actionpack 6.0.4.7 → 6.1.0.rc1

data/MIT-LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2004-2019 David Heinemeier Hansson
+Copyright (c) 2004-2020 David Heinemeier Hansson
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

data/README.rdoc

@@ -33,7 +33,7 @@ The latest version of Action Pack can be installed with RubyGems:
 
 Source code can be downloaded as part of the Rails project on GitHub:
 
-* https://github.com/rails/rails/tree/main/actionpack
+* https://github.com/rails/rails/tree/master/actionpack
 
 
 == License

data/lib/abstract_controller/base.rb

@@ -9,6 +9,35 @@ require "active_support/core_ext/module/attr_internal"
 module AbstractController
   # Raised when a non-existing controller action is triggered.
   class ActionNotFound < StandardError
+    attr_reader :controller, :action
+    def initialize(message = nil, controller = nil, action = nil)
+      @controller = controller
+      @action = action
+      super(message)
+    end
+
+    class Correction
+      def initialize(error)
+        @error = error
+      end
+
+      def corrections
+        if @error.action
+          maybe_these = @error.controller.class.action_methods
+
+          maybe_these.sort_by { |n|
+            DidYouMean::Jaro.distance(@error.action.to_s, n)
+          }.reverse.first(4)
+        else
+          []
+        end
+      end
+    end
+
+    # We may not have DYM, and DYM might not let us register error handlers
+    if defined?(DidYouMean) && DidYouMean.respond_to?(:correct_error)
+      DidYouMean.correct_error(self, Correction)
+    end
   end
 
   # AbstractController::Base is a low-level API. Nobody should be
@@ -104,7 +133,7 @@ module AbstractController
       # ==== Returns
       # * <tt>String</tt>
       def controller_path
-        @controller_path ||= name.sub(/Controller$/, "").underscore unless anonymous?
+        @controller_path ||= name.delete_suffix("Controller").underscore unless anonymous?
       end
 
       # Refresh the cached action_methods when a new action_method is added.
@@ -128,7 +157,7 @@ module AbstractController
       @_action_name = action.to_s
 
       unless action_name = _find_action_name(@_action_name)
-        raise ActionNotFound, "The action '#{action}' could not be found for #{self.class.name}"
+        raise ActionNotFound.new("The action '#{action}' could not be found for #{self.class.name}", self, action)
       end
 
       @_response_body = nil
@@ -175,6 +204,10 @@ module AbstractController
       true
     end
 
+    def inspect # :nodoc:
+      "#<#{self.class.name}:#{'%#016x' % (object_id << 1)}>"
+    end
+
     private
       # Returns true if the name can be considered an action because
       # it has a method defined in the controller.

data/lib/abstract_controller/callbacks.rb

@@ -37,7 +37,7 @@ module AbstractController
 
     # Override <tt>AbstractController::Base#process_action</tt> to run the
     # <tt>process_action</tt> callbacks around the normal behavior.
-    def process_action(*args)
+    def process_action(*)
       run_callbacks(:process_action) do
         super
       end
@@ -69,7 +69,7 @@ module AbstractController
       end
 
       def _normalize_callback_option(options, from, to) # :nodoc:
-        if from = options[from]
+        if from = options.delete(from)
           _from = Array(from).map(&:to_s).to_set
           from = proc { |c| _from.include? c.action_name }
           options[to] = Array(options[to]).unshift(from)

data/lib/abstract_controller/helpers.rb

@@ -7,8 +7,19 @@ module AbstractController
     extend ActiveSupport::Concern
 
     included do
-      class_attribute :_helpers, default: Module.new
       class_attribute :_helper_methods, default: Array.new
+
+      # This is here so that it is always higher in the inheritance chain than
+      # the definition in lib/action_view/rendering.rb
+      redefine_singleton_method(:_helpers) do
+        if @_helpers ||= nil
+          @_helpers
+        else
+          superclass._helpers
+        end
+      end
+
+      self._helpers = define_helpers_module(self)
     end
 
     class MissingHelperError < LoadError
@@ -25,17 +36,24 @@ module AbstractController
       end
     end
 
+    def _helpers
+      self.class._helpers
+    end
+
     module ClassMethods
       # When a class is inherited, wrap its helper module in a new module.
       # This ensures that the parent class's module can be changed
       # independently of the child class's.
       def inherited(klass)
-        helpers = _helpers
-        klass._helpers = Module.new { include helpers }
+        # Inherited from parent by default
+        klass._helpers = nil
+
         klass.class_eval { default_helper_module! } unless klass.anonymous?
         super
       end
 
+      attr_writer :_helpers
+
       # Declare a controller method as a helper. For example, the following
       # makes the +current_user+ and +logged_in?+ controller methods available
       # to the view:
@@ -57,60 +75,81 @@ module AbstractController
       # ==== Parameters
       # * <tt>method[, method]</tt> - A name or names of a method on the controller
       #   to be made available on the view.
-      def helper_method(*meths)
-        meths.flatten!
-        self._helper_methods += meths
-
-        meths.each do |method|
-          _helpers.class_eval <<-ruby_eval, __FILE__, __LINE__ + 1
-            def #{method}(*args, &blk)                     # def current_user(*args, &blk)
-              controller.send(%(#{method}), *args, &blk)   #   controller.send(:current_user, *args, &blk)
-            end                                            # end
-            ruby2_keywords(%(#{method})) if respond_to?(:ruby2_keywords, true)
+      def helper_method(*methods)
+        methods.flatten!
+        self._helper_methods += methods
+
+        location = caller_locations(1, 1).first
+        file, line = location.path, location.lineno
+
+        methods.each do |method|
+          _helpers_for_modification.class_eval <<-ruby_eval, file, line
+            def #{method}(*args, &block)                    # def current_user(*args, &block)
+              controller.send(:'#{method}', *args, &block)  #   controller.send(:'current_user', *args, &block)
+            end                                             # end
+            ruby2_keywords(:'#{method}') if respond_to?(:ruby2_keywords, true)
           ruby_eval
         end
       end
 
-      # The +helper+ class method can take a series of helper module names, a block, or both.
+      # Includes the given modules in the template class.
+      #
+      # Modules can be specified in different ways. All of the following calls
+      # include +FooHelper+:
+      #
+      #   # Module, recommended.
+      #   helper FooHelper
+      #
+      #   # String/symbol without the "helper" suffix, camel or snake case.
+      #   helper "Foo"
+      #   helper :Foo
+      #   helper "foo"
+      #   helper :foo
+      #
+      # The last two assume that <tt>"foo".camelize</tt> returns "Foo".
       #
-      # ==== Options
-      # * <tt>*args</tt> - Module, Symbol, String
-      # * <tt>block</tt> - A block defining helper methods
+      # When strings or symbols are passed, the method finds the actual module
+      # object using +String#constantize+. Therefore, if the module has not been
+      # yet loaded, it has to be autoloadable, which is normally the case.
       #
-      # When the argument is a module it will be included directly in the template class.
-      #   helper FooHelper # => includes FooHelper
+      # Namespaces are supported. The following calls include +Foo::BarHelper+:
       #
-      # When the argument is a string or symbol, the method will provide the "_helper" suffix, require the file
-      # and include the module in the template class. The second form illustrates how to include custom helpers
-      # when working with namespaced controllers, or other cases where the file containing the helper definition is not
-      # in one of Rails' standard load paths:
-      #   helper :foo             # => requires 'foo_helper' and includes FooHelper
-      #   helper 'resources/foo'  # => requires 'resources/foo_helper' and includes Resources::FooHelper
+      #   # Module, recommended.
+      #   helper Foo::BarHelper
       #
-      # Additionally, the +helper+ class method can receive and evaluate a block, making the methods defined available
-      # to the template.
+      #   # String/symbol without the "helper" suffix, camel or snake case.
+      #   helper "Foo::Bar"
+      #   helper :"Foo::Bar"
+      #   helper "foo/bar"
+      #   helper :"foo/bar"
       #
-      #   # One line
-      #   helper { def hello() "Hello, world!" end }
+      # The last two assume that <tt>"foo/bar".camelize</tt> returns "Foo::Bar".
+      #
+      # The method accepts a block too. If present, the block is evaluated in
+      # the context of the controller helper module. This simple call makes the
+      # +wadus+ method available in templates of the enclosing controller:
       #
-      #   # Multi-line
       #   helper do
-      #     def foo(bar)
-      #       "#{bar} is the very best"
+      #     def wadus
+      #       "wadus"
       #     end
       #   end
       #
-      # Finally, all the above styles can be mixed together, and the +helper+ method can be invoked with a mix of
-      # +symbols+, +strings+, +modules+ and blocks.
+      # Furthermore, all the above styles can be mixed together:
       #
-      #   helper(:three, BlindHelper) { def mice() 'mice' end }
+      #   helper FooHelper, "woo", "bar/baz" do
+      #     def wadus
+      #       "wadus"
+      #     end
+      #   end
       #
       def helper(*args, &block)
         modules_for_helpers(args).each do |mod|
-          add_template_helper(mod)
+          next if _helpers.include?(mod)
+          _helpers_for_modification.include(mod)
         end
 
-        _helpers.module_eval(&block) if block_given?
+        _helpers_for_modification.module_eval(&block) if block_given?
       end
 
       # Clears up all existing helpers in this class, only keeping the helper
@@ -124,71 +163,47 @@ module AbstractController
         default_helper_module! unless anonymous?
       end
 
-      # Returns a list of modules, normalized from the acceptable kinds of
-      # helpers with the following behavior:
-      #
-      # String or Symbol:: :FooBar or "FooBar" becomes "foo_bar_helper",
-      # and "foo_bar_helper.rb" is loaded using require_dependency.
-      #
-      # Module:: No further processing
-      #
-      # After loading the appropriate files, the corresponding modules
-      # are returned.
-      #
-      # ==== Parameters
-      # * <tt>args</tt> - An array of helpers
-      #
-      # ==== Returns
-      # * <tt>Array</tt> - A normalized list of modules for the list of
-      #   helpers provided.
-      def modules_for_helpers(args)
-        args.flatten.map! do |arg|
-          case arg
-          when String, Symbol
-            file_name = "#{arg.to_s.underscore}_helper"
-            begin
-              require_dependency(file_name)
-            rescue LoadError => e
-              raise AbstractController::Helpers::MissingHelperError.new(e, file_name)
-            end
-
-            mod_name = file_name.camelize
-            begin
-              mod_name.constantize
-            rescue LoadError
-              # dependencies.rb gives a similar error message but its wording is
-              # not as clear because it mentions autoloading. To the user all it
-              # matters is that a helper module couldn't be loaded, autoloading
-              # is an internal mechanism that should not leak.
-              raise NameError, "Couldn't find #{mod_name}, expected it to be defined in helpers/#{file_name}.rb"
-            end
+      # Given an array of values like the ones accepted by +helper+, this method
+      # returns an array with the corresponding modules, in the same order.
+      def modules_for_helpers(modules_or_helper_prefixes)
+        modules_or_helper_prefixes.flatten.map! do |module_or_helper_prefix|
+          case module_or_helper_prefix
           when Module
-            arg
+            module_or_helper_prefix
+          when String, Symbol
+            helper_prefix = module_or_helper_prefix.to_s
+            helper_prefix = helper_prefix.camelize unless helper_prefix.start_with?(/[A-Z]/)
+            "#{helper_prefix}Helper".constantize
           else
             raise ArgumentError, "helper must be a String, Symbol, or Module"
           end
         end
       end
 
+      def _helpers_for_modification
+        unless @_helpers
+          self._helpers = define_helpers_module(self, superclass._helpers)
+        end
+        _helpers
+      end
+
       private
-        # Makes all the (instance) methods in the helper module available to templates
-        # rendered through this controller.
-        #
-        # ==== Parameters
-        # * <tt>module</tt> - The module to include into the current helper module
-        #   for the class
-        def add_template_helper(mod)
-          _helpers.module_eval { include mod }
+        def define_helpers_module(klass, helpers = nil)
+          # In some tests inherited is called explicitly. In that case, just
+          # return the module from the first time it was defined
+          return klass.const_get(:HelperMethods) if klass.const_defined?(:HelperMethods, false)
+
+          mod = Module.new
+          klass.const_set(:HelperMethods, mod)
+          mod.include(helpers) if helpers
+          mod
         end
 
         def default_helper_module!
-          module_name = name.sub(/Controller$/, "")
-          module_path = module_name.underscore
-          helper module_path
-        rescue LoadError => e
-          raise e unless e.is_missing? "helpers/#{module_path}_helper"
+          helper_prefix = name.delete_suffix("Controller")
+          helper(helper_prefix)
         rescue NameError => e
-          raise e unless e.missing_name? "#{module_name}Helper"
+          raise unless e.missing_name?("#{helper_prefix}Helper")
         end
     end
   end

data/lib/abstract_controller/rendering.rb

@@ -28,6 +28,7 @@ module AbstractController
       else
         _set_rendered_content_type rendered_format
       end
+      _set_vary_header
       self.response_body = rendered_body
     end
 
@@ -55,20 +56,16 @@ module AbstractController
       Mime[:text]
     end
 
-    DEFAULT_PROTECTED_INSTANCE_VARIABLES = Set.new %i(
-      @_action_name @_response_body @_formats @_prefixes
-    )
+    DEFAULT_PROTECTED_INSTANCE_VARIABLES = %i(@_action_name @_response_body @_formats @_prefixes)
 
     # This method should return a hash with assigns.
     # You can overwrite this configuration per controller.
     def view_assigns
-      protected_vars = _protected_ivars
-      variables      = instance_variables
+      variables = instance_variables - _protected_ivars
 
-      variables.reject! { |s| protected_vars.include? s }
-      variables.each_with_object({}) { |name, hash|
+      variables.each_with_object({}) do |name, hash|
         hash[name.slice(1, name.length)] = instance_variable_get(name)
-      }
+      end
     end
 
   private
@@ -109,6 +106,9 @@ module AbstractController
     def _set_html_content_type # :nodoc:
     end
 
+    def _set_vary_header # :nodoc:
+    end
+
     def _set_rendered_content_type(format) # :nodoc:
     end
 
@@ -120,7 +120,7 @@ module AbstractController
       options
     end
 
-    def _protected_ivars # :nodoc:
+    def _protected_ivars
       DEFAULT_PROTECTED_INSTANCE_VARIABLES
     end
   end

data/lib/abstract_controller/translation.rb

@@ -1,7 +1,11 @@
 # frozen_string_literal: true
 
+require "active_support/core_ext/symbol/starts_ends_with"
+
 module AbstractController
   module Translation
+    mattr_accessor :raise_on_missing_translations, default: false
+
     # Delegates to <tt>I18n.translate</tt>. Also aliased as <tt>t</tt>.
     #
     # When the given key starts with a period, it will be scoped by the current
@@ -11,14 +15,16 @@ module AbstractController
     # to translate many keys within the same controller / action and gives you a
     # simple framework for scoping them consistently.
     def translate(key, **options)
-      if key.to_s.first == "."
+      if key.start_with?(".")
         path = controller_path.tr("/", ".")
         defaults = [:"#{path}#{key}"]
         defaults << options[:default] if options[:default]
         options[:default] = defaults.flatten
         key = "#{path}.#{action_name}#{key}"
       end
-      I18n.translate(key, **options)
+
+      i18n_raise = options.fetch(:raise, self.raise_on_missing_translations)
+      I18n.translate(key, **options, raise: i18n_raise)
     end
     alias :t :translate
 

data/lib/abstract_controller.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "action_pack"
+require "active_support"
 require "active_support/rails"
 require "active_support/i18n"
 

data/lib/action_controller/api.rb

@@ -93,7 +93,7 @@ module ActionController
     # the ones passed as arguments:
     #
     #   class MyAPIBaseController < ActionController::Metal
-    #     ActionController::API.without_modules(:ForceSSL, :UrlFor).each do |left|
+    #     ActionController::API.without_modules(:UrlFor).each do |left|
     #       include left
     #     end
     #   end
@@ -120,9 +120,9 @@ module ActionController
       BasicImplicitRender,
       StrongParameters,
 
-      ForceSSL,
       DataStreaming,
       DefaultHeaders,
+      Logging,
 
       # Before callbacks should also be executed as early as possible, so
       # also include them at the bottom.

data/lib/action_controller/base.rb

@@ -226,13 +226,14 @@ module ActionController
       FormBuilder,
       RequestForgeryProtection,
       ContentSecurityPolicy,
-      ForceSSL,
+      FeaturePolicy,
       Streaming,
       DataStreaming,
       HttpAuthentication::Basic::ControllerMethods,
       HttpAuthentication::Digest::ControllerMethods,
       HttpAuthentication::Token::ControllerMethods,
       DefaultHeaders,
+      Logging,
 
       # Before callbacks should also be executed as early as possible, so
       # also include them at the bottom.
@@ -261,9 +262,10 @@ module ActionController
       @_view_renderer @_lookup_context @_routes @_view_runtime @_db_runtime @_helper_proxy
     )
 
-    def _protected_ivars # :nodoc:
+    def _protected_ivars
       PROTECTED_IVARS
     end
+    private :_protected_ivars
 
     ActiveSupport.run_load_hooks(:action_controller_base, self)
     ActiveSupport.run_load_hooks(:action_controller, self)

data/lib/action_controller/caching.rb

@@ -22,7 +22,6 @@ module ActionController
   #   config.action_controller.cache_store = :mem_cache_store, Memcached::Rails.new('localhost:11211')
   #   config.action_controller.cache_store = MyOwnStore.new('parameter')
   module Caching
-    extend ActiveSupport::Autoload
     extend ActiveSupport::Concern
 
     included do

data/lib/action_controller/log_subscriber.rb

@@ -11,6 +11,7 @@ module ActionController
       params  = payload[:params].except(*INTERNAL_PARAMS)
       format  = payload[:format]
       format  = format.to_s.upcase if format.is_a?(Symbol)
+      format  = "*/*" if format.nil?
 
       info "Processing by #{payload[:controller]}##{payload[:action]} as #{format}"
       info "  Parameters: #{params.inspect}" unless params.empty?
@@ -22,15 +23,14 @@ module ActionController
         additions = ActionController::Base.log_process_action(payload)
         status = payload[:status]
 
-        if status.nil? && payload[:exception].present?
-          exception_class_name = payload[:exception].first
+        if status.nil? && (exception_class_name = payload[:exception].first)
           status = ActionDispatch::ExceptionWrapper.status_code_for_exception(exception_class_name)
         end
 
         additions << "Allocations: #{event.allocations}"
 
         message = +"Completed #{status} #{Rack::Utils::HTTP_STATUS_CODES[status]} in #{event.duration.round}ms"
-        message << " (#{additions.join(" | ")})" unless additions.empty?
+        message << " (#{additions.join(" | ")})"
         message << "\n\n" if defined?(Rails.env) && Rails.env.development?
 
         message

data/lib/action_controller/metal/conditional_get.rb

@@ -1,5 +1,8 @@
 # frozen_string_literal: true
 
+require "active_support/core_ext/object/try"
+require "active_support/core_ext/integer/time"
+
 module ActionController
   module ConditionalGet
     extend ActiveSupport::Concern
@@ -17,12 +20,12 @@ module ActionController
       # of cached pages.
       #
       #   class InvoicesController < ApplicationController
-      #     etag { current_user.try :id }
+      #     etag { current_user&.id }
       #
       #     def show
       #       # Etag will differ even for the same invoice when it's viewed by a different current_user
       #       @invoice = Invoice.find(params[:id])
-      #       fresh_when(@invoice)
+      #       fresh_when etag: @invoice
       #     end
       #   end
       def etag(&etagger)
@@ -234,6 +237,11 @@ module ActionController
     #   expires_in 3.hours, public: true, stale_while_revalidate: 60.seconds
     #   expires_in 3.hours, public: true, stale_while_revalidate: 60.seconds, stale_if_error: 5.minutes
     #
+    # HTTP Cache-Control Extensions other values: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control
+    # Any additional key-value pairs are concatenated onto the `Cache-Control` header in the response:
+    #
+    #   expires_in 3.hours, public: true, "s-maxage": 3.hours, "no-transform": true
+    #
     # The method will also ensure an HTTP Date header for client compatibility.
     def expires_in(seconds, options = {})
       response.cache_control.merge!(

data/lib/action_controller/metal/content_security_policy.rb

@@ -45,7 +45,7 @@ module ActionController #:nodoc:
       end
 
       def current_content_security_policy
-        request.content_security_policy.try(:clone) || ActionDispatch::ContentSecurityPolicy.new
+        request.content_security_policy&.clone || ActionDispatch::ContentSecurityPolicy.new
       end
   end
 end

data/lib/action_controller/metal/data_streaming.rb

@@ -53,7 +53,7 @@ module ActionController #:nodoc:
       #
       # Show a 404 page in the browser:
       #
-      #   send_file '/path/to/404.html', type: 'text/html; charset=utf-8', status: 404
+      #   send_file '/path/to/404.html', type: 'text/html; charset=utf-8', disposition: 'inline', status: 404
       #
       # Read about the other Content-* HTTP headers if you'd like to
       # provide the user with more information (such as Content-Description) in

data/lib/action_controller/metal/etag_with_template_digest.rb

@@ -26,10 +26,8 @@ module ActionController
     included do
       class_attribute :etag_with_template_digest, default: true
 
-      ActiveSupport.on_load :action_view, yield: true do
-        etag do |options|
-          determine_template_etag(options) if etag_with_template_digest
-        end
+      etag do |options|
+        determine_template_etag(options) if etag_with_template_digest
       end
     end
 

data/lib/action_controller/metal/exceptions.rb

@@ -23,6 +23,39 @@ module ActionController
   end
 
   class UrlGenerationError < ActionControllerError #:nodoc:
+    attr_reader :routes, :route_name, :method_name
+
+    def initialize(message, routes = nil, route_name = nil, method_name = nil)
+      @routes      = routes
+      @route_name  = route_name
+      @method_name = method_name
+
+      super(message)
+    end
+
+    class Correction
+      def initialize(error)
+        @error = error
+      end
+
+      def corrections
+        if @error.method_name
+          maybe_these = @error.routes.named_routes.helper_names.grep(/#{@error.route_name}/)
+          maybe_these -= [@error.method_name.to_s] # remove exact match
+
+          maybe_these.sort_by { |n|
+            DidYouMean::Jaro.distance(@error.route_name, n)
+          }.reverse.first(4)
+        else
+          []
+        end
+      end
+    end
+
+    # We may not have DYM, and DYM might not let us register error handlers
+    if defined?(DidYouMean) && DidYouMean.respond_to?(:correct_error)
+      DidYouMean.correct_error(self, Correction)
+    end
   end
 
   class MethodNotAllowed < ActionControllerError #:nodoc: