aris 1.4.2 → 1.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 522385f073c3f854d6c1c257177a18cb47584eccde6c78bbd2f8f15a2252ec6a
-  data.tar.gz: 20d7625e69e21e364d790fa45393be6bce546783c061422d419e310c3d12dea1
+  metadata.gz: 177c81e9724b54870daf6b964a57dd9fd3266c7aba9a33e6e2ad86739a03abfa
+  data.tar.gz: f3cb1744bd6822871889d9e8e8d3b59c3e26dd02409bd9de5f6e8824cb4a6760
 SHA512:
-  metadata.gz: 3dc13fa33795500031ecf33ce8d83d2edee2b39914f707d8275f4f8dbe827a8bebd022394d5471b0f46a00a1c17c3c67a23e6f85c42af1497e0db2ed9deb2bd6
-  data.tar.gz: fbf7c8643a0b5a793ca5bb66ee0c3dc0ba1a2b2f83f09d393a9914e6b0a5bac262928273b1ff45c7270cf07ef455e5580d99b60ae7f875a55287654fd0042164
+  metadata.gz: ebd7ca4a073b9d073c192ce21bc84aaf831257968bb1f5f22c93a7eff45f6e57bc487944596aa7ad4881abe61a56db73b8fae4d5935455e102a4dce1804c0eab
+  data.tar.gz: 9ab6127bf992f2341bf827f063ad013795ecae774264207afdc3421d08c703daa56c644e1596dbd74d09dde18b78c0a6d61c4d6a38cf840fe43fb549dc4f9b89

data/CHANGELOG.md

@@ -0,0 +1,259 @@
+# Changelog
+
+## [1.5.1] - 2026-09-13
+
+Text is text. Suite: 426 tests / 1294 assertions, green.
+
+### 🐛 Fixed
+
+* **Path params and multipart fields came out as raw bytes (ASCII-8BIT).** Servers hand `PATH_INFO` and the request body over as binary strings, and aris passed them straight through. That is invisible until something cares about encoding: the `sqlite3` gem binds a binary string as a BLOB, so `WHERE book = ?` with a route param never matched, and a form value saved through a multipart form landed in the database as a BLOB instead of TEXT. Route params (`params[:book]`) and multipart field values, names and filenames are now UTF-8 text (invalid bytes are scrubbed). File data stays binary. Urlencoded forms were already fine (Rack decodes them as UTF-8).
+
+## [1.5.0] - 2026-09-12
+
+Sessions you can build a login on, and Rack 3 correct responses. Suite: 424 tests / 1289 assertions, green.
+
+### 🔒 Security
+
+* **Sessions are encrypted and authenticated.** The session cookie is now an AES-256-GCM payload keyed from `Aris::Config.secret_key_base`. Before, it was Base64-encoded JSON: readable, and forgeable by anyone who could type `{"user_id":1}`. A tampered, forged, expired, or wrong-key cookie loads as an empty session. `expire_after` is enforced server-side. A missing or short secret raises a clear `ArgumentError`. **Any 1.4 session cookie is ignored.** See `docs/plugins/SESSION.md`.
+* **CSRF tokens are session-backed.** The old plugin kept the token in `Thread.current` and compared it across requests, which is meaningless under a threaded server. Tokens now live in the session, are exposed as `request.csrf_token`, and are accepted from the `_csrf` form field or the `X-CSRF-Token` header, compared in constant time. Requires `use: [:session, :form_parser, :csrf]` in that order. See `docs/plugins/CSRF.md`.
+
+### 🐛 Fixed
+
+* **Cookies were never read under the Rack adapter.** `Aris::Adapters::Rack::Request#cookies` looked at `env['rack.request.cookie_hash']`, which nothing populated, so sessions and flash could not persist in production. It now parses the `Cookie` header.
+* **Several `Set-Cookie` values were comma-joined into one header**, which browsers cannot parse — setting a session and a flash in one response lost one of them. Cookies are emitted as a Rack 3 Array under `set-cookie`.
+* **`FormParser.build` returned an instance that could not be called** (every request 500'd — 16 red tests since 1.4.2). Instances and the bare class both work now, on both adapters.
+* **`Session.build` had the same problem**; instances work.
+* `request.body` on the Rack adapter can be read more than once (memoized, input rewound).
+* `:flash`, `:security_headers`, `:cors`, `:request_logger` are self-registered like every other plugin, so `use: [:flash]` works without a manual `register_plugin`. The three configurable ones run with defaults when used by symbol. (`BasicAuth` still needs `.build(username:, password:)`.)
+* Tests that asserted a capitalized `Location` header against Rack-3 lowercase output fixed.
+
+### ✨ Added
+
+* `response.set_cookie` / `response.delete_cookie` on every response (Mock and Rack), with `path`, `domain`, `max_age`, `expires`, `httponly`, `secure`, `same_site`. The `:cookies` plugin is now a no-op kept for compatibility. See `docs/plugins/COOKIES.md`.
+* `request.form_params` and `request.params` (query + form) after `:form_parser`; `request.multipart_params`, `request.multipart_files`, `request.multipart_data` after `:multipart`, with fields merged into `request.params`.
+* The Rack adapter normalizes every response header name to lowercase and merges duplicates, as Rack 3 requires. Plugins may keep setting `'Cache-Control'` etc.; the wire output is `cache-control`.
+
+### 🔧 Changed
+
+* `request.cookies` is available on Rack requests without any plugin.
+* Session data keys are always symbols.
+
+
+## [1.4.2] - 2026-01-22
+
+### 🐛 Fixed
+
+* Fixed a bug where form_parser plugin failed to pass parameters to handlers
+
+Parameters are reached as follows:
+
+```ruby
+def self.send(req, res, params)
+  email = req.form_params['email']
+```
+
+## [1.4.0] - 2025-12-30
+This release adds native static file serving with production-grade MIME type handling.
+
+### ✨ Added
+* **Static File Serving:** Introduced `Aris::Config.serve_static` to serve static assets directly from the `public/` directory in development. Works seamlessly with nginx in production (nginx handles static files, Aris handles dynamic routes).
+* **Configurable MIME Types:** Added `Aris::Config.mime_types` with sensible defaults for common file types (images, fonts, CSS, JS). Fully extensible for custom file formats.
+* **Cache Headers:** Static files are served with `Cache-Control: public, max-age=31536000` for optimal browser caching.
+
+### 🔧 Changed
+* Both `RackApp` and `MockAdapter` now check for static files before routing, improving performance for asset-heavy applications.
+
+### 📝 Usage
+```ruby
+# Enable in development (disabled by default)
+Aris.configure do |c|
+  c.serve_static = ENV['RACK_ENV'] != 'production'
+  
+  # Optional: Add custom MIME types
+  c.mime_types = {
+    '.webm' => 'video/webm',
+    '.flac' => 'audio/flac'
+  }
+end
+```
+
+## [1.3.0] - 2025-12-30
+
+This release focuses on state management and fine-tuning URL strictness.
+
+### ✨ Added
+
+* **Session & Flash Support:** Introduced `Aris::Plugins::Session` and `Aris::Plugins::Flash`. Supports persistence across redirects and "flash.now" for the current request cycle.
+* **Trailing Slash Configuration:** Added `Aris::Config.trailing_slash`. You can now choose between `:strict` (default), `:ignore`, or `:redirect` (301/302) to normalize incoming paths.
+* **Cookie Management:** Added `Aris::Plugins::Cookies` with a fluent helper API for reading, writing, and deleting cookies with secure defaults.
+
+### 🐛 Fixed
+
+* Fixed a bug where the `MockAdapter` would not correctly pass the response object into handler blocks, causing issues with state-dependent plugins.
+
+---
+
+## [1.2.0] - 2025-12-15
+
+Deep integration for internationalization and complex domain patterns.
+
+### ✨ Added
+
+* **First-Class Locales:** Added `Aris::LocaleInjector`. Routes can now be expanded per-locale (e.g., `/en/about` and `/es/acerca` pointing to the same handler).
+* **Locale-Aware Path Generation:** `Aris.path` now accepts a `locale:` argument to generate localized URLs automatically.
+* **Root Locale Redirect:** Added `root_locale_redirect: true` to domain configurations to automatically bounce users from `/` to their default locale.
+* **Subdomain Wildcards:** Enhanced the Trie to support `*.example.com` routing. The `request.subdomain` helper now correctly extracts multi-level subdomains (e.g., "app.staging").
+
+### 💥 Changed
+
+* **Response Helpers:** Refactored `Aris::Response` into a modular helper system. Handlers now have access to `res.json`, `res.html`, `res.text`, and `res.xml`.
+
+---
+
+## [1.1.0] - 2025-11-20
+
+Introduction of the "Utils" layer for SEO and automated metadata.
+
+### ✨ Added
+
+* **Sitemap Generator:** Added `Aris::Utils::Sitemap`. Automatically generates `sitemap.xml` based on discovered routes and provided metadata (priority, changefreq).
+* **Redirects Manager:** Added `Aris::Utils::Redirects`. Allows registering legacy URL mappings directly within route handlers using the `redirects_from` helper.
+* **Content Negotiation:** Added `res.negotiate`. Handlers can now respond to different formats (JSON, XML, HTML) using a single block.
+
+### 💥 Changed
+
+* **Header Normalization:** Aris now internally downcases all header keys to ensure compatibility between different Rack servers and the Mock adapter.
+
+---
+
+## [1.0.0] - 2025-10-30
+
+The "Autodiscovery" Milestone. This version marks the transition to a file-based convention for large-scale applications.
+
+### ✨ Added
+
+* **Route Autodiscovery:** Introduced `Aris.discover_and_define(routes_dir)`. Aris now scans your directory structure (e.g., `domain/path/_id/get.rb`) to build the routing tree automatically.
+* **Convention-over-Configuration:** Parameterized routes are now identified by the `_` prefix in the filesystem (e.g., `_slug` becomes `:slug`).
+* **OpenAPI/Swagger Metadata:** Added `api_doc` helper to handlers to facilitate automatic documentation generation.
+
+### 💥 Changed
+
+* **Handler Resolution:** The `PipelineRunner` now lazily loads `Handler` constants from Ruby files only when the route is matched, significantly reducing boot time for thousands of routes.
+
+---
+
+## [0.9.0] - 2025-10-05
+
+Performance optimization and production hardening.
+
+### ✨ Added
+
+* **Request ID Tracking:** Added `Aris::Plugins::RequestId`. Automatically preserves or generates `X-Request-ID` headers for distributed tracing.
+* **Response Compression:** Added `Aris::Plugins::Compression`. Transparent Gzip compression for text-based responses over a configurable size threshold.
+* **Security Headers:** Added `Aris::Plugins::SecurityHeaders`. Configurable defaults for HSTS, CSP, X-Frame-Options, and Referrer-Policy.
+
+### ⚡ Performance
+
+* Optimized Trie traversal by caching path segments, resulting in a 15% speed increase for deeply nested routes.
+
+---
+
+## [0.8.0] - 2025-09-10
+
+Advanced matching features.
+
+### ✨ Added
+
+* **Path Constraints:** Added `constraints: { id: /\d+/ }` support. Routes now only match if parameters satisfy the provided regex.
+* **Wildcard Globbing:** Added support for `*path` segments to capture remaining path parts into a single parameter.
+* **Health Checks:** Added `Aris::Plugins::HealthCheck`. A highly configurable plugin for liveness/readiness probes with dependency monitoring.
+
+---
+
+## [0.7.0] - 2025-08-15
+
+Middleware and the Plugin Pipeline.
+
+### ✨ Added
+
+* **The Plugin System:** Introduced the `use:` key at domain, scope, and route levels. Plugins follow a `call(request, response)` contract.
+* **JSON Body Parser:** Added `Aris::Plugins::Json` to automatically parse incoming payloads into `request.json_body`.
+* **Form Parser:** Added support for `application/x-www-form-urlencoded` payloads via `Aris::Plugins::FormParser`.
+
+---
+
+## [0.6.0] - 2025-07-20
+
+Hardened Authentication.
+
+### ✨ Added
+
+* **Bearer Auth Plugin:** Standardized token-based authentication.
+* **Basic Auth Plugin:** Easy username/password protection for admin scopes.
+* **API Key Auth Plugin:** Header-based key validation with custom validator support.
+* **CORS Plugin:** Full support for origins, methods, credentials, and preflight `OPTIONS` handling.
+
+---
+
+## [0.5.0] - 2025-06-28
+
+Integrated CSRF and Mocking.
+
+### ✨ Added
+
+* **CSRF Protection:** A two-phase plugin (`CsrfTokenGenerator` and `CsrfProtection`) to secure state-changing requests.
+* **Mock Adapter:** Built `Aris::Adapters::Mock` to allow full integration testing of routes and plugins without a live Rack server.
+
+---
+
+## [0.4.0] - 2025-06-01
+
+The "Rack" release.
+
+### ✨ Added
+
+* **Rack Adapter:** Official production adapter `Aris::Adapters::RackApp`.
+* **Agnostic Request/Response:** Wrapped Rack environment in `Aris::Request` and `Aris::Response` to ensure handlers remain server-agnostic.
+
+---
+
+## [0.3.0] - 2025-05-15
+
+Named routes and URL generation.
+
+### ✨ Added
+
+* **Named Routes:** Added the `as:` option to route definitions.
+* **Path/URL Helpers:** Introduced `Aris.path` and `Aris.url`. Support for query parameter appending and automatic URI encoding.
+* **Domain Context:** Added `Aris.with_domain` for scoped URL generation.
+
+---
+
+## [0.2.0] - 2025-04-25
+
+Multi-domain support.
+
+### ✨ Added
+
+* **Multi-Domain Routing:** The routing hash now accepts domain strings as top-level keys.
+* **Wildcard Domain Fallback:** Support for the `"*"` domain key to handle health checks or generic responses across all hosts.
+
+---
+
+## [0.1.0] - 2025-04-10
+
+### ✨ Added
+
+* **Initial Release!**
+* Core Trie-based routing engine.
+* Support for standard HTTP verbs (GET, POST, PUT, PATCH, DELETE).
+* Parameter extraction (e.g., `/users/:id`).
+* Global `Aris.routes` configuration.
+
+---
+
+**Would you like me to ...**
+
+* Generate the `VERSION` file for this project?
+* Create a `ROADMAP.md` for 2026?
+* Implement a CLI command to auto-generate this changelog from git tags?

data/README.md

@@ -118,6 +118,24 @@ Aris.routes({
 })
 ```
 
+### Sessions, cookies, CSRF, forms
+
+```ruby
+Aris.configure { |c| c.secret_key_base = ENV.fetch('SECRET_KEY_BASE') }
+
+Aris.routes({
+  "example.com": {
+    use: [:session, :form_parser, :csrf],
+    "/login": { post: { to: ->(req, res, prm) {
+      req.session[:user_id] = 1          # encrypted + authenticated cookie
+      res.redirect('/')
+    } } }
+  }
+})
+```
+
+`request.session`, `request.cookies`, `request.form_params`, `request.csrf_token`, `response.set_cookie` — see `docs/plugins/`.
+
 ### Composable Plugins
 
 Plugins execute between routing and handler dispatch. They're just callables that can inspect, modify, or halt the request.