easy-jsonapi 1.0.3 → 1.0.8

data/.rubocop.yml

@@ -1,6 +1,6 @@
 AllCops:
   NewCops: enable
-  TargetRubyVersion: '3.0.0'
+  TargetRubyVersion: '3.0.1'
   SuggestExtensions: false
 
 Metrics/AbcSize:

data/.ruby-version

@@ -1 +1 @@
-3.0.0
+3.0.1

data/.travis.yml

@@ -0,0 +1,8 @@
+language: ruby
+cache: bundler
+rvm:
+  - 3.0.1
+before_install:
+- gem install bundler
+- bundler install
+script: bundle exec rake build

data/CHANGELOG.md

@@ -1,5 +1,29 @@
 # CHANGELOG
 
+## 1.0.8 - 2020-05-04
+
+- Updated dependencies to fix security vulnerability in rexml
+
+## 1.0.7 - 2020-03-31
+
+- Fixed bug in JSONAPI::Parser::JSONParser that would serialize hashes with symbol key values instead of string
+
+## 1.0.6 - 2020-03-30
+
+- Fixed bug in JSONAPI::Middleware that was not checking for environment variables properly
+
+## 1.0.5 - 2020-03-30
+
+- Fixed bug in JSONAPI::Exceptions::HeadersExceptions that didn't check for user required headers requirements
+- Fixed bug in JSONAPI::Exceptions::QueryParamExceptions that didn't check for user required query param requirements
+- Added more tests to the middleware
+- Updated Documentation
+
+## 1.0.4 - 2020-03-28
+
+- Fixed JSONAPI::ExceptionsHeadersExceptions bug
+- Updated README files
+
 ## 1.0.3 - 2020-03-25
 
 - Updated JSONAPI::Exceptions::HeadersExceptions to allow wildcard matching for Accept header

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    easy-jsonapi (1.0.3)
+    easy-jsonapi (1.0.8)
       oj (~> 3.10)
 
 GEM
@@ -24,7 +24,7 @@ GEM
       racc (~> 1.4)
     nokogiri (1.11.2-x86_64-linux)
       racc (~> 1.4)
-    oj (3.11.3)
+    oj (3.11.5)
     parallel (1.20.1)
     parser (3.0.0.0)
       ast (~> 2.4.1)

data/README.md

@@ -5,11 +5,13 @@
 
 # easy-jsonapi
 
-[![Gem Version](https://badge.fury.io/rb/easy-jsonapi.svg)](https://badge.fury.io/rb/easy-jsonapi)
-![](https://ruby-gem-downloads-badge.herokuapp.com/easy-jsonapi?type=total&color=brightgreen)
-[![Ruby Style Guide](https://img.shields.io/badge/code_style-rubocop-brightgreen.svg)](https://github.com/rubocop/rubocop)
-[![License](https://img.shields.io/github/license/Curatess/easy-jsonapi)](https://img.shields.io)
-[![Build Status](https://img.shields.io/codecov/c/github/curatess/easy-jsonapi)](https://img.shields.io/codecov/c/github/curatess/easy-jsonapi)
+![Gem Version](https://badge.fury.io/rb/easy-jsonapi.svg)
+![Downloads](https://ruby-gem-downloads-badge.herokuapp.com/easy-jsonapi?type=total&color=brightgreen)
+![Build Status](https://img.shields.io/travis/Curatess/easy-jsonapi/production)
+![Code Coverage](https://img.shields.io/codecov/c/github/curatess/easy-jsonapi)
+![Ruby Style Guide](https://img.shields.io/badge/code_style-rubocop-brightgreen.svg)
+![License](https://img.shields.io/github/license/Curatess/easy-jsonapi)
+
 
 The gem that makes using [JSON:API](https://jsonapi.org/) ***EASY***!
 
@@ -19,9 +21,9 @@ Ever wanted the benefits of [JSONAPI](https://jsonapi.org/) without the learning
 2. A `parser` to interact with requests in a typical Object-Oriented Fashion, providing convenient and efficient access to headers, query parameters, and document members.
 3. A `validator` to check your serialized responses for [JSONAPI](https://jsonapi.org/) compliance.
 
-With its only gem dependency being [Oj](https://github.com/ohler55/oj), ***easy-jsonapi*** is a lightweight, dependable tool, featuring comprehensive error messages and over 500 unit tests allowing developers to spend less time debugging and more time creating.
+With its only gem dependency being [Oj](https://github.com/ohler55/oj), ***easy-jsonapi*** is a lightweight, dependable tool, featuring comprehensive error messages and over ***525 unit tests*** allowing developers to spend less time debugging and more time creating.
 
-As a bonus, flexible user configurations can be added to the middleware providing custom screening on all requests or individual requests depending on the resource type of the endpoint and the given document, header, or query param restrictions from the user.
+As a bonus, flexible user configurations can be added to the middleware providing custom screening on all requests or individual requests depending on the resource type of the endpoint and the user-defined document, header, or query param restrictions.
 
 ## Links
 
@@ -29,6 +31,8 @@ As a bonus, flexible user configurations can be added to the middleware providin
 
 - [*RubyGems* *Repository*](https://rubygems.org/search?query=easy-jsonapi)
 
+- [*Class Diagram*](https://lucid.app/lucidchart/invitations/accept/3d543b29-4171-43cb-94db-9aeb346cdcac)
+
 ## Installation
 
 Add this line to your applications' Gemfile:
@@ -54,13 +58,15 @@ $ gem install easy-jsonapi
 
 ## Quick Start
 
-1. Set up the middleware
+***easy-jsonapi's*** 3 main use cases can be used together or separately, so to get started quickly, do any of the 3 below to begin enjoying the convenience of the library.
+
+- Set up the middleware
 
     ```ruby
     use JSONAPI::Middleware
     ```
 
-2. Parse the rack environment variable and get access to request components
+- Parse the rack environment variable and get access to request components (assumes valid JSON:API requests -- use with middleware to ensure valid requests)
 
     ```ruby
     j_req = JSONAPI::Parser.parse_request(env)
@@ -70,7 +76,7 @@ $ gem install easy-jsonapi
     j_req.body.data.type         # => "person"
     ```
 
-3. Validate your serialized JSON:API before returning it to your clients.
+- Validate your serialized JSON:API before returning it to your clients.
 
     ```ruby
     begin
@@ -120,9 +126,9 @@ use JSONAPI::Middleware
 
 ### Functionality
 
-The easy-jsonapi middleware can opperate in development or production mode.
+The easy-jsonapi middleware can operate in development or production mode.
 
-If `ENV['RACK_ENV']` is set to `:development` or not set at all, the middleware will be opperating in development mode.
+If `ENV['RACK_ENV']` is set to `'development'` or not set at all, the middleware will be operating in development mode.
 
 When the middleware is in development mode it will raise an exception wherever it finds the http request to be non JSONAPI compliant.
 
@@ -133,11 +139,11 @@ The types of exceptions it will raise are:
 - `JSONAPI::Exceptions::QueryParamExceptions::InvalidQueryParam` when an included query parameter is non-compliant
 - `JSONAPI::Exceptions::DocumentExceptions::InvalidDocument` when the body is included and non-compliant
 
-If `ENV['RACK_ENV']` is set to something other than  `:development`, then the middleware will return the appropriate status code error given the JSON:API clause the headers, query params, or document violates.
+If `ENV['RACK_ENV']` is set to something other than  `'development'`, then the middleware will return the appropriate status code error given the JSON:API clause the headers, query params, or document violates.
 
 ### User Configurations
 
-***easy-jsonapi*** has a fair amount of flexibility when it comes to user configurations and plenty of room for extending the current user configurations to include more features. To see the currently available configurations see [UsingUserConfigurations](https://github.com/Curatess/easy-jsonapi/blob/production/docs/UsingUserConfigurations.md) and to propose a new feature create a pull request or ticket on [the github repository](https://github.com/Curatess/easy-jsonapi)
+***easy-jsonapi*** has a fair amount of flexibility when it comes to user configurations but also plenty of room for to add more features. To see the currently available configurations see [UsingUserConfigurations](https://github.com/Curatess/easy-jsonapi/blob/production/docs/UsingUserConfigurations.md) and to propose a new feature create a pull request or ticket on the [dev repository](https://github.com/Curatess/easy-jsonapi/tree/dev).
 
 ## Using the Request Parser
 
@@ -196,7 +202,7 @@ See the [rubydocs](https://rubydoc.info/github/Curatess/easy-jsonapi/proudction)
 
 ## Acknowledgements
 
-The exception checking strategy for `JSONAPI::Exceptions::DocumentExceptions` and some innitial compliance checks are based off [jsonapi-parser](https://github.com/jsonapi-rb/jsonapi-parser). We would like to thank the [jsonapi-rb](https://github.com/jsonapi-rb) team for the document validation work and to all our contributors and users for the continuous support!
+The exception checking strategy for `JSONAPI::Exceptions::DocumentExceptions` and some initial compliance checks are based off [jsonapi-parser](https://github.com/jsonapi-rb/jsonapi-parser). We would like to thank the [jsonapi-rb](https://github.com/jsonapi-rb) team for the document validation work and to all our contributors and users for the continuous support!
 
 ## Releases
 

data/docs/UsingTheRequestObject.md

@@ -69,6 +69,6 @@ j_req.body.jsonapi # The JSONAPI jsonapi member
 j_req.body.to_s # serialized JSONAPI
 j_req.body.to_h # ruby hash representation of JSONAPI 
 
-# NOTE: j_req.body.data returns a resoure or an array of resources depending on the request
+# NOTE: j_req.body.data returns a resource or an array of resources depending on the request
 j_req.body.data # JSONAPI::Document::Resource or [JSONAPI::Document::Resource]
 ```

data/docs/UsingUserConfigurations.md

@@ -17,7 +17,7 @@ use JSONAPI::Middleware do |config_manager|
 end
 ```
 
-To add restrictions to ALL requests use default global config included with the Config Manager:
+To add restrictions to ALL requests use the default global config included with the Config Manager:
 
 ```ruby
 use JSONAPI::Middleware do |config_manager|

data/easy-jsonapi.gemspec

@@ -2,7 +2,7 @@
 
 Gem::Specification.new do |spec|
   spec.name          = 'easy-jsonapi'
-  spec.version       = '1.0.3'
+  spec.version       = '1.0.8'
   spec.authors       = ['Joshua DeMoss, Joe Viscomi']
   spec.email         = ['demoss.joshua@gmail.com']
 

data/lib/easy/jsonapi/exceptions/headers_exceptions.rb

@@ -25,9 +25,11 @@ module JSONAPI
 
       # Check http verb vs included headers
       # @param env [Hash] The rack environment variable
+      # @param config_manager [JSONAPI::ConfigManager] The manager of user configurations
+      # @param opts [Hash] Includes http_method, path, and contains_body values
       def self.check_request(env, config_manager = nil, opts = {})
         check_compliance(env, config_manager, opts)
-        check_http_method_against_headers(env)
+        check_http_method_against_headers(env, opts[:contains_body])
       end
 
       # Check jsonapi compliance
@@ -39,7 +41,7 @@ module JSONAPI
         hdrs = JSONAPI::Parser::HeadersParser.parse(env)
         usr_opts = { http_method: opts[:http_method], path: opts[:path] }
         err_msg = JSONAPI::Exceptions::UserDefinedExceptions.check_user_header_requirements(hdrs, config_manager, usr_opts)
-        return err_msg unless err_msg.nil?
+        raise err_msg unless err_msg.nil?
       end
 
       class << self
@@ -78,30 +80,30 @@ module JSONAPI
         #   error if the combination doesn't make sense
         # @param (see #compliant?)
         # @raise InvalidHeader the invalid header incombination with the http verb
-        def check_http_method_against_headers(env)
+        def check_http_method_against_headers(env, contains_body)
           case env['REQUEST_METHOD']
           when 'GET'
-            check_get_against_hdrs(env)
+            check_get_against_hdrs(env, contains_body)
           when 'POST' || 'PATCH' || 'PUT'
-            check_post_against_hdrs(env)
+            check_post_against_hdrs(env, contains_body)
           when 'DELETE'
-            check_delete_against_hdrs(env)
+            check_delete_against_hdrs(env, contains_body)
           end
         end
 
         # Raise error if a GET request has a body or a content type header
         # @param (see #compliant?)
-        def check_get_against_hdrs(env)
-          raise_error('GET requests cannot have a body.') unless env['rack.input'].nil?
+        def check_get_against_hdrs(env, contains_body)
+          raise_error('GET requests cannot have a body.') if contains_body
           raise_error("GET request cannot have a 'CONTENT_TYPE' http header.") unless env['CONTENT_TYPE'].nil?
         end
 
         # POST, PUT, and PATCH request must have a content type header,
         #   a body, and a content-type and accept header that accepts jsonapi
         # @param (see #compliant?)
-        def check_post_against_hdrs(env)
+        def check_post_against_hdrs(env, contains_body)
           raise_error("POST, PUT, and PATCH requests must have a 'CONTENT_TYPE' header.") unless env['CONTENT_TYPE']
-          raise_error('POST, PUT, and PATCH requests must have a body.') unless env['rack.input']
+          raise_error('POST, PUT, and PATCH requests must have a body.') unless contains_body
           
           return if env['CONTENT_TYPE'] == 'application/vnd.api+json' && accepts_jsonapi?(env)
           
@@ -109,6 +111,12 @@ module JSONAPI
                       "JSON:API media type, if they include a JSON:API 'CONTENT_TYPE' header")
         end
 
+        # Raise error if DELETE hdr has a body or a content type header
+        def check_delete_against_hdrs(env, contains_body)
+          raise_error('DELETE requests cannot have a body.') if contains_body
+          raise_error("DELETE request cannot have a 'CONTENT_TYPE' http header.") unless env['CONTENT_TYPE'].nil?
+        end
+        
         # Check the accept header to see if any of the provided media types indicate that
         #   jsonapi is accepted
         # @param (see #compliant?)
@@ -121,12 +129,6 @@ module JSONAPI
           false
         end
 
-        # Raise error if DELETE hdr has a body or a content type header
-        def check_delete_against_hdrs(env)
-          raise_error('DELETE requests cannot have a body.') unless env['rack.input'].nil?
-          raise_error("DELETE request cannot have a 'CONTENT_TYPE' http header.") unless env['CONTENT_TYPE'].nil?
-        end
-
         # @param accept_hdr [String] The value of the http accept header
         def contains_at_least_one_jsonapi_media_type_without_params?(accept_hdr)
           accept_hdr.split(',').each do |mt|

data/lib/easy/jsonapi/exceptions/query_params_exceptions.rb

@@ -33,7 +33,7 @@ module JSONAPI
         end
         
         err_msg = JSONAPI::Exceptions::UserDefinedExceptions.check_user_query_param_requirements(rack_req_params, config_manager, opts)
-        return err_msg unless err_msg.nil?
+        raise err_msg unless err_msg.nil?
 
         nil
       end

data/lib/easy/jsonapi/exceptions/user_defined_exceptions.rb

@@ -62,8 +62,10 @@ module JSONAPI
         #   with underscores instead of dashes.
         # @param config (see #check_user_document_requirements)
         def check_user_header_requirements(headers, config_manager, opts)
-          return if config_manager.nil? || config_manager.default?
+          return if config_manager.nil?
+          
           config = get_config(config_manager, opts[:http_method], opts[:path])
+          return if config.default? && config_manager.size.positive?
 
           err = 
             check_for_required_headers(headers, config.required_headers)
@@ -77,8 +79,10 @@ module JSONAPI
         # @param rack_req_params [Hash]  The hash of the query parameters given by Rack::Request
         # @param config (see #check_user_document_requirements)
         def check_user_query_param_requirements(rack_req_params, config_manager, opts)
-          return if config_manager.nil? || config_manager.default?
+          return if config_manager.nil?
+          
           config = get_config(config_manager, opts[:http_method], opts[:path])
+          return if config.default? && config_manager.size.positive?
 
           err = 
             check_for_required_params(rack_req_params, config.required_query_params)

data/lib/easy/jsonapi/middleware.rb

@@ -23,8 +23,8 @@ module JSONAPI
     #   and error if any section is found to be non-compliant.
     # @param env The rack envirornment hash
     def call(env)
-      if in_maintenance_mode?(env)
-        return maintenance_response(env)
+      if in_maintenance_mode?
+        return maintenance_response
       end
 
       if jsonapi_request?(env)
@@ -38,17 +38,15 @@ module JSONAPI
     private
 
     # Checks the 'MAINTENANCE' environment variable
-    # @param (see #call)
     # @return [TrueClass | FalseClass]
-    def in_maintenance_mode?(env)
-      !env['MAINTENANCE'].nil?
+    def in_maintenance_mode?
+      !ENV['MAINTENANCE'].nil?
     end
 
     # Return 503 with or without msg depending on environment
-    # @param (see #call)
     # @return [Array] Http Error Responses
-    def maintenance_response(env)
-      if environment_development?(env)
+    def maintenance_response
+      if environment_development?
         [503, {}, ['MAINTENANCE envirornment variable set']]
       else
         [503, {}, []]
@@ -88,18 +86,21 @@ module JSONAPI
     # @param config_manager [JSONAPI::ConfigManager::Config] The config object to use modify compliance checking
     # @return [NilClass | Array] Nil meaning no error or a 400 level http response
     def check_compliance(env, config_manager)
-      opts = { http_method: env['REQUEST_METHOD'], path: env['PATH_INFO'] }
+      # Store separately so you can rewind for next middleware or app
+      body = env['rack.input'].read
+      env['rack.input'].rewind
+      opts = { http_method: env['REQUEST_METHOD'], path: env['PATH_INFO'], contains_body: body != "" }
 
       header_error = check_headers_compliance(env, config_manager, opts)
       return header_error unless header_error.nil?
 
       req = Rack::Request.new(env)
-      param_error = check_query_param_compliance(env, req.GET, config_manager, opts)
+      param_error = check_query_param_compliance(req.GET, config_manager, opts)
       return param_error unless param_error.nil?
       
       return unless env['CONTENT_TYPE']
 
-      body_error = check_req_body_compliance(env, config_manager, opts)
+      body_error = check_body_compliance(body, config_manager, opts)
       return body_error unless body_error.nil?
     end
 
@@ -108,8 +109,8 @@ module JSONAPI
     # @return [NilClass | Array] Nil meaning no error or a 400 level http response
     def check_headers_compliance(env, config_manager, opts)
       JSONAPI::Exceptions::HeadersExceptions.check_request(env, config_manager, opts)
-    rescue JSONAPI::Exceptions::HeadersExceptions::InvalidHeader || JSONAPI::Exceptions::UserDefinedExceptions::InvalidHeader => e
-      raise if environment_development?(env)
+    rescue JSONAPI::Exceptions::HeadersExceptions::InvalidHeader, JSONAPI::Exceptions::UserDefinedExceptions::InvalidHeader => e
+      raise if environment_development?
 
       [e.status_code, {}, []]
     end
@@ -117,10 +118,10 @@ module JSONAPI
     # @param query_params [Hash] The rack request query_param hash
     # @raise If the query parameters are not JSONAPI compliant
     # @return [NilClass | Array] Nil meaning no error or a 400 level http response
-    def check_query_param_compliance(env, query_params, config_manager, opts)
+    def check_query_param_compliance(query_params, config_manager, opts)
       JSONAPI::Exceptions::QueryParamsExceptions.check_compliance(query_params, config_manager, opts)
-    rescue JSONAPI::Exceptions::QueryParamsExceptions::InvalidQueryParameter || JSONAPI::Exceptions::UserDefinedExceptions::InvalidQueryParam => e
-      raise if environment_development?(env)
+    rescue JSONAPI::Exceptions::QueryParamsExceptions::InvalidQueryParameter, JSONAPI::Exceptions::UserDefinedExceptions::InvalidQueryParam => e
+      raise if environment_development?
       
       [e.status_code, {}, []]
     end
@@ -128,17 +129,14 @@ module JSONAPI
     # @param env (see #call)
     # @param req (see #check_query_param_compliance)
     # @raise If the document body is not JSONAPI compliant
-    def check_req_body_compliance(env, config_manager, opts)
-      # Store separately so you can rewind for next middleware or app
-      body = env['rack.input'].read
-      env['rack.input'].rewind
+    def check_body_compliance(body, config_manager, opts)
       JSONAPI::Exceptions::DocumentExceptions.check_compliance(body, config_manager, opts)
-    rescue JSONAPI::Exceptions::DocumentExceptions::InvalidDocument || JSONAPI::Exceptions::UserDefinedExceptions::InvalidDocument => e
-      raise if environment_development?(env)
+    rescue JSONAPI::Exceptions::DocumentExceptions::InvalidDocument, JSONAPI::Exceptions::UserDefinedExceptions::InvalidDocument => e
+      raise if environment_development?
 
       [e.status_code, {}, []]
     rescue JSONAPI::Exceptions::JSONParseError
-      raise if environment_development?(env)
+      raise if environment_development?
 
       [400, {}, []]
     end
@@ -151,8 +149,8 @@ module JSONAPI
     end
 
     # @param (see #call)
-    def environment_development?(env)
-      env['RACK_ENV'].to_s.downcase == 'development' || env['RACK_ENV'].nil?
+    def environment_development?
+      ENV['RACK_ENV'].to_s.downcase == 'development' || ENV['RACK_ENV'].nil?
     end
   end
 end

data/lib/easy/jsonapi/parser/json_parser.rb

@@ -21,7 +21,7 @@ module JSONAPI
       # Convert ruby hash into JSON
       # @param ruby_hash [Hash] THe hash to convert into JSON
       def self.dump(ruby_hash)
-        Oj.dump(ruby_hash)
+        Oj.dump(ruby_hash, mode: :compat)
       end
 
     end

data/lib/easy/jsonapi/request/query_param_collection.rb

@@ -8,10 +8,12 @@ module JSONAPI
     # A collection of QueryParam objects 
     class QueryParamCollection < JSONAPI::NameValuePairCollection
 
+      # The special query params defined by the JSON:API specification
+      SPECIAL_QUERY_PARAMS = %i[sorts filters fields page includes].freeze
+
       # @param param_arr [Array<JSONAPI::Request::QueryParamCollection::QueryParam] The
       #   query params to initialize the collection with
       def initialize(param_arr = [])
-        @param_names = []
         super(param_arr, item_type: JSONAPI::Request::QueryParamCollection::QueryParam)
       end
   
@@ -43,8 +45,12 @@ module JSONAPI
       # @param args If any arguments were passed to the method called
       # @param block If a block was passed to the method called
       def method_missing(method_name, *args, &block)
-        super unless include?(method_name)
-        get(method_name)
+        included = include?(method_name)
+        super unless included || SPECIAL_QUERY_PARAMS.include?(method_name)
+        if included
+          return get(method_name)
+        end
+        nil
       end
 
       # Whether or not method missing should be called.