Skip to content

fix(agent): authorize associate-related on the foreign collection and scope the many-to-many link #356

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
PMerlet merged 4 commits into from
Aug 13, 2026
Merged

fix(agent): authorize associate-related on the foreign collection and scope the many-to-many link #356

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
73d3ede
fix(agent): authorize associate-related on the foreign collection and…
PMerlet Aug 13, 2026
fda1f8a
fix(agent): write the many-to-many relation key targets in the throug…
PMerlet Aug 13, 2026
624f884
fix(agent): match every key column of a composite-key associate target
PMerlet Aug 13, 2026
9b3b37e
test(agent): cover a many-to-many associate whose target has a compos…
PMerlet Aug 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
60 changes: 32 additions & 28 deletions ...s/forest_admin_agent/lib/forest_admin_agent/routes/resources/related/associate_related.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ def setup_routes

def handle_request(args = {})
context = build(args)
context.permissions.can?(:edit, context.collection)
context.permissions.can?(:edit, context.child_collection)

parent_primary_key_values = Utils::Id.unpack_id(context.collection, args[:params]['id'], with_key: true)
target_primary_key_values = Utils::Id.unpack_id(context.child_collection, args[:params]['data'][0]['id'],
Expand All @@ -44,34 +44,15 @@ def handle_request(args = {})
private

def associate_one_to_many(relation, parent_primary_key_values, target_primary_key_values, context)
id = Schema.primary_keys(context.child_collection)[0]
value = Collection.get_value(context.child_collection, context.caller, target_primary_key_values, id)
filter = Filter.new(
condition_tree: ConditionTree::ConditionTreeFactory.intersect(
[
ConditionTree::Nodes::ConditionTreeLeaf.new(id, 'Equal', value),
context.permissions.get_scope(context.child_collection)
]
)
)
filter = target_in_scope_filter(target_primary_key_values, context)
value = Collection.get_value(context.collection, context.caller, parent_primary_key_values,
relation.origin_key_target)

context.child_collection.update(context.caller, filter, { relation.origin_key => value })
end

def associate_polymorphic_one_to_many(relation, parent_primary_key_values, target_primary_key_values, context)
id = Schema.primary_keys(context.child_collection)[0]
value = Collection.get_value(context.child_collection, context.caller, target_primary_key_values, id)
filter = Filter.new(
condition_tree: ConditionTree::ConditionTreeFactory.intersect(
[
ConditionTree::Nodes::ConditionTreeLeaf.new(id, 'Equal', value),
context.permissions.get_scope(context.child_collection)
]
)
)

filter = target_in_scope_filter(target_primary_key_values, context)
value = Collection.get_value(context.collection, context.caller, parent_primary_key_values,
relation.origin_key_target)

Expand All @@ -83,16 +64,39 @@ def associate_polymorphic_one_to_many(relation, parent_primary_key_values, targe
end

def associate_many_to_many(relation, parent_primary_key_values, target_primary_key_values, context)
id = Schema.primary_keys(context.child_collection)[0]
foreign_value = Collection.get_value(context.child_collection, context.caller, target_primary_key_values,
id)
id = Schema.primary_keys(context.collection)[0]
origin_value = Collection.get_value(context.collection, context.caller, parent_primary_key_values, id)
record = { relation.origin_key => origin_value, relation.foreign_key => foreign_value }
target = find_target_in_scope(target_primary_key_values, relation.foreign_key_target, context)
return if target.nil?

origin_value = Collection.get_value(context.collection, context.caller, parent_primary_key_values,
relation.origin_key_target)
record = {
relation.origin_key => origin_value,
relation.foreign_key => target[relation.foreign_key_target]
}

through_collection = context.datasource.get_collection(relation.through_collection)
through_collection.create(context.caller, record)
end

def find_target_in_scope(target_primary_key_values, foreign_key_target, context)
context.child_collection.list(
context.caller,
target_in_scope_filter(target_primary_key_values, context),
Projection.new([foreign_key_target])
).first
end

def target_in_scope_filter(target_primary_key_values, context)
Filter.new(
condition_tree: ConditionTree::ConditionTreeFactory.intersect(
[
ConditionTree::ConditionTreeFactory.match_ids(context.child_collection,
[target_primary_key_values]),
context.permissions.get_scope(context.child_collection)
]
)
)
end
end
end
end
Expand Down
Loading
Loading