dm-rails 1.0.3 → 1.0.4

data/.gitignore

@@ -31,6 +31,7 @@ measurements
 .bundle
 Gemfile.local
 Gemfile.lock
+Gemfile.local.lock
 
 ## PROJECT::SPECIFIC
 vendor

data/Gemfile

@@ -5,7 +5,7 @@ DM_VERSION = '~> 1.0.0'
 
 group :runtime do
 
-  git 'git://github.com/rails/rails.git' do
+  git 'git://github.com/rails/rails.git', :branch => '3-0-stable' do
 
     gem 'activesupport', :require => 'active_support'
     gem 'actionpack',    :require => 'action_pack'

data/README.rdoc

@@ -6,18 +6,18 @@ Creating new datamapper apps on rails3 from scratch is actually really easy. The
 
 == Generating a new application from scratch
 
-It's really easy to go from zero gems to a working rails3 app using datamapper. All you need is the latest {rubygems}[http://docs.rubygems.org/read/chapter/3] release, {bundler}[http://gembundler.com] and {rails}[http://github.com/rails/rails]
+To go from zero gems to a working rails3 app using datamapper, all you need are the latest {rubygems}[http://docs.rubygems.org/read/chapter/3] release, {bundler}[http://gembundler.com] and {rails}[http://github.com/rails/rails]. After possibly updating your rubygems, issue the following:
 
-  gem update —system # you will need rubygems ~> 1.3.6 for the command below to work
-  gem install bundler --pre (optional, rails will likely pull in a current version)
-  gem install rails --pre
+  gem install rails
 
-Once you have {rails}[http://github.com/rails/rails] and thus {bundler}[http://github.com/carlhuda/bundler] installed, you can bootstrap a rails master branch application with a single command. Yes! A single command. Cool.
+Once you have {rails}[http://github.com/rails/rails] and thus {bundler}[http://github.com/carlhuda/bundler] installed, you can bootstrap a rails application with a single command.
 
   rails new project_name -m http://datamapper.org/templates/rails.rb
 
 When run, the command will print out some options on how to proceed with your newly generated application.
 
+Be aware that this command executes code loaded from the internet! It is currently the simplest way to bootstrap a new application, and a commonly used way to reuse rails application templates.  Have a look at {rails templates}[http://github.com/datamapper/datamapper.github.com/tree/master/templates/] to know exactly what we'll do to your system, but be aware that a man-in-the-middle attack could alter that.
+
 == rspec support
 
 I haven't yet tested rspec support extensively, but the basics are working after a few modifications to the spec/spec_helper.rb file that the necessary
@@ -74,7 +74,7 @@ If you haven't done so for whatever reason, use
 
 instead.
 
-You may have noticed that rspec is included into both the `:development` and `:test` groups in the Gemfile the application template generated. I couldn't find another way to make it so that the above mentioned way of running the specs work. If rspec is not included into the `:development` group, rails must be informed explicitly about the environment it should run in, by prefixing the above rake commands with `RAILS_ENV=test`. 
+You may have noticed that rspec is included into both the `:development` and `:test` groups in the Gemfile the application template generated. I couldn't find another way to make it so that the above mentioned way of running the specs work. If rspec is not included into the `:development` group, rails must be informed explicitly about the environment it should run in, by prefixing the above rake commands with `RAILS_ENV=test`.
 
 == Developing dm-rails
 
@@ -105,7 +105,7 @@ Using {bundler}[http://github.com/carlhuda/bundler] it's really easy to get an a
   gem 'actionmailer',       RAILS_VERSION, :require => 'action_mailer'
   gem 'railties',           RAILS_VERSION, :require => 'rails'
 
-  gem 'dm-rails',          DM_VERSION # !NOTE! 1.0.2 will be released soon
+  gem 'dm-rails',          '~> 1.0.3'
   gem 'dm-sqlite-adapter', DM_VERSION
 
   # You can use any of the other available database adapters.
@@ -487,6 +487,42 @@ or that you want to use your own naming convention, that is implemented in e.g.
 
 For more detailed documentation about DataMapper naming conventions and the ones that are available by default, have a look at http://rdoc.info/projects/datamapper/dm-core and search for _NamingConventions_ in the Class List.
 
+== Mass assignment protection
+
+By default, `dm-rails` doesn't activate any support for mass assignment protection.
+You can however activate it for your application by including the relevant module
+either globally into all known models, or on a per model basis (the latter being
+advised, for reasons explained below).
+
+  # Global installation (config/application.rb is a good place for adding this)
+  #
+  # Make .attr_protected and .attr_accessible available to all models
+  # NOTE: This won't work if you have code that includes DataMapper::Resource
+  # into any other module. This is done by dm-is-remixable for example, so to
+  # be safe, you should only do that if you really know what you're doing.
+  # Quite some plugins make use of dm-is-remixable, so be sure to check that out
+  # before you go ahead and do the following in your config/application.rb
+  DataMapper::Model.append_inclusions(Rails::DataMapper::MassAssignmentSecurity)
+
+  # Local installation (recommended)
+  #
+  # Include the mass assignment protection only into models that actually need it
+  # This is the preferred way of doing things, at least for now. You will only
+  # have the functionality available where you actually need it, and you don't run
+  # into problems with third party code including DataMapper::Resource into other
+  # modules.
+
+  class Person
+
+    include DataMapper::Resource
+    include DataMapper::MassAssignmentSecurity
+
+    property :id, Serial
+    property :login, String
+
+    attr_protected :login
+
+  end
 
 == Using additional datamapper plugins
 
@@ -549,6 +585,7 @@ Thx to all contributors, every patch, big or small is very much appreciated!
 * Patrik Sundberg ({sundbp}[http://github.com/sundbp])
 * Corin Langosch ({gucki}[http://github.com/gucki])
 * Jared Morgan ({jm81}[http://github.com/jm81])
+* Blake Gentry ({bgentry}[http://github.com/bgentry])
 
 == Copyright
 

data/Rakefile

@@ -16,10 +16,10 @@ begin
     gem.rubyforge_project = 'datamapper'
 
     gem.add_dependency 'dm-core',         '~> 1.0.0'
-    gem.add_dependency 'dm-active_model', '~> 1.0.0'
-    gem.add_dependency 'activesupport',   '~> 3.0.0.rc'
-    gem.add_dependency 'actionpack',      '~> 3.0.0.rc'
-    gem.add_dependency 'railties',        '~> 3.0.0.rc'
+    gem.add_dependency 'dm-active_model', '~> 1.0.3'
+    gem.add_dependency 'activesupport',   '~> 3.0.0'
+    gem.add_dependency 'actionpack',      '~> 3.0.0'
+    gem.add_dependency 'railties',        '~> 3.0.0'
   end
 
   Jeweler::GemcutterTasks.new

data/VERSION

@@ -1,2 +1,2 @@
-1.0.3
+1.0.4
 

data/dm-rails.gemspec

@@ -5,11 +5,11 @@
 
 Gem::Specification.new do |s|
   s.name = %q{dm-rails}
-  s.version = "1.0.3"
+  s.version = "1.0.4"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["Martin Gamsjaeger (snusnu)", "Dan Kubb"]
-  s.date = %q{2010-08-11}
+  s.date = %q{2010-10-24}
   s.description = %q{Integrate DataMapper with Rails 3}
   s.email = %q{gamsnjaga@gmail.com}
   s.extra_rdoc_files = [
@@ -27,6 +27,7 @@ Gem::Specification.new do |s|
      "dm-rails.gemspec",
      "lib/dm-rails.rb",
      "lib/dm-rails/configuration.rb",
+     "lib/dm-rails/mass_assignment_security.rb",
      "lib/dm-rails/middleware/identity_map.rb",
      "lib/dm-rails/railtie.rb",
      "lib/dm-rails/railties/controller_runtime.rb",
@@ -64,23 +65,23 @@ Gem::Specification.new do |s|
 
     if Gem::Version.new(Gem::VERSION) >= Gem::Version.new('1.2.0') then
       s.add_runtime_dependency(%q<dm-core>, ["~> 1.0.0"])
-      s.add_runtime_dependency(%q<dm-active_model>, ["~> 1.0.0"])
-      s.add_runtime_dependency(%q<activesupport>, ["~> 3.0.0.rc"])
-      s.add_runtime_dependency(%q<actionpack>, ["~> 3.0.0.rc"])
-      s.add_runtime_dependency(%q<railties>, ["~> 3.0.0.rc"])
+      s.add_runtime_dependency(%q<dm-active_model>, ["~> 1.0.3"])
+      s.add_runtime_dependency(%q<activesupport>, ["~> 3.0.0"])
+      s.add_runtime_dependency(%q<actionpack>, ["~> 3.0.0"])
+      s.add_runtime_dependency(%q<railties>, ["~> 3.0.0"])
     else
       s.add_dependency(%q<dm-core>, ["~> 1.0.0"])
-      s.add_dependency(%q<dm-active_model>, ["~> 1.0.0"])
-      s.add_dependency(%q<activesupport>, ["~> 3.0.0.rc"])
-      s.add_dependency(%q<actionpack>, ["~> 3.0.0.rc"])
-      s.add_dependency(%q<railties>, ["~> 3.0.0.rc"])
+      s.add_dependency(%q<dm-active_model>, ["~> 1.0.3"])
+      s.add_dependency(%q<activesupport>, ["~> 3.0.0"])
+      s.add_dependency(%q<actionpack>, ["~> 3.0.0"])
+      s.add_dependency(%q<railties>, ["~> 3.0.0"])
     end
   else
     s.add_dependency(%q<dm-core>, ["~> 1.0.0"])
-    s.add_dependency(%q<dm-active_model>, ["~> 1.0.0"])
-    s.add_dependency(%q<activesupport>, ["~> 3.0.0.rc"])
-    s.add_dependency(%q<actionpack>, ["~> 3.0.0.rc"])
-    s.add_dependency(%q<railties>, ["~> 3.0.0.rc"])
+    s.add_dependency(%q<dm-active_model>, ["~> 1.0.3"])
+    s.add_dependency(%q<activesupport>, ["~> 3.0.0"])
+    s.add_dependency(%q<actionpack>, ["~> 3.0.0"])
+    s.add_dependency(%q<railties>, ["~> 3.0.0"])
   end
 end
 

data/lib/dm-rails/configuration.rb

@@ -8,18 +8,19 @@ module Rails
 
     class Configuration
 
-      def self.for(root, database_yml_hash)
-        Rails::DataMapper.configuration ||= new(root, database_yml_hash)
-      end
+      attr_accessor :raw
+      attr_accessor :root
 
-      attr_reader :root, :raw
+      def self.create
+        Rails::DataMapper.configuration ||= new
+      end
 
       def environments
         raw.keys
       end
 
       def repositories
-        @repositories ||= @raw.reject { |k,v| k =~ /defaults/ }.inject({}) do |repositories, pair|
+        @repositories ||= raw.reject { |k,v| k =~ /defaults/ }.inject({}) do |repositories, pair|
           environment, config = pair.first, pair.last
           repositories[environment] = begin
             c = config['repositories'] || {}
@@ -36,24 +37,31 @@ module Rails
 
     private
 
-      def initialize(root, database_yml_hash)
-        @root, @raw = root, database_yml_hash
-      end
-
       def normalize_repository_config(hash)
         config = {}
         hash.each do |key, value|
+
           config[key] = if value.kind_of?(Hash)
             normalize_repository_config(value)
           elsif key == 'port'
             value.to_i
           elsif key == 'adapter' && value == 'postgresql'
             'postgres'
-          elsif key == 'database' && hash['adapter'] == 'sqlite3'
-            value == ':memory:' ? value : File.expand_path(hash['database'], root)
+          elsif (key == 'database' || key == 'path') && hash['adapter'] =~ /sqlite/
+            value == ':memory:' ? value : File.expand_path(hash[key], root)
           else
             value
           end
+
+          # FIXME Rely on a new dm-sqlite-adapter to do the right thing
+          # For now, we need to make sure that both 'path' and 'database'
+          # point to the same thing, since dm-sqlite-adapter always passes
+          # both to the underlying do_sqlite3 adapter and there's no
+          # guarantee which one will be used
+
+          config['path']     = config[key] if key == 'database'
+          config['database'] = config[key] if key == 'path'
+
         end
         config
       end

data/lib/dm-rails/mass_assignment_security.rb

@@ -0,0 +1,65 @@
+require 'dm-core'
+require 'active_support/core_ext/class/attribute'
+require 'active_support/concern'
+require 'active_model'
+
+module ActiveModel
+  module MassAssignmentSecurity
+    module Sanitizer
+      # Returns all attributes not denied by the authorizer. Property keys can
+      # be a Symbol, String, DataMapper::Property, or DataMapper::Relationship
+      def sanitize(attributes)
+        sanitized_attributes = attributes.reject do |key, value|
+          key_name = key.name rescue key
+          deny?(key_name)
+        end
+        debug_protected_attribute_removal(attributes, sanitized_attributes)
+        sanitized_attributes
+      end
+    end
+  end
+end
+
+module DataMapper
+  # = Active Model Mass-Assignment Security
+  module MassAssignmentSecurity
+    extend ::ActiveSupport::Concern
+    include ::ActiveModel::MassAssignmentSecurity
+
+    module ClassMethods
+      extend ::ActiveModel::MassAssignmentSecurity::ClassMethods
+
+      def logger
+        @logger ||= ::DataMapper.logger
+      end
+
+    end
+
+    # Allows you to set all the attributes at once by passing in a hash with keys
+    # matching the attribute names (which again matches the column names).
+    #
+    # If +guard_protected_attributes+ is true (the default), then sensitive
+    # attributes can be protected from this form of mass-assignment by using
+    # the +attr_protected+ macro. Or you can alternatively specify which
+    # attributes *can* be accessed with the +attr_accessible+ macro. Then all the
+    # attributes not included in that won't be allowed to be mass-assigned.
+    #
+    #   class User < ActiveRecord::Base
+    #     attr_protected :is_admin
+    #   end
+    #
+    #   user = User.new
+    #   user.attributes = { :username => 'Phusion', :is_admin => true }
+    #   user.username   # => "Phusion"
+    #   user.is_admin?  # => false
+    #
+    #   user.send(:attributes=, { :username => 'Phusion', :is_admin => true }, false)
+    #   user.is_admin?  # => true
+    def attributes=(attributes, guard_protected_attributes = true)
+      attributes = sanitize_for_mass_assignment(attributes) if guard_protected_attributes
+      super(attributes)
+    end
+
+  end
+end
+

data/lib/dm-rails/railtie.rb

@@ -16,21 +16,26 @@ require 'dm-rails/setup'
 require "dm-rails/railties/log_subscriber"
 require "dm-rails/railties/i18n_support"
 
+# The module provided in there is made available
+# but users will still need to include it into the
+# models they want it to use it in.
+require 'dm-rails/mass_assignment_security'
 
 module Rails
   module DataMapper
 
     class Railtie < Rails::Railtie
 
+      config.data_mapper = Rails::DataMapper::Configuration.create
+
       config.generators.orm :data_mapper, :migration => true
 
 
       # Support overwriting crucial steps in subclasses
 
       def configure_data_mapper(app)
-        app.config.data_mapper = Rails::DataMapper::Configuration.for(
-          Rails.root, app.config.database_configuration
-        )
+        app.config.data_mapper.root = Rails.root
+        app.config.data_mapper.raw  = app.config.database_configuration
       end
 
       def setup_i18n_support(app)

data/lib/dm-rails/railties/controller_runtime.rb

@@ -43,4 +43,3 @@ module Rails
     end
   end
 end
-

data/lib/dm-rails/railties/database.rake

@@ -6,10 +6,6 @@ namespace :db do
   desc 'Create the database, load the schema, and initialize with the seed data'
   task :setup => [ 'db:create', 'db:automigrate', 'db:seed' ]
 
-  namespace :test do
-    task :prepare => ['db:setup']
-  end
-
   namespace :create do
     desc 'Create all the local databases defined in config/database.yml'
     task :all => :environment do
@@ -17,12 +13,9 @@ namespace :db do
     end
   end
 
-  desc "Create the database(s) defined in config/database.yml for the current Rails.env - also creates the test database(s) if Rails.env.development?"
+  desc "Create all local databases defined for the current Rails.env"
   task :create => :environment do
     Rails::DataMapper.storage.create_environment(Rails::DataMapper.configuration.repositories[Rails.env])
-    if Rails.env.development? && Rails::DataMapper.configuration.repositories['test']
-      Rails::DataMapper.storage.create_environment(Rails::DataMapper.configuration.repositories['test'])
-    end
   end
 
   namespace :drop do
@@ -32,7 +25,7 @@ namespace :db do
     end
   end
 
-  desc "Drops the database(s) for the current Rails.env - also drops the test database(s) if Rails.env.development?"
+  desc "Drop all local databases defined for the current Rails.env"
   task :drop => :environment do
     Rails::DataMapper.storage.drop_environment(Rails::DataMapper.configuration.repositories[Rails.env])
   end
@@ -42,7 +35,6 @@ namespace :db do
   task :automigrate => :environment do
     require 'dm-migrations'
     Rails::DataMapper.configuration.repositories[Rails.env].each do |repository, config|
-      ::DataMapper.setup(repository.to_sym, config)
       ::DataMapper.auto_migrate!(repository.to_sym)
       puts "[datamapper] Finished auto_migrate! for :#{repository} repository '#{config['database']}'"
     end
@@ -52,7 +44,6 @@ namespace :db do
   task :autoupgrade => :environment do
     require 'dm-migrations'
     Rails::DataMapper.configuration.repositories[Rails.env].each do |repository, config|
-      ::DataMapper.setup(repository.to_sym, config)
       ::DataMapper.auto_upgrade!(repository.to_sym)
       puts "[datamapper] Finished auto_upgrade! for :#{repository} repository '#{config['database']}'"
     end

data/lib/dm-rails/railties/log_subscriber.rb

@@ -52,4 +52,3 @@ module DataMapper
 end
 
 DataMapper::Railties::LogSubscriber.attach_to :data_mapper
-

data/lib/dm-rails/storage.rb

@@ -67,13 +67,11 @@ module Rails
       end
 
       def create
-        _create
-        puts "[datamapper] Created database '#{database}'"
+        puts create_message if _create
       end
 
       def drop
-        _drop
-        puts "[datamapper] Dropped database '#{database}'"
+        puts drop_message if _drop
       end
 
       def database
@@ -92,11 +90,28 @@ module Rails
         @charset ||= config['charset'] || ENV['CHARSET'] || 'utf8'
       end
 
+      def create_message
+        "[datamapper] Created database '#{database}'"
+      end
+
+      def drop_message
+        "[datamapper] Dropped database '#{database}'"
+      end
+
       class Sqlite < Storage
         def _create
-          return if in_memory?
-          # TODO don't to_s the path once a do_sqlite3 gem supports it
-          ::DataMapper.setup(name, config.merge('database' => path.to_s))
+          # This is a noop for sqlite
+          #
+          # Both auto_migrate!/auto_upgrade! will create the actual database
+          # if the connection has been setup properly and there actually
+          # are statements to execute (i.e. at least one model is declared)
+          #
+          # DataMapper.setup alone won't create the actual database so there
+          # really is no API to simply create an empty database for sqlite3.
+          #
+          # we return true to indicate success nevertheless
+
+          true
         end
 
         def _drop
@@ -104,6 +119,10 @@ module Rails
           path.unlink if path.file?
         end
 
+        def create_message
+          "[datamapper] db:create is a noop for sqlite3, use db:automigrate instead (#{database})"
+        end
+
       private
 
         def in_memory?

data/tasks/local_gemfile.rake

@@ -1,16 +1,14 @@
 desc "Support bundling from local source code (allows BUNDLE_GEMFILE=Gemfile.local bundle foo)"
 task :local_gemfile do |t|
 
-  root              = Pathname(__FILE__).dirname.parent
-  datamapper        = root.parent
-
-  source_regex     = /DATAMAPPER = 'git:\/\/github.com\/datamapper'/
-  gem_source_regex = /:git => \"#\{DATAMAPPER\}\/(.+?)(?:\.git)?\"/
+  root       = Pathname(__FILE__).dirname.parent
+  datamapper = root.parent
 
   root.join('Gemfile.local').open('w') do |f|
     root.join('Gemfile').open.each do |line|
-      line.sub!(source_regex,     "DATAMAPPER = '#{datamapper}'")
-      line.sub!(gem_source_regex, ':path => "#{DATAMAPPER}/\1"')
+      line.sub!(/DATAMAPPER = 'git:\/\/github.com\/datamapper'/, "DATAMAPPER = '#{datamapper}'")
+      line.sub!(/:git => \"#\{DATAMAPPER\}\/(.+?)(?:\.git)?\"/,  ':path => "#{DATAMAPPER}/\1"')
+      line.sub!(/do_options\[:git\] = \"#\{DATAMAPPER\}\/(.+?)(?:\.git)?\"/,  'do_options[:path] = "#{DATAMAPPER}/\1"')
       f.puts line
     end
   end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification 
 name: dm-rails
 version: !ruby/object:Gem::Version 
-  hash: 17
+  hash: 31
   prerelease: false
   segments: 
   - 1
   - 0
-  - 3
-  version: 1.0.3
+  - 4
+  version: 1.0.4
 platform: ruby
 authors: 
 - Martin Gamsjaeger (snusnu)
@@ -16,7 +16,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2010-08-11 00:00:00 +02:00
+date: 2010-10-24 00:00:00 +02:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency 
@@ -43,12 +43,12 @@ dependencies:
     requirements: 
     - - ~>
       - !ruby/object:Gem::Version 
-        hash: 23
+        hash: 17
         segments: 
         - 1
         - 0
-        - 0
-        version: 1.0.0
+        - 3
+        version: 1.0.3
   type: :runtime
   version_requirements: *id002
 - !ruby/object:Gem::Dependency 
@@ -59,13 +59,12 @@ dependencies:
     requirements: 
     - - ~>
       - !ruby/object:Gem::Version 
-        hash: 7712042
+        hash: 7
         segments: 
         - 3
         - 0
         - 0
-        - rc
-        version: 3.0.0.rc
+        version: 3.0.0
   type: :runtime
   version_requirements: *id003
 - !ruby/object:Gem::Dependency 
@@ -76,13 +75,12 @@ dependencies:
     requirements: 
     - - ~>
       - !ruby/object:Gem::Version 
-        hash: 7712042
+        hash: 7
         segments: 
         - 3
         - 0
         - 0
-        - rc
-        version: 3.0.0.rc
+        version: 3.0.0
   type: :runtime
   version_requirements: *id004
 - !ruby/object:Gem::Dependency 
@@ -93,13 +91,12 @@ dependencies:
     requirements: 
     - - ~>
       - !ruby/object:Gem::Version 
-        hash: 7712042
+        hash: 7
         segments: 
         - 3
         - 0
         - 0
-        - rc
-        version: 3.0.0.rc
+        version: 3.0.0
   type: :runtime
   version_requirements: *id005
 description: Integrate DataMapper with Rails 3
@@ -122,6 +119,7 @@ files:
 - dm-rails.gemspec
 - lib/dm-rails.rb
 - lib/dm-rails/configuration.rb
+- lib/dm-rails/mass_assignment_security.rb
 - lib/dm-rails/middleware/identity_map.rb
 - lib/dm-rails/railtie.rb
 - lib/dm-rails/railties/controller_runtime.rb