[dependabot]

Bumps cancancan from 3.6.2 to 3.7.0.

Release notes

Sourced from cancancan's releases.

3.7.0

The one below is a list of all the PRs merged. For a more detailed update, read the blog post about this release.

• Merge the ControllerResourceLoader, ControllerResourceBuilder, ControllerResourceFinder, ControllerResourceNameFinder and ControllerResourceSanitizer modules into CanCan::ControllerResource, and call the params method of the controller only once per request: it was called once more for every attribute set by the conditions of the ability. WARNING: the five modules no longer exist; override their methods in a subclass of CanCan::ControllerResource instead. (@​coorasse)
• Expand the actions again after alias_action, clear_aliased_actions and merge: can? kept using the aliases expanded by a previous check, so clear_aliased_actions did not remove can :read from can?(:index, Model). (@​coorasse)
• Raise an error when an action is aliased to :manage, which granted every action, or to itself, which looped forever. (@​coorasse)
• Do not include the primary key in permitted_attributes for a rule without attributes, remove every attribute with a cannot rule without attributes, including those that are not columns, and accept a hash subject instead of raising a TypeError. WARNING: permitted_attributes no longer returns :id, and with a composite primary key none of its columns are returned. (@​coorasse)
• Convert a String resource name to a symbol in load_and_authorize_resource and the skip_* methods: load_and_authorize_resource 'article' treated the resource as a parent and authorized :show on the class instead of the action on the record. (@​coorasse)
• #927: Look up the unauthorized message of a String action through its aliases: authorize!('index', post) did not use the message defined for read. (@​coorasse)
• #913: Match a symbol in a condition with the string that has the same name in can?, as accessible_by already did: cannot :read, Post, state: :draft on a string column no longer allows can?(:read, draft). WARNING: a can rule with a symbol now also allows records whose string attribute has the same name. (@​bruno-costanzo)
• #905: Match String actions like Symbol actions: can?('destroy', user) ignored cannot :destroy, User when can :manage was defined, and skip_authorize_resource except: 'destroy' also skipped the authorization of destroy. WARNING: a String action now goes through the aliases like a Symbol action, so can?('show', order) and authorize!(action_name, order) are allowed by can :read, Order and may grant access that 3.6 denied. A rule defined with a String action now matches the same Symbol action, permissions returns symbols, and a block rule without a subject receives the action as a symbol. (@​bruno-costanzo)
• #848: Do not deny can?(:index, parent => Model) because of a cannot rule with conditions on the model, as can?(:index, Model) already did: load_and_authorize_resource failed on the index of a nested resource. (@​coorasse)
• #861, #846, #690: Give the conditions of accessible_by the table aliases that Active Record gives to the joined associations, and build them with the model of each table. A rule with a has_many :through association, or with an association without conditions, used the alias of another table: the query failed or returned the wrong records. On an aliased table, a model was not converted to its foreign key and the values were not cast with the attribute types of the model. (@​coorasse)
• #911: Load the resource when the id is only whitespace: a request like /books/%20 ran the action with a nil resource, authorized only against the class, instead of raising ActiveRecord::RecordNotFound. (@​bruno-costanzo)
• #833: Match nil in an array of enum values in can?, as accessible_by already did: can :read, Post, status: [nil, :published] now allows a post without a status. (@​jtagle2, @​coorasse)
• #910: Accept a subclass of CanCan::ModelAdapters::Strategies::Base as accessible_by_strategy, so the SQL generated by accessible_by can be customized with your own strategy. (@​cb341, @​coorasse)
• #909: Make can? and accessible_by consistent for cannot rules and single table inheritance: a cannot rule on a subclass keeps its precedence in accessible_by, records with NULL in a column of a cannot condition are no longer excluded, rules on subclasses of subclasses reach the base class, and a class check passes when the class or any of its subclasses is allowed. WARNING: accessible_by returns more records when a cannot rule has conditions on a nullable column, and can? on an STI base class no longer fails because a subclass is forbidden. (@​coorasse, @​0llirocks, @​kevinluo201)
• #880: Fix accessible_by with rules on STI subclasses: a rule on a subclass without conditions no longer discards the rules defined before it, and rules with the same conditions on different subjects are no longer compressed into one. (@​takayamaki, @​sjoulbak)
• #890: Support an Active Record relation as the value of a condition in can?: the selected column, or the primary key, is checked with a query, as accessible_by already did. (@​olistik)
• #908: Join consecutive can rules in a flat chain of ORs in the SQL conditions, so that many rules on the same model no longer overflow the parser of SQLite. (@​coorasse)
• #907: Make with_accessible_by_strategy thread safe: the strategy chosen in the block no longer leaks into concurrent requests. (@​NikosVlagoidis, @​coorasse)
• #906: Keep the conditions of an association when a rule is a scope: group.posts.accessible_by(ability) returned the posts of every group matched by the scope. WARNING: accessible_by called on an association now returns fewer records when the scope of a rule constrains the same column as the association. Only the conditions dropped by merge are applied again, so a condition on a subquery like where(category: Category.where(...)) is not turned into IS NULL, and the conditions of a default scope removed by unscope in the rule stay removed. (@​coorasse)
• #694: Document that cannot supports the :all subject. (@​jaredbeck)
• #852: Add changelog_uri to the gemspec, so rubygems.org links to the changelog. (@​mark-young-atg)
• #842: Add disallowed_attributes to retrieve the attributes forbidden by cannot rules. (@​mswiszcz)
• #904: Assign the parent of a singleton resource through the inverse of the association when the resource has no setter named after the through option. (@​coorasse)
• #878: Support through_association together with singleton when loading a resource. (@​cgunther)
• #786: Fix the table aliases generated by accessible_by when the same association is joined more than twice: the WHERE clause referenced an alias that was never joined. (@​daveallie)
• #902: Do not change the rules of the ability in accessible_by: a rule shared by several models kept the conditions normalized for the first queried model. (@​bruno-costanzo)
• #901: Keep the scope of a has_many :through association in accessible_by: the association was rewritten into its through and source associations and its scope was dropped, so accessible_by returned records that can? denies. WARNING: accessible_by returns fewer records for a rule on a has_many :through association with a scope. (@​bruno-costanzo)
• Remove the VitePress documentation website: the documentation lives in the docs folder as plain Markdown. (@​coorasse)

Changelog

Sourced from cancancan's changelog.

3.7.0

• Merge the ControllerResourceLoader, ControllerResourceBuilder, ControllerResourceFinder, ControllerResourceNameFinder and ControllerResourceSanitizer modules into CanCan::ControllerResource, and call the params method of the controller only once per request: it was called once more for every attribute set by the conditions of the ability. WARNING: the five modules no longer exist; override their methods in a subclass of CanCan::ControllerResource instead. ([@​coorasse][])
• Expand the actions again after alias_action, clear_aliased_actions and merge: can? kept using the aliases expanded by a previous check, so clear_aliased_actions did not remove can :read from can?(:index, Model). ([@​coorasse][])
• Raise an error when an action is aliased to :manage, which granted every action, or to itself, which looped forever. ([@​coorasse][])
• Do not include the primary key in permitted_attributes for a rule without attributes, remove every attribute with a cannot rule without attributes, including those that are not columns, and accept a hash subject instead of raising a TypeError. WARNING: permitted_attributes no longer returns :id, and with a composite primary key none of its columns are returned. ([@​coorasse][])
• Convert a String resource name to a symbol in load_and_authorize_resource and the skip_* methods: load_and_authorize_resource 'article' treated the resource as a parent and authorized :show on the class instead of the action on the record. ([@​coorasse][])
• #927: Look up the unauthorized message of a String action through its aliases: authorize!('index', post) did not use the message defined for read. ([@​coorasse][])
• #913: Match a symbol in a condition with the string that has the same name in can?, as accessible_by already did: cannot :read, Post, state: :draft on a string column no longer allows can?(:read, draft). WARNING: a can rule with a symbol now also allows records whose string attribute has the same name. ([@​bruno-costanzo][])
• #905: Match String actions like Symbol actions: can?('destroy', user) ignored cannot :destroy, User when can :manage was defined, and skip_authorize_resource except: 'destroy' also skipped the authorization of destroy. WARNING: a String action now goes through the aliases like a Symbol action, so can?('show', order) and authorize!(action_name, order) are allowed by can :read, Order and may grant access that 3.6 denied. A rule defined with a String action now matches the same Symbol action, permissions returns symbols, and a block rule without a subject receives the action as a symbol. ([@​bruno-costanzo][])
• #848: Do not deny can?(:index, parent => Model) because of a cannot rule with conditions on the model, as can?(:index, Model) already did: load_and_authorize_resource failed on the index of a nested resource. ([@​coorasse][])
• #861, #846, #690: Give the conditions of accessible_by the table aliases that Active Record gives to the joined associations, and build them with the model of each table. A rule with a has_many :through association, or with an association without conditions, used the alias of another table: the query failed or returned the wrong records. On an aliased table, a model was not converted to its foreign key and the values were not cast with the attribute types of the model. ([@​coorasse][])
• #911: Load the resource when the id is only whitespace: a request like /books/%20 ran the action with a nil resource, authorized only against the class, instead of raising ActiveRecord::RecordNotFound. ([@​bruno-costanzo][])
• #833: Match nil in an array of enum values in can?, as accessible_by already did: can :read, Post, status: [nil, :published] now allows a post without a status. ([@​jtagle2][], [@​coorasse][])
• #910: Accept a subclass of CanCan::ModelAdapters::Strategies::Base as accessible_by_strategy, so the SQL generated by accessible_by can be customized with your own strategy. ([@​cb341][], [@​coorasse][])
• #909: Make can? and accessible_by consistent for cannot rules and single table inheritance: a cannot rule on a subclass keeps its precedence in accessible_by, records with NULL in a column of a cannot condition are no longer excluded, rules on subclasses of subclasses reach the base class, and a class check passes when the class or any of its subclasses is allowed. WARNING: accessible_by returns more records when a cannot rule has conditions on a nullable column, and can? on an STI base class no longer fails because a subclass is forbidden. ([@​coorasse][], [@​0llirocks][], [@​kevinluo201][])
• #880: Fix accessible_by with rules on STI subclasses: a rule on a subclass without conditions no longer discards the rules defined before it, and rules with the same conditions on different subjects are no longer compressed into one. ([@​takayamaki][], [@​sjoulbak][])
• #890: Support an Active Record relation as the value of a condition in can?: the selected column, or the primary key, is checked with a query, as accessible_by already did. ([@​olistik][])
• #908: Join consecutive can rules in a flat chain of ORs in the SQL conditions, so that many rules on the same model no longer overflow the parser of SQLite. ([@​coorasse][])
• #907: Make with_accessible_by_strategy thread safe: the strategy chosen in the block no longer leaks into concurrent requests. ([@​NikosVlagoidis][], [@​coorasse][])
• #906: Keep the conditions of an association when a rule is a scope: group.posts.accessible_by(ability) returned the posts of every group matched by the scope. WARNING: accessible_by called on an association now returns fewer records when the scope of a rule constrains the same column as the association. Only the conditions dropped by merge are applied again, so a condition on a subquery like where(category: Category.where(...)) is not turned into IS NULL, and the conditions of a default scope removed by unscope in the rule stay removed. ([@​coorasse][])
• #694: Document that cannot supports the :all subject. ([@​jaredbeck][])
• #852: Add changelog_uri to the gemspec, so rubygems.org links to the changelog. ([@​mark-young-atg][])
• #842: Add disallowed_attributes to retrieve the attributes forbidden by cannot rules. ([@​mswiszcz][])
• #904: Assign the parent of a singleton resource through the inverse of the association when the resource has no setter named after the through option. ([@​coorasse][])
• #878: Support through_association together with singleton when loading a resource. ([@​cgunther][])
• #786: Fix the table aliases generated by accessible_by when the same association is joined more than twice: the WHERE clause referenced an alias that was never joined. ([@​daveallie][])
• #902: Do not change the rules of the ability in accessible_by: a rule shared by several models kept the conditions normalized for the first queried model. ([@​bruno-costanzo][])
• #901: Keep the scope of a has_many :through association in accessible_by: the association was rewritten into its through and source associations and its scope was dropped, so accessible_by returned records that can? denies. WARNING: accessible_by returns fewer records for a rule on a has_many :through association with a scope. ([@​bruno-costanzo][])
• Remove the VitePress documentation website: the documentation lives in the docs folder as plain Markdown. ([@​coorasse][])

Commits

• 95c5593 Bump version to 3.7.0
• b6d9ca5 Merge the controller resource modules into ControllerResource (#930)
• ad9cef9 Fix aliased actions, permitted_attributes and String resource names (#929)
• 5b5e80a Remove unreachable subject lookups
• c9bd98f Look up the unauthorized message of a String action through its aliases (#927)
• 1c8f07e Apply again only the base conditions dropped by merge when a rule is a scope ...
• 522760d Match symbols with strings in can? as accessible_by does (#913)
• 604fec2 Match String actions like Symbol actions (#905)
• efb6c56 Document that a can rule without attributes permits every attribute (#888)
• 4a894f0 Do not deny nested class checks because of a cannot with conditions on the ch...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Test coverage

94.11% line coverage reported by SimpleCov.
Run: https://github.com/RaspberryPiFoundation/editor-api/actions/runs/40301465787