wor-simple_crud 0.6.0 → 0.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b40c7867a484ffc3807b8dceac29ac1f6cc49ccca6d8a9bb067f93f839703e0c
-  data.tar.gz: 5a72d84147fc1f149695fe0244a11e7f99f2c9b4debb0b99a291e16439b873ac
+  metadata.gz: 31af4e1bcfb9f45e6bcbe33a2454c96b27b2adab13ff87674a9bde462d21d2f4
+  data.tar.gz: 7fadec0262d373a35c02cd015e566a97d312c5afb110abe34f58e3ca99d88d2e
 SHA512:
-  metadata.gz: 2354c67d6866dd82b70172279fd47a65bced5a950ce4385df97a1d3ab3373724d7f49a2ee7185e9cca3f86f403892e732afeade705c74337d7ae32ed53815632
-  data.tar.gz: 851104267914cd47c8312723af3361a13e5ee5fa2a323f73add55a0a09e04d965492f870c66ffc81f24c5851239afd35485b367633192c80ce8b3d8d90a7753a
+  metadata.gz: 56aa1239c57e89eaa7a3944bf2c6303033806815e9671357249958b0eb954b431a9798898fdffa4e8d70432ee650ecad9a3ab6888aff38f0398ea69454302cb3
+  data.tar.gz: 69f04e8600f4e4d10b7687c94a14a3f06b4434d12572ab969ce5f67bbb9b886e4e6ffe1d572e9a7e89f936fe999ffc435bbcc358eda12fefb0108d4f2756e67e

data/CHANGELOG.md

@@ -1,5 +1,31 @@
 ## Change log
 
+### V0.8.0
+
+Shared examples:
+* New examples: `update with block`, `edit with finder` and `edit with block`.
+* `required_attribute: nil` skips the invalid-attribute cases in `create`, `update` and their block variants, for models with nothing to validate. `update with finder` and `owned resource` skip their `required_attribute` assertions as well.
+* `singular: true` covers singular resources. Requests carry no id, the "does not exist" examples are skipped, and the controller's own finder loads the record.
+* `index with scope` handles scopes that exclude nothing. With `other_scoped_attributes: nil` it asserts every scoped record comes back, and `scoped_order: ->(records) { ... }` asserts their order.
+* `create with block` and `destroy with block` accept a redirect or a 2xx render, so a block that redirects on success (the README's HTML example) passes. `edit` and `update with finder` accept the same when they use a block.
+* `new with build` and `create with build` assert ownership by the current user only when an `owner_association` is configured. For `parent:`-built records they check that the hook built the record.
+* `make_policies_succeed` takes `permissive: true`. The `show`, `new` and `edit` "with block" examples use it, so a block can ask the policy about other actions, such as `update?`, without failing the strict double.
+
+### V0.7.0
+
+Serializer support:
+* `serializer:` accepts a plain class exposing a `.render` class method, with no base class or gem dependency. simple_crud calls `serializer.render(record, **options)`, so a `def self.render(record, key: default)` signature works untouched. It checks this after Blueprinter's `render_as_hash` and before the ActiveModelSerializers fallback, leaving existing Blueprinter and AMS apps unaffected.
+
+New options:
+* `owned_by:` (Symbol): names an association on `Config.user_method` (`current_user.posts` for `owned_by: :posts`) and supplies the default `finder:`/`build:`/index `scope:` from it, so an owned resource stops spelling out `finder: ->(params) { current_user.posts.find(params[:id]) }` and `build: -> { current_user.posts.build }` on every action. An explicit `finder:`/`build:`/`scope:` overrides the default for that option alone. On `:index`, `owned_by:` takes precedence over the Pundit `policy_scope`, and an explicit `scope:` overrides both. With no current user, an owned `:index` returns no records and an owned `:show`/`:update`/`:destroy` returns `not_found`.
+* `parent:` names a nested route's parent and derives the same defaults from `parent.public_send(parent_association)`. A Symbol resolves a controller method first, then an `@ivar`, so a conventional `before_action` works unchanged; a `Proc` runs in controller context. `parent_association:` defaults to the controller model's plural (`ExamsController` gives `@category.exams`). An explicit `finder:`/`build:`/`scope:` overrides the default, and a nil parent fails closed (404 on find/build, empty index). `parent:` and `owned_by:` both resolve a relation from an owner, so setting both raises `ArgumentError`.
+
+Behavior changes:
+* `scope:` on `:index` accepts a `Symbol` naming a class method on the model, called as `klass.send(scope, user, params)`. Query composition can live on the model instead of inline in the controller.
+* `scope:` lambdas run with the controller as `self`, so a scope can read `@ivars` and route-parent state. Arity 0 receives no arguments (it previously errored by being passed two), arity 1 the user, anything else the user and params.
+* `simple_crud_for` accepts an Array of actions to declare several at once: `simple_crud_for %i[show create update destroy], owned_by: :tasks, serializer: TaskSerializer`.
+* `notice:`/`alert:` on HTML `:create`/`:update`/`:destroy`: set a flash message on the success redirect (`notice`) or the failure re-render (`alert`).
+
 ### V0.6.0
 
 Serializer support:

data/README.md

@@ -18,6 +18,8 @@ SimpleCrud
         - [Serializer](#serializer)
         - [HTML](#html)
         - [Finder](#finder)
+        - [Owned by](#owned-by)
+        - [Parent](#parent)
         - [Cache](#cache)
       - [Controller-level defaults](#controller-level-defaults)
       - [Shared examples](#shared-examples)
@@ -94,6 +96,12 @@ simple_crud_for :new
 simple_crud_for :edit
 ```
 
+Declare several actions with the same options at once by passing an Array:
+```ruby
+simple_crud_for %i[show create update destroy], owned_by: :tasks, serializer: TaskSerializer
+simple_crud_for :destroy, status: :no_content # per-action override on top of the batch
+```
+
 Each method supports different options, as in:
 ```
 simple_crud_for :index, paginate: false, authorize: false, serializer: CustomSerializer
@@ -108,11 +116,13 @@ simple_crud_for :index, paginate: false, authorize: false, serializer: CustomSer
 - Status: only valid for `:create`, `:update` and `:destroy`. Overrides the success status (`:created`, `:ok` and `:ok` by default). `status: :no_content` responds with an empty body
 - After_persist: only valid for `:create`, `:update` and `:destroy`. A `Proc`/`lambda` `->(record, saved) { ... }` that runs with the controller as `self`, after the write and before rendering. Use it for side effects like cache invalidation. It still runs when you pass a render block
 - Html: renders the action's ERB template instead of JSON (valid for `:index`, `:show`, `:new`, `:edit`, `:create`, `:update` and `:destroy`). Only meaningful in controllers that render templates
-- Scope: only valid for `:index`. A `Proc`/`lambda` taking `current_user` (plus the controller's `params` if it takes a second argument) that returns the relation to list, overriding the default `policy_scope`. The user is resolved via `SimpleCrud::Config.user_method` (`:current_user` by default; set it to e.g. `:current_admin`)
+- Scope: only valid for `:index`. A `Proc`/`lambda` that runs with the controller as `self` (so `@ivars` and route-parent state are available) and returns the relation to list, overriding the default `policy_scope`. It takes `current_user` (plus the controller's `params` when it takes a second argument); an arity-0 lambda gets no arguments. The user is resolved via `SimpleCrud::Config.user_method` (`:current_user` by default; set it to e.g. `:current_admin`)
 - Finder: only valid for `:show`, `:update`, `:destroy` and `:edit`. A `Proc`/`lambda` (invoked with the controller's params) or a `Symbol` naming a class method on the model, used to look up the record instead of `klass.find(params[:id])`.
 - Build: only valid for `:new` and `:create`. A `Proc`/`lambda` that builds the record (invoked with the controller as `self`, so `current_user`, `params` and any instance variables are available), for building nested or owner-scoped records like `current_user.projects.build`. `:create` then assigns the permitted params to the built record before saving
 - Raise_on_invalid: only valid for `:create` and `:update`. Keeps the strict `create!`/`update!` semantics (raising on invalid input) instead of returning `422` with the validation errors
 - Redirect: only valid for HTML-mode `:create`, `:update` and `:destroy`. A `Proc`/`lambda` (called with the record) or a literal path used as the success redirect target. Defaults to the record (`:create`/`:update`) or the model's collection path (`:destroy`)
+- Notice: only valid for HTML-mode `:create`, `:update` and `:destroy`. A flash message set on the success redirect. No-op when the controller has no `flash`
+- Alert: only valid for HTML-mode `:create`, `:update` and `:destroy`. A `flash.now` message set before re-rendering on failure. No-op when the controller has no `flash`
 
 #### Controller-level defaults
 
@@ -203,12 +213,19 @@ end
 
 ```
 
-When `authorize: true`, the `:index` action paginates the Pundit `policy_scope` of the model (falling back to the full relation when no `Scope` is defined) instead of `klass.all`, so "only my records" scoping works out of the box. Override the scope per action with the `scope:` option, a callable that receives the user resolved via `SimpleCrud::Config.user_method` (`nil` when there is none, and `params` too when it takes a second argument):
+When `authorize: true`, the `:index` action paginates the Pundit `policy_scope` of the model (falling back to the full relation when no `Scope` is defined) instead of `klass.all`, so "only my records" scoping works out of the box. Override the scope per action with `scope:`: a callable that receives the user resolved via `SimpleCrud::Config.user_method` (`nil` when there is none, and `params` too when it takes a second argument), or a `Symbol` naming a class method on the model so query composition lives on the model:
 
 ```ruby
 SimpleCrud.configure { |c| c.user_method = :current_admin } # non-Devise naming conventions
 simple_crud_for :index, scope: ->(user) { Model.visible_to(user) }
 simple_crud_for :index, scope: ->(user, params) { Model.where(status: params[:status]).visible_to(user) }
+simple_crud_for :index, scope: :visible_to # calls Model.visible_to(user, params)
+```
+
+A `scope:` lambda runs with the controller as `self`, so it can reach `@ivars` and route-parent context. Arity 0 receives no arguments, arity 1 the user, anything else the user and params:
+
+```ruby
+simple_crud_for :index, scope: -> { @category.exams.includes(:questions).order(:title) }
 ```
 
 Prefer CanCanCan or Action Policy instead? Both have adapters ready to go:
@@ -272,7 +289,7 @@ simple_crud_defaults authenticate: false, authenticate_headers: true
 ```
 
 #### Serializer
-`serializer:` picks the serializer for JSON responses on every action. Pass either an [ActiveModelSerializers](https://github.com/rails-api/active_model_serializers) serializer class, which simple_crud builds per record with `serializer.new(record, serializer_options)`, or a [Blueprinter](https://github.com/blueprinter/blueprinter) blueprint class, which it renders with `blueprint.render_as_hash(record, serializer_options)`.
+`serializer:` picks the serializer for JSON responses on every action. Pass an [ActiveModelSerializers](https://github.com/rails-api/active_model_serializers) serializer class, which simple_crud builds per record with `serializer.new(record, serializer_options)`; a [Blueprinter](https://github.com/blueprinter/blueprinter) blueprint class, rendered with `blueprint.render_as_hash(record, serializer_options)`; or any plain class of your own that responds to `.render`, called as `serializer.render(record, **serializer_options)`, with no base class or extra gem required.
 
 Without `serializer:`, the response uses the record's `as_json`. The shared examples expect an `:id` attribute. Paginated `:index` with Blueprinter needs wor-paginate ≥ 0.5.
 
@@ -286,6 +303,13 @@ class AuthorBlueprint < Blueprinter::Base
   fields :email, :first_name, :last_name
 end
 
+# A plain class works too, with no dependency on either gem above:
+class AuthorPlainSerializer
+  def self.render(author, **)
+    { id: author.id, email: author.email, first_name: author.first_name, last_name: author.last_name }
+  end
+end
+
 simple_crud_for :show, serializer: AuthorBlueprint
 simple_crud_for :index, serializer: AuthorBlueprint, serializer_options: -> { { current_user: current_user } }
 ```
@@ -306,11 +330,13 @@ simple_crud_for :index, html: true
 simple_crud_for :show, html: true
 simple_crud_for :new, html: true
 simple_crud_for :edit, html: true
-simple_crud_for :create, html: true
-simple_crud_for :update, html: true
-simple_crud_for :destroy, html: true
+simple_crud_for :create, html: true, notice: 'Created!', alert: 'Could not create.'
+simple_crud_for :update, html: true, redirect: ->(record) { record_path(record) }, notice: 'Saved!'
+simple_crud_for :destroy, html: true, notice: 'Removed.'
 ```
 
+`notice:` sets a flash message on the success redirect; `alert:` sets a `flash.now` message before the failure re-render. Both are skipped when the controller has no `flash` (e.g. `ActionController::API`).
+
 Or pass a block that renders explicitly, overriding the auto-render. The block receives the records for `:index`, the record for `:show`/`:new`, or the record plus a saved flag for `:create`/`:update`/`:destroy`. Blocks do not change the `html:` default; pass it explicitly so the shared examples know which request format to use:
 
 ```ruby
@@ -357,6 +383,63 @@ simple_crud_for :destroy, finder: ->(params) { current_user.models.find(params[:
 
 When omitted it defaults to `klass.find(params[:id])`, and `not_found` is still returned whenever the finder finds no record.
 
+#### Owned by
+`owned_by:` covers a resource scoped to the current user's own records. It names an association on `Config.user_method` (`current_user` by default) and derives `finder:`, `build:` and the index `scope:` from it:
+
+```ruby
+class PostsController < ApplicationController
+  simple_crud_defaults owned_by: :posts
+  simple_crud_for :index
+  simple_crud_for :show
+  simple_crud_for :create
+  simple_crud_for :update
+  simple_crud_for :destroy
+end
+```
+
+This is equivalent to writing, on every action:
+
+```ruby
+simple_crud_for :index, scope: ->(user) { user.posts }
+simple_crud_for :show, finder: ->(params) { current_user.posts.find(params[:id]) }
+simple_crud_for :create, build: -> { current_user.posts.build }
+simple_crud_for :update, finder: ->(params) { current_user.posts.find(params[:id]) }
+simple_crud_for :destroy, finder: ->(params) { current_user.posts.find(params[:id]) }
+```
+
+An explicit `finder:`, `build:` or `scope:` on an action overrides the `owned_by:` default for that option alone, so an owned `:show`/`:update`/`:destroy` can use a hand-written `:index` scope that needs extra filtering or eager loading. On `:index`, `owned_by:` takes precedence over the Pundit `policy_scope`; an explicit `scope:` overrides both. With no current user, an owned `:index` returns no records and an owned `:show`/`:update`/`:destroy` returns `not_found`, instead of falling back to the unscoped relation.
+
+Keep the owner's foreign key out of strong params. If `owned_by: :posts` sets the owner through the built association, `params.permit(:user_id)` lets a request override it.
+
+#### Parent
+`parent:` covers a nested route. It derives the same `finder:`, `build:` and index `scope:` from an association on a parent resource instead of on the current user. Both options resolve an association on some owner, so setting them together raises `ArgumentError`.
+
+`parent:` takes a `Symbol` that resolves a controller method first, then an `@ivar`. A `before_action` that sets `@category` works unchanged:
+
+```ruby
+class ExamsController < ApplicationController
+  before_action :set_category
+
+  simple_crud_defaults parent: :category   # reads the category method, else @category
+  simple_crud_for %i[index show new create], serializer: ExamSerializer, html: true
+
+  private
+
+  def set_category = @category = Category.find_by!(slug: params.expect(:category_slug))
+end
+```
+
+The association comes from the controller's model, so `ExamsController` gets `@category.exams`. Pass `parent_association:` when the name differs, or a `Proc` (run in controller context) for a parent that isn't an ivar or method:
+
+```ruby
+simple_crud_for :show, parent: :category, parent_association: :published_exams
+simple_crud_for :show, parent: -> { @listing.interview }
+```
+
+As with `owned_by:`, an explicit `finder:`/`build:`/`scope:` overrides the derived default for that option, and a nil parent fails closed: `:show`/`:update`/`:destroy` return `not_found` and `:index` returns no records.
+
+The same strong-params caveat applies: `:create` builds through the parent association and then assigns the permitted params, so never permit the parent's foreign key (for a `@category.exams` controller, don't permit `:category_id`).
+
 #### Cache
 Pass `cache: { key:, ttl: }` on `:show` or `:index` to skip the DB on cache hits.
 
@@ -428,11 +511,14 @@ The `create` and `update` examples cover the `422` response with validation erro
 ```ruby
 include_examples 'simple crud for new'                    # the :new action
 include_examples 'simple crud for edit'                   # the :edit action
+include_examples 'simple crud for edit with finder'      # finder on :edit
+include_examples 'simple crud for edit with block'       # render block on :edit
 include_examples 'simple crud for index with block'      # render block
 include_examples 'simple crud for index with scope'      # scope: ->(user) { ... }
 include_examples 'simple crud for show with block'       # render block on :show
 include_examples 'simple crud for new with block'        # render block on :new
 include_examples 'simple crud for create with block'     # render block on :create
+include_examples 'simple crud for update with block'     # render block on :update
 include_examples 'simple crud for destroy with block'    # render block on :destroy
 include_examples 'simple crud for show with finder'      # finder on :show
 include_examples 'simple crud for update with finder'    # finder on :update
@@ -441,6 +527,8 @@ include_examples 'simple crud for new with build'        # build: -> { ... } on
 include_examples 'simple crud for create with build'     # build: -> { ... } on :create
 ```
 
+The `create with block`, `destroy with block`, `edit` and `update with finder` examples accept a 2xx render or a redirect. The `show`, `new` and `edit` block examples let the block ask the policy about other actions, such as `update?`. `new with build` and `create with build` check ownership by the current user only when you configure an `owner_association`.
+
 It's not needed to specify paginate: true and such, since the shared examples will use the configuration that was originally passed to simple_crud_for
 
 #### Adopting the shared examples
@@ -465,7 +553,7 @@ SimpleCrud::RSpec.configure do |config|
   # override model_attributes directly for multi-key or non-user-owned models).
   config.owner_association = :owner
   config.model_attributes = -> { { owner: current_user } }
-  config.required_attribute = :title
+  config.required_attribute = :title # nil skips the invalid-attribute cases
   config.required_error = "Title can't be blank"
 
   # Redirect-based apps: unauthenticated requests get a redirect, not a 401.
@@ -504,7 +592,7 @@ SimpleCrud::RSpec.configure do |config|
 end
 ```
 
-Each setting has a sensible default, so you only override what differs. Callable settings (`current_user`, `authenticate`, `create_record`, `create_records`, `params_for`, `model_attributes`, `scoped_attributes`, `other_scoped_attributes`, `policy_class`, `serializer_class`) run in the example-group context, so they can call `request`, `create`, `current_user`, etc.; `created_record_check` receives the persisted record. The examples are controller-agnostic (they issue requests by action name, not hardcoded paths), so they work for namespaced and nested controllers alike. If you keep `assert_html_template` on (the default), add `gem 'rails-controller-testing'` for the `render_template` matcher.
+Each setting has a sensible default, so you only override what differs. Callable settings (`current_user`, `authenticate`, `create_record`, `create_records`, `params_for`, `model_attributes`, `scoped_attributes`, `other_scoped_attributes`, `policy_class`, `serializer_class`) run in the example-group context, so they can call `request`, `create`, `current_user`, etc.; `created_record_check` receives the persisted record and `scoped_order` the created records. The examples are controller-agnostic (they issue requests by action name, not hardcoded paths), so they work for namespaced and nested controllers alike. If you keep `assert_html_template` on (the default), add `gem 'rails-controller-testing'` for the `render_template` matcher.
 
 #### Per-controller overrides via metadata
 
@@ -523,6 +611,26 @@ end
 
 Callable settings resolve in the example context, so their lambdas can close over the spec's `let`s; that's how records land in the same project the route params point at.
 
+A scope that only orders excludes nothing. Set `other_scoped_attributes: nil` and `simple crud for index with scope` asserts that every scoped record comes back. `scoped_order` also asserts the order. It takes the created records and returns them in the expected order:
+
+```ruby
+RSpec.describe UsersController, type: :controller, simple_crud: {
+  other_scoped_attributes: nil,
+  scoped_order: ->(records) { records.sort_by(&:email) }
+} do
+  include_examples 'simple crud for index with scope'
+end
+```
+
+`singular: true` is a per-controller setting for singular resources (`resource :profile`). Requests carry no id, the "model does not exist" examples are skipped, and the controller's own finder, such as `finder: ->(_params) { current_user.profile }`, loads the record:
+
+```ruby
+RSpec.describe ProfilesController, type: :controller, simple_crud: { singular: true } do
+  include_examples 'simple crud for show'
+  include_examples 'simple crud for update'
+end
+```
+
 ## Contributing
 
 1. Fork it

data/lib/simple_crud/action_context.rb

@@ -57,11 +57,25 @@ module SimpleCrud
     end
 
     def find_by_id
-      klass.find(controller.params[:id])
+      finder_scope.find(controller.params[:id])
     end
 
     def build_record
-      parameters[:build] ? controller.instance_exec(&parameters[:build]) : klass.new
+      return controller.instance_exec(&parameters[:build]) if parameters[:build]
+      return relation_source.relation!.build if relation_source.configured?
+
+      klass.new
+    end
+
+    # Falls back to klass when owned_by:/parent: is unset.
+    def finder_scope
+      return klass unless relation_source.configured?
+
+      relation_source.relation!
+    end
+
+    def relation_source
+      @relation_source ||= SimpleCrud::RelationSource.new(controller, klass, parameters)
     end
 
     def permitted_params

data/lib/simple_crud/index_context.rb

@@ -46,20 +46,31 @@ module SimpleCrud
     end
 
     def index_relation
-      if parameters[:scope]
-        call_scope
-      elsif parameters[:authorize]
-        SimpleCrud::Config.authorization_adapter.policy_scope(controller, klass)
-      else
-        klass.all
-      end
+      return call_scope if parameters[:scope]
+      return relation_source.relation || klass.none if relation_source.configured?
+
+      default_index_relation
+    end
+
+    def default_index_relation
+      return SimpleCrud::Config.authorization_adapter.policy_scope(controller, klass) if parameters[:authorize]
+
+      klass.all
     end
 
     def call_scope
-      user_method = SimpleCrud::Config.user_method
-      user = controller.respond_to?(user_method, true) ? controller.send(user_method) : nil
       scope = parameters[:scope]
-      scope.arity == 1 ? scope.call(user) : scope.call(user, controller.params)
+      return klass.send(scope, relation_source.user, controller.params) unless scope.respond_to?(:call)
+
+      controller.instance_exec(*scope_arguments(scope), &scope)
+    end
+
+    def scope_arguments(scope)
+      case scope.arity
+      when 0 then []
+      when 1 then [relation_source.user]
+      else [relation_source.user, controller.params]
+      end
     end
 
     def index_records(relation, opts)

data/lib/simple_crud/persistence_context.rb

@@ -19,11 +19,22 @@ module SimpleCrud
     end
 
     def render_html_redirect(record, saved, options)
-      if saved
-        controller.redirect_to(redirect_target(record, options[:redirect]))
-      else
-        controller.render(options[:failure_template])
-      end
+      return render_html_failure(options) unless saved
+
+      set_flash(:notice, parameters[:notice])
+      controller.redirect_to(redirect_target(record, options[:redirect]))
+    end
+
+    def render_html_failure(options)
+      set_flash(:alert, parameters[:alert], now: true)
+      controller.render(options[:failure_template])
+    end
+
+    def set_flash(key, message, now: false)
+      return if message.nil? || !controller.respond_to?(:flash)
+
+      target = now ? controller.flash.now : controller.flash
+      target[key] = message
     end
 
     def redirect_target(record, target)

data/lib/simple_crud/relation_source.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+
+module SimpleCrud
+  # Resolves the owner shared by owned_by: and parent:.
+  class RelationSource
+    def initialize(controller, klass, parameters)
+      @controller = controller
+      @klass      = klass
+      @parameters = parameters
+    end
+
+    def configured?
+      !owned_by.nil? || !parent.nil?
+    end
+
+    # nil when the owner can't be resolved.
+    def relation
+      return owner.relation if owned_by
+      return parent_source.relation if parent
+
+      nil
+    end
+
+    def relation!
+      relation || raise(ActiveRecord::RecordNotFound, "no #{description} to scope the record to")
+    end
+
+    def user
+      Source.user(controller)
+    end
+
+    private
+
+    attr_reader :controller, :klass, :parameters
+
+    def owned_by = parameters[:owned_by]
+
+    def parent = parameters[:parent]
+
+    def description
+      owned_by ? "owner for #{owned_by}" : "parent for #{parent}"
+    end
+
+    def owner
+      OwnerSource.new(controller, parameters[:owned_by])
+    end
+
+    def parent_source
+      ParentSource.new(controller, klass, parameters)
+    end
+
+    # Shared by both relation sources.
+    module Source
+      def self.user(controller)
+        user_method = SimpleCrud::Config.user_method
+        controller.respond_to?(user_method, true) ? controller.send(user_method) : nil
+      end
+    end
+
+    # nil without a user.
+    class OwnerSource
+      def initialize(controller, association)
+        @controller  = controller
+        @association = association
+      end
+
+      def relation
+        Source.user(@controller)&.public_send(@association)
+      end
+    end
+
+    # A Symbol resolves method then @ivar.
+    class ParentSource
+      def initialize(controller, klass, parameters)
+        @controller = controller
+        @klass      = klass
+        @parameters = parameters
+      end
+
+      def relation
+        resolved&.public_send(association)
+      end
+
+      private
+
+      def resolved
+        reference = @parameters[:parent]
+        return @controller.instance_exec(&reference) if reference.respond_to?(:call)
+
+        by_method_or_ivar(reference)
+      end
+
+      def by_method_or_ivar(reference)
+        return @controller.send(reference) if @controller.respond_to?(reference, true)
+
+        ivar = :"@#{reference}"
+        return @controller.instance_variable_get(ivar) if @controller.instance_variable_defined?(ivar)
+
+        raise ArgumentError, "parent: #{reference} is neither a controller method nor an @#{reference} ivar"
+      end
+
+      def association
+        @parameters[:parent_association] || @klass.model_name.plural.to_sym
+      end
+    end
+  end
+end

data/lib/simple_crud/rspec/config.rb

@@ -43,6 +43,8 @@ module SimpleCrud
           owner_association ? attributes.merge(owner_association => other_user) : {}
         },
         required_attribute: :name,
+        singular: false,
+        scoped_order: nil,
         required_error: "Name can't be blank",
         finder_key: :slug,
         params_key: nil,

data/lib/simple_crud/rspec/helpers/controller_options.rb

@@ -11,7 +11,7 @@ module SimpleCrud
         end
 
         %i[paginate authorize authenticate serializer serializer_options status after_persist html finder
-           scope build raise_on_invalid block authenticate_headers].each do |option|
+           scope build raise_on_invalid block authenticate_headers owned_by parent].each do |option|
           define_method("check_#{option}") { |method| get_option(method, option) }
         end
 

data/lib/simple_crud/rspec/helpers/policies.rb

@@ -15,9 +15,9 @@ module SimpleCrud
             .and_return(instance_double(policy_class_object, "#{method}?" => false))
         end
 
-        def make_policies_succeed(method)
-          allow(policy_class_object).to receive(:new)
-            .and_return(instance_double(policy_class_object, "#{method}?" => true))
+        def make_policies_succeed(method, permissive: false)
+          policy = instance_double(policy_class_object, "#{method}?" => true)
+          allow(policy_class_object).to receive(:new).and_return(permissive ? policy.as_null_object : policy)
         end
       end
     end

data/lib/simple_crud/rspec/helpers/requests.rb

@@ -29,8 +29,11 @@ module SimpleCrud
         end
 
         # The params that identify a record for the given action, using the
-        # configured finder_key when the action has a custom finder.
+        # configured finder_key when the action has a custom finder. A singular
+        # resource has no id, so it identifies nothing.
         def record_param(action, record, not_found: false)
+          return {} if singular
+
           key = check_finder(action) ? finder_key : :id
           value = not_found ? "nonexistent-#{key}" : record.public_send(key)
           { key => value }

data/lib/simple_crud/rspec/helpers/settings.rb

@@ -24,10 +24,19 @@ module SimpleCrud
         end
 
         %i[owner_association required_attribute required_error finder_key params_key invalid_status
-           unauthenticated_status assert_html_template scoped_attributes other_scoped_attributes].each do |name|
+           unauthenticated_status assert_html_template scoped_attributes other_scoped_attributes
+           singular].each do |name|
           define_method(name) { resolve(setting(name)) }
         end
 
+        def invalid_case?(action)
+          !required_attribute.nil? && !check_raise_on_invalid(action)
+        end
+
+        def scoped_order
+          setting(:scoped_order)
+        end
+
         def created_record_check
           setting(:created_record_check)
         end

data/lib/simple_crud/rspec.rb

@@ -11,6 +11,9 @@ require_relative '../spec/shared_examples/simple_crud_for_destroy'
 require_relative '../spec/shared_examples/simple_crud_for_create'
 require_relative '../spec/shared_examples/simple_crud_for_new'
 require_relative '../spec/shared_examples/simple_crud_for_edit'
+require_relative '../spec/shared_examples/simple_crud_for_edit_with_finder'
+require_relative '../spec/shared_examples/simple_crud_for_edit_with_block'
+require_relative '../spec/shared_examples/simple_crud_for_update_with_block'
 require_relative '../spec/shared_examples/unauthorized_when_not_logged_in'
 require_relative '../spec/shared_examples/simple_crud_renders_template'
 require_relative '../spec/shared_examples/simple_crud_without_authenticated_user'
@@ -27,8 +30,11 @@ require_relative '../spec/shared_examples/simple_crud_for_destroy_with_finder'
 require_relative '../spec/shared_examples/simple_crud_not_found_with_finder'
 require_relative '../spec/shared_examples/simple_crud_for_new_with_build'
 require_relative '../spec/shared_examples/simple_crud_for_create_with_build'
+require_relative '../spec/shared_examples/simple_crud_for_owned_resource'
+require_relative '../spec/shared_examples/simple_crud_for_nested_resource'
 require_relative '../spec/shared_examples/authorization_adapter_authorize'
 require_relative '../spec/matchers/have_been_serialized_with'
+require_relative '../spec/matchers/render_or_redirect'
 
 module SimpleCrud
   # Opt-in wiring for the shared examples: see .install!

data/lib/simple_crud/serializer.rb

@@ -1,17 +1,12 @@
 # frozen_string_literal: true
 
 module SimpleCrud
-  # Renders a record with the app's serializer stack.
-  #
-  # Blueprinter blueprints respond to `render_as_hash` and receive the
-  # render options, so a blueprint can read `url_builder:` (or any other
-  # option) from them. For anything else, simple_crud assumes an
-  # ActiveModelSerializers-style serializer and calls `new(record, options)`.
-  # A `nil` serializer renders `record.as_json`.
+  # Precedence: Blueprinter, then a plain class .render, then ActiveModelSerializers.
   module Serializer
     def self.render(serializer, record, options = {})
       return record.as_json if serializer.nil?
       return serializer.render_as_hash(record, options) if serializer.respond_to?(:render_as_hash)
+      return serializer.render(record, **options) if serializer.is_a?(Class) && serializer.respond_to?(:render)
 
       serializer.new(record, options).as_json
     end