From d1008a4f1d4c4928f748acc4aae9867ce85c0427 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 29 Sep 2026 15:16:41 +0000 Subject: [PATCH 1/4] Bump undici in the npm_and_yarn group across 1 directory Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici). Updates `undici` from 6.28.0 to 6.29.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](https://github.com/nodejs/undici/compare/v6.28.0...v6.29.0) --- updated-dependencies: - dependency-name: undici dependency-version: 6.29.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] --- yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/yarn.lock b/yarn.lock index 295a5039..d3378c45 100644 --- a/yarn.lock +++ b/yarn.lock @@ -4339,9 +4339,9 @@ undici-types@~6.20.0: integrity sha512-Ny6QZ2Nju20vw1SRHe3d9jVu6gJ+4e3+MMpqu7pqE5HT6WsTSlce++GQmK5UXS8mzV8DSYHrQH+Xrf2jVcuKNg== undici@^6.16.1: - version "6.28.0" - resolved "https://registry.yarnpkg.com/undici/-/undici-6.28.0.tgz#9f0e385744fef5021d6596c5bccd783f61193c1c" - integrity sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA== + version "6.29.0" + resolved "https://registry.yarnpkg.com/undici/-/undici-6.29.0.tgz#140fa16e337ac706d6ff12f03fbe5c4357e5f9a3" + integrity sha512-R+RODBqp6i2pPflGdq+xIOUkl+RNfGgHwoinecKu/JCuf2uO06cOKoDbI2P7Dn6KcswdKwrczbU6IYJ6K8X+wg== unicode-canonical-property-names-ecmascript@^2.0.0: version "2.0.1" From 56175a4cc27785d4401cd1e5f7d0e8192ae3b12e Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Sat, 3 Oct 2026 10:06:47 +0000 Subject: [PATCH 2/4] Add ApplicationPolicy default permission and scope regression specs. Lock down Axis Mundi-only CRUD defaults and Scope#resolve deny-by-default behavior used by campuses, schools, departments, and other catalog resources. Co-authored-by: rsmoke --- spec/policies/application_policy_spec.rb | 57 ++++++++++++++++++++++++ 1 file changed, 57 insertions(+) create mode 100644 spec/policies/application_policy_spec.rb diff --git a/spec/policies/application_policy_spec.rb b/spec/policies/application_policy_spec.rb new file mode 100644 index 00000000..5fd27273 --- /dev/null +++ b/spec/policies/application_policy_spec.rb @@ -0,0 +1,57 @@ +# frozen_string_literal: true + +require 'rails_helper' + +RSpec.describe ApplicationPolicy, type: :policy do + let(:record) { Object.new } + + describe 'default action permissions' do + context 'with an Axis Mundi user' do + subject { described_class.new(create(:user, :with_axis_mundi_role), record) } + + %i[index show create new update edit destroy].each do |action| + it { is_expected.to permit_action(action) } + end + end + + context 'with a regular user' do + subject { described_class.new(create(:user), record) } + + %i[index show create new update edit destroy].each do |action| + it { is_expected.not_to permit_action(action) } + end + end + + context 'with a nil user' do + subject { described_class.new(nil, record) } + + it { is_expected.not_to permit_action(:index) } + it { is_expected.not_to permit_action(:destroy) } + end + end + + describe 'Scope#resolve' do + let!(:visible_role) { create(:role, kind: 'Scoped Role A') } + let!(:hidden_role) { create(:role, kind: 'Scoped Role B') } + + it 'returns all records for Axis Mundi users' do + user = create(:user, :with_axis_mundi_role) + scope = described_class::Scope.new(user, Role.all).resolve + + expect(scope).to include(visible_role, hidden_role) + end + + it 'returns no records for regular users' do + user = create(:user) + scope = described_class::Scope.new(user, Role.all).resolve + + expect(scope).to be_empty + end + + it 'returns no records for a nil user' do + scope = described_class::Scope.new(nil, Role.all).resolve + + expect(scope).to be_empty + end + end +end From 31435ef40c93591af2e1d46d4a8e0f3f98f59db4 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 14 Oct 2026 13:23:39 +0000 Subject: [PATCH 3/4] Bump the npm_and_yarn group across 1 directory with 2 updates Bumps the npm_and_yarn group with 2 updates in the / directory: [dompurify](https://github.com/cure53/DOMPurify) and [source-map-js](https://github.com/7rulnik/source-map-js). Updates `dompurify` from 3.4.13 to 3.4.17 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](https://github.com/cure53/DOMPurify/compare/3.4.13...3.4.17) Updates `source-map-js` from 1.2.1 to 1.2.2 - [Release notes](https://github.com/7rulnik/source-map-js/releases) - [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md) - [Commits](https://github.com/7rulnik/source-map-js/compare/v1.2.1...v1.2.2) --- updated-dependencies: - dependency-name: dompurify dependency-version: 3.4.17 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: source-map-js dependency-version: 1.2.2 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] --- yarn.lock | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/yarn.lock b/yarn.lock index d3378c45..ee0d8d27 100644 --- a/yarn.lock +++ b/yarn.lock @@ -2321,9 +2321,9 @@ domexception@^4.0.0: webidl-conversions "^7.0.0" dompurify@^3.2.5: - version "3.4.13" - resolved "https://registry.yarnpkg.com/dompurify/-/dompurify-3.4.13.tgz#fc28949d59f92d62e28a3a764bcbeee35897a1be" - integrity sha512-2vmYIoqjze2d+kakP8S/nS5shfsl587kzwEjcGlTdiksUVgFHnFCsLYDVj/JNqJVOQZGSYBTmuycv0PodwmnMQ== + version "3.4.17" + resolved "https://registry.yarnpkg.com/dompurify/-/dompurify-3.4.17.tgz#074bbb24eaa419535ac19ffe7f663104b0e1543d" + integrity sha512-B/pSlYVHQ58kqISD/yDjuJ1yfzI34m1gF4lAod2bwSRhiN4K5Cl3H8Af7hqB2PmTL911tdEudnnXn5FnhRoz0w== optionalDependencies: "@types/trusted-types" "^2.0.7" @@ -4113,9 +4113,9 @@ sortablejs@^1.15.6: integrity sha512-aNfiuwMEpfBM/CN6LY0ibyhxPfPbyFeBTYJKCvzkJ2GkUpazIt3H+QIPAMHwqQ7tMKaHz1Qj+rJJCqljnf4p3A== "source-map-js@>=0.6.2 <2.0.0", source-map-js@^1.2.1: - version "1.2.1" - resolved "https://registry.yarnpkg.com/source-map-js/-/source-map-js-1.2.1.tgz#1ce5650fddd87abc099eda37dcff024c2667ae46" - integrity sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA== + version "1.2.2" + resolved "https://registry.yarnpkg.com/source-map-js/-/source-map-js-1.2.2.tgz#79fb88d97535a21cb27162cb05d211b67acea4ab" + integrity sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw== source-map-support@0.5.13: version "0.5.13" From 0af58035085382f44d0567dcd856b9b42d9f17fe Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 14 Oct 2026 13:29:40 +0000 Subject: [PATCH 4/4] Strengthen ApplicationPolicy regression specs Co-authored-by: rsmoke <5861173+rsmoke@users.noreply.github.com> --- spec/policies/application_policy_spec.rb | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/spec/policies/application_policy_spec.rb b/spec/policies/application_policy_spec.rb index 5fd27273..e1c88233 100644 --- a/spec/policies/application_policy_spec.rb +++ b/spec/policies/application_policy_spec.rb @@ -25,8 +25,9 @@ context 'with a nil user' do subject { described_class.new(nil, record) } - it { is_expected.not_to permit_action(:index) } - it { is_expected.not_to permit_action(:destroy) } + %i[index show create new update edit destroy].each do |action| + it { is_expected.not_to permit_action(action) } + end end end @@ -36,9 +37,10 @@ it 'returns all records for Axis Mundi users' do user = create(:user, :with_axis_mundi_role) + roles = Role.all.to_a scope = described_class::Scope.new(user, Role.all).resolve - expect(scope).to include(visible_role, hidden_role) + expect(scope).to match_array(roles) end it 'returns no records for regular users' do