module Ransack::Adapters::ActiveRecord::Base

Public Class Methods

extended(base) click to toggle source
# File lib/ransack/adapters/active_record/base.rb, line 6
def self.extended(base)
  base.class_eval do
    class_attribute :_ransackers
    class_attribute :_ransack_aliases
    self._ransackers ||= {}
    self._ransack_aliases ||= {}
  end
end

Public Instance Methods

authorizable_ransackable_associations() click to toggle source

Bare list of all potentially searchable associations. Searchable associations need to be explicitly allowlisted through the ‘ransackable_associations` method in each model, but if you’re allowing almost everything to be searched, this list can be used as a base for exclusions.

# File lib/ransack/adapters/active_record/base.rb, line 93
def authorizable_ransackable_associations
  reflect_on_all_associations.map { |a| a.name.to_s }
end
authorizable_ransackable_attributes() click to toggle source

Bare list of all potentially searchable attributes. Searchable attributes need to be explicitly allowlisted through the ‘ransackable_attributes` method in each model, but if you’re allowing almost everything to be searched, this list can be used as a base for exclusions.

# File lib/ransack/adapters/active_record/base.rb, line 78
def authorizable_ransackable_attributes
  if Ransack::SUPPORTS_ATTRIBUTE_ALIAS
    column_names + _ransackers.keys + _ransack_aliases.keys +
    attribute_aliases.keys
  else
    column_names + _ransackers.keys + _ransack_aliases.keys
  end.uniq
end
ransack(params = {}, options = {}) click to toggle source
# File lib/ransack/adapters/active_record/base.rb, line 15
def ransack(params = {}, options = {})
  Search.new(self, params, options)
end
ransack!(params = {}, options = {}) click to toggle source
# File lib/ransack/adapters/active_record/base.rb, line 19
def ransack!(params = {}, options = {})
  ransack(params, options.merge(ignore_unknown_conditions: false))
end
ransack_alias(new_name, old_name) click to toggle source
# File lib/ransack/adapters/active_record/base.rb, line 28
def ransack_alias(new_name, old_name)
  self._ransack_aliases = _ransack_aliases.merge new_name.to_s =>
    old_name.to_s
end
ransackable_associations(auth_object = nil) click to toggle source

Ransackable_associations, by default, returns the names of all associations as an array of strings. For overriding with a whitelist array of strings.

# File lib/ransack/adapters/active_record/base.rb, line 45
def ransackable_associations(auth_object = nil)
  @ransackable_associations ||= deprecated_ransackable_list(:ransackable_associations)
end
ransackable_attributes(auth_object = nil) click to toggle source

Ransackable_attributes, by default, returns all column names and any defined ransackers as an array of strings. For overriding with a whitelist array of strings.

# File lib/ransack/adapters/active_record/base.rb, line 37
def ransackable_attributes(auth_object = nil)
  @ransackable_attributes ||= deprecated_ransackable_list(:ransackable_attributes)
end
ransackable_scopes(auth_object = nil) click to toggle source

Ransackable_scopes, by default, returns an empty array i.e. no class methods/scopes are authorized. For overriding with a whitelist array of symbols.

# File lib/ransack/adapters/active_record/base.rb, line 61
def ransackable_scopes(auth_object = nil)
  []
end
ransackable_scopes_skip_sanitize_args() click to toggle source

ransack_scope_skip_sanitize_args, by default, returns an empty array. i.e. use the sanitize_scope_args setting to determine if args should be converted. For overriding with a list of scopes which should be passed the args as-is.

# File lib/ransack/adapters/active_record/base.rb, line 69
def ransackable_scopes_skip_sanitize_args
  []
end
ransacker(name, opts = {}, &block) click to toggle source
# File lib/ransack/adapters/active_record/base.rb, line 23
def ransacker(name, opts = {}, &block)
  self._ransackers = _ransackers.merge name.to_s => Ransacker
    .new(self, name, opts, &block)
end
ransortable_attributes(auth_object = nil) click to toggle source

Ransortable_attributes, by default, returns the names of all attributes available for sorting as an array of strings. For overriding with a whitelist array of strings.

# File lib/ransack/adapters/active_record/base.rb, line 53
def ransortable_attributes(auth_object = nil)
  ransackable_attributes(auth_object)
end

Private Instance Methods

deprecated_ransackable_list(method) click to toggle source
# File lib/ransack/adapters/active_record/base.rb, line 99
        def deprecated_ransackable_list(method)
          list_type = method.to_s.delete_prefix("ransackable_")

          if explicitly_defined?(method)
            warn_deprecated <<~ERROR
              Ransack's builtin `#{method}` method is deprecated and will result
              in an error in the future. If you want to authorize the full list
              of searchable #{list_type} for this model, use
              `authorizable_#{method}` instead of delegating to `super`.
            ERROR

            public_send("authorizable_#{method}")
          else
            raise <<~MESSAGE
              Ransack needs #{name} #{list_type} explicitly allowlisted as
              searchable. Define a `#{method}` class method in your `#{name}`
              model, watching out for items you DON'T want searchable (for
              example, `encrypted_password`, `password_reset_token`, `owner` or
              other sensitive information). You can use the following as a base:

              ```ruby
              class #{name} < ApplicationRecord

                # ...

                def self.#{method}(auth_object = nil)
                  #{public_send("authorizable_#{method}").sort.inspect}
                end

                # ...

              end
              ```
            MESSAGE
          end
        end
explicitly_defined?(method) click to toggle source
# File lib/ransack/adapters/active_record/base.rb, line 136
def explicitly_defined?(method)
  definer_ancestor = singleton_class.ancestors.find do |ancestor|
    ancestor.instance_methods(false).include?(method)
  end

  definer_ancestor != Ransack::Adapters::ActiveRecord::Base
end
warn_deprecated(message) click to toggle source
# File lib/ransack/adapters/active_record/base.rb, line 144
def warn_deprecated(message)
  caller_location = caller_locations.find { |location| !location.path.start_with?(File.expand_path("../..", __dir__)) }

  warn "DEPRECATION WARNING: #{message.squish} (called at #{caller_location.path}:#{caller_location.lineno})"
end