wor-simple_crud 0.5.0 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b5b50548416811b034a75f72c96d4e94c41cdb9883d7112cdf720ad3febaeb11
-  data.tar.gz: 99ae1562bae38c2fa8ff1d697859f8643e2b818aaeb66f2e14220171fa9f28dc
+  metadata.gz: 32e4043eb57f025e3a834a364be09cae1e35fa401bbf95bac88351272297d4f9
+  data.tar.gz: bb88b34edd232839b1b760a2bcb834bd25f8a244d3ad02c4a91097f14d85b377
 SHA512:
-  metadata.gz: ef7dd6acb64f882534e9951a9adf2d8deab27f2264451cb1dee2613c78e4842e38d10a638a2ed9ec623984d0d571aee558e2a3626f7bf8f016eca65dc3174ae3
-  data.tar.gz: 43a9b8fb46febb90d101814a33d48049ba0a5c2df3a3b14568c5423816ebd55325966fabe8673320ef3ed89b1a7bfe0ac10f4940c16b0e412649b100dd08e051
+  metadata.gz: e173f6052e2c1674896a08067369068d2ab9f3c50c082f4a52bf8f4d7db3a9e27f548df1a55fd12bc22e9cc4a360095033d4693ecd5b6957fae7c6b09bd24224
+  data.tar.gz: a1ffc6e33056614ff6806f2b15716d21e749777de66619f23ef0025b4e5561c60e89bbb2d0df27abc3817f248cf21aa8a6ed7cbcdcc0dad67a561411084ba2f0

data/CHANGELOG.md

@@ -1,5 +1,42 @@
 ## Change log
 
+### V0.7.0
+
+Serializer support:
+* `serializer:` accepts a plain class exposing a `.render` class method, with no base class or gem dependency. simple_crud calls `serializer.render(record, **options)`, so a `def self.render(record, key: default)` signature works untouched. It checks this after Blueprinter's `render_as_hash` and before the ActiveModelSerializers fallback, leaving existing Blueprinter and AMS apps unaffected.
+
+New options:
+* `owned_by:` (Symbol): names an association on `Config.user_method` (`current_user.posts` for `owned_by: :posts`) and supplies the default `finder:`/`build:`/index `scope:` from it, so an owned resource stops spelling out `finder: ->(params) { current_user.posts.find(params[:id]) }` and `build: -> { current_user.posts.build }` on every action. An explicit `finder:`/`build:`/`scope:` overrides the default for that option alone. On `:index`, `owned_by:` takes precedence over the Pundit `policy_scope`, and an explicit `scope:` overrides both. With no current user, an owned `:index` returns no records and an owned `:show`/`:update`/`:destroy` returns `not_found`.
+* `parent:` names a nested route's parent and derives the same defaults from `parent.public_send(parent_association)`. A Symbol resolves a controller method first, then an `@ivar`, so a conventional `before_action` works unchanged; a `Proc` runs in controller context. `parent_association:` defaults to the controller model's plural (`ExamsController` gives `@category.exams`). An explicit `finder:`/`build:`/`scope:` overrides the default, and a nil parent fails closed (404 on find/build, empty index). `parent:` and `owned_by:` both resolve a relation from an owner, so setting both raises `ArgumentError`.
+
+Behavior changes:
+* `scope:` on `:index` accepts a `Symbol` naming a class method on the model, called as `klass.send(scope, user, params)`. Query composition can live on the model instead of inline in the controller.
+* `scope:` lambdas run with the controller as `self`, so a scope can read `@ivars` and route-parent state. Arity 0 receives no arguments (it previously errored by being passed two), arity 1 the user, anything else the user and params.
+* `simple_crud_for` accepts an Array of actions to declare several at once: `simple_crud_for %i[show create update destroy], owned_by: :tasks, serializer: TaskSerializer`.
+* `notice:`/`alert:` on HTML `:create`/`:update`/`:destroy`: set a flash message on the success redirect (`notice`) or the failure re-render (`alert`).
+
+### V0.6.0
+
+Serializer support:
+* Blueprinter: `serializer:` now accepts a [Blueprinter](https://github.com/blueprinter/blueprinter) blueprint on every action, which simple_crud renders with `render_as_hash(record, options)`, as well as an ActiveModelSerializers serializer. The shared examples' default `serializer_class` uses `"#{Model}Blueprint"` when no `"#{Model}Serializer"` constant exists, and `have_been_serialized_with` reads Blueprinter fields.
+* `serializer_options:` on every action: a lambda that runs through `instance_exec`. simple_crud forwards its result to the serializer (`render_as_hash(record, options)` for Blueprinter, `new(record, options)` for AMS). Arity 0 runs with no arguments; arity ≥ 1 gets the record. On `:index` it runs once with no record, so arity-1 lambdas get `nil`. Paginated Blueprinter indexes need wor-paginate ≥ 0.5.
+
+New options:
+* `status:` on `:create`/`:update`/`:destroy` overrides the success status (`:created`/`:ok`/`:ok` by default). `status: :no_content` returns an empty body.
+* `after_persist:` on `:create`/`:update`/`:destroy`: a `(record, saved)` lambda that runs after the write and before rendering. Use it for side effects like cache invalidation. It still runs when you pass a render block.
+
+Behavior changes:
+* `create`/`update` responses now honor `serializer:`. Before, they returned the raw record. AMS apps that never passed `serializer:` see no change.
+* Cached `:show` now honors `serializer:`. Before, it returned `record.as_json`.
+* Unpaginated `:index` now serializes through the same path as the other actions, so Blueprinter works there. Before, it passed `each_serializer` to `render`.
+
+Fixes:
+* `finder:` lambdas now run through `instance_exec` on the controller, so `current_user` and other controller methods are available, matching the README.
+* `:index` resolves a private `current_user` method.
+* Shared examples no longer inject `params[:format]`, which collided with model attributes named `format`.
+* Shared-example `owner_foreign_key` honors custom `foreign_key:` declarations.
+* The base `index` example compares ids with `match_array`; create/update/destroy examples honor a custom `status:`.
+
 ### V0.5.0
 
 New options:

data/Gemfile

@@ -17,6 +17,7 @@ group :development, :test do
   gem 'action_policy', '~> 0.7.6', require: false
   gem 'active_model_serializers', '~> 0.10.16'
   gem 'appraisal', '~> 2.5'
+  gem 'blueprinter', '~> 1.3'
   gem 'byebug', '~> 13.0'
   gem 'cancancan', '~> 3.6', require: false
   gem 'database_cleaner-active_record', '~> 2.2', require: 'database_cleaner/active_record'
@@ -24,6 +25,9 @@ group :development, :test do
   gem 'devise-jwt', '~> 0.13'
   gem 'factory_bot_rails', '~> 6.5'
   gem 'faker', '~> 3.8'
+  # json 3 dropped the `quirks_mode` keyword that ActionController::TestCase
+  # (and thus rails-controller-testing) still passes on Rails <= 8.0.
+  gem 'json', '< 3'
   gem 'kaminari', '~> 1.2', require: false
   gem 'overcommit', '~> 0.72'
   gem 'pagy', '~> 43.0', require: false
@@ -39,5 +43,5 @@ group :development, :test do
   # required range differs across supported versions.
   gem 'webmock', '~> 3.26'
   gem 'will_paginate', '~> 4.0', require: false
-  gem 'wor-paginate', '~> 0.4'
+  gem 'wor-paginate', '~> 0.5'
 end

data/README.md

@@ -18,6 +18,8 @@ SimpleCrud
         - [Serializer](#serializer)
         - [HTML](#html)
         - [Finder](#finder)
+        - [Owned by](#owned-by)
+        - [Parent](#parent)
         - [Cache](#cache)
       - [Controller-level defaults](#controller-level-defaults)
       - [Shared examples](#shared-examples)
@@ -94,6 +96,12 @@ simple_crud_for :new
 simple_crud_for :edit
 ```
 
+Declare several actions with the same options at once by passing an Array:
+```ruby
+simple_crud_for %i[show create update destroy], owned_by: :tasks, serializer: TaskSerializer
+simple_crud_for :destroy, status: :no_content # per-action override on top of the batch
+```
+
 Each method supports different options, as in:
 ```
 simple_crud_for :index, paginate: false, authorize: false, serializer: CustomSerializer
@@ -103,13 +111,18 @@ simple_crud_for :index, paginate: false, authorize: false, serializer: CustomSer
 - Authorize: whether it should check authorization via the configured authorization adapter (Pundit by default)
 - Authenticate: whether the generated action calls `authenticate_user!`. `true` (default) or `false`
 - Authenticate_headers: whether shared examples set auth headers and run the unauthorized test. Defaults to `authenticate:`. Set independently when a base-controller `before_action` handles auth and the lambda should skip `authenticate_user!`
-- Serializer: specify a particular serializer you should use
+- Serializer: specify a particular serializer you should use. Accepts an ActiveModelSerializers serializer or a Blueprinter blueprint (see [Serializer](#serializer))
+- Serializer_options: a `Proc`/`lambda` that runs with the controller as `self`. Its result goes to the serializer: `render_as_hash(record, options)` for Blueprinter, `new(record, options)` for ActiveModelSerializers. Arity 0 runs without arguments; arity ≥ 1 receives the record. On `:index` it runs once with no record
+- Status: only valid for `:create`, `:update` and `:destroy`. Overrides the success status (`:created`, `:ok` and `:ok` by default). `status: :no_content` responds with an empty body
+- After_persist: only valid for `:create`, `:update` and `:destroy`. A `Proc`/`lambda` `->(record, saved) { ... }` that runs with the controller as `self`, after the write and before rendering. Use it for side effects like cache invalidation. It still runs when you pass a render block
 - Html: renders the action's ERB template instead of JSON (valid for `:index`, `:show`, `:new`, `:edit`, `:create`, `:update` and `:destroy`). Only meaningful in controllers that render templates
-- Scope: only valid for `:index`. A `Proc`/`lambda` taking `current_user` (plus the controller's `params` if it takes a second argument) that returns the relation to list, overriding the default `policy_scope`. The user is resolved via `SimpleCrud::Config.user_method` (`:current_user` by default; set it to e.g. `:current_admin`)
+- Scope: only valid for `:index`. A `Proc`/`lambda` that runs with the controller as `self` (so `@ivars` and route-parent state are available) and returns the relation to list, overriding the default `policy_scope`. It takes `current_user` (plus the controller's `params` when it takes a second argument); an arity-0 lambda gets no arguments. The user is resolved via `SimpleCrud::Config.user_method` (`:current_user` by default; set it to e.g. `:current_admin`)
 - Finder: only valid for `:show`, `:update`, `:destroy` and `:edit`. A `Proc`/`lambda` (invoked with the controller's params) or a `Symbol` naming a class method on the model, used to look up the record instead of `klass.find(params[:id])`.
 - Build: only valid for `:new` and `:create`. A `Proc`/`lambda` that builds the record (invoked with the controller as `self`, so `current_user`, `params` and any instance variables are available), for building nested or owner-scoped records like `current_user.projects.build`. `:create` then assigns the permitted params to the built record before saving
 - Raise_on_invalid: only valid for `:create` and `:update`. Keeps the strict `create!`/`update!` semantics (raising on invalid input) instead of returning `422` with the validation errors
 - Redirect: only valid for HTML-mode `:create`, `:update` and `:destroy`. A `Proc`/`lambda` (called with the record) or a literal path used as the success redirect target. Defaults to the record (`:create`/`:update`) or the model's collection path (`:destroy`)
+- Notice: only valid for HTML-mode `:create`, `:update` and `:destroy`. A flash message set on the success redirect. No-op when the controller has no `flash`
+- Alert: only valid for HTML-mode `:create`, `:update` and `:destroy`. A `flash.now` message set before re-rendering on failure. No-op when the controller has no `flash`
 
 #### Controller-level defaults
 
@@ -200,12 +213,19 @@ end
 
 ```
 
-When `authorize: true`, the `:index` action paginates the Pundit `policy_scope` of the model (falling back to the full relation when no `Scope` is defined) instead of `klass.all`, so "only my records" scoping works out of the box. Override the scope per action with the `scope:` option, a callable that receives the user resolved via `SimpleCrud::Config.user_method` (`nil` when there is none, and `params` too when it takes a second argument):
+When `authorize: true`, the `:index` action paginates the Pundit `policy_scope` of the model (falling back to the full relation when no `Scope` is defined) instead of `klass.all`, so "only my records" scoping works out of the box. Override the scope per action with `scope:`: a callable that receives the user resolved via `SimpleCrud::Config.user_method` (`nil` when there is none, and `params` too when it takes a second argument), or a `Symbol` naming a class method on the model so query composition lives on the model:
 
 ```ruby
 SimpleCrud.configure { |c| c.user_method = :current_admin } # non-Devise naming conventions
 simple_crud_for :index, scope: ->(user) { Model.visible_to(user) }
 simple_crud_for :index, scope: ->(user, params) { Model.where(status: params[:status]).visible_to(user) }
+simple_crud_for :index, scope: :visible_to # calls Model.visible_to(user, params)
+```
+
+A `scope:` lambda runs with the controller as `self`, so it can reach `@ivars` and route-parent context. Arity 0 receives no arguments, arity 1 the user, anything else the user and params:
+
+```ruby
+simple_crud_for :index, scope: -> { @category.exams.includes(:questions).order(:title) }
 ```
 
 Prefer CanCanCan or Action Policy instead? Both have adapters ready to go:
@@ -269,12 +289,29 @@ simple_crud_defaults authenticate: false, authenticate_headers: true
 ```
 
 #### Serializer
-The name of the serializer, by default, is the name of the model followed by Serializer, as is the standard for [ActiveModelSerializers](https://github.com/rails-api/active_model_serializers). It's possible to just pass a custom serializer class though. As for the serializer itself, it's a standard serializer, with the gotcha that you need to include `:id` for the SimpleCrud examples to work.
+`serializer:` picks the serializer for JSON responses on every action. Pass an [ActiveModelSerializers](https://github.com/rails-api/active_model_serializers) serializer class, which simple_crud builds per record with `serializer.new(record, serializer_options)`; a [Blueprinter](https://github.com/blueprinter/blueprinter) blueprint class, rendered with `blueprint.render_as_hash(record, serializer_options)`; or any plain class of your own that responds to `.render`, called as `serializer.render(record, **serializer_options)`, with no base class or extra gem required.
+
+Without `serializer:`, the response uses the record's `as_json`. The shared examples expect an `:id` attribute. Paginated `:index` with Blueprinter needs wor-paginate ≥ 0.5.
 
 ```ruby
 class AuthorSerializer < ActiveModel::Serializer
-  attributes :email, :first_name, :last_name, :institution, :role, :id
+  attributes :email, :first_name, :last_name, :id
 end
+
+class AuthorBlueprint < Blueprinter::Base
+  identifier :id
+  fields :email, :first_name, :last_name
+end
+
+# A plain class works too, with no dependency on either gem above:
+class AuthorPlainSerializer
+  def self.render(author, **)
+    { id: author.id, email: author.email, first_name: author.first_name, last_name: author.last_name }
+  end
+end
+
+simple_crud_for :show, serializer: AuthorBlueprint
+simple_crud_for :index, serializer: AuthorBlueprint, serializer_options: -> { { current_user: current_user } }
 ```
 
 #### HTML
@@ -293,11 +330,13 @@ simple_crud_for :index, html: true
 simple_crud_for :show, html: true
 simple_crud_for :new, html: true
 simple_crud_for :edit, html: true
-simple_crud_for :create, html: true
-simple_crud_for :update, html: true
-simple_crud_for :destroy, html: true
+simple_crud_for :create, html: true, notice: 'Created!', alert: 'Could not create.'
+simple_crud_for :update, html: true, redirect: ->(record) { record_path(record) }, notice: 'Saved!'
+simple_crud_for :destroy, html: true, notice: 'Removed.'
 ```
 
+`notice:` sets a flash message on the success redirect; `alert:` sets a `flash.now` message before the failure re-render. Both are skipped when the controller has no `flash` (e.g. `ActionController::API`).
+
 Or pass a block that renders explicitly, overriding the auto-render. The block receives the records for `:index`, the record for `:show`/`:new`, or the record plus a saved flag for `:create`/`:update`/`:destroy`. Blocks do not change the `html:` default; pass it explicitly so the shared examples know which request format to use:
 
 ```ruby
@@ -344,6 +383,63 @@ simple_crud_for :destroy, finder: ->(params) { current_user.models.find(params[:
 
 When omitted it defaults to `klass.find(params[:id])`, and `not_found` is still returned whenever the finder finds no record.
 
+#### Owned by
+`owned_by:` covers a resource scoped to the current user's own records. It names an association on `Config.user_method` (`current_user` by default) and derives `finder:`, `build:` and the index `scope:` from it:
+
+```ruby
+class PostsController < ApplicationController
+  simple_crud_defaults owned_by: :posts
+  simple_crud_for :index
+  simple_crud_for :show
+  simple_crud_for :create
+  simple_crud_for :update
+  simple_crud_for :destroy
+end
+```
+
+This is equivalent to writing, on every action:
+
+```ruby
+simple_crud_for :index, scope: ->(user) { user.posts }
+simple_crud_for :show, finder: ->(params) { current_user.posts.find(params[:id]) }
+simple_crud_for :create, build: -> { current_user.posts.build }
+simple_crud_for :update, finder: ->(params) { current_user.posts.find(params[:id]) }
+simple_crud_for :destroy, finder: ->(params) { current_user.posts.find(params[:id]) }
+```
+
+An explicit `finder:`, `build:` or `scope:` on an action overrides the `owned_by:` default for that option alone, so an owned `:show`/`:update`/`:destroy` can use a hand-written `:index` scope that needs extra filtering or eager loading. On `:index`, `owned_by:` takes precedence over the Pundit `policy_scope`; an explicit `scope:` overrides both. With no current user, an owned `:index` returns no records and an owned `:show`/`:update`/`:destroy` returns `not_found`, instead of falling back to the unscoped relation.
+
+Keep the owner's foreign key out of strong params. If `owned_by: :posts` sets the owner through the built association, `params.permit(:user_id)` lets a request override it.
+
+#### Parent
+`parent:` covers a nested route. It derives the same `finder:`, `build:` and index `scope:` from an association on a parent resource instead of on the current user. Both options resolve an association on some owner, so setting them together raises `ArgumentError`.
+
+`parent:` takes a `Symbol` that resolves a controller method first, then an `@ivar`. A `before_action` that sets `@category` works unchanged:
+
+```ruby
+class ExamsController < ApplicationController
+  before_action :set_category
+
+  simple_crud_defaults parent: :category   # reads the category method, else @category
+  simple_crud_for %i[index show new create], serializer: ExamSerializer, html: true
+
+  private
+
+  def set_category = @category = Category.find_by!(slug: params.expect(:category_slug))
+end
+```
+
+The association comes from the controller's model, so `ExamsController` gets `@category.exams`. Pass `parent_association:` when the name differs, or a `Proc` (run in controller context) for a parent that isn't an ivar or method:
+
+```ruby
+simple_crud_for :show, parent: :category, parent_association: :published_exams
+simple_crud_for :show, parent: -> { @listing.interview }
+```
+
+As with `owned_by:`, an explicit `finder:`/`build:`/`scope:` overrides the derived default for that option, and a nil parent fails closed: `:show`/`:update`/`:destroy` return `not_found` and `:index` returns no records.
+
+The same strong-params caveat applies: `:create` builds through the parent association and then assigns the permitted params, so never permit the parent's foreign key (for a `@category.exams` controller, don't permit `:category_id`).
+
 #### Cache
 Pass `cache: { key:, ttl: }` on `:show` or `:index` to skip the DB on cache hits.
 

data/lib/simple_crud/action_context.rb

@@ -50,14 +50,32 @@ module SimpleCrud
 
     def lookup_record
       finder = parameters[:finder]
-      return klass.find(controller.params[:id]) if finder.nil?
+      return find_by_id if finder.nil?
       return klass.send(finder, controller.params) unless finder.respond_to?(:call)
 
-      finder.call(controller.params)
+      controller.instance_exec(controller.params, &finder)
+    end
+
+    def find_by_id
+      finder_scope.find(controller.params[:id])
     end
 
     def build_record
-      parameters[:build] ? controller.instance_exec(&parameters[:build]) : klass.new
+      return controller.instance_exec(&parameters[:build]) if parameters[:build]
+      return relation_source.relation!.build if relation_source.configured?
+
+      klass.new
+    end
+
+    # Falls back to klass when owned_by:/parent: is unset.
+    def finder_scope
+      return klass unless relation_source.configured?
+
+      relation_source.relation!
+    end
+
+    def relation_source
+      @relation_source ||= SimpleCrud::RelationSource.new(controller, klass, parameters)
     end
 
     def permitted_params
@@ -65,16 +83,33 @@ module SimpleCrud
     end
 
     def serialize_opts(key)
-      { key => parameters[:serializer] }.compact
+      opts = { key => parameters[:serializer] }.compact
+      options = serializer_options
+      opts[:serializer_options] = options if options.present?
+      opts
+    end
+
+    def serializer_options(record = nil)
+      callable = parameters[:serializer_options]
+      return {} unless callable
+
+      callable.arity.zero? ? controller.instance_exec(&callable) : controller.instance_exec(record, &callable)
     end
 
     def render_record(record, template)
-      if parameters[:html] || block
-        controller.instance_variable_set(:@record, record)
-        block ? controller.instance_exec(record, &block) : controller.render(template)
-      else
-        controller.render({ json: record }.merge(serialize_opts(:serializer)))
-      end
+      return render_html_record(record, template) if parameters[:html] || block
+
+      render_json_record(record)
+    end
+
+    def render_html_record(record, template)
+      controller.instance_variable_set(:@record, record)
+      block ? controller.instance_exec(record, &block) : controller.render(template)
+    end
+
+    def render_json_record(record)
+      serializer = parameters[:serializer]
+      controller.render json: SimpleCrud::Serializer.render(serializer, record, serializer_options(record))
     end
 
     def render_cached(cache_opts, &fetch_block)

data/lib/simple_crud/create_context.rb

@@ -10,7 +10,8 @@ module SimpleCrud
       record.assign_attributes(attrs)
       maybe_authorize(record)
       persist = ->(bang:) { bang ? record.save! : record.save }
-      options = { status: :created, failure_template: :new, redirect: parameters[:redirect] || record }
+      options = { status: parameters[:status] || :created, failure_template: :new,
+                  redirect: parameters[:redirect] || record }
       persist_and_render(record, options, persist)
     end
   end

data/lib/simple_crud/destroy_context.rb

@@ -8,7 +8,8 @@ module SimpleCrud
       record = find_record
       maybe_authorize(record)
       persist = ->(bang:) { bang ? record.destroy! : record.destroy }
-      options = { status: :ok, failure_template: :show, redirect: parameters[:redirect] || klass }
+      options = { status: parameters[:status] || :ok, failure_template: :show,
+                  redirect: parameters[:redirect] || klass }
       persist_and_render(record, options, persist)
     end
   end

data/lib/simple_crud/index_context.rb

@@ -17,7 +17,14 @@ module SimpleCrud
       relation = index_relation
       records  = index_records(relation, opts)
       controller.instance_variable_set(:@records, records)
-      block ? controller.instance_exec(records, &block) : records.as_json
+      block ? controller.instance_exec(records, &block) : serialize_records(records)
+    end
+
+    def serialize_records(records)
+      serializer = parameters[:serializer]
+      return records.as_json if serializer.nil?
+
+      records.map { |record| SimpleCrud::Serializer.render(serializer, record, serializer_options) }
     end
 
     def render_index
@@ -28,7 +35,7 @@ module SimpleCrud
       elsif parameters[:paginate]
         SimpleCrud::Config.pagination_adapter.paginate(controller, relation, opts)
       else
-        controller.render({ json: relation }.merge(opts))
+        controller.render json: serialize_records(relation)
       end
     end
 
@@ -39,20 +46,31 @@ module SimpleCrud
     end
 
     def index_relation
-      if parameters[:scope]
-        call_scope
-      elsif parameters[:authorize]
-        SimpleCrud::Config.authorization_adapter.policy_scope(controller, klass)
-      else
-        klass.all
-      end
+      return call_scope if parameters[:scope]
+      return relation_source.relation || klass.none if relation_source.configured?
+
+      default_index_relation
+    end
+
+    def default_index_relation
+      return SimpleCrud::Config.authorization_adapter.policy_scope(controller, klass) if parameters[:authorize]
+
+      klass.all
     end
 
     def call_scope
-      user_method = SimpleCrud::Config.user_method
-      user = controller.respond_to?(user_method) ? controller.public_send(user_method) : nil
       scope = parameters[:scope]
-      scope.arity == 1 ? scope.call(user) : scope.call(user, controller.params)
+      return klass.send(scope, relation_source.user, controller.params) unless scope.respond_to?(:call)
+
+      controller.instance_exec(*scope_arguments(scope), &scope)
+    end
+
+    def scope_arguments(scope)
+      case scope.arity
+      when 0 then []
+      when 1 then [relation_source.user]
+      else [relation_source.user, controller.params]
+      end
     end
 
     def index_records(relation, opts)

data/lib/simple_crud/pagination/wor_paginate_adapter.rb

@@ -10,7 +10,13 @@ module SimpleCrud
       include Adapter
 
       def paginate(controller, relation, options)
-        controller.send(:render_paginated, relation, options)
+        serializer = options[:each_serializer]
+        return controller.send(:render_paginated, relation, options) if serializer.nil?
+
+        serializer_options = options[:serializer_options] || {}
+        controller.send(:render_paginated, relation, options) do |record|
+          SimpleCrud::Serializer.render(serializer, record, serializer_options)
+        end
       end
 
       def paginated_records(controller, relation, options)

data/lib/simple_crud/persistence_context.rb

@@ -6,18 +6,35 @@ module SimpleCrud
 
     def persist_and_render(record, options, persist)
       saved = parameters[:raise_on_invalid] ? persist.call(bang: true) : persist.call(bang: false)
+      run_after_persist(record, saved)
       return render_persisted(record, saved, options) unless block || parameters[:html]
 
       controller.instance_variable_set(:@record, record)
       block ? controller.instance_exec(record, saved, &block) : render_html_redirect(record, saved, options)
     end
 
+    def run_after_persist(record, saved)
+      hook = parameters[:after_persist]
+      controller.instance_exec(record, saved, &hook) if hook
+    end
+
     def render_html_redirect(record, saved, options)
-      if saved
-        controller.redirect_to(redirect_target(record, options[:redirect]))
-      else
-        controller.render(options[:failure_template])
-      end
+      return render_html_failure(options) unless saved
+
+      set_flash(:notice, parameters[:notice])
+      controller.redirect_to(redirect_target(record, options[:redirect]))
+    end
+
+    def render_html_failure(options)
+      set_flash(:alert, parameters[:alert], now: true)
+      controller.render(options[:failure_template])
+    end
+
+    def set_flash(key, message, now: false)
+      return if message.nil? || !controller.respond_to?(:flash)
+
+      target = now ? controller.flash.now : controller.flash
+      target[key] = message
     end
 
     def redirect_target(record, target)
@@ -25,9 +42,19 @@ module SimpleCrud
     end
 
     def render_persisted(record, saved, options)
-      return controller.render(json: record, status: options[:status]) if saved
+      return render_success(record, options[:status]) if saved
 
       controller.render json: { errors: record.errors.full_messages }, status: 422
     end
+
+    def render_success(record, status)
+      return controller.head(status) if status == :no_content
+
+      controller.render json: payload(record), status: status
+    end
+
+    def payload(record)
+      SimpleCrud::Serializer.render(parameters[:serializer], record, serializer_options(record))
+    end
   end
 end

data/lib/simple_crud/relation_source.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+
+module SimpleCrud
+  # Resolves the owner shared by owned_by: and parent:.
+  class RelationSource
+    def initialize(controller, klass, parameters)
+      @controller = controller
+      @klass      = klass
+      @parameters = parameters
+    end
+
+    def configured?
+      !owned_by.nil? || !parent.nil?
+    end
+
+    # nil when the owner can't be resolved.
+    def relation
+      return owner.relation if owned_by
+      return parent_source.relation if parent
+
+      nil
+    end
+
+    def relation!
+      relation || raise(ActiveRecord::RecordNotFound, "no #{description} to scope the record to")
+    end
+
+    def user
+      Source.user(controller)
+    end
+
+    private
+
+    attr_reader :controller, :klass, :parameters
+
+    def owned_by = parameters[:owned_by]
+
+    def parent = parameters[:parent]
+
+    def description
+      owned_by ? "owner for #{owned_by}" : "parent for #{parent}"
+    end
+
+    def owner
+      OwnerSource.new(controller, parameters[:owned_by])
+    end
+
+    def parent_source
+      ParentSource.new(controller, klass, parameters)
+    end
+
+    # Shared by both relation sources.
+    module Source
+      def self.user(controller)
+        user_method = SimpleCrud::Config.user_method
+        controller.respond_to?(user_method, true) ? controller.send(user_method) : nil
+      end
+    end
+
+    # nil without a user.
+    class OwnerSource
+      def initialize(controller, association)
+        @controller  = controller
+        @association = association
+      end
+
+      def relation
+        Source.user(@controller)&.public_send(@association)
+      end
+    end
+
+    # A Symbol resolves method then @ivar.
+    class ParentSource
+      def initialize(controller, klass, parameters)
+        @controller = controller
+        @klass      = klass
+        @parameters = parameters
+      end
+
+      def relation
+        resolved&.public_send(association)
+      end
+
+      private
+
+      def resolved
+        reference = @parameters[:parent]
+        return @controller.instance_exec(&reference) if reference.respond_to?(:call)
+
+        by_method_or_ivar(reference)
+      end
+
+      def by_method_or_ivar(reference)
+        return @controller.send(reference) if @controller.respond_to?(reference, true)
+
+        ivar = :"@#{reference}"
+        return @controller.instance_variable_get(ivar) if @controller.instance_variable_defined?(ivar)
+
+        raise ArgumentError, "parent: #{reference} is neither a controller method nor an @#{reference} ivar"
+      end
+
+      def association
+        @parameters[:parent_association] || @klass.model_name.plural.to_sym
+      end
+    end
+  end
+end

data/lib/simple_crud/rspec/config.rb

@@ -51,7 +51,12 @@ module SimpleCrud
         unauthenticated_status: :unauthorized,
         assert_html_template: true,
         policy_class: ->(klass) { "#{klass}Policy".constantize },
-        serializer_class: ->(model) { "#{model.class}_serializer".classify.constantize },
+        serializer_class: lambda { |model|
+          klass = model.class
+          next "#{klass}Serializer".constantize if Kernel.const_defined?("#{klass}Serializer")
+
+          "#{klass}Blueprint".constantize
+        },
         created_record_check: nil
       }.freeze
 

data/lib/simple_crud/rspec/helpers/authentication.rb

@@ -19,7 +19,8 @@ module SimpleCrud
         end
 
         def owner_foreign_key
-          :"#{owner_association}_id"
+          reflection = model_class_object.reflect_on_association(owner_association)
+          reflection ? reflection.foreign_key : :"#{owner_association}_id"
         end
 
         # The owner association attributed to current_user, if the model has one.

data/lib/simple_crud/rspec/helpers/controller_options.rb

@@ -10,8 +10,8 @@ module SimpleCrud
           described_class.instance_variable_get(:@simple_crud_metadata)[method][option]
         end
 
-        %i[paginate authorize authenticate serializer html finder scope build raise_on_invalid block
-           authenticate_headers].each do |option|
+        %i[paginate authorize authenticate serializer serializer_options status after_persist html finder
+           scope build raise_on_invalid block authenticate_headers owned_by parent].each do |option|
           define_method("check_#{option}") { |method| get_option(method, option) }
         end