concerns_on_rails 1.32.0 → 1.32.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a5638a56a20ce9b346dd013448af31656fe6925eaefbf8bd87ee8906c17825b4
-  data.tar.gz: b3feeb0feaab7f14bf5d03ea46a9e7a1a69f0d087173cf2fb0baa1efb2c86daa
+  metadata.gz: 3e44cfe4621a22897c4d3f6e2ade5b1485d7c686f10dd72fb0dd582a50eadd73
+  data.tar.gz: 478bc126777b1627ffba7275f1f81421c0ce112b01e3348c30b4010a023af75c
 SHA512:
-  metadata.gz: 25623c6d25c7fafc8e8c4dfd5f16350df059a5f0bb2999c0d457b986cfcff1c55365f8e072ab5dd01cb9ae48e6226ff335a546f02c1521ca0c3934898e92c296
-  data.tar.gz: ad5dd6aa2c310c9d711fd9513e01488e79f164df54aa2accdbca8ab9a46f3c2fe296c0733c6b0c404c0df09147c28160f7c5177e0938b6637eb3037d71f1e363
+  metadata.gz: bf067b1d2068e59ed7007bddfc41e2b70a287a57e6e3727e0fba8653ef4d4c1f892e158d6e012b96fbfb862eb1a2a8e48c17d60acc0891c2b85fc43f9c8bb17f
+  data.tar.gz: 71db79d7dd7e673b111d20a89a99d2ea7a95cd41c13ff3ededd017f27ef10a4351d7689b7aebcf04a2c8aedebbc0cee5bb8d8f57e1ac96bec1aaf5f838852171

data/CHANGELOG.md

@@ -1,5 +1,114 @@
 <!-- CHANGELOG.md -->
 
+## 1.32.1 (2026-10-08)
+
+A bug-fix release from a six-angle audit of 1.32.0 — data and encryption, state and counters,
+scopes and batch verbs, field transforms, request params, HTTP policy. Every finding was
+reproduced by a failing spec before it was fixed, and every fix ships with a regression spec;
+the batch then went through an adversarial review round. No new concerns, no new options and
+no migrations. A few fixes now raise where the gem used to misbehave silently — read
+**Changed** first. 2827 examples, 0 failures (2795 on Rails 6.0).
+
+### Changed
+- **Encryptable: Lockable's `unlock_token:` cannot be `encryptable`** (`ArgumentError` at
+  declaration, either order). The token is minted, claimed and cleared by callback-skipping
+  SQL keyed on the column value, so an encrypted token was never found: every unlock link was
+  dead. Keep it a plain column — it is random, single-use and cleared with the lock.
+- **Monetizable: an `encryptable` cents column is refused** (`ArgumentError`, either order):
+  `sum_`/`average_`/`minimum_`/`maximum_` ran SQL aggregates over ciphertext.
+- **Auditable: `audited_changes_since` reads its argument in `Time.zone`** — a `Date` is
+  midnight in `Time.zone`, a zone-less String is read in `Time.zone` (not the server's system
+  zone), and a String that names no time raises `ArgumentError` (`"junk"` used to mean June 1).
+- **Encryptable: blind indexes refresh in `before_create`/`before_update`**, after every
+  `before_save`, instead of in an include-time `before_save`. An app `before_save` that rewrites
+  the field (`self.email = email.downcase`) is now fingerprinted as stored, and a new row always
+  refreshes every indexed field, so a copy (`dup`, Duplicable's `reset:`) no longer keeps its
+  original's digest. Rows written by such a callback before this release keep a stale digest
+  until re-saved with a change.
+
+### Fixed
+- **Encryptable**: decrypted text reads back as UTF-8 (binary only when the bytes are not valid
+  UTF-8). Non-ASCII values compared unequal to what was written after a reload, were dirty on
+  every reassignment, and `reencrypt!` fingerprinted different bytes under a `downcase`
+  `expression:`, so rotated rows could no longer be found.
+- **Encryptable**: an empty-String column default (`text null: false, default: ""`) reads as
+  `""` instead of raising `DecryptionError` on every new record.
+- **Encryptable**: `find_by_<field>` / `where_<field>` / `<field>_fingerprint` run the lookup
+  value through the field's Normalizable rule and its Rails 7.1+ `normalizes`, as Rails' own
+  finders do.
+- **Storable**: a `:float` key given `"Infinity"`/`"NaN"` casts to nil instead of raising
+  `JSON::GeneratorError` (a 500 from a form field).
+- **SoftDeletable**: `without_deleted.really_destroy_all` (and any relation repeating the
+  default `deleted_at IS NULL`) no longer hard-deletes the trash, and `without_deleted.restore_all`
+  no longer restores it: only the default scope's own predicate is peeled off.
+- **`*_all` batch verbs** (`Support::BatchOps`) roll the whole batch back inside a caller's
+  transaction too: the batch runs in its own savepoint, so a caller rescuing the
+  `RecordNotSaved` no longer commits the records written before the failing one.
+- **Sluggable**: a record moved to another `scope:` value whose slug that scope already holds
+  rebuilds it against the new scope instead of duplicating it; a slug that is free there is kept.
+- **Sortable**: the position acts_as_list assigns in `before_create` is reported through
+  `Support::GeneratedValues`, so an Auditable model tracking it records it on create.
+- **CounterCacheable**: a save that changes a row's STI type (`becomes!`, `update!(type:)`)
+  judges the old state under the old type's rule and the new state under the new type's, and
+  destroy uses the persisted type's rule — the live counter no longer drifts from
+  `recount_counter_caches!`.
+- **Stateable `lock: true` / Activatable `toggle_active!`**: the reload under the row lock keeps
+  a loaded `belongs_to` parent whose foreign key it didn't change, so CounterCacheable's mirror
+  reaches the caller's parent instead of leaving it to raise `StaleObjectError`.
+- **Stateable**: `transition_all` no longer skips rows already in the target state when the
+  event's `from:` lists that state (a declared self-transition).
+- **Lockable**: `attempts_remaining` returns the full `max_attempts` once a lock has lapsed
+  (`unlock_in`), instead of 0 on an unlocked account.
+- **Sanitizable** `on: :write`, **Taggable** and **Addressable** also normalize in a prepended
+  `before_save` backstop (Normalizable's pattern), so `update_attribute` / `save(validate: false)`
+  no longer store raw markup, un-normalized tags or un-normalized address parts. A validated
+  save stores exactly what it stored before (the backstop never re-runs a rule on a value
+  validation already accepted).
+- **Maskable / Sanitizable**: `as_json(masked: true)` / `as_json(sanitized: true)` carry the flag
+  through every nested `include:` level, so a grandchild reached through a model without the
+  concern is no longer serialized raw.
+- **Masker `:email`** fails closed (full mask) unless the value is exactly one address, so a
+  second address in a list is no longer revealed.
+- **Monetizable**: a `Rational` amount converts (`Rational(1999, 100)` → 1999 cents) instead of
+  being stored as nil.
+- **Searchable / Taggable**: queries and tags are trimmed (and `mode: :all` split) on Unicode
+  whitespace — a no-break or ideographic space no longer becomes part of the LIKE pattern or a
+  distinct tag.
+- **Filterable**: a nested-array param (`?name[][]=a&name[][]=b`) is ignored instead of raising
+  a `TypeError` 500; a JSON-body number on a date/datetime column — compared, in equality,
+  `in`/`not_in`, or handed to a `type: :date` lambda — matches nothing instead of being bound raw
+  (a 500 on PostgreSQL); a date/time operand longer than 128 characters no longer raises
+  `Date._parse`'s `ArgumentError` (a 500) on Rails 6.0–7.0 and is answered as 7.1+ answers it.
+- **Paginatable**: a number where a nested page Hash belongs (`{"page": 2}` under
+  `style: :jsonapi`) falls back to the defaults instead of a `TypeError` 500.
+- **CursorPaginatable**: a page ending on a stored ±Infinity/NaN float no longer raises
+  `JSON::GeneratorError` on every request — the boundary is minted as a string and walked
+  correctly on PostgreSQL and SQLite; a tampered number/boolean for a date/time boundary, or an
+  over-long date String on Rails 6.0–7.0, is an `InvalidCursor` (400), not a decoded position
+  or a 500.
+- **Paginatable / CursorPaginatable**: `Link` header URLs are percent-encoded inside `<…>`, so a
+  crafted request path can no longer inject extra Link entries.
+- **Throttleable**: the first-hit seed is written `raw: true` (to any store whose `write` takes
+  options), so a memcached `Rails.cache` on Rails 6.0–7.0 enforces the limit again (every later
+  `increment` returned nil and the 429 never fired).
+- **Timezoneable**: a `Time-Zone` header or `time_zone` cookie that is not valid UTF-8 is ignored
+  instead of raising a 500 (persistently, for the cookie); the `available:` allow-list matches by
+  zone, not spelling, so `America/New_York` matches an allow-listed `Eastern Time (US & Canada)`.
+- **Cacheable**: per-call `stale_resource?(r, extras: [...])` downgrades `Cache-Control` to
+  `private`, like a Vary-less `etag_with` source, so a CDN no longer serves one caller's
+  representation to the next.
+- **Localizable**: `Accept-Language: pt-BR` (and `?locale=pt-br`) selects an available `:pt_BR`;
+  `-` and `_` are one separator (an exact spelling still wins).
+
+### Known issues (not fixed in this release)
+- CounterCacheable: a parent destroyed inside the same rolled-back transaction keeps the
+  mirrored counter/lock_version in memory.
+- Aliasable: eager-loading an alias together with its source in one query loads each child twice.
+- Encryptable: on the pre-7.1 Marshal format, a record whose field has a per-field Proc `key:`
+  cannot be `Marshal.dump`ed (`Rails.cache`).
+- CursorPaginatable: on PostgreSQL, a page ending on a timestamp stored as `'infinity'` now mints
+  its cursor (it used to be a 500), but the next page answers 400 — the walk cannot step past it.
+
 ## 1.32.0 (2026-10-07)
 
 A dependency release (#127): the `permittable` floor rises to `>= 0.8`, and the Permittable docs

data/README.md

@@ -148,7 +148,7 @@ across all 43 concerns — press <kbd>/</kbd> and type.
 - **Lean dependencies** — only `acts_as_list` (Sortable) and `friendly_id` (Sluggable), and both load **lazily**: an app that never includes those concerns never loads them. Depends on `activerecord`/`actionpack`/`activesupport`, not the full `rails` meta-gem; controller concerns have zero extra deps
 - **Schema-validated configuration** — every macro checks that the configured columns exist and raises `ArgumentError` early — listing *every* missing column at once, with one ready-to-paste `rails generate migration` command that adds them all
 - **Composable** — concerns are independent; mix and match per model
-- **Tested like an app, not a snippet** — **2,723 RSpec examples** run against a real database on every CI build
+- **Tested like an app, not a snippet** — **2,827 RSpec examples** run against a real database on every CI build
 - **Documented twice** — everything in this README also lives as a per-concern page on the [docs site](https://vsn2015.github.io/concerns_on_rails), searchable and deep-linkable
 
 ---
@@ -203,8 +203,22 @@ still wins over the gem-wide fallback.
 - **Rails**: 6.0 through 8.1
 
 Every one of those lines runs the full suite on every push — Rails 6.0, 6.1, 7.0, 7.1, 7.2,
-8.0 and 8.1 on SQLite, plus PostgreSQL and MySQL, and Ruby 3.3/3.4 against the current
-lines. See [`.github/workflows/ci.yml`](.github/workflows/ci.yml).
+8.0 and 8.1 on SQLite, plus PostgreSQL and MySQL. Ruby 3.2, 3.3, 3.4 and 4.0 each run
+against every one of those Rails lines, and a non-blocking ruby-head job gives early
+warning of the next Ruby. See [`.github/workflows/ci.yml`](.github/workflows/ci.yml).
+
+**Rails 6.0/6.1 on Ruby 3.4+** needs a few Gemfile lines that Rails 6.x itself never
+declared. Ruby 3.4 and 4.0 moved these libraries out of the default gems, and without them
+`require "active_record"` fails with `LoadError: cannot load such file -- mutex_m`:
+
+```ruby
+gem "base64"
+gem "bigdecimal"
+gem "drb"
+gem "mutex_m"
+gem "benchmark" # Ruby 4.0+
+gem "logger"    # Ruby 4.0+
+```
 
 **Rails 5.x is not supported**, despite what older versions of this gem declared. Rails 5
 cannot run on any Ruby this gem supports: Ruby 3 separated keyword arguments, which breaks
@@ -1257,7 +1271,7 @@ end
 | `fingerprint:`    | `nil`                                | A `string` column to store `address_fingerprint` in (stamped in `before_validation`, after normalization) so duplicates are one indexed query away: `Location.with_address(record)`. |
 | `if:` / `unless:` | `nil`                                | Standard Rails validation conditions (Symbol, Proc, or Array) gating the address **validations** — e.g. `if: :on_addresses?`. Normalization still runs unconditionally. Per class: a later `addressable_by` (or a subclass's) replaces the condition. Procs get Rails' callback arguments for their arity (`-> {}`, `->(record) {}`, `->(record, _) {}`). |
 
-**What it normalizes** (in `before_validation`)
+**What it normalizes** (in `before_validation`, plus a `before_save` backstop for saves that skip validation)
 - Text parts: `strip` + `squish`.
 - `postal_code`: squish + upcase, with canonical spacing for CA (`A1A1A1` → `A1A 1A1`).
 - `country` / `state`: upcased when they look like a 2-letter code (full names left alone). With `normalize_country: true`, a recognized ISO country name or alpha-3 code is canonicalized to its alpha-2 (`"Canada"`/`"CAN"` → `"CA"`); unrecognized values are left as-is.
@@ -1335,7 +1349,7 @@ Article.normalize_tags!                        # repair rows written around the
 **Notes**
 - Matching is **boundary-safe** — searching `rail` does not match `rails`. An explicit SQL `ESCAPE` clause makes tags containing `_` / `%` match literally on every adapter.
 - `tagged_with` matches **case-insensitively on every adapter** — `LIKE` on SQLite and MySQL, `ILIKE` on PostgreSQL — so one call means one thing everywhere (how non-ASCII characters fold is still the database collation's business). The Ruby-side helpers (`tagged_with?`, `all_tags`, `tag_counts`) compare exactly, so `downcase: true` — which folds on write — is what makes the scope and the helpers agree.
-- Tags are normalized in `before_validation`, so a direct `record.tags = "a, b"` assignment is cleaned too. An empty list stores `NULL`.
+- Tags are normalized in `before_validation` (plus a `before_save` backstop for saves that skip validation), so a direct `record.tags = "a, b"` assignment is cleaned too. An empty list stores `NULL`.
 - An [Encryptable](#-encryptable) tag column holds ciphertext, which `tagged_with`'s `LIKE` never matches — declaring it raises `ArgumentError` at declaration, in either order (an undeclared default `:tags` column is refused when `tagged_with` is called).
 - `tagged_with` matches the **normalized** column form (`"ruby,rails"`) — which every write through the model produces. A row written around the callbacks (`update_column`, `update_all`, raw SQL, an import) as `"ruby, rails"` is found by `tagged_with?` but not by `tagged_with`; run `Model.normalize_tags!` (relation-aware, one `update_columns` per changed row in a transaction, no validations/callbacks, returns the count; `unscoped` to include default-scoped-away rows) to rewrite such rows.
 - `tag_counts` runs one `GROUP BY` on the raw column — identical tag strings ship once with their row count and are split in Ruby — so it scales with distinct tag strings, not rows; ordered by count desc then name, `limit:` keeps the top N.
@@ -1394,7 +1408,7 @@ Article.where(legacy: true).sanitize_all!(:body)   # scope-aware, subset of fiel
 
 **Notes**
 - `on: :read` (default) is **non-destructive**: it adds a `sanitized_<field>` reader and leaves the stored column untouched.
-- `on: :write` overwrites the column in `before_validation` — **lossy and irreversible** (never use it on code, Markdown, math, or prices), and bypassed by `update_column` / `update_all` / raw SQL.
+- `on: :write` overwrites the column in `before_validation` (plus a `before_save` backstop for `update_attribute` / `save(validate: false)`) — **lossy and irreversible** (never use it on code, Markdown, math, or prices), and bypassed only by `update_column` / `update_all` / raw SQL.
 - `with: :strip, on: :write` stores **plain text**, not HTML-escaped text: `"<b>Tom</b> & Jerry"` is stored as `"Tom & Jerry"` (so `<%= %>` shows it once, not as `Tom &amp;amp; Jerry`). `&lt;` / `&gt;` are deliberately kept encoded — the stored value can never become markup, even rendered with `raw` — so a typed `a < b` is stored as `a &lt; b`. An `&amp;` that would read back as a character reference (a literal `&amp;copy;`) also stays encoded (a static, linear-time rule: `&` followed by `#`, a `name;`, or an HTML5 semicolon-less legacy name), so re-saving and `sanitize_all!` are idempotent. `sanitize_all!` uses the same plain-text form, and repairs rows stored double-escaped by earlier versions. The `on: :read` reader and `sanitized:` serialization still return HTML-escaped text.
 - `sanitize_all!` is the repair tool for that bypass (and for rows written before the concern was added): one `update_columns` per row that actually changes, skipping validations/callbacks on purpose, inside a transaction. A bare call repairs the `on: :write` fields only — with none declared it returns `0` without a query.
 - `sanitized:` sanitizes the **serialized** value, so it composes with [Maskable](#-maskable) in either include order: `as_json(masked: true, sanitized: true)` never falls back to the raw column.
@@ -2708,9 +2722,9 @@ Point your agent at `llms.txt` for an overview, or paste a single concern's `.md
 
 ```sh
 bundle install                                  # install dev dependencies
-bundle exec rspec                               # run the test suite (2,723 examples)
+bundle exec rspec                               # run the test suite (2,827 examples)
 gem build concerns_on_rails.gemspec             # build the gem
-gem install ./concerns_on_rails-1.32.0.gem      # install locally
+gem install ./concerns_on_rails-1.32.1.gem      # install locally
 
 # Preview the docs site locally (GitHub Pages serves docs/ as-is):
 cd docs && python3 -m http.server 8000          # → http://localhost:8000

data/lib/concerns_on_rails/controllers/cacheable.rb

@@ -64,7 +64,8 @@ module ConcernsOnRails
     #     method, a block, or a preset with `vary: false` — makes the response
     #     unshareable, so `Cache-Control` is emitted as `private` however the
     #     rule declared its `visibility:`. `:query` is exempt: the URL already
-    #     carries it.
+    #     carries it. Per-call `extras:` are such a source too (they carry no
+    #     Vary), so a request that passes any is `private` as well.
     #
     # Notes:
     #   * `no_store: true` overrides everything (emits the lone `no-store`),
@@ -279,10 +280,13 @@ module ConcernsOnRails
       # the computed { etag:, last_modified: } pair. Class-level `etag_with`
       # values and per-call `extras:` are folded into the ETag (an explicit
       # `etag:` stays verbatim only when there are none), and the sources' Vary
-      # headers are merged into the response.
+      # headers are merged into the response. Per-call extras advertise no Vary,
+      # so — exactly like a Vary-less etag_with source — they make this
+      # response `private` (see http_cache_visibility_for).
       def set_cache_validators(resource = nil, etag: nil, last_modified: nil, extras: nil)
         etag ||= cache_etag_for(resource) unless resource.nil?
         last_modified ||= cache_last_modified_for(resource) unless resource.nil?
+        http_cache_note_request_extras(extras)
         context = cache_etag_extras(extras)
         etag = http_cache_combine_etag(etag, context) if etag && context.any?
         http_cache_write_validators(etag, last_modified)
@@ -378,7 +382,10 @@ module ConcernsOnRails
       # `vary: false` — is a dimension no cache can key on (`Vary` has no way to
       # say "who is asking"), so the representation is simply not shareable and
       # the declared `visibility:` is downgraded rather than trusted. `:query`
-      # is exempt: the query string is already part of the cache key.
+      # is exempt: the query string is already part of the cache key. Per-call
+      # `extras:` (`stale_resource?(r, extras: [current_user.role])`) are the
+      # same kind of dimension and used to keep `public`, so a CDN keyed on the
+      # URL handed one caller's representation to the next.
       def http_cache_visibility_for(rule)
         return "private" if http_cache_unshareable_etag?
 
@@ -386,9 +393,17 @@ module ConcernsOnRails
       end
 
       def http_cache_unshareable_etag?
+        return true if @http_cache_request_extras
+
         self.class.cacheable_etag_extras.any? { |entry| entry[:vary].empty? && entry[:source] != :query }
       end
 
+      # Any per-call extra counts, a nil one included — just as a block source
+      # downgrades whatever it returns: the dimension exists either way.
+      def http_cache_note_request_extras(extras)
+        @http_cache_request_extras = true unless Array(extras).empty?
+      end
+
       # Previously a hand-rolled, case-SENSITIVE merge that also appended to
       # `Vary: *` — and, run from set_cache_validators before render, it left
       # the header non-blank so Rails skipped its own `Vary: Accept`.

data/lib/concerns_on_rails/controllers/cursor_paginatable.rb

@@ -558,11 +558,15 @@ module ConcernsOnRails
       # redefined #is_a? returns true for Time). iso8601(6) keeps microsecond
       # precision so boundary equality survives the round trip. The UTC form is
       # a copy: `to_time.utc` converted the boundary record's own attribute in
-      # place (TimeWithZone#to_time is memoized).
+      # place (TimeWithZone#to_time is memoized). A non-finite Float — a
+      # stored ±Infinity or NaN (see cursor_non_finite_minted?) — is written
+      # as the String ActiveModel's Float type casts back ("Infinity",
+      # "-Infinity", "NaN"): JSON has no such number, and JSON.generate raised
+      # on it, so one such row on a page boundary made that page a 500.
       def serialize_cursor_value(value)
         return ConcernsOnRails::Support::TimeValue.utc(value).iso8601(6) if value.is_a?(Time) || value.is_a?(DateTime)
         return value.iso8601 if value.is_a?(Date)
-        return value.to_s if value.is_a?(BigDecimal)
+        return value.to_s if value.is_a?(BigDecimal) || (value.is_a?(Float) && !value.finite?)
 
         value
       end
@@ -596,24 +600,38 @@ module ConcernsOnRails
       # drops unboundable values to 1=0) and a RangeError 500 on 6.0. A
       # timestamp outside years 0001..9999 casts fine too, then raised
       # DatetimeFieldOverflow on PostgreSQL (a 500) and compared as text on
-      # SQLite. We never mint any of them, so each is tampering and gets the
+      # SQLite. So did a number or `true` for a datetime boundary: the date
+      # and time casts hand a non-String back unchanged, and
+      # `(created_at, id) > (12345, 3)` restarted the walk on SQLite (it sorts
+      # any number before a date's text) and was a 500 on PostgreSQL. We
+      # never mint any of them, so each is tampering and gets the
       # InvalidCursor 400.
       def cast_cursor_value!(model, col, raw)
         return nil if raw.nil? # a NULL boundary; valid_cursor_values? only admits it on a nullable column
 
         type = model.type_for_attribute(col.to_s)
-        value = type.cast(raw)
-        raise InvalidCursor, "Invalid pagination cursor." unless cursor_bindable?(type, value)
+        value = cursor_type_cast(type, raw)
+        raise InvalidCursor, "Invalid pagination cursor." unless cursor_bindable?(model, type, value)
 
         value
       end
 
+      # Rails 6.0–7.0's date and time casts raise Date._parse's ArgumentError
+      # for a String over 128 characters (7.1 casts it to nil): a tampered
+      # date boundary was a 500 instead of the 400 below. Any other type's
+      # ArgumentError is left alone.
+      def cursor_type_cast(type, raw)
+        type.cast(raw)
+      rescue ArgumentError
+        raise unless ConcernsOnRails::Support::TimeValue.temporal_type?(type)
+
+        raise InvalidCursor, "Invalid pagination cursor."
+      end
+
       # `serializable?` is the Rails 6.1+ range probe; on 6.0 only serialize
-      # itself knows, raising ActiveModel::RangeError (a ::RangeError). A
-      # non-finite Float/BigDecimal is refused outright: it is never minted
-      # and adapters disagree on how (or whether) to quote it.
-      def cursor_bindable?(type, value)
-        return false if cursor_never_minted?(value)
+      # itself knows, raising ActiveModel::RangeError (a ::RangeError).
+      def cursor_bindable?(model, type, value)
+        return false if cursor_never_minted?(model, type, value)
         return type.serializable?(value) if type.respond_to?(:serializable?)
 
         type.serialize(value)
@@ -622,12 +640,37 @@ module ConcernsOnRails
         false
       end
 
-      # nil, a non-finite Float/BigDecimal, or a date/time outside
-      # Support::TimeValue::YEARS: none of them is ever minted.
-      def cursor_never_minted?(value)
-        value.nil? ||
-          ((value.is_a?(Float) || value.is_a?(BigDecimal)) && !value.finite?) ||
-          !ConcernsOnRails::Support::TimeValue.representable?(value)
+      # nil, a non-finite Float/BigDecimal (except where one is minted, see
+      # cursor_non_finite_minted?), anything but a date or time on a date/time
+      # column, or a date/time outside Support::TimeValue::YEARS: none of them
+      # is ever minted.
+      def cursor_never_minted?(model, type, value)
+        return true if value.nil?
+        return !cursor_non_finite_minted?(model, type, value) if value.is_a?(Float) && !value.finite?
+        return true if value.is_a?(BigDecimal) && !value.finite?
+
+        !cursor_time_minted?(type, value)
+      end
+
+      # A date/time column's boundary is a date or time, and any date or time
+      # lies within Support::TimeValue::YEARS.
+      def cursor_time_minted?(type, value)
+        time_value = ConcernsOnRails::Support::TimeValue
+        return false if time_value.temporal_type?(type) && !time_value.temporal?(value)
+
+        time_value.representable?(value)
+      end
+
+      # A float column can hold a non-finite boundary on PostgreSQL (±Infinity
+      # and NaN) and SQLite (±Infinity; it stores NaN as NULL). Anywhere else
+      # — another column type, NaN on SQLite, MySQL, which stores none — it is
+      # tampering, and refused outright: adapters disagree on how (or
+      # whether) to quote one.
+      def cursor_non_finite_minted?(model, type, value)
+        return false unless type.type == :float
+
+        adapter = model.connection.adapter_name
+        adapter.match?(/postgres/i) || (adapter.match?(/sqlite/i) && !value.nan?)
       end
 
       # Pre-bidirectional cursors carry no "d" — they are forward cursors and
@@ -702,6 +745,7 @@ module ConcernsOnRails
       # tuple cannot say "NULLs last" (`(c, id) > (v, x)` is never TRUE for a
       # NULL c), so :auto AND an explicit :row fall back to it.
       def cursor_predicate(model, pairs, values, nullable: [], backward: false)
+        values = values.map { |value| cursor_sql_value(model, value) }
         if nullable.empty? && cursor_row_predicate?(model, pairs)
           cursor_row_predicate(model, pairs, values)
         else
@@ -709,6 +753,19 @@ module ConcernsOnRails
         end
       end
 
+      # A boundary as the WHERE binds it. Only an infinite float on SQLite
+      # differs: SQLite reads no quoted literal as infinity — Rails before 7.2
+      # quote Float::INFINITY as the bare word Infinity (no such column, a
+      # 500), later ones as the TEXT 'Infinity', which SQLite sorts after
+      # every number, so the boundary row matched again and the walk never
+      # ended — but it reads a literal past the largest double as one.
+      # PostgreSQL reads its quoted 'Infinity' / 'NaN' as float8.
+      def cursor_sql_value(model, value)
+        return value unless value.is_a?(Float) && value.infinite? && model.connection.adapter_name.match?(/sqlite/i)
+
+        Arel.sql(value.positive? ? "9e999" : "-9e999")
+      end
+
       # :auto picks :row when it is expressible (>= 2 uniform-direction
       # columns) and the adapter supports tuples, silently falling back
       # otherwise; an explicit :row raises on mixed directions instead of

data/lib/concerns_on_rails/controllers/filterable.rb

@@ -186,12 +186,22 @@ module ConcernsOnRails
         return options[:with].call(relation, type ? type.cast(value) : value) unless type
 
         operand = ConcernsOnRails::Support::NumericOperand.classify(value, type, column_type: nil)
-        return options[:with].call(relation, type.cast(value)) if operand.nil?
+        return options[:with].call(relation, filterable_lambda_cast(type, value)) if operand.nil?
         return relation.none unless operand.status == :exact
 
         options[:with].call(relation, operand.value)
       end
 
+      # What the type answers for any other String it cannot read: nil — also
+      # for the one Rails 6.0–7.0 raised on (filterable_type_cast).
+      # A date/time `type:` hands over nil, too, for an operand that is no
+      # date or time (a JSON body's Integer, which the date cast returns as
+      # is): the lambda would bind it raw, exactly the comparison bug.
+      def filterable_lambda_cast(type, value)
+        cast = filterable_type_cast(type, value)
+        filterable_uncastable?(type, value, cast) ? nil : cast
+      end
+
       # ?price[gte]=10&price[lte]=50 — unknown keys are ignored.
       def apply_filter_operator_hash(relation, field, hash, options)
         hash.each do |key, raw|
@@ -333,7 +343,7 @@ module ConcernsOnRails
       # list left empty matches nothing (`in`) or every non-NULL row
       # (`not_in`, exactly what `!=` / NOT IN would answer).
       def apply_filter_equality(relation, field, value, negate: false)
-        kept = filterable_equality_values(relation, field, value.is_a?(Array) ? value : [value])
+        kept = filterable_equality_values(relation, field, value.is_a?(Array) ? value : [value], negate: negate)
         return filterable_where(relation, field, value, negate) if kept.nil?
         return relation.none if kept == :uncastable
         return negate ? relation.where.not(field => nil) : relation.none if kept.empty?
@@ -361,28 +371,51 @@ module ConcernsOnRails
 
       # The members to keep on a numeric or date/time column, or nil to keep
       # the raw value unchanged.
-      def filterable_equality_values(relation, field, values)
+      def filterable_equality_values(relation, field, values, negate: false)
         filterable_numeric_equality_values(relation, field, values) ||
-          filterable_time_equality_values(relation, field, values)
-      end
-
-      # A date or time no stored value can equal (outside TimeValue::YEARS)
-      # drops out of the list, like an out-of-range number. On PostgreSQL it
-      # used to raise (a 500). nil when no member is out of range, so the
-      # caller keeps its unchanged path. A member that casts to no date or time
-      # stays exactly as it was.
-      def filterable_time_equality_values(relation, field, values)
+          filterable_time_equality_values(relation, field, values, negate)
+      end
+
+      # A date or time no stored value can equal drops out of the list, like
+      # an out-of-range number: one outside TimeValue::YEARS (on PostgreSQL it
+      # used to raise, a 500). A value the cast hands back unchanged — no
+      # date or time at all (a JSON body's Integer: a 500 on PostgreSQL, a
+      # coerced date on MySQL) — fails the whole filter closed (:uncastable),
+      # as an uncastable number does. A String Rails 6.0–7.0 cannot parse
+      # (filterable_type_cast; `where`'s own cast raised a 500) is answered as
+      # 7.1+ answers it, casting it to nil: it equals nothing (dropped from
+      # `=`/`in`), and `!=`/NOT IN against NULL matches nothing (`not`/`not_in`
+      # fail closed). nil when no member drops, so the caller keeps its
+      # unchanged path. A String that casts to nil stays as it was.
+      def filterable_time_equality_values(relation, field, values, negate)
         column_type = filterable_column_type(relation, field)
         return nil unless column_type
 
-        kept = values.reject { |member| filterable_time_beyond(filterable_equality_cast(column_type, member)) }
+        casts = values.map { |member| [member, filterable_equality_cast(column_type, member)] }
+        return :uncastable if filterable_any_time_uncastable?(column_type, casts, negate)
+
+        kept = casts.reject { |_member, cast| filterable_time_never_equal?(cast) }.map(&:first)
         kept.size == values.size ? nil : kept
       end
 
+      def filterable_time_never_equal?(cast)
+        cast.equal?(UNCASTABLE) || filterable_time_beyond(cast)
+      end
+
+      def filterable_any_time_uncastable?(column_type, casts, negate)
+        casts.any? do |member, cast|
+          next negate if cast.equal?(UNCASTABLE)
+          next false if member.nil? || cast.nil?
+
+          filterable_uncastable?(column_type, member, cast)
+        end
+      end
+
       # Only to classify the member: `where` still casts the raw value itself,
-      # so a type whose cast raises is left to fail (or not) exactly as before.
+      # so a type whose cast raises is left to fail (or not) exactly as before
+      # — except the date/time cast filterable_type_cast answers UNCASTABLE for.
       def filterable_equality_cast(column_type, member)
-        column_type.cast(member)
+        filterable_type_cast(column_type, member)
       rescue StandardError
         nil
       end
@@ -457,9 +490,23 @@ module ConcernsOnRails
       def filter_cast(relation, field, value, options)
         type = options[:type] || filterable_column_type(relation, field)
         return value if type.nil?
-        return UNCASTABLE if filterable_uncastable?(type, value)
+        return UNCASTABLE if filterable_non_numeric?(type, value)
+
+        cast = filterable_type_cast(type, value)
+        filterable_uncastable?(type, value, cast) ? UNCASTABLE : cast
+      end
 
+      # type.cast, or UNCASTABLE for a String a date/time type cannot parse on
+      # Rails 6.0–7.0: Date._parse refuses one over 128 characters with an
+      # ArgumentError, which their date and time casts only rescue (to nil)
+      # from 7.1 on, so `?happened_on_gte=<129 characters>` was a 500. Any
+      # other type's ArgumentError is left alone.
+      def filterable_type_cast(type, value)
         type.cast(value)
+      rescue ArgumentError
+        raise unless ConcernsOnRails::Support::TimeValue.temporal_type?(type)
+
+        UNCASTABLE
       end
 
       # PostgreSQL's Column answers `array` (its sql_type drops the "[]", so
@@ -484,20 +531,35 @@ module ConcernsOnRails
 
       # Numeric types are checked against the string BEFORE casting, because
       # `Integer#cast`/`Decimal#cast` answer 0 for any non-numeric string rather
-      # than nil — the cast result alone cannot tell "0" from "twelve". Every
-      # other type reports the failure by casting to nil (blank values never get
-      # this far; `apply_filter_operator` skipped them).
-      def filterable_uncastable?(type, value)
-        return type.cast(value).nil? unless NUMERIC_TYPES.include?(type.type)
+      # than nil — the cast result alone cannot tell "0" from "twelve".
+      def filterable_non_numeric?(type, value)
+        return false unless NUMERIC_TYPES.include?(type.type)
         return false if value.is_a?(Numeric)
 
         !NUMERIC_STRING.match?(value.to_s)
       end
 
+      # Every other type reports the failure by casting to nil (blank values
+      # never get this far; `apply_filter_operator` skipped them) — except the
+      # date/time types, whose casts return a non-String they cannot read
+      # unchanged: a JSON body's `{"happened_on_gte": 12345}` bound
+      # `happened_on >= 12345`, which SQLite answered with every row (it sorts
+      # any number before a date's text) and PostgreSQL with a 500. Their cast
+      # must be a date or time, or the ±Float::INFINITY PostgreSQL's own types
+      # read "infinity" as — which only a String can ask for.
+      def filterable_uncastable?(type, value, cast)
+        return true if cast.nil? || cast.equal?(UNCASTABLE)
+        return false unless ConcernsOnRails::Support::TimeValue.temporal_type?(type)
+        return false if ConcernsOnRails::Support::TimeValue.temporal?(cast)
+
+        !(value.is_a?(String) && cast.is_a?(Float) && cast.infinite?)
+      end
+
       # Scalars (and arrays of scalars, which AR turns into `IN (...)`) are safe
       # to pass to .where; a Hash / ActionController::Parameters is not — and
       # since 1.22 neither is an array CONTAINING one (`?status[][x]=1` used to
-      # slip through as [Parameters] and 500 with a TypeError).
+      # slip through as [Parameters] and 500 with a TypeError), nor, now, an
+      # array of arrays (`?status[][]=a&status[][]=b`, the same TypeError).
       def filterable_scalar?(value)
         ConcernsOnRails::Support::ScalarParam.where_safe?(value)
       end

data/lib/concerns_on_rails/controllers/localizable.rb

@@ -142,11 +142,11 @@ module ConcernsOnRails
 
       def parse_accept_language(header, allowed)
         ranked_accept_languages(header).each do |lang|
-          # Full tag first (fr-CA matches an available :"fr-CA"), then the
-          # primary subtag (fr). Pre-1.22 the region was discarded outright,
-          # so a regional locale in available: could never match its own
-          # Accept-Language tag.
-          match = match_locale(lang, allowed) || match_locale(lang.split("-").first, allowed)
+          # Full tag first (fr-CA matches an available :"fr-CA" or :fr_CA),
+          # then the primary subtag (fr). Pre-1.22 the region was discarded
+          # outright, so a regional locale in available: could never match its
+          # own Accept-Language tag.
+          match = match_locale(lang, allowed) || match_locale(lang.split(/[-_]/).first, allowed)
           return match if match
         end
         nil
@@ -184,11 +184,24 @@ module ConcernsOnRails
         QVALUE.match?(weight) ? weight.to_f : 0.0
       end
 
+      # Case-insensitive, with `_` and `-` as ONE separator: Accept-Language
+      # tags are BCP 47 (`pt-BR`) while Rails locales are often `:pt_BR`. The
+      # concern's own Content-Language already writes one as the other, yet a
+      # client sending that tag back fell through to `pt` or the default. The
+      # app's own symbol is what comes back.
+      # An exact (case-insensitive) spelling wins, so an app offering both
+      # :pt_BR and :"pt-BR" gets the one the client named.
       def match_locale(candidate, allowed)
         return nil if candidate.blank?
 
-        wanted = candidate.to_s.downcase
-        allowed.find { |loc| loc.to_s.downcase == wanted }
+        exact = candidate.to_s.downcase
+        wanted = locale_match_key(candidate)
+        allowed.find { |loc| loc.to_s.downcase == exact } ||
+          allowed.find { |loc| locale_match_key(loc) == wanted }
+      end
+
+      def locale_match_key(locale)
+        locale.to_s.downcase.tr("_", "-")
       end
     end
   end

data/lib/concerns_on_rails/controllers/paginatable.rb

@@ -377,10 +377,13 @@ module ConcernsOnRails
 
       # Dig the configured path out of params: `["page"]` → params[:page];
       # `["page", "number"]` → params[:page][:number]. A scalar where a Hash
-      # is expected yields nil (→ the default), like any other garbage.
+      # is expected yields nil (→ the default), like any other garbage. Only
+      # a Hash / Parameters is dug into: a JSON body's `{"page": 2}` under
+      # `style: :jsonapi` reached `2["number"]` (Integer#[] reads a bit) and
+      # raised TypeError, a 500.
       def pagination_param(path)
         path.reduce(params) do |node, key|
-          break nil unless node.respond_to?(:[]) && !node.is_a?(String) && !node.is_a?(Array)
+          break nil unless ConcernsOnRails::Support::ScalarParam.hash_like?(node)
 
           node[key]
         end