class DummyModelsController < ApplicationController
   include Pundit::Authorization
   extend SimpleCrudController
 
-  before_action :set_params
-  def set_params
-    SimpleCrudController.params = params
-  end
-
   def dummy_model_params
     params.permit(:name, :something, :user_id, :slug)
   end

data/spec/dummy/app/controllers/finder/dummy_models_controller.rb

@@ -6,11 +6,6 @@ module Finder
     include Pundit::Authorization
     extend SimpleCrudController
 
-    before_action :set_params
-    def set_params
-      SimpleCrudController.params = params
-    end
-
     def dummy_model_params
       params.permit(:name, :something, :user_id)
     end

data/spec/dummy/app/controllers/html_modes/base_controller.rb

@@ -5,11 +5,6 @@ module HtmlModes
     include Wor::Paginate
     extend SimpleCrudController
 
-    before_action :set_params
-    def set_params
-      SimpleCrudController.params = params
-    end
-
     def dummy_model_params
       params.permit(:name, :something, :user_id, :slug)
     end

data/spec/dummy/app/controllers/invalid_status/dummy_models_controller.rb

@@ -2,7 +2,7 @@
 
 module InvalidStatus
   class DummyModelsController < HtmlModes::BaseController
-    simple_crud_for :create, authenticate: false, authorize: false do |record, saved|
+    simple_crud_for :create, html: true, authenticate: false, authorize: false do |record, saved|
       if saved
         redirect_to(record)
       else

data/spec/dummy/app/controllers/nested/dummy_models_controller.rb

@@ -6,11 +6,6 @@ module Nested
     include Pundit::Authorization
     extend SimpleCrudController
 
-    before_action :set_params
-    def set_params
-      SimpleCrudController.params = params
-    end
-
     def dummy_model_params
       params.require(:dummy_model).permit(:name, :something, :user_id, :slug)
     end

data/spec/dummy/app/controllers/nested_route/dummy_models_controller.rb

@@ -6,11 +6,6 @@ module NestedRoute
     include Pundit::Authorization
     extend SimpleCrudController
 
-    before_action :set_params
-    def set_params
-      SimpleCrudController.params = params
-    end
-
     def dummy_model_params
       params.require(:dummy_model).permit(:name, :something, :user_id, :slug, :classroom_slug)
     end

data/spec/dummy/app/controllers/redirect_auth/dummy_models_controller.rb

@@ -10,11 +10,6 @@ module RedirectAuth
 
     rescue_from UnauthenticatedError, with: :redirect_to_login
 
-    before_action :set_params
-    def set_params
-      SimpleCrudController.params = params
-    end
-
     def authenticate_user!
       raise UnauthenticatedError unless current_user
     end

data/spec/dummy/app/controllers/scoped/dummy_models_controller.rb

@@ -6,11 +6,6 @@ module Scoped
     include Pundit::Authorization
     extend SimpleCrudController
 
-    before_action :set_params
-    def set_params
-      SimpleCrudController.params = params
-    end
-
     simple_crud_for :index, scope: ->(user) { DummyModel.where(user: user) }
   end
 end

data/spec/dummy/app/controllers/scoped_params/dummy_models_controller.rb

@@ -6,11 +6,6 @@ module ScopedParams
     include Pundit::Authorization
     extend SimpleCrudController
 
-    before_action :set_params
-    def set_params
-      SimpleCrudController.params = params
-    end
-
     simple_crud_for :index, scope: ->(user, params) { DummyModel.where(user: user, something: params[:something]) }
   end
 end

data/spec/dummy/app/controllers/strict/dummy_models_controller.rb

@@ -6,11 +6,6 @@ module Strict
     include Pundit::Authorization
     extend SimpleCrudController
 
-    before_action :set_params
-    def set_params
-      SimpleCrudController.params = params
-    end
-
     def dummy_model_params
       params.permit(:name, :something, :user_id, :slug)
     end

data/spec/dummy/app/controllers/unpaginated_scoped/dummy_models_controller.rb

@@ -6,11 +6,6 @@ module UnpaginatedScoped
     include Pundit::Authorization
     extend SimpleCrudController
 
-    before_action :set_params
-    def set_params
-      SimpleCrudController.params = params
-    end
-
     simple_crud_for :index, paginate: false, scope: ->(user) { DummyModel.where(user: user) }
   end
 end

data/spec/dummy/app/controllers/without_pagination/dummy_models_controller.rb

@@ -5,11 +5,6 @@ module WithoutPagination
     include Pundit::Authorization
     extend SimpleCrudController
 
-    before_action :set_params
-    def set_params
-      SimpleCrudController.params = params
-    end
-
     simple_crud_for :index, paginate: false
   end
 end

data/spec/simple_crud/rspec_config_spec.rb

@@ -82,6 +82,12 @@ describe SimpleCrud::RSpec do
       expect(model_attributes).to eq(user: current_user)
     end
 
+    it 'raises a clear error when owner_association has no setter on the model' do
+      klass = Class.new { def self.column_names = [] }
+      allow(self).to receive_messages(owner_association: :nonexistent, model_class_object: klass)
+      expect { validate_owner_association! }.to raise_error(/owner_association is :nonexistent/)
+    end
+
     describe 'with simple_crud metadata',
              simple_crud: { finder_key: :token, model_attributes: -> { { overridden: true } } } do
       it 'prefers metadata for overridden settings' do

data/spec/simple_crud_controller_spec.rb

@@ -8,6 +8,14 @@ class UnpoliceableThingsController
   extend SimpleCrudController
 end
 
+class BaseWithDefaultsController
+  extend SimpleCrudController
+  simple_crud_defaults authorize: false, authenticate: false, authenticate_headers: true
+end
+
+class InheritingController < BaseWithDefaultsController
+end
+
 describe SimpleCrudController do
   describe '.check_policies' do
     it 'returns when a matching policy exists' do
@@ -21,6 +29,36 @@ describe SimpleCrudController do
     end
   end
 
+  describe '.simple_crud_defaults' do
+    it 'applies to parameters_with_defaults', :aggregate_failures do
+      params = BaseWithDefaultsController.parameters_with_defaults({})
+      expect(params[:authorize]).to be false
+      expect(params[:authenticate]).to be false
+      expect(params[:authenticate_headers]).to be true
+    end
+
+    it 'are inherited by subclasses', :aggregate_failures do
+      params = InheritingController.parameters_with_defaults({})
+      expect(params[:authorize]).to be false
+      expect(params[:authenticate]).to be false
+      expect(params[:authenticate_headers]).to be true
+    end
+
+    it 'can be overridden per action', :aggregate_failures do
+      params = InheritingController.parameters_with_defaults(authorize: true)
+      expect(params[:authorize]).to be true
+      expect(params[:authenticate]).to be false
+      expect(params[:authenticate_headers]).to be true
+    end
+
+    it 'does not affect unrelated controllers', :aggregate_failures do
+      params = DummyModelsController.parameters_with_defaults({})
+      expect(params[:authorize]).to be true
+      expect(params[:authenticate]).to be true
+      expect(params[:authenticate_headers]).to be true
+    end
+  end
+
   describe '.check_serializer' do
     it 'returns when the serializer option is blank' do
       expect { DummyModelsController.check_serializer({}) }.not_to raise_error

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: wor-simple_crud
 version: !ruby/object:Gem::Version
-  version: 0.3.1
+  version: 0.4.0
 platform: ruby
 authors:
 - icoluccio
 bindir: bin
 cert_chain: []
-date: 2026-08-22 00:00:00.000000000 Z
+date: 2026-08-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails