activerecord 6.0.0 → 7.2.3

data/lib/active_record/token_for.rb

@@ -0,0 +1,123 @@
+# frozen_string_literal: true
+
+require "active_support/core_ext/object/json"
+
+module ActiveRecord
+  module TokenFor
+    extend ActiveSupport::Concern
+
+    included do
+      class_attribute :token_definitions, instance_accessor: false, instance_predicate: false, default: {}
+      class_attribute :generated_token_verifier, instance_accessor: false, instance_predicate: false
+    end
+
+    TokenDefinition = Struct.new(:defining_class, :purpose, :expires_in, :block) do # :nodoc:
+      def full_purpose
+        @full_purpose ||= [defining_class.name, purpose, expires_in].join("\n")
+      end
+
+      def message_verifier
+        defining_class.generated_token_verifier
+      end
+
+      def payload_for(model)
+        block ? [model.id, model.instance_eval(&block).as_json] : [model.id]
+      end
+
+      def generate_token(model)
+        message_verifier.generate(payload_for(model), expires_in: expires_in, purpose: full_purpose)
+      end
+
+      def resolve_token(token)
+        payload = message_verifier.verified(token, purpose: full_purpose)
+        model = yield(payload[0]) if payload
+        model if model && payload_for(model) == payload
+      end
+    end
+
+    module RelationMethods
+      # Finds a record using a given +token+ for a predefined +purpose+. Returns
+      # +nil+ if the token is invalid or the record was not found.
+      def find_by_token_for(purpose, token)
+        raise UnknownPrimaryKey.new(self) unless model.primary_key
+        model.token_definitions.fetch(purpose).resolve_token(token) { |id| find_by(model.primary_key => id) }
+      end
+
+      # Finds a record using a given +token+ for a predefined +purpose+. Raises
+      # ActiveSupport::MessageVerifier::InvalidSignature if the token is invalid
+      # (e.g. expired, bad format, etc). Raises ActiveRecord::RecordNotFound if
+      # the token is valid but the record was not found.
+      def find_by_token_for!(purpose, token)
+        model.token_definitions.fetch(purpose).resolve_token(token) { |id| find(id) } ||
+          (raise ActiveSupport::MessageVerifier::InvalidSignature)
+      end
+    end
+
+    module ClassMethods
+      # Defines the behavior of tokens generated for a specific +purpose+.
+      # A token can be generated by calling TokenFor#generate_token_for on a
+      # record. Later, that record can be fetched by calling #find_by_token_for
+      # (or #find_by_token_for!) with the same purpose and token.
+      #
+      # Tokens are signed so that they are tamper-proof. Thus they can be
+      # exposed to outside world as, for example, password reset tokens.
+      #
+      # By default, tokens do not expire. They can be configured to expire by
+      # specifying a duration via the +expires_in+ option. The duration becomes
+      # part of the token's signature, so changing the value of +expires_in+
+      # will automatically invalidate previously generated tokens.
+      #
+      # A block may also be specified. When generating a token with
+      # TokenFor#generate_token_for, the block will be evaluated in the context
+      # of the record, and its return value will be embedded in the token as
+      # JSON. Later, when fetching the record with #find_by_token_for, the block
+      # will be evaluated again in the context of the fetched record. If the two
+      # JSON values do not match, the token will be treated as invalid. Note
+      # that the value returned by the block <b>should not contain sensitive
+      # information</b> because it will be embedded in the token as
+      # <b>human-readable plaintext JSON</b>.
+      #
+      # ==== Examples
+      #
+      #   class User < ActiveRecord::Base
+      #     has_secure_password
+      #
+      #     generates_token_for :password_reset, expires_in: 15.minutes do
+      #       # Last 10 characters of password salt, which changes when password is updated:
+      #       password_salt&.last(10)
+      #     end
+      #   end
+      #
+      #   user = User.first
+      #
+      #   token = user.generate_token_for(:password_reset)
+      #   User.find_by_token_for(:password_reset, token) # => user
+      #   # 16 minutes later...
+      #   User.find_by_token_for(:password_reset, token) # => nil
+      #
+      #   token = user.generate_token_for(:password_reset)
+      #   User.find_by_token_for(:password_reset, token) # => user
+      #   user.update!(password: "new password")
+      #   User.find_by_token_for(:password_reset, token) # => nil
+      def generates_token_for(purpose, expires_in: nil, &block)
+        self.token_definitions = token_definitions.merge(purpose => TokenDefinition.new(self, purpose, expires_in, block))
+      end
+
+      def find_by_token_for(purpose, token) # :nodoc:
+        all.find_by_token_for(purpose, token)
+      end
+
+      def find_by_token_for!(purpose, token) # :nodoc:
+        all.find_by_token_for!(purpose, token)
+      end
+    end
+
+    # Generates a token for a predefined +purpose+.
+    #
+    # Use ClassMethods#generates_token_for to define a token purpose and
+    # behavior.
+    def generate_token_for(purpose)
+      self.class.token_definitions.fetch(purpose).generate_token(self)
+    end
+  end
+end

data/lib/active_record/touch_later.rb

@@ -3,22 +3,20 @@
 module ActiveRecord
   # = Active Record Touch Later
   module TouchLater # :nodoc:
-    extend ActiveSupport::Concern
-
-    included do
-      before_commit_without_transaction_enrollment :touch_deferred_attributes
+    def before_committed!
+      touch_deferred_attributes if has_defer_touch_attrs? && persisted?
+      super
     end
 
     def touch_later(*names) # :nodoc:
-      unless persisted?
-        raise ActiveRecordError, <<-MSG.squish
-          cannot touch on a new or destroyed record object. Consider using
-          persisted?, new_record?, or destroyed? before touching
-        MSG
-      end
+      _raise_record_not_touched_error unless persisted?
 
       @_defer_touch_attrs ||= timestamp_attributes_for_update_in_model
-      @_defer_touch_attrs |= names
+      @_defer_touch_attrs |= names.map! do |name|
+        name = name.to_s
+        self.class.attribute_aliases[name] || name
+      end unless names.empty?
+
       @_touch_time = current_time_from_proper_timezone
 
       surreptitiously_touch @_defer_touch_attrs
@@ -26,9 +24,13 @@ module ActiveRecord
       @_new_record_before_last_commit ||= false
 
       # touch the parents as we are not calling the after_save callbacks
-      self.class.reflect_on_all_associations(:belongs_to).each do |r|
+      self.class.reflect_on_all_associations.each do |r|
         if touch = r.options[:touch]
-          ActiveRecord::Associations::Builder::BelongsTo.touch_record(self, changes_to_save, r.foreign_key, r.name, touch, :touch_later)
+          if r.macro == :belongs_to
+            ActiveRecord::Associations::Builder::BelongsTo.touch_record(self, changes_to_save, r.foreign_key, r.name, touch)
+          elsif r.macro == :has_one
+            ActiveRecord::Associations::Builder::HasOne.touch_record(self, r.name, touch)
+          end
         end
       end
     end
@@ -36,31 +38,33 @@ module ActiveRecord
     def touch(*names, time: nil) # :nodoc:
       if has_defer_touch_attrs?
         names |= @_defer_touch_attrs
+        super(*names, time: time)
+        @_defer_touch_attrs, @_touch_time = nil, nil
+      else
+        super
       end
-      super(*names, time: time)
     end
 
     private
-
-      def surreptitiously_touch(attrs)
-        attrs.each { |attr| write_attribute attr, @_touch_time }
-        clear_attribute_changes attrs
+      def init_internals
+        super
+        @_defer_touch_attrs = nil
       end
 
-      def touch_deferred_attributes
-        if has_defer_touch_attrs? && persisted?
-          @_skip_dirty_tracking = true
-          touch(*@_defer_touch_attrs, time: @_touch_time)
-          @_defer_touch_attrs, @_touch_time = nil, nil
+      def surreptitiously_touch(attr_names)
+        attr_names.each do |attr_name|
+          _write_attribute(attr_name, @_touch_time)
+          clear_attribute_change(attr_name)
         end
       end
 
-      def has_defer_touch_attrs?
-        defined?(@_defer_touch_attrs) && @_defer_touch_attrs.present?
+      def touch_deferred_attributes
+        @_skip_dirty_tracking = true
+        touch(time: @_touch_time)
       end
 
-      def belongs_to_touch_method
-        :touch_later
+      def has_defer_touch_attrs?
+        @_defer_touch_attrs.present?
       end
   end
 end

data/lib/active_record/transaction.rb

@@ -0,0 +1,132 @@
+# frozen_string_literal: true
+
+require "active_support/core_ext/digest"
+
+module ActiveRecord
+  # Class specifies the interface to interact with the current transaction state.
+  #
+  # It can either map to an actual transaction/savepoint, or represent the
+  # absence of a transaction.
+  #
+  # == State
+  #
+  # We say that a transaction is _finalized_ when it wraps a real transaction
+  # that has been either committed or rolled back.
+  #
+  # A transaction is _open_ if it wraps a real transaction that is not finalized.
+  #
+  # On the other hand, a transaction is _closed_ when it is not open. That is,
+  # when it represents absence of transaction, or it wraps a real but finalized
+  # one.
+  #
+  # You can check whether a transaction is open or closed with the +open?+ and
+  # +closed?+ predicates:
+  #
+  #  if Article.current_transaction.open?
+  #    # We are inside a real and not finalized transaction.
+  #  end
+  #
+  # Closed transactions are `blank?` too.
+  #
+  # == Callbacks
+  #
+  # After updating the database state, you may sometimes need to perform some extra work, or reflect these
+  # changes in a remote system like clearing or updating a cache:
+  #
+  #   def publish_article(article)
+  #     article.update!(published: true)
+  #     NotificationService.article_published(article)
+  #   end
+  #
+  # The above code works but has one important flaw, which is that it no longer works properly if called inside
+  # a transaction, as it will interact with the remote system before the changes are persisted:
+  #
+  #   Article.transaction do
+  #     article = create_article(article)
+  #     publish_article(article)
+  #   end
+  #
+  # The callbacks offered by ActiveRecord::Transaction allow to rewriting this method in a way that is compatible
+  # with transactions:
+  #
+  #   def publish_article(article)
+  #     article.update!(published: true)
+  #     Article.current_transaction.after_commit do
+  #       NotificationService.article_published(article)
+  #     end
+  #   end
+  #
+  # In the above example, if +publish_article+ is called inside a transaction, the callback will be invoked
+  # after the transaction is successfully committed, and if called outside a transaction, the callback will be invoked
+  # immediately.
+  #
+  # == Caveats
+  #
+  # When using after_commit callbacks, it is important to note that if the callback raises an error, the transaction
+  # won't be rolled back as it was already committed. Relying solely on these to synchronize state between multiple
+  # systems may lead to consistency issues.
+  class Transaction
+    def initialize(internal_transaction) # :nodoc:
+      @internal_transaction = internal_transaction
+      @uuid = nil
+    end
+
+    # Registers a block to be called after the transaction is fully committed.
+    #
+    # If there is no currently open transactions, the block is called
+    # immediately, unless the transaction is finalized, in which case attempting
+    # to register the callback raises ActiveRecord::ActiveRecordError.
+    #
+    # If the transaction has a parent transaction, the callback is transferred to
+    # the parent when the current transaction commits, or dropped when the current transaction
+    # is rolled back. This operation is repeated until the outermost transaction is reached.
+    #
+    # If the callback raises an error, the transaction remains committed.
+    def after_commit(&block)
+      if @internal_transaction.nil?
+        yield
+      else
+        @internal_transaction.after_commit(&block)
+      end
+    end
+
+    # Registers a block to be called after the transaction is rolled back.
+    #
+    # If there is no currently open transactions, the block is not called. But
+    # if the transaction is finalized, attempting to register the callback
+    # raises ActiveRecord::ActiveRecordError.
+    #
+    # If the transaction is successfully committed but has a parent
+    # transaction, the callback is automatically added to the parent transaction.
+    #
+    # If the entire chain of nested transactions are all successfully committed,
+    # the block is never called.
+    #
+    # If the transaction is already finalized, attempting to register a callback
+    # will raise ActiveRecord::ActiveRecordError.
+    def after_rollback(&block)
+      @internal_transaction&.after_rollback(&block)
+    end
+
+    # Returns true if the transaction exists and isn't finalized yet.
+    def open?
+      !closed?
+    end
+
+    # Returns true if the transaction doesn't exist or is finalized.
+    def closed?
+      @internal_transaction.nil? || @internal_transaction.state.finalized?
+    end
+
+    alias_method :blank?, :closed?
+
+    # Returns a UUID for this transaction or +nil+ if no transaction is open.
+    def uuid
+      if @internal_transaction
+        @uuid ||= Digest::UUID.uuid_v4
+      end
+    end
+
+    NULL_TRANSACTION = new(nil).freeze
+  end
+end