Problem
On branch set-up-an-avo-installer-rake, lib/tasks/templates/avo/resources/post.rb.tt generates:
self.search = {
query: -> { query.ransack(id_eq: params[:q], title_cont: params[:q], slug_cont: params[:q], m: "or").result(distinct: false) }
}Ransack 4+ raises unless the model defines ransackable_attributes, and ransack may not even be in the host bundle — so generated search either crashes or (on older ransack) exposes all attributes for filtering.
Proposed solution
Generate an explicit allowlist alongside the resource — inject def self.ransackable_attributes(...) = %w[id title slug] guidance into the generated Post model, or print it as a post-install step. Allowlist only id title slug (never status/content — Avo search runs over all records including drafts).
Acceptance criteria
- Generated search works on Ransack 4+ without manual fixes.
- Allowlist limited to id/title/slug.
- Behavior documented when ransack is absent.
Problem
On branch
set-up-an-avo-installer-rake,lib/tasks/templates/avo/resources/post.rb.ttgenerates:Ransack 4+ raises unless the model defines
ransackable_attributes, and ransack may not even be in the host bundle — so generated search either crashes or (on older ransack) exposes all attributes for filtering.Proposed solution
Generate an explicit allowlist alongside the resource — inject
def self.ransackable_attributes(...) = %w[id title slug]guidance into the generated Post model, or print it as a post-install step. Allowlist onlyid title slug(never status/content — Avo search runs over all records including drafts).Acceptance criteria