actionpack 7.0.5 → 7.1.3.4

data/MIT-LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2004-2022 David Heinemeier Hansson
+Copyright (c) David Heinemeier Hansson
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

data/README.rdoc

@@ -16,11 +16,11 @@ It consists of several modules:
   subclassed to implement filters and actions to handle requests. The result
   of an action is typically content generated from views.
 
-With the Ruby on Rails framework, users only directly interface with the
+With the Ruby on \Rails framework, users only directly interface with the
 Action Controller module. Necessary Action Dispatch functionality is activated
 by default and Action View rendering is implicitly triggered by Action
 Controller. However, these modules are designed to function on their own and
-can be used outside of Rails.
+can be used outside of \Rails.
 
 You can read more about Action Pack in the {Action Controller Overview}[https://guides.rubyonrails.org/action_controller_overview.html] guide.
 
@@ -30,7 +30,7 @@ The latest version of Action Pack can be installed with RubyGems:
 
   $ gem install actionpack
 
-Source code can be downloaded as part of the Rails project on GitHub:
+Source code can be downloaded as part of the \Rails project on GitHub:
 
 * https://github.com/rails/rails/tree/main/actionpack
 
@@ -48,7 +48,7 @@ API documentation is at:
 
 * https://api.rubyonrails.org
 
-Bug reports for the Ruby on Rails project can be filed here:
+Bug reports for the Ruby on \Rails project can be filed here:
 
 * https://github.com/rails/rails/issues
 

data/lib/abstract_controller/base.rb

@@ -26,6 +26,8 @@ module AbstractController
     end
   end
 
+  # = Abstract Controller \Base
+  #
   # AbstractController::Base is a low-level API. Nobody should be
   # using it directly, and subclasses (like ActionController::Base) are
   # expected to provide their own +render+ method, since rendering means
@@ -70,12 +72,17 @@ module AbstractController
       # instance methods on that abstract class. Public instance methods of
       # a controller would normally be considered action methods, so methods
       # declared on abstract classes are being removed.
-      # (<tt>ActionController::Metal</tt> and ActionController::Base are defined as abstract)
+      # (ActionController::Metal and ActionController::Base are defined as abstract)
       def internal_methods
         controller = self
+        methods = []
 
-        controller = controller.superclass until controller.abstract?
-        controller.public_instance_methods(true)
+        until controller.abstract?
+          methods += controller.public_instance_methods(false)
+          controller = controller.superclass
+        end
+
+        controller.public_instance_methods(true) - methods
       end
 
       # A list of method names that should be considered actions. This
@@ -89,14 +96,11 @@ module AbstractController
       def action_methods
         @action_methods ||= begin
           # All public instance methods of this class, including ancestors
-          methods = (public_instance_methods(true) -
-            # Except for public instance methods of Base and its ancestors
-            internal_methods +
-            # Be sure to include shadowed public instance methods of this class
-            public_instance_methods(false))
-
+          # except for public instance methods of Base and its ancestors.
+          methods = public_instance_methods(true) - internal_methods
+          # Be sure to include shadowed public instance methods of this class.
+          methods.concat(public_instance_methods(false))
           methods.map!(&:to_s)
-
           methods.to_set
         end
       end
@@ -127,11 +131,16 @@ module AbstractController
         super
         clear_action_methods!
       end
+
+      def eager_load! # :nodoc:
+        action_methods
+        nil
+      end
     end
 
     abstract!
 
-    # Calls the action going through the entire action dispatch stack.
+    # Calls the action going through the entire Action Dispatch stack.
     #
     # The actual method that is called is determined by calling
     # #method_for_action. If no method can handle the action, then an

data/lib/abstract_controller/caching/fragments.rb

@@ -2,6 +2,8 @@
 
 module AbstractController
   module Caching
+    # = Abstract Controller Caching \Fragments
+    #
     # Fragment caching is used for caching various blocks within
     # views without caching the entire action as a whole. This is
     # useful when certain elements of an action change frequently or

data/lib/abstract_controller/callbacks.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module AbstractController
-  # = Abstract Controller Callbacks
+  # = Abstract Controller \Callbacks
   #
   # Abstract Controller provides hooks during the life cycle of a controller action.
   # Callbacks allow you to trigger logic during this cycle. Available callbacks are:
@@ -33,14 +33,36 @@ module AbstractController
       define_callbacks :process_action,
                        terminator: ->(controller, result_lambda) { result_lambda.call; controller.performed? },
                        skip_after_callbacks_if_terminated: true
+      mattr_accessor :raise_on_missing_callback_actions, default: false
     end
 
     class ActionFilter # :nodoc:
-      def initialize(actions)
+      def initialize(filters, conditional_key, actions)
+        @filters = filters.to_a
+        @conditional_key = conditional_key
         @actions = Array(actions).map(&:to_s).to_set
       end
 
       def match?(controller)
+        if controller.raise_on_missing_callback_actions
+          missing_action = @actions.find { |action| !controller.available_action?(action) }
+          if missing_action
+            filter_names = @filters.length == 1 ? @filters.first.inspect : @filters.inspect
+
+            message = <<~MSG
+              The #{missing_action} action could not be found for the #{filter_names}
+              callback on #{controller.class.name}, but it is listed in the controller's
+              #{@conditional_key.inspect} option.
+
+              Raising for missing callback actions is a new default in Rails 7.1, if you'd
+              like to turn this off you can delete the option from the environment configurations
+              or set `config.action_controller.raise_on_missing_callback_actions` to `false`.
+            MSG
+
+            raise ActionNotFound.new(message, controller, missing_action)
+          end
+        end
+
         @actions.include?(controller.action_name)
       end
 
@@ -75,9 +97,10 @@ module AbstractController
       end
 
       def _normalize_callback_option(options, from, to) # :nodoc:
-        if from = options.delete(from)
-          from = ActionFilter.new(from)
-          options[to] = Array(options[to]).unshift(from)
+        if from_value = options.delete(from)
+          filters = options[:filters]
+          from_value = ActionFilter.new(filters, from, from_value)
+          options[to] = Array(options[to]).unshift(from_value)
         end
       end
 
@@ -95,8 +118,10 @@ module AbstractController
       # * <tt>options</tt>  - A hash of options to be used when adding the callback.
       def _insert_callbacks(callbacks, block = nil)
         options = callbacks.extract_options!
-        _normalize_callback_options(options)
         callbacks.push(block) if block
+        options[:filters] = callbacks
+        _normalize_callback_options(options)
+        options.delete(:filters)
         callbacks.each do |callback|
           yield callback, options
         end

data/lib/abstract_controller/deprecator.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module AbstractController
+  def self.deprecator # :nodoc:
+    @deprecator ||= ActiveSupport::Deprecation.new
+  end
+end

data/lib/abstract_controller/helpers.rb

@@ -5,6 +5,7 @@ require "active_support/core_ext/name_error"
 
 module AbstractController
   module Helpers
+    include ActiveSupport::Deprecation::DeprecatedConstantAccessor
     extend ActiveSupport::Concern
 
     included do
@@ -23,7 +24,7 @@ module AbstractController
       self._helpers = define_helpers_module(self)
     end
 
-    class MissingHelperError < LoadError
+    class DeprecatedMissingHelperError < LoadError
       def initialize(error, path)
         @error = error
         @path  = "helpers/#{path}.rb"
@@ -36,11 +37,46 @@ module AbstractController
         end
       end
     end
+    deprecate_constant "MissingHelperError", "AbstractController::Helpers::DeprecatedMissingHelperError",
+      message: "AbstractController::Helpers::MissingHelperError has been deprecated. If a Helper is not present, a NameError will be raised instead.",
+      deprecator: AbstractController.deprecator
 
     def _helpers
       self.class._helpers
     end
 
+    module Resolution # :nodoc:
+      def modules_for_helpers(modules_or_helper_prefixes)
+        modules_or_helper_prefixes.flatten.map! do |module_or_helper_prefix|
+          case module_or_helper_prefix
+          when Module
+            module_or_helper_prefix
+          when String, Symbol
+            helper_prefix = module_or_helper_prefix.to_s
+            helper_prefix = helper_prefix.camelize unless helper_prefix.start_with?(/[A-Z]/)
+            "#{helper_prefix}Helper".constantize
+          else
+            raise ArgumentError, "helper must be a String, Symbol, or Module"
+          end
+        end
+      end
+
+      def all_helpers_from_path(path)
+        helpers = Array(path).flat_map do |_path|
+          names = Dir["#{_path}/**/*_helper.rb"].map { |file| file[_path.to_s.size + 1..-"_helper.rb".size - 1] }
+          names.sort!
+        end
+        helpers.uniq!
+        helpers
+      end
+
+      def helper_modules_from_paths(paths)
+        modules_for_helpers(all_helpers_from_path(paths))
+      end
+    end
+
+    extend Resolution
+
     module ClassMethods
       # When a class is inherited, wrap its helper module in a new module.
       # This ensures that the parent class's module can be changed
@@ -55,6 +91,30 @@ module AbstractController
 
       attr_writer :_helpers
 
+      include Resolution
+
+      ##
+      # :method: modules_for_helpers
+      # :call-seq: modules_for_helpers(modules_or_helper_prefixes)
+      #
+      # Given an array of values like the ones accepted by +helper+, this method
+      # returns an array with the corresponding modules, in the same order.
+      #
+      #--
+      # Implemented by Resolution#modules_for_helpers.
+
+      ##
+      # :method: all_helpers_from_path
+      # :call-seq: all_helpers_from_path(path)
+      #
+      # Returns a list of helper names in a given path.
+      #
+      #   ActionController::Base.all_helpers_from_path 'app/helpers'
+      #   # => ["application", "chart", "rubygems"]
+      #
+      #--
+      # Implemented by Resolution#all_helpers_from_path.
+
       # Declare a controller method as a helper. For example, the following
       # makes the +current_user+ and +logged_in?+ controller methods available
       # to the view:
@@ -85,10 +145,13 @@ module AbstractController
         file, line = location.path, location.lineno
 
         methods.each do |method|
-          _helpers_for_modification.class_eval <<~ruby_eval, file, line
-            def #{method}(*args, &block)                    # def current_user(*args, &block)
-              controller.send(:'#{method}', *args, &block)  #   controller.send(:'current_user', *args, &block)
-            end                                             # end
+          # def current_user(*args, &block)
+          #   controller.send(:'current_user', *args, &block)
+          # end
+          _helpers_for_modification.class_eval <<~ruby_eval.lines.map(&:strip).join(";"), file, line
+            def #{method}(*args, &block)
+              controller.send(:'#{method}', *args, &block)
+            end
             ruby2_keywords(:'#{method}')
           ruby_eval
         end
@@ -165,23 +228,6 @@ module AbstractController
         default_helper_module! unless anonymous?
       end
 
-      # Given an array of values like the ones accepted by +helper+, this method
-      # returns an array with the corresponding modules, in the same order.
-      def modules_for_helpers(modules_or_helper_prefixes)
-        modules_or_helper_prefixes.flatten.map! do |module_or_helper_prefix|
-          case module_or_helper_prefix
-          when Module
-            module_or_helper_prefix
-          when String, Symbol
-            helper_prefix = module_or_helper_prefix.to_s
-            helper_prefix = helper_prefix.camelize unless helper_prefix.start_with?(/[A-Z]/)
-            "#{helper_prefix}Helper".constantize
-          else
-            raise ArgumentError, "helper must be a String, Symbol, or Module"
-          end
-        end
-      end
-
       def _helpers_for_modification
         unless @_helpers
           self._helpers = define_helpers_module(self, superclass._helpers)

data/lib/abstract_controller/railties/routes_helpers.rb

@@ -10,26 +10,11 @@ module AbstractController
           define_method(:inherited) do |klass|
             super(klass)
 
-            namespace = klass.module_parents.detect { |m| m.respond_to?(:railtie_routes_url_helpers) }
-            actual_routes = namespace ? namespace.railtie_routes_url_helpers._routes : routes
-
-            if namespace
+            if namespace = klass.module_parents.detect { |m| m.respond_to?(:railtie_routes_url_helpers) }
               klass.include(namespace.railtie_routes_url_helpers(include_path_helpers))
             else
               klass.include(routes.url_helpers(include_path_helpers))
             end
-
-            # In the case that we have ex.
-            #   class A::Foo < ApplicationController
-            #   class Bar < A::Foo
-            # We will need to redefine _routes because it will not be correct
-            # via inheritance.
-            unless klass._routes.equal?(actual_routes)
-              klass.redefine_singleton_method(:_routes) { actual_routes }
-              klass.include(Module.new do
-                define_method(:_routes) { @_routes || actual_routes }
-              end)
-            end
           end
         end
       end

data/lib/abstract_controller/rendering.rb

@@ -7,7 +7,7 @@ require "set"
 
 module AbstractController
   class DoubleRenderError < Error
-    DEFAULT_MESSAGE = "Render and/or redirect were called multiple times in this action. Please note that you may only call render OR redirect, and at most once per action. Also note that neither redirect nor render terminate execution of the action, so if you want to exit an action after redirecting, you need to do something like \"redirect_to(...) and return\"."
+    DEFAULT_MESSAGE = "Render and/or redirect were called multiple times in this action. Please note that you may only call render OR redirect, and at most once per action. Also note that neither redirect nor render terminate execution of the action, so if you want to exit an action after redirecting, you need to do something like \"redirect_to(...); return\"."
 
     def initialize(message = nil)
       super(message || DEFAULT_MESSAGE)
@@ -68,8 +68,8 @@ module AbstractController
 
   private
     # Normalize args by converting <tt>render "foo"</tt> to
-    # <tt>render :action => "foo"</tt> and <tt>render "foo/bar"</tt> to
-    # <tt>render :file => "foo/bar"</tt>.
+    # <tt>render action: "foo"</tt> and <tt>render "foo/bar"</tt> to
+    # <tt>render file: "foo/bar"</tt>.
     def _normalize_args(action = nil, options = {}) # :doc:
       if action.respond_to?(:permitted?)
         if action.permitted?

data/lib/abstract_controller/translation.rb

@@ -4,9 +4,7 @@ require "active_support/html_safe_translation"
 
 module AbstractController
   module Translation
-    mattr_accessor :raise_on_missing_translations, default: false
-
-    # Delegates to <tt>I18n.translate</tt>. Also aliased as <tt>t</tt>.
+    # Delegates to <tt>I18n.translate</tt>.
     #
     # When the given key starts with a period, it will be scoped by the current
     # controller and action. So if you call <tt>translate(".foo")</tt> from
@@ -23,13 +21,18 @@ module AbstractController
         key = "#{path}.#{action_name}#{key}"
       end
 
-      i18n_raise = options.fetch(:raise, self.raise_on_missing_translations)
+      if options[:default]
+        options[:default] = [options[:default]] unless options[:default].is_a?(Array)
+        options[:default] = options[:default].map do |value|
+          value.is_a?(String) ? ERB::Util.html_escape(value) : value
+        end
+      end
 
-      ActiveSupport::HtmlSafeTranslation.translate(key, **options, raise: i18n_raise)
+      ActiveSupport::HtmlSafeTranslation.translate(key, **options)
     end
     alias :t :translate
 
-    # Delegates to <tt>I18n.localize</tt>. Also aliased as <tt>l</tt>.
+    # Delegates to <tt>I18n.localize</tt>.
     def localize(object, **options)
       I18n.localize(object, **options)
     end

data/lib/abstract_controller/url_for.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 module AbstractController
+  # = URL For
+  #
   # Includes +url_for+ into the host class (e.g. an abstract controller or mailer). The class
   # has to provide a +RouteSet+ by implementing the <tt>_routes</tt> methods. Otherwise, an
   # exception will be raised.

data/lib/abstract_controller.rb

@@ -4,6 +4,7 @@ require "action_pack"
 require "active_support"
 require "active_support/rails"
 require "active_support/i18n"
+require "abstract_controller/deprecator"
 
 module AbstractController
   extend ActiveSupport::Autoload
@@ -24,5 +25,10 @@ module AbstractController
   def self.eager_load!
     super
     AbstractController::Caching.eager_load!
+    AbstractController::Base.descendants.each do |controller|
+      unless controller.abstract?
+        controller.eager_load!
+      end
+    end
   end
 end

data/lib/action_controller/api.rb

@@ -5,6 +5,8 @@ require "action_controller"
 require "action_controller/log_subscriber"
 
 module ActionController
+  # = Action Controller \API
+  #
   # API Controller is a lightweight version of ActionController::Base,
   # created for applications that don't require all functionalities that a complete
   # \Rails controller provides, allowing you to create controllers with just the
@@ -19,7 +21,7 @@ module ActionController
   # your application, they're just not part of the default API controller stack.
   #
   # Normally, +ApplicationController+ is the only controller that inherits from
-  # <tt>ActionController::API</tt>. All other controllers in turn inherit from
+  # +ActionController::API+. All other controllers in turn inherit from
   # +ApplicationController+.
   #
   # A sample controller could look like this:
@@ -62,7 +64,7 @@ module ActionController
   #
   # In some scenarios you may want to add back some functionality provided by
   # ActionController::Base that is not present by default in
-  # <tt>ActionController::API</tt>, for instance <tt>MimeResponds</tt>. This
+  # +ActionController::API+, for instance <tt>MimeResponds</tt>. This
   # module gives you the <tt>respond_to</tt> method. Adding it is quite simple,
   # you just need to include the module in a specific controller or in
   # +ApplicationController+ in case you want it available in your entire
@@ -85,7 +87,7 @@ module ActionController
   #
   # Make sure to check the modules included in ActionController::Base
   # if you want to use any other functionality that is not provided
-  # by <tt>ActionController::API</tt> out of the box.
+  # by +ActionController::API+ out of the box.
   class API < Metal
     abstract!
 

data/lib/action_controller/base.rb

@@ -5,11 +5,13 @@ require "action_controller/log_subscriber"
 require "action_controller/metal/params_wrapper"
 
 module ActionController
+  # = Action Controller \Base
+  #
   # Action Controllers are the core of a web request in \Rails. They are made up of one or more actions that are executed
   # on request and then either it renders a template or redirects to another action. An action is defined as a public method
   # on the controller, which will automatically be made accessible to the web-server through \Rails Routes.
   #
-  # By default, only the ApplicationController in a \Rails application inherits from <tt>ActionController::Base</tt>. All other
+  # By default, only the ApplicationController in a \Rails application inherits from +ActionController::Base+. All other
   # controllers inherit from ApplicationController. This gives you one class to configure things such as
   # request forgery protection and filtering of sensitive request parameters.
   #
@@ -167,22 +169,6 @@ module ActionController
   class Base < Metal
     abstract!
 
-    # We document the request and response methods here because albeit they are
-    # implemented in ActionController::Metal, the type of the returned objects
-    # is unknown at that level.
-
-    ##
-    # :method: request
-    #
-    # Returns an ActionDispatch::Request instance that represents the
-    # current request.
-
-    ##
-    # :method: response
-    #
-    # Returns an ActionDispatch::Response that represents the current
-    # response.
-
     # Shortcut helper that returns all the modules included in
     # ActionController::Base except the ones passed as arguments:
     #

data/lib/action_controller/caching.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 module ActionController
+  # = Action Controller \Caching
+  #
   # \Caching is a cheap way of speeding up slow applications by keeping the result of
   # calculations, renderings, and database calls around for subsequent requests.
   #

data/lib/action_controller/deprecator.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module ActionController
+  def self.deprecator # :nodoc:
+    AbstractController.deprecator
+  end
+end

data/lib/action_controller/form_builder.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 module ActionController
+  # = Action Controller Form Builder
+  #
   # Override the default form builder for all views rendered by this
   # controller and any of its descendants. Accepts a subclass of
   # ActionView::Helpers::FormBuilder.

data/lib/action_controller/log_subscriber.rb

@@ -8,7 +8,10 @@ module ActionController
       return unless logger.info?
 
       payload = event.payload
-      params  = payload[:params].except(*INTERNAL_PARAMS)
+      params = {}
+      payload[:params].each_pair do |k, v|
+        params[k] = v unless INTERNAL_PARAMS.include?(k)
+      end
       format  = payload[:format]
       format  = format.to_s.upcase if format.is_a?(Symbol)
       format  = "*/*" if format.nil?
@@ -16,6 +19,7 @@ module ActionController
       info "Processing by #{payload[:controller]}##{payload[:action]} as #{format}"
       info "  Parameters: #{params.inspect}" unless params.empty?
     end
+    subscribe_log_level :start_processing, :info
 
     def process_action(event)
       info do
@@ -29,29 +33,34 @@ module ActionController
 
         additions << "Allocations: #{event.allocations}"
 
-        message = +"Completed #{status} #{Rack::Utils::HTTP_STATUS_CODES[status]} in #{event.duration.round}ms"
-        message << " (#{additions.join(" | ")})"
+        message = +"Completed #{status} #{Rack::Utils::HTTP_STATUS_CODES[status]} in #{event.duration.round}ms" \
+                   " (#{additions.join(" | ")})"
         message << "\n\n" if defined?(Rails.env) && Rails.env.development?
 
         message
       end
     end
+    subscribe_log_level :process_action, :info
 
     def halted_callback(event)
       info { "Filter chain halted as #{event.payload[:filter].inspect} rendered or redirected" }
     end
+    subscribe_log_level :halted_callback, :info
 
     def send_file(event)
       info { "Sent file #{event.payload[:path]} (#{event.duration.round(1)}ms)" }
     end
+    subscribe_log_level :send_file, :info
 
     def redirect_to(event)
       info { "Redirected to #{event.payload[:location]}" }
     end
+    subscribe_log_level :redirect_to, :info
 
     def send_data(event)
       info { "Sent data #{event.payload[:filename]} (#{event.duration.round(1)}ms)" }
     end
+    subscribe_log_level :send_data, :info
 
     def unpermitted_parameters(event)
       debug do
@@ -61,15 +70,18 @@ module ActionController
         color("Unpermitted parameter#{'s' if unpermitted_keys.size > 1}: #{display_unpermitted_keys}. Context: { #{context} }", RED)
       end
     end
+    subscribe_log_level :unpermitted_parameters, :debug
 
     %w(write_fragment read_fragment exist_fragment? expire_fragment).each do |method|
       class_eval <<-METHOD, __FILE__, __LINE__ + 1
+        # frozen_string_literal: true
         def #{method}(event)
-          return unless logger.info? && ActionController::Base.enable_fragment_cache_logging
+          return unless ActionController::Base.enable_fragment_cache_logging
           key         = ActiveSupport::Cache.expand_cache_key(event.payload[:key] || event.payload[:path])
           human_name  = #{method.to_s.humanize.inspect}
           info("\#{human_name} \#{key} (\#{event.duration.round(1)}ms)")
         end
+        subscribe_log_level :#{method}, :info
       METHOD
     end
 

data/lib/action_controller/metal/content_security_policy.rb

@@ -40,7 +40,7 @@ module ActionController # :nodoc:
         before_action(options) do
           if block_given?
             policy = current_content_security_policy
-            yield policy
+            instance_exec(policy, &block)
             request.content_security_policy = policy
           end
 

data/lib/action_controller/metal/data_streaming.rb

@@ -4,6 +4,8 @@ require "action_controller/metal/exceptions"
 require "action_dispatch/http/content_disposition"
 
 module ActionController # :nodoc:
+  # = Action Controller Data \Streaming
+  #
   # Methods for sending arbitrary data and for streaming files to the browser,
   # instead of rendering.
   module DataStreaming

data/lib/action_controller/metal/default_headers.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 module ActionController
+  # = Action Controller Default Headers
+  #
   # Allows configuring default headers that will be automatically merged into
   # each response.
   module DefaultHeaders

data/lib/action_controller/metal/etag_with_flash.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 module ActionController
+  # = Action Controller Etag With \Flash
+  #
   # When you're using the flash, it's generally used as a conditional on the view.
   # This means the content of the view depends on the flash. Which in turn means
   # that the ETag for a response should be computed with the content of the flash