Update action does not call `authorize_resource!` after assigning attributes about activeadmin HOT 10 CLOSED

 def update_resource(object, attributes) 
   object = assign_attributes(object, attributes) 
   authorize_resource! object 
  
   run_update_callbacks object do 
     save_resource(object) 
   end 
 end

# frozen_string_literal: true
require "bundler/inline"

gemfile(true) do
  source "https://rubygems.org"

  # Use local changes or ActiveAdmin master.
  if ENV["ACTIVE_ADMIN_PATH"]
    gem "activeadmin", path: ENV["ACTIVE_ADMIN_PATH"], require: false
  else
    gem "activeadmin", github: "activeadmin/activeadmin", require: false
  end

  # Change Rails version if necessary.
  gem "rails", "~> 7.0.0"

  gem "sprockets", "~> 3.7"
  gem "sassc-rails"
  gem "sqlite3", platform: :mri
  gem "activerecord-jdbcsqlite3-adapter", platform: :jruby

  # Fixes an issue on CI with default gems when using inline bundle with default
  # gems that are already activated
  # Ref: rubygems/rubygems#6386
  if ENV["CI"]
    require "net/protocol"
    require "timeout"

    gem "net-protocol", Net::Protocol::VERSION
    gem "timeout", Timeout::VERSION
  end
end

require "active_record"

ActiveRecord::Base.establish_connection(adapter: "sqlite3", database: ":memory:")
ActiveRecord::Base.logger = Logger.new(STDOUT)

ActiveRecord::Schema.define do
  create_table :active_admin_comments, force: true do |_t|
  end

  create_table :users, force: true do |t|
    t.string :full_name
  end

  create_table :posts, force: true do |t|
    t.integer :author_id
    t.string :name
  end
end

require "action_controller/railtie"
require "action_view/railtie"
require "active_admin"

class TestApp < Rails::Application
  config.root = __dir__
  config.session_store :cookie_store, key: "cookie_store_key"
  secrets.secret_token = "secret_token"
  secrets.secret_key_base = "secret_key_base"

  config.eager_load = false
  config.logger = Logger.new($stdout)

  config.hosts = "www.example.com"
end

module ApplicationHelper
  def destroy_admin_user_session_path
    ""
  end
end

class ApplicationController < ActionController::Base
  include Rails.application.routes.url_helpers

  def current_user
    User.new(id: 1)
  end

end

class ApplicationRecord < ActiveRecord::Base
  primary_abstract_class

  def self.ransackable_attributes(auth_object = nil)
    authorizable_ransackable_attributes
  end

  def self.ransackable_associations(auth_object = nil)
    authorizable_ransackable_associations
  end
end

class User < ApplicationRecord
  def author_ids
    [1, 2]
  end
end

class Post < ApplicationRecord
end

class AdminAuthorization < ActiveAdmin::AuthorizationAdapter

  def authorized?(action, subject = nil)
    case subject
    when normalized(Post)
      # Only let the author update and delete posts
      if subject.is_a?(Post)
        user.author_ids.include?(subject.author_id)
      else
        true
      end
    else
      true
    end
  end

end

ActiveAdmin.setup do |config|
  # Authentication disabled by default. Override if necessary.
  config.authentication_method = false
  config.current_user_method = :current_user
  config.authorization_adapter = "AdminAuthorization"
end

Rails.application.initialize!

ActiveAdmin.register_page "Dashboard" do
  menu priority: 1, label: proc { I18n.t("active_admin.dashboard") }
  content do
    "Test Me"
  end
end

ActiveAdmin.register User do
end

ActiveAdmin.register Post do
  permit_params do
    [:author_id, :name]
  end
end

Rails.application.routes.draw do
  ActiveAdmin.routes(self)
end

require "minitest/autorun"
require "rack/test"
require "rails/test_help"

# Replace this with the code necessary to make your test fail.
class BugTest < ActionDispatch::IntegrationTest

  def test_admin_posts
    # we should be able to create a post with one of our author_ids
    post admin_posts_url, params: { post: {author_id: 1, name: "My Post"} }
    assert_equal 1, Post.count

    # we should see the post
    get admin_posts_url
    assert_match "My Post", response.body
    assert_response :success

    # and be able to edit it
    get edit_admin_post_url(1)
    assert_response :success

    # we shoould not be able to create a post with a foreign author_id
    post admin_posts_url, params: { post: {author_id: 666, name: "Not my other Post"} }
    assert_equal 1, Post.count

    # we should not be allowed to change the author_id of the first post to something we are not supposed to    
    patch admin_post_url(1), params: { post: {author_id: 666, name: "Not my Post anymore"} }

    # the post should still be one of ours
    get edit_admin_post_url(1)
    assert_response :success
  end

  private

  def app
    Rails.application
  end
end