actionpack 6.0.0

data/lib/action_controller/form_builder.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module ActionController
+  # Override the default form builder for all views rendered by this
+  # controller and any of its descendants. Accepts a subclass of
+  # +ActionView::Helpers::FormBuilder+.
+  #
+  # For example, given a form builder:
+  #
+  #   class AdminFormBuilder < ActionView::Helpers::FormBuilder
+  #     def special_field(name)
+  #     end
+  #   end
+  #
+  # The controller specifies a form builder as its default:
+  #
+  #   class AdminAreaController < ApplicationController
+  #     default_form_builder AdminFormBuilder
+  #   end
+  #
+  # Then in the view any form using +form_for+ will be an instance of the
+  # specified form builder:
+  #
+  #   <%= form_for(@instance) do |builder| %>
+  #     <%= builder.special_field(:name) %>
+  #   <% end %>
+  module FormBuilder
+    extend ActiveSupport::Concern
+
+    included do
+      class_attribute :_default_form_builder, instance_accessor: false
+    end
+
+    module ClassMethods
+      # Set the form builder to be used as the default for all forms
+      # in the views rendered by this controller and its subclasses.
+      #
+      # ==== Parameters
+      # * <tt>builder</tt> - Default form builder, an instance of +ActionView::Helpers::FormBuilder+
+      def default_form_builder(builder)
+        self._default_form_builder = builder
+      end
+    end
+
+    # Default form builder for the controller
+    def default_form_builder
+      self.class._default_form_builder
+    end
+  end
+end

data/lib/action_controller/log_subscriber.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+module ActionController
+  class LogSubscriber < ActiveSupport::LogSubscriber
+    INTERNAL_PARAMS = %w(controller action format _method only_path)
+
+    def start_processing(event)
+      return unless logger.info?
+
+      payload = event.payload
+      params  = payload[:params].except(*INTERNAL_PARAMS)
+      format  = payload[:format]
+      format  = format.to_s.upcase if format.is_a?(Symbol)
+
+      info "Processing by #{payload[:controller]}##{payload[:action]} as #{format}"
+      info "  Parameters: #{params.inspect}" unless params.empty?
+    end
+
+    def process_action(event)
+      info do
+        payload = event.payload
+        additions = ActionController::Base.log_process_action(payload)
+        status = payload[:status]
+
+        if status.nil? && payload[:exception].present?
+          exception_class_name = payload[:exception].first
+          status = ActionDispatch::ExceptionWrapper.status_code_for_exception(exception_class_name)
+        end
+
+        additions << "Allocations: #{event.allocations}"
+
+        message = +"Completed #{status} #{Rack::Utils::HTTP_STATUS_CODES[status]} in #{event.duration.round}ms"
+        message << " (#{additions.join(" | ")})" unless additions.empty?
+        message << "\n\n" if defined?(Rails.env) && Rails.env.development?
+
+        message
+      end
+    end
+
+    def halted_callback(event)
+      info { "Filter chain halted as #{event.payload[:filter].inspect} rendered or redirected" }
+    end
+
+    def send_file(event)
+      info { "Sent file #{event.payload[:path]} (#{event.duration.round(1)}ms)" }
+    end
+
+    def redirect_to(event)
+      info { "Redirected to #{event.payload[:location]}" }
+    end
+
+    def send_data(event)
+      info { "Sent data #{event.payload[:filename]} (#{event.duration.round(1)}ms)" }
+    end
+
+    def unpermitted_parameters(event)
+      debug do
+        unpermitted_keys = event.payload[:keys]
+        color("Unpermitted parameter#{'s' if unpermitted_keys.size > 1}: #{unpermitted_keys.map { |e| ":#{e}" }.join(", ")}", RED)
+      end
+    end
+
+    %w(write_fragment read_fragment exist_fragment?
+       expire_fragment expire_page write_page).each do |method|
+      class_eval <<-METHOD, __FILE__, __LINE__ + 1
+        def #{method}(event)
+          return unless logger.info? && ActionController::Base.enable_fragment_cache_logging
+          key         = ActiveSupport::Cache.expand_cache_key(event.payload[:key] || event.payload[:path])
+          human_name  = #{method.to_s.humanize.inspect}
+          info("\#{human_name} \#{key} (\#{event.duration.round(1)}ms)")
+        end
+      METHOD
+    end
+
+    def logger
+      ActionController::Base.logger
+    end
+  end
+end
+
+ActionController::LogSubscriber.attach_to :action_controller

data/lib/action_controller/metal.rb

@@ -0,0 +1,256 @@
+# frozen_string_literal: true
+
+require "active_support/core_ext/array/extract_options"
+require "action_dispatch/middleware/stack"
+require "action_dispatch/http/request"
+require "action_dispatch/http/response"
+
+module ActionController
+  # Extend ActionDispatch middleware stack to make it aware of options
+  # allowing the following syntax in controllers:
+  #
+  #   class PostsController < ApplicationController
+  #     use AuthenticationMiddleware, except: [:index, :show]
+  #   end
+  #
+  class MiddlewareStack < ActionDispatch::MiddlewareStack #:nodoc:
+    class Middleware < ActionDispatch::MiddlewareStack::Middleware #:nodoc:
+      def initialize(klass, args, actions, strategy, block)
+        @actions = actions
+        @strategy = strategy
+        super(klass, args, block)
+      end
+
+      def valid?(action)
+        @strategy.call @actions, action
+      end
+    end
+
+    def build(action, app = nil, &block)
+      action = action.to_s
+
+      middlewares.reverse.inject(app || block) do |a, middleware|
+        middleware.valid?(action) ? middleware.build(a) : a
+      end
+    end
+
+    private
+
+      INCLUDE = ->(list, action) { list.include? action }
+      EXCLUDE = ->(list, action) { !list.include? action }
+      NULL    = ->(list, action) { true }
+
+      def build_middleware(klass, args, block)
+        options = args.extract_options!
+        only   = Array(options.delete(:only)).map(&:to_s)
+        except = Array(options.delete(:except)).map(&:to_s)
+        args << options unless options.empty?
+
+        strategy = NULL
+        list     = nil
+
+        if only.any?
+          strategy = INCLUDE
+          list     = only
+        elsif except.any?
+          strategy = EXCLUDE
+          list     = except
+        end
+
+        Middleware.new(klass, args, list, strategy, block)
+      end
+  end
+
+  # <tt>ActionController::Metal</tt> is the simplest possible controller, providing a
+  # valid Rack interface without the additional niceties provided by
+  # <tt>ActionController::Base</tt>.
+  #
+  # A sample metal controller might look like this:
+  #
+  #   class HelloController < ActionController::Metal
+  #     def index
+  #       self.response_body = "Hello World!"
+  #     end
+  #   end
+  #
+  # And then to route requests to your metal controller, you would add
+  # something like this to <tt>config/routes.rb</tt>:
+  #
+  #   get 'hello', to: HelloController.action(:index)
+  #
+  # The +action+ method returns a valid Rack application for the \Rails
+  # router to dispatch to.
+  #
+  # == Rendering Helpers
+  #
+  # <tt>ActionController::Metal</tt> by default provides no utilities for rendering
+  # views, partials, or other responses aside from explicitly calling of
+  # <tt>response_body=</tt>, <tt>content_type=</tt>, and <tt>status=</tt>. To
+  # add the render helpers you're used to having in a normal controller, you
+  # can do the following:
+  #
+  #   class HelloController < ActionController::Metal
+  #     include AbstractController::Rendering
+  #     include ActionView::Layouts
+  #     append_view_path "#{Rails.root}/app/views"
+  #
+  #     def index
+  #       render "hello/index"
+  #     end
+  #   end
+  #
+  # == Redirection Helpers
+  #
+  # To add redirection helpers to your metal controller, do the following:
+  #
+  #   class HelloController < ActionController::Metal
+  #     include ActionController::Redirecting
+  #     include Rails.application.routes.url_helpers
+  #
+  #     def index
+  #       redirect_to root_url
+  #     end
+  #   end
+  #
+  # == Other Helpers
+  #
+  # You can refer to the modules included in <tt>ActionController::Base</tt> to see
+  # other features you can bring into your metal controller.
+  #
+  class Metal < AbstractController::Base
+    abstract!
+
+    # Returns the last part of the controller's name, underscored, without the ending
+    # <tt>Controller</tt>. For instance, PostsController returns <tt>posts</tt>.
+    # Namespaces are left out, so Admin::PostsController returns <tt>posts</tt> as well.
+    #
+    # ==== Returns
+    # * <tt>string</tt>
+    def self.controller_name
+      @controller_name ||= name.demodulize.sub(/Controller$/, "").underscore
+    end
+
+    def self.make_response!(request)
+      ActionDispatch::Response.new.tap do |res|
+        res.request = request
+      end
+    end
+
+    def self.binary_params_for?(action) # :nodoc:
+      false
+    end
+
+    # Delegates to the class' <tt>controller_name</tt>.
+    def controller_name
+      self.class.controller_name
+    end
+
+    attr_internal :response, :request
+    delegate :session, to: "@_request"
+    delegate :headers, :status=, :location=, :content_type=,
+             :status, :location, :content_type, :media_type, to: "@_response"
+
+    def initialize
+      @_request = nil
+      @_response = nil
+      @_routes = nil
+      super
+    end
+
+    def params
+      @_params ||= request.parameters
+    end
+
+    def params=(val)
+      @_params = val
+    end
+
+    alias :response_code :status # :nodoc:
+
+    # Basic url_for that can be overridden for more robust functionality.
+    def url_for(string)
+      string
+    end
+
+    def response_body=(body)
+      body = [body] unless body.nil? || body.respond_to?(:each)
+      response.reset_body!
+      return unless body
+      response.body = body
+      super
+    end
+
+    # Tests if render or redirect has already happened.
+    def performed?
+      response_body || response.committed?
+    end
+
+    def dispatch(name, request, response) #:nodoc:
+      set_request!(request)
+      set_response!(response)
+      process(name)
+      request.commit_flash
+      to_a
+    end
+
+    def set_response!(response) # :nodoc:
+      @_response = response
+    end
+
+    def set_request!(request) #:nodoc:
+      @_request = request
+      @_request.controller_instance = self
+    end
+
+    def to_a #:nodoc:
+      response.to_a
+    end
+
+    def reset_session
+      @_request.reset_session
+    end
+
+    class_attribute :middleware_stack, default: ActionController::MiddlewareStack.new
+
+    def self.inherited(base) # :nodoc:
+      base.middleware_stack = middleware_stack.dup
+      super
+    end
+
+    # Pushes the given Rack middleware and its arguments to the bottom of the
+    # middleware stack.
+    def self.use(*args, &block)
+      middleware_stack.use(*args, &block)
+    end
+
+    # Alias for +middleware_stack+.
+    def self.middleware
+      middleware_stack
+    end
+
+    # Returns a Rack endpoint for the given action name.
+    def self.action(name)
+      app = lambda { |env|
+        req = ActionDispatch::Request.new(env)
+        res = make_response! req
+        new.dispatch(name, req, res)
+      }
+
+      if middleware_stack.any?
+        middleware_stack.build(name, app)
+      else
+        app
+      end
+    end
+
+    # Direct dispatch to the controller. Instantiates the controller, then
+    # executes the action named +name+.
+    def self.dispatch(name, req, res)
+      if middleware_stack.any?
+        middleware_stack.build(name) { |env| new.dispatch(name, req, res) }.call req.env
+      else
+        new.dispatch(name, req, res)
+      end
+    end
+  end
+end

data/lib/action_controller/metal/basic_implicit_render.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module ActionController
+  module BasicImplicitRender # :nodoc:
+    def send_action(method, *args)
+      super.tap { default_render unless performed? }
+    end
+
+    def default_render
+      head :no_content
+    end
+  end
+end

data/lib/action_controller/metal/conditional_get.rb

@@ -0,0 +1,280 @@
+# frozen_string_literal: true
+
+module ActionController
+  module ConditionalGet
+    extend ActiveSupport::Concern
+
+    include Head
+
+    included do
+      class_attribute :etaggers, default: []
+    end
+
+    module ClassMethods
+      # Allows you to consider additional controller-wide information when generating an ETag.
+      # For example, if you serve pages tailored depending on who's logged in at the moment, you
+      # may want to add the current user id to be part of the ETag to prevent unauthorized displaying
+      # of cached pages.
+      #
+      #   class InvoicesController < ApplicationController
+      #     etag { current_user.try :id }
+      #
+      #     def show
+      #       # Etag will differ even for the same invoice when it's viewed by a different current_user
+      #       @invoice = Invoice.find(params[:id])
+      #       fresh_when(@invoice)
+      #     end
+      #   end
+      def etag(&etagger)
+        self.etaggers += [etagger]
+      end
+    end
+
+    # Sets the +etag+, +last_modified+, or both on the response and renders a
+    # <tt>304 Not Modified</tt> response if the request is already fresh.
+    #
+    # === Parameters:
+    #
+    # * <tt>:etag</tt> Sets a "weak" ETag validator on the response. See the
+    #   +:weak_etag+ option.
+    # * <tt>:weak_etag</tt> Sets a "weak" ETag validator on the response.
+    #   Requests that set If-None-Match header may return a 304 Not Modified
+    #   response if it matches the ETag exactly. A weak ETag indicates semantic
+    #   equivalence, not byte-for-byte equality, so they're good for caching
+    #   HTML pages in browser caches. They can't be used for responses that
+    #   must be byte-identical, like serving Range requests within a PDF file.
+    # * <tt>:strong_etag</tt> Sets a "strong" ETag validator on the response.
+    #   Requests that set If-None-Match header may return a 304 Not Modified
+    #   response if it matches the ETag exactly. A strong ETag implies exact
+    #   equality: the response must match byte for byte. This is necessary for
+    #   doing Range requests within a large video or PDF file, for example, or
+    #   for compatibility with some CDNs that don't support weak ETags.
+    # * <tt>:last_modified</tt> Sets a "weak" last-update validator on the
+    #   response. Subsequent requests that set If-Modified-Since may return a
+    #   304 Not Modified response if last_modified <= If-Modified-Since.
+    # * <tt>:public</tt> By default the Cache-Control header is private, set this to
+    #   +true+ if you want your application to be cacheable by other devices (proxy caches).
+    # * <tt>:template</tt> By default, the template digest for the current
+    #   controller/action is included in ETags. If the action renders a
+    #   different template, you can include its digest instead. If the action
+    #   doesn't render a template at all, you can pass <tt>template: false</tt>
+    #   to skip any attempt to check for a template digest.
+    #
+    # === Example:
+    #
+    #   def show
+    #     @article = Article.find(params[:id])
+    #     fresh_when(etag: @article, last_modified: @article.updated_at, public: true)
+    #   end
+    #
+    # This will render the show template if the request isn't sending a matching ETag or
+    # If-Modified-Since header and just a <tt>304 Not Modified</tt> response if there's a match.
+    #
+    # You can also just pass a record. In this case +last_modified+ will be set
+    # by calling +updated_at+ and +etag+ by passing the object itself.
+    #
+    #   def show
+    #     @article = Article.find(params[:id])
+    #     fresh_when(@article)
+    #   end
+    #
+    # You can also pass an object that responds to +maximum+, such as a
+    # collection of active records. In this case +last_modified+ will be set by
+    # calling <tt>maximum(:updated_at)</tt> on the collection (the timestamp of the
+    # most recently updated record) and the +etag+ by passing the object itself.
+    #
+    #   def index
+    #     @articles = Article.all
+    #     fresh_when(@articles)
+    #   end
+    #
+    # When passing a record or a collection, you can still set the public header:
+    #
+    #   def show
+    #     @article = Article.find(params[:id])
+    #     fresh_when(@article, public: true)
+    #   end
+    #
+    # When rendering a different template than the default controller/action
+    # style, you can indicate which digest to include in the ETag:
+    #
+    #   before_action { fresh_when @article, template: 'widgets/show' }
+    #
+    def fresh_when(object = nil, etag: nil, weak_etag: nil, strong_etag: nil, last_modified: nil, public: false, template: nil)
+      weak_etag ||= etag || object unless strong_etag
+      last_modified ||= object.try(:updated_at) || object.try(:maximum, :updated_at)
+
+      if strong_etag
+        response.strong_etag = combine_etags strong_etag,
+          last_modified: last_modified, public: public, template: template
+      elsif weak_etag || template
+        response.weak_etag = combine_etags weak_etag,
+          last_modified: last_modified, public: public, template: template
+      end
+
+      response.last_modified = last_modified if last_modified
+      response.cache_control[:public] = true if public
+
+      head :not_modified if request.fresh?(response)
+    end
+
+    # Sets the +etag+ and/or +last_modified+ on the response and checks it against
+    # the client request. If the request doesn't match the options provided, the
+    # request is considered stale and should be generated from scratch. Otherwise,
+    # it's fresh and we don't need to generate anything and a reply of <tt>304 Not Modified</tt> is sent.
+    #
+    # === Parameters:
+    #
+    # * <tt>:etag</tt> Sets a "weak" ETag validator on the response. See the
+    #   +:weak_etag+ option.
+    # * <tt>:weak_etag</tt> Sets a "weak" ETag validator on the response.
+    #   Requests that set If-None-Match header may return a 304 Not Modified
+    #   response if it matches the ETag exactly. A weak ETag indicates semantic
+    #   equivalence, not byte-for-byte equality, so they're good for caching
+    #   HTML pages in browser caches. They can't be used for responses that
+    #   must be byte-identical, like serving Range requests within a PDF file.
+    # * <tt>:strong_etag</tt> Sets a "strong" ETag validator on the response.
+    #   Requests that set If-None-Match header may return a 304 Not Modified
+    #   response if it matches the ETag exactly. A strong ETag implies exact
+    #   equality: the response must match byte for byte. This is necessary for
+    #   doing Range requests within a large video or PDF file, for example, or
+    #   for compatibility with some CDNs that don't support weak ETags.
+    # * <tt>:last_modified</tt> Sets a "weak" last-update validator on the
+    #   response. Subsequent requests that set If-Modified-Since may return a
+    #   304 Not Modified response if last_modified <= If-Modified-Since.
+    # * <tt>:public</tt> By default the Cache-Control header is private, set this to
+    #   +true+ if you want your application to be cacheable by other devices (proxy caches).
+    # * <tt>:template</tt> By default, the template digest for the current
+    #   controller/action is included in ETags. If the action renders a
+    #   different template, you can include its digest instead. If the action
+    #   doesn't render a template at all, you can pass <tt>template: false</tt>
+    #   to skip any attempt to check for a template digest.
+    #
+    # === Example:
+    #
+    #   def show
+    #     @article = Article.find(params[:id])
+    #
+    #     if stale?(etag: @article, last_modified: @article.updated_at)
+    #       @statistics = @article.really_expensive_call
+    #       respond_to do |format|
+    #         # all the supported formats
+    #       end
+    #     end
+    #   end
+    #
+    # You can also just pass a record. In this case +last_modified+ will be set
+    # by calling +updated_at+ and +etag+ by passing the object itself.
+    #
+    #   def show
+    #     @article = Article.find(params[:id])
+    #
+    #     if stale?(@article)
+    #       @statistics = @article.really_expensive_call
+    #       respond_to do |format|
+    #         # all the supported formats
+    #       end
+    #     end
+    #   end
+    #
+    # You can also pass an object that responds to +maximum+, such as a
+    # collection of active records. In this case +last_modified+ will be set by
+    # calling +maximum(:updated_at)+ on the collection (the timestamp of the
+    # most recently updated record) and the +etag+ by passing the object itself.
+    #
+    #   def index
+    #     @articles = Article.all
+    #
+    #     if stale?(@articles)
+    #       @statistics = @articles.really_expensive_call
+    #       respond_to do |format|
+    #         # all the supported formats
+    #       end
+    #     end
+    #   end
+    #
+    # When passing a record or a collection, you can still set the public header:
+    #
+    #   def show
+    #     @article = Article.find(params[:id])
+    #
+    #     if stale?(@article, public: true)
+    #       @statistics = @article.really_expensive_call
+    #       respond_to do |format|
+    #         # all the supported formats
+    #       end
+    #     end
+    #   end
+    #
+    # When rendering a different template than the default controller/action
+    # style, you can indicate which digest to include in the ETag:
+    #
+    #   def show
+    #     super if stale? @article, template: 'widgets/show'
+    #   end
+    #
+    def stale?(object = nil, **freshness_kwargs)
+      fresh_when(object, **freshness_kwargs)
+      !request.fresh?(response)
+    end
+
+    # Sets an HTTP 1.1 Cache-Control header. Defaults to issuing a +private+
+    # instruction, so that intermediate caches must not cache the response.
+    #
+    #   expires_in 20.minutes
+    #   expires_in 3.hours, public: true
+    #   expires_in 3.hours, public: true, must_revalidate: true
+    #
+    # This method will overwrite an existing Cache-Control header.
+    # See https://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html for more possibilities.
+    #
+    # HTTP Cache-Control Extensions for Stale Content. See https://tools.ietf.org/html/rfc5861
+    # It helps to cache an asset and serve it while is being revalidated and/or returning with an error.
+    #
+    #   expires_in 3.hours, public: true, stale_while_revalidate: 60.seconds
+    #   expires_in 3.hours, public: true, stale_while_revalidate: 60.seconds, stale_if_error: 5.minutes
+    #
+    # The method will also ensure an HTTP Date header for client compatibility.
+    def expires_in(seconds, options = {})
+      response.cache_control.merge!(
+        max_age: seconds,
+        public: options.delete(:public),
+        must_revalidate: options.delete(:must_revalidate),
+        stale_while_revalidate: options.delete(:stale_while_revalidate),
+        stale_if_error: options.delete(:stale_if_error),
+      )
+      options.delete(:private)
+
+      response.cache_control[:extras] = options.map { |k, v| "#{k}=#{v}" }
+      response.date = Time.now unless response.date?
+    end
+
+    # Sets an HTTP 1.1 Cache-Control header of <tt>no-cache</tt>. This means the
+    # resource will be marked as stale, so clients must always revalidate.
+    # Intermediate/browser caches may still store the asset.
+    def expires_now
+      response.cache_control.replace(no_cache: true)
+    end
+
+    # Cache or yield the block. The cache is supposed to never expire.
+    #
+    # You can use this method when you have an HTTP response that never changes,
+    # and the browser and proxies should cache it indefinitely.
+    #
+    # * +public+: By default, HTTP responses are private, cached only on the
+    #   user's web browser. To allow proxies to cache the response, set +true+ to
+    #   indicate that they can serve the cached response to all users.
+    def http_cache_forever(public: false)
+      expires_in 100.years, public: public
+
+      yield if stale?(etag: request.fullpath,
+                      last_modified: Time.new(2011, 1, 1).utc,
+                      public: public)
+    end
+
+    private
+      def combine_etags(validator, options)
+        [validator, *etaggers.map { |etagger| instance_exec(options, &etagger) }].compact
+      end
+  end
+end