flexirest 1.12.5 → 1.13.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 44aa9166918c27766f3d696c23cc78b08e1f956edb6ae8a7413c9e88f01c48e7
-  data.tar.gz: 1068bcb89fb8da7af5505177f989997794615703df092d8d27fa55479987565c
+  metadata.gz: 152b5d789cff3ee4ccd09c6090d4f5bee5b431a96fb34797d5d189882585c235
+  data.tar.gz: 91c220948c05caec4b7f625d618c1b3e180272013a8dee3157bd66cbaf039bbb
 SHA512:
-  metadata.gz: 9cddabff55c7531fdb3856c863fc9888fa3731c82135f9a02c4e3d5026514c479815ecaa499fc38b6f50c6579bff7703bcbaef688d76ea067a43f7a26dc8efc5
-  data.tar.gz: 204f29f4a0baa07661ea497d88799f137ed55114fdea808f5a1ea905a21f9ff51f2d0ce1c9a82d985c140c6e6f4fc29ae26e394a34a63cc51b87907dbef81139
+  metadata.gz: 7440c4c8b5122e296360ece864f8ffd9ba59ae83429badd94c587ce700ecab20e823b3cff166c2623ecde5a5f5697737caf1684ac3237f5b20a63213d2dc42e0
+  data.tar.gz: e54a1e79e49dca9a29ed9c6d04ee43ea7a0da4943b6b873ff30d9df8377605d418a84ad391cccaad60d65102f9d43936b191bb2a5f6c4f8889ca011381e7a529

data/.github/workflows/build.yml

@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        ruby-version: ['3.0', '3.1', '3.2', '3.3']
+        ruby-version: ['3.0', '3.1', '3.2', '3.3', '3.4']
 
     steps:
     - uses: actions/checkout@v4

data/CHANGELOG.md

@@ -1,10 +1,24 @@
 # Changelog
 
+## 1.13.1
+
+Bugfix:
+
+- Ruby 4.0 removed `ostruct` from the standard library, and Flexirest builds OpenStructs internally, so it is now required explicitly and declared as a runtime dependency rather than relying on the host application to provide it
+- Proxy routes with parameters (e.g. `get "/things/:id"`) no longer mutate the string they are given, so declaring one with a frozen string literal works. Previously `ProxyBase.add_mapping` built the regex with `gsub!` on the caller's string, which warns under Ruby 3.4+ chilled string literals and raises `FrozenError` under `--enable=frozen-string-literal`
+- A forced URL is now duplicated before `before_request` callbacks run, so the documented `request.url.gsub!` pattern works when the URL passed to `_request` is a frozen string literal
+
+## 1.13.0
+
+Bugfix:
+
+- Major changes to internals to better support thread-safe usage. Thanks to Kurtis for the bug report
+
 ## 1.12.5
 
 Feature:
 
-- Some broken APIs require a GET body, even though this is against HTTP spec. Added a `send_get_body` parameter like we already have for DELETE requests (thanks to Jan Schroeder for the request)
+- Some broken APIs require a GET body, even though this is against HTTP spec. Added a `send_get_body` parameter like we already have for DELETE requests (thanks to Jan Schroeder for the request)
 
 ## 1.12.4
 

data/Rakefile

@@ -1,3 +1,8 @@
+# IMPORTANT: bundler/setup so a bare `rake spec` runs the same suite as CI's
+# `bundle exec rake`. Several specs are defined conditionally on
+# Gem.loaded_specs["api-auth"], which only lists *activated* gems - without Bundler
+# those guards read false and the examples silently vanish rather than fail.
+require "bundler/setup"
 require "bundler/gem_tasks"
 require 'rspec/core/rake_task'
 RSpec::Core::RakeTask.new('spec')

data/flexirest.gemspec

@@ -38,6 +38,9 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency 'rest-client'
   spec.add_development_dependency 'timecop'
 
+  # A default gem up to Ruby 3.4 and dropped from the stdlib in 4.0, so declare it
+  # rather than assume the host application provides it.
+  spec.add_runtime_dependency "ostruct"
   spec.add_runtime_dependency "mime-types"
   spec.add_runtime_dependency "multi_json"
   spec.add_runtime_dependency "crack"

data/lib/flexirest/associations.rb

@@ -51,17 +51,22 @@ module Flexirest
         end
       end
 
+      # The keys passed to `.includes(...)` travel from this class-method call
+      # into the Request built by the subsequent finder call. Storing them in a
+      # class instance variable meant concurrent threads calling `.includes` on
+      # the same model shared (and corrupted) one slot, so they're held in
+      # thread-local storage keyed by the class instead.
       def includes(*keys)
-        @_include_associations = keys
+        (Thread.current[:flexirest_include_associations] ||= {})[self] = keys
         self
       end
 
       def _include_associations
-        @_include_associations
+        (Thread.current[:flexirest_include_associations] ||= {})[self] || []
       end
 
       def _reset_include_associations!
-        @_include_associations = []
+        (Thread.current[:flexirest_include_associations] ||= {}).delete(self)
       end
 
       def parse_date(*keys)
@@ -80,7 +85,6 @@ module Flexirest
       def inherited(subclass)
         subclass.instance_variable_set(:@_date_fields, [])
         subclass.instance_variable_set(:@_associations, {})
-        subclass.instance_variable_set(:@_include_associations, [])
         super
       end
     end

data/lib/flexirest/connection.rb

@@ -41,6 +41,18 @@ module Flexirest
       end
     end
 
+    def get_with_body(path, data, options={})
+      set_defaults(options)
+      make_safe_request(path) do
+        @session.get(path) do |req|
+          set_per_request_timeout(req, options) if options[:timeout]
+          req.headers = req.headers.merge(options[:headers])
+          req.body = data
+          sign_request(req, options[:api_auth])
+        end
+      end
+    end
+
     def get(path, options={})
       set_defaults(options)
       make_safe_request(path) do

data/lib/flexirest/instrumentation.rb

@@ -7,25 +7,28 @@ module Flexirest
       Flexirest::Logger.debug "  \033[1;4;32m#{name}\033[0m #{event.payload[:name]}" unless event.payload[:quiet]
     end
 
+    # These counters accumulate per request and are reported/reset per
+    # controller action. Held per-thread so concurrent requests each track their
+    # own totals instead of sharing (and losing updates to) one class variable.
     def self.time_spent=(value)
-      @@time_spent = value
+      Thread.current[:flexirest_time_spent] = value
     end
 
     def self.time_spent
-      @@time_spent ||= 0
+      Thread.current[:flexirest_time_spent] ||= 0
     end
 
     def self.calls_made=(value)
-      @@calls_made = value
+      Thread.current[:flexirest_calls_made] = value
     end
 
     def self.calls_made
-      @@calls_made ||= 0
+      Thread.current[:flexirest_calls_made] ||= 0
     end
 
     def self.reset
-      @@time_spent = 0
-      @@calls_made = 0
+      Thread.current[:flexirest_time_spent] = 0
+      Thread.current[:flexirest_calls_made] = 0
     end
 
     def logger

data/lib/flexirest/json_api_proxy.rb

@@ -172,10 +172,18 @@ module Flexirest
     # Creating JSON API header
     module Headers
       extend self
+      # `extend self` makes this module a single process-wide object, so the
+      # headers used while building a request must not be stashed in an ivar
+      # here — concurrent requests would overwrite each other's (and leak
+      # authentication headers across requests). Hold them per-thread instead.
       def save(headers)
         # Save headers used in a request for building lazy association
         # loaders when parsing the response
-        @headers = headers
+        Thread.current[:flexirest_jsonapi_headers] = headers
+      end
+
+      def headers
+        Thread.current[:flexirest_jsonapi_headers]
       end
     end
 
@@ -185,8 +193,16 @@ module Flexirest
       extend Flexirest::JsonAPIProxy::Helpers
       ID_PFIX = '_id_'
 
+      # `extend self` makes Response a single shared object too. The resource
+      # class saved here is read again while building lazy association loaders
+      # during the same parse, so it must be per-thread: otherwise a concurrent
+      # parse of a different model would corrupt association resolution.
       def save_resource_class(object)
-        @resource_class = object.is_a?(Class) ? object : object.class
+        Thread.current[:flexirest_jsonapi_resource_class] = object.is_a?(Class) ? object : object.class
+      end
+
+      def resource_class
+        Thread.current[:flexirest_jsonapi_resource_class]
       end
 
       def parse(body, object)
@@ -387,7 +403,7 @@ module Flexirest
 
       def find_association_class(base, name)
         stack = base + [name]
-        klass = @resource_class
+        klass = resource_class
 
         until stack.empty?
           shift = stack.shift
@@ -424,7 +440,7 @@ module Flexirest
 
         # Also add the previous request's header, which may contain
         # crucial authentication headers (or so), to connect with the service
-        request.headers = @headers
+        request.headers = Flexirest::JsonAPIProxy::Headers.headers
         request.url = request.forced_url = url
 
         Flexirest::LazyAssociationLoader.new(name, url, request)

data/lib/flexirest/logger.rb

@@ -2,18 +2,25 @@ module Flexirest
   class Logger
     @logfile = nil
     @messages = []
+    # Guards the shared in-memory buffer / logfile handle below, which are
+    # written on every log call during request handling. Without this,
+    # concurrent requests racing on `@messages << ...` (or a shared IO) can
+    # interleave and lose or corrupt entries.
+    @mutex = Mutex.new
 
     def self.logfile=(value)
-      @logfile = value
+      @mutex.synchronize { @logfile = value }
     end
 
     def self.messages
-      @messages
+      @mutex.synchronize { @messages.dup }
     end
 
     def self.reset!
-      @logfile = nil
-      @messages = []
+      @mutex.synchronize do
+        @logfile = nil
+        @messages = []
+      end
     end
 
     def self.level
@@ -27,65 +34,52 @@ module Flexirest
     def self.debug(message)
       if defined?(Rails) && Rails.logger.present?
         Rails.logger.debug(message)
-      elsif @logfile
-        if @logfile.is_a?(String)
-          File.open(@logfile, "a") do |f|
-            f << "#{message}\n"
-          end
-        else
-          @logfile << "#{message}\n"
-        end
       else
-        @messages << message
+        write_fallback(message)
       end
     end
 
     def self.info(message)
       if defined?(Rails) && Rails.logger.present?
         Rails.logger.info(message)
-      elsif @logfile
-        if @logfile.is_a?(String)
-          File.open(@logfile, "a") do |f|
-            f << "#{message}\n"
-          end
-        else
-          @logfile << "#{message}\n"
-        end
       else
-        @messages << message
+        write_fallback(message)
       end
     end
 
     def self.warn(message)
       if defined?(Rails) && Rails.logger.present?
         Rails.logger.warn(message)
-      elsif @logfile
-        if @logfile.is_a?(String)
-          File.open(@logfile, "a") do |f|
-            f << "#{message}\n"
-          end
-        else
-          @logfile << "#{message}\n"
-        end
       else
-        @messages << message
+        write_fallback(message)
       end
     end
 
     def self.error(message)
       if defined?(Rails) && Rails.logger.present?
         Rails.logger.error(message)
-      elsif @logfile
-        if @logfile.is_a?(String)
-          File.open(@logfile, "a") do |f|
-            f << "#{message}\n"
+      else
+        write_fallback(message)
+      end
+    end
+
+    # Writes to the configured logfile, or falls back to the in-memory buffer.
+    # Synchronised because both destinations are shared across threads.
+    def self.write_fallback(message)
+      @mutex.synchronize do
+        if @logfile
+          if @logfile.is_a?(String)
+            File.open(@logfile, "a") do |f|
+              f << "#{message}\n"
+            end
+          else
+            @logfile << "#{message}\n"
           end
         else
-          @logfile << "#{message}\n"
+          @messages << message
         end
-      else
-        @messages << message
       end
     end
+    private_class_method :write_fallback
   end
 end

data/lib/flexirest/proxy_base.rb

@@ -2,10 +2,19 @@ require "uri"
 
 module Flexirest
   class ProxyBase
-    cattr_accessor :mappings, :request, :original_handler
-    cattr_accessor :original_body, :original_get_params, :original_post_params, :original_url
-
     module ClassMethods
+      # Per-request state used while handling a proxied request is stored in
+      # thread-local storage (keyed by the proxy class) rather than on the
+      # class itself. The DSL is implemented as class methods run via
+      # class_eval, so historically "the current request" was stored in class
+      # instance variables/class variables, which are shared across every
+      # thread calling through the same proxy class. That caused request data
+      # to be dropped or corrupted under concurrency. Keeping it per-thread
+      # isolates concurrent requests while preserving the existing DSL.
+      def _proxy_state
+        states = (Thread.current[:flexirest_proxy_state] ||= {})
+        states[self] ||= {}
+      end
       def get(match, &block)
         add_mapping(:get, match, block)
       end
@@ -30,44 +39,48 @@ module Flexirest
         @mappings ||= []
 
         if match.is_a?(String) && (param_keys = match.scan(/:\w+/)) && param_keys.any?
-          param_keys.each do |key|
-            match.gsub!(key, "([^/]+)")
-          end
+          # Build the pattern from a copy rather than mutating the caller's string. A
+          # route is almost always declared with a string literal, and under Ruby 3.4+
+          # those are chilled (mutating one warns); with frozen string literals enabled
+          # - Ruby 4.0's --enable=frozen-string-literal, or a magic comment - the same
+          # mutation raises FrozenError and the proxy class fails to load.
+          pattern = param_keys.reduce(match.dup) { |acc, key| acc.gsub(key, "([^/]+)") }
           param_keys = param_keys.map {|k| k.gsub(":", "").to_sym}
-          match = Regexp.new(match)
+          match = Regexp.new(pattern)
         end
 
         @mappings << OpenStruct.new(http_method:method_type, match:match, block:block, param_keys:param_keys)
       end
 
       def body(value = nil)
-        @body = value if value
-        @body
+        _proxy_state[:body] = value if value
+        _proxy_state[:body]
       end
 
       def url(value = nil)
-        @url = value if value
-        @url
+        _proxy_state[:url] = value if value
+        _proxy_state[:url]
       end
 
       def get_params(value = nil)
-        @get_params = value if value
-        @get_params
+        _proxy_state[:get_params] = value if value
+        _proxy_state[:get_params]
       end
 
       def post_params(value = nil)
-        @post_params = value if value
-        @post_params
+        _proxy_state[:post_params] = value if value
+        _proxy_state[:post_params]
       end
 
       def params(value = nil)
-        @params = value if value
-        @params
+        _proxy_state[:params] = value if value
+        _proxy_state[:params]
       end
 
       def passthrough
         rebuild_request
-        @original_handler.call(@request)
+        state = _proxy_state
+        state[:original_handler].call(state[:request])
       end
 
       def result_is_json_or_unspecified?(result)
@@ -93,56 +106,73 @@ module Flexirest
       end
 
       def rebuild_request
-        if @url != @original_url
-          @request.forced_url = @request.url = @url
+        state = _proxy_state
+        request = state[:request]
+        if state[:url] != state[:original_url]
+          request.forced_url = request.url = state[:url]
         end
-        if @body != @original_body
-          @request.body = @body
-        elsif @post_params != @original_post_params
-          @request.body = nil
-          @request.prepare_request_body(@post_params)
+        if state[:body] != state[:original_body]
+          request.body = state[:body]
+        elsif state[:post_params] != state[:original_post_params]
+          request.body = nil
+          request.prepare_request_body(state[:post_params])
         end
-        if @get_params != @original_get_params
-          @request.get_params = @get_params
-          @request.prepare_url
-          @request.append_get_parameters
+        if state[:get_params] != state[:original_get_params]
+          request.get_params = state[:get_params]
+          request.prepare_url
+          request.append_get_parameters
         end
       end
 
       def handle(request, &block)
-        @request = request
-        @original_handler = block
+        # Preserve any state already in flight on this thread (e.g. a proxied
+        # request that itself triggers another request through the same proxy
+        # class) and restore it when we're done, so nested calls can't clobber
+        # each other.
+        states = (Thread.current[:flexirest_proxy_state] ||= {})
+        previous_state = states[self]
 
-        @original_body = request.body
-        @body = @original_body.dup
+        state = states[self] = {}
+        state[:request] = request
+        state[:original_handler] = block
 
-        @original_get_params = request.get_params
-        @get_params = @original_get_params.dup
+        state[:original_body] = request.body
+        state[:body] = state[:original_body].dup
 
-        @original_post_params = request.post_params
-        @post_params = (@original_post_params || {}).dup
+        state[:original_get_params] = request.get_params
+        state[:get_params] = state[:original_get_params].dup
 
-        @original_url = request.url
-        @url = @original_url.dup
+        state[:original_post_params] = request.post_params
+        state[:post_params] = (state[:original_post_params] || {}).dup
+
+        state[:original_url] = request.url
+        state[:url] = state[:original_url].dup
 
         if mapping = find_mapping_for_current_request
           self.class_eval(&mapping.block)
         else
           passthrough
         end
+      ensure
+        if previous_state
+          states[self] = previous_state
+        else
+          states.delete(self)
+        end
       end
 
       def find_mapping_for_current_request
-        uri = URI.parse(@original_url)
+        state = _proxy_state
+        uri = URI.parse(state[:original_url])
         @mappings ||= []
-        @params = {}
+        state[:params] = {}
         @mappings.each do |mapping|
           match = mapping.match
-          if (match_data = uri.path.match(match)) && @request.http_method.to_sym == mapping.http_method
+          if (match_data = uri.path.match(match)) && state[:request].http_method.to_sym == mapping.http_method
             matches = match_data.to_a
             matches.shift
             matches.each_with_index do |value, index|
-              @params[mapping.param_keys[index]] = value
+              state[:params][mapping.param_keys[index]] = value
             end
             return mapping
           end

data/lib/flexirest/request.rb

@@ -426,7 +426,10 @@ module Flexirest
     def prepare_url
       missing = []
       if @forced_url && @forced_url.present?
-        @url = @forced_url
+        # dup for the same reason as the branch below: before_request callbacks are
+        # documented to rewrite the URL in place with gsub!, and a forced URL is
+        # usually a string literal from the caller.
+        @url = @forced_url.dup
       else
         @url = @method[:url].dup
         matches = @url.scan(/(:[a-z_-]+)/)
@@ -610,7 +613,7 @@ module Flexirest
       if http_method == :get && !@method[:options][:send_get_body]
         response = connection.get(@url, request_options)
       elsif http_method == :get
-          response = connection.get(@url, @body, request_options)
+        response = connection.get_with_body(@url, @body, request_options)
       elsif http_method == :put
         response = connection.put(@url, @body, request_options)
       elsif http_method == :post

data/lib/flexirest/version.rb

@@ -1,3 +1,3 @@
 module Flexirest
-  VERSION = "1.12.5"
+  VERSION = "1.13.1"
 end

data/lib/flexirest.rb

@@ -1,3 +1,7 @@
+# ostruct stopped being a default gem in Ruby 4.0, and Flexirest builds OpenStructs in
+# Request and ProxyBase, so require it explicitly rather than relying on the host
+# application having pulled it in.
+require "ostruct"
 require 'active_support/all'
 require "flexirest/version"
 require "flexirest/attribute_parsing"

data/spec/lib/associations_spec.rb

@@ -84,6 +84,37 @@ describe "Has Many Associations" do
   end
 end
 
+describe "includes association thread safety" do
+  it "keeps .includes state isolated across concurrent threads" do
+    thread_count = 10
+
+    # All threads set their own includes, then wait until every thread has done
+    # so before reading it back. Before the fix, the shared class instance
+    # variable meant each thread read whichever value was written last.
+    count = 0
+    mutex = Mutex.new
+    cond = ConditionVariable.new
+    results = {}
+
+    threads = thread_count.times.map do |i|
+      Thread.new do
+        AssociationExampleBase.includes(:"assoc_#{i}")
+        mutex.synchronize do
+          count += 1
+          cond.broadcast
+          cond.wait(mutex) while count < thread_count
+        end
+        results[i] = AssociationExampleBase._include_associations
+      end
+    end
+    threads.each { |t| t.join(5) }
+
+    thread_count.times do |i|
+      expect(results[i]).to eq([:"assoc_#{i}"])
+    end
+  end
+end
+
 describe "Has One Associations" do
   let(:subject) {AssociationExampleBase.new}
 

data/spec/lib/callbacks_spec.rb

@@ -42,7 +42,11 @@ class SubClassedCallbacksExample < CallbacksExample
 end
 
 describe Flexirest::Callbacks do
-  let(:request) { OpenStruct.new(get_params:{}, post_params:{}, url:"http://www.example.com", headers:Flexirest::HeadersList.new) }
+  # The unary + matters: these examples exercise callbacks rewriting the URL in place
+  # with gsub!, which is the documented API (docs/using-callbacks.md). A real request
+  # hands callbacks a mutable String, so the double has to as well - a frozen literal
+  # here would fail under frozen string literals for a reason the library doesn't have.
+  let(:request) { OpenStruct.new(get_params:{}, post_params:{}, url:+"http://www.example.com", headers:Flexirest::HeadersList.new) }
   let(:response) { OpenStruct.new(body:"") }
 
   it "should call through to adjust the parameters" do

data/spec/lib/connection_manager_spec.rb

@@ -5,6 +5,27 @@ describe Flexirest::ConnectionManager do
     Flexirest::ConnectionManager.reset!
   end
 
+  # IMPORTANT: The two typhoeus examples below set a *global* adapter. Reset it in an
+  # after hook rather than on the last line of each example: if the example raises
+  # first that line never runs, every later spec in the suite inherits
+  # adapter = :typhoeus, and they all fail with ":typhoeus is not registered on
+  # Faraday::Adapter". Specs run in random order, so that turns one local failure into
+  # a suite-wide cascade whose size depends on the seed.
+  after(:each) do
+    Flexirest::Base._reset_configuration!
+  end
+
+  # Gem.loaded_specs only lists gems that have been *activated*, not every gem in the
+  # bundle, so it is not a reliable way to ask whether faraday-typhoeus is installed -
+  # when it reads as absent the require is skipped and :typhoeus is never registered.
+  # Just attempt the require and let the older typhoeus-provided adapter be the
+  # fallback.
+  def require_typhoeus_adapter
+    require 'faraday/typhoeus'
+  rescue LoadError
+    require 'typhoeus/adapters/faraday'
+  end
+
   it "should have a get_connection method" do
     expect(Flexirest::ConnectionManager).to respond_to("get_connection")
   end
@@ -35,19 +56,17 @@ describe Flexirest::ConnectionManager do
   end
 
   it "should call 'in_parallel' for a session and yield procedure inside that block" do
-    require 'faraday/typhoeus' if Gem.loaded_specs["faraday-typhoeus"].present?
+    require_typhoeus_adapter
     Flexirest::Base.adapter = :typhoeus
     Flexirest::ConnectionManager.get_connection("http://www.example.com").session
     expect { |b| Flexirest::ConnectionManager.in_parallel("http://www.example.com", &b)}.to yield_control
-    Flexirest::Base._reset_configuration!
   end
 
   it "should raise Flexirest::MissingOptionalLibraryError if Typhoeus isn't available" do
-    require 'faraday/typhoeus' if Gem.loaded_specs["faraday-typhoeus"].present?
+    require_typhoeus_adapter
     Flexirest::Base.adapter = :typhoeus
     Flexirest::ConnectionManager.get_connection("http://www.example.com").session
     expect(Flexirest::ConnectionManager).to receive(:require).and_raise(LoadError)
     expect { Flexirest::ConnectionManager.in_parallel("http://www.example.com")}.to raise_error(Flexirest::MissingOptionalLibraryError)
-    Flexirest::Base._reset_configuration!
   end
 end

data/spec/lib/json_api_spec.rb

@@ -567,3 +567,64 @@ describe 'JSON API' do
     end
   end
 end
+
+# A simple N-party rendezvous forcing concurrent parses to interleave, so the
+# per-request state the JSON:API proxy stashes (resource class + headers) is
+# provably isolated per thread rather than shared on the singleton modules.
+class JsonAPIThreadBarrier
+  def initialize(parties)
+    @parties = parties
+    @count = 0
+    @mutex = Mutex.new
+    @cond = ConditionVariable.new
+  end
+
+  def wait
+    @mutex.synchronize do
+      @count += 1
+      if @count >= @parties
+        @cond.broadcast
+      else
+        @cond.wait(@mutex) while @count < @parties
+      end
+    end
+  end
+end
+
+describe Flexirest::JsonAPIProxy do
+  it 'keeps the parsed resource class isolated across concurrent threads' do
+    classes = [JsonAPIExampleArticle, JsonAPIAssociationExampleTag, JsonAPIAssociationExampleAuthor]
+    thread_count = 9
+    barrier = JsonAPIThreadBarrier.new(thread_count)
+
+    threads = thread_count.times.map do |i|
+      klass = classes[i % classes.size]
+      Thread.new do
+        Flexirest::JsonAPIProxy::Response.save_resource_class(klass)
+        # All threads have now saved a class; if it were shared they'd all read
+        # whichever was written last.
+        barrier.wait
+        [i, Flexirest::JsonAPIProxy::Response.resource_class]
+      end
+    end
+    results = threads.to_h(&:value)
+
+    thread_count.times { |i| expect(results[i]).to eq(classes[i % classes.size]) }
+  end
+
+  it 'keeps the saved request headers isolated across concurrent threads' do
+    thread_count = 10
+    barrier = JsonAPIThreadBarrier.new(thread_count)
+
+    threads = thread_count.times.map do |i|
+      Thread.new do
+        Flexirest::JsonAPIProxy::Headers.save('X-Marker' => i.to_s)
+        barrier.wait
+        [i, Flexirest::JsonAPIProxy::Headers.headers]
+      end
+    end
+    results = threads.to_h(&:value)
+
+    thread_count.times { |i| expect(results[i]).to eq('X-Marker' => i.to_s) }
+  end
+end

data/spec/lib/proxy_spec.rb

@@ -2,6 +2,29 @@ require 'spec_helper'
 require 'active_support/core_ext/hash'
 require 'base64'
 
+# A simple N-party rendezvous used to force concurrent proxy requests to be
+# interleaved inside `handle` at the same time, deterministically reproducing
+# the thread-safety bug where per-request state was stored on the class.
+class ProxyTestBarrier
+  def initialize(parties)
+    @parties = parties
+    @count = 0
+    @mutex = Mutex.new
+    @cond = ConditionVariable.new
+  end
+
+  def wait
+    @mutex.synchronize do
+      @count += 1
+      if @count >= @parties
+        @cond.broadcast
+      else
+        @cond.wait(@mutex) while @count < @parties
+      end
+    end
+  end
+end
+
 class ProxyExample < Flexirest::ProxyBase
   get "/all" do
     url.gsub!("/all", "/getAll")
@@ -72,6 +95,22 @@ class ProxyExample < Flexirest::ProxyBase
   get "/fake" do
     render "{\"id\":1234}"
   end
+
+  def self.thread_barrier=(barrier)
+    @thread_barrier = barrier
+  end
+
+  def self.thread_barrier
+    @thread_barrier
+  end
+
+  get "/thread_test/:marker" do
+    url "/thread_result/#{params[:marker]}"
+    # Pause every concurrent request here, after it has set its own URL but
+    # before it is sent, so all threads are inside `handle` simultaneously.
+    ProxyExample.thread_barrier.wait
+    passthrough
+  end
 end
 
 class ProxyClientExample < Flexirest::Base
@@ -91,6 +130,7 @@ class ProxyClientExample < Flexirest::Base
   get :not_proxied, "/not_proxied"
   delete :remove, "/remove"
   get :hal_test, "/hal_test/:id"
+  get :thread_test, "/thread_test/:marker"
 end
 
 describe Flexirest::Base do
@@ -200,6 +240,43 @@ describe Flexirest::Base do
     expect(ProxyClientExample.hal_test(id:1).test.result).to eq(true)
   end
 
+  it "keeps proxied request data isolated across concurrent threads" do
+    thread_count = 10
+    ProxyExample.thread_barrier = ProxyTestBarrier.new(thread_count)
+
+    requested_paths = Queue.new
+    allow_any_instance_of(Flexirest::Connection).to receive(:get) do |_connection, path, _options|
+      requested_paths << path
+      ::FaradayResponseMock.new(OpenStruct.new(body: "{\"result\":true}", status: 200, response_headers: {}))
+    end
+
+    threads = thread_count.times.map do |i|
+      Thread.new { ProxyClientExample.thread_test(marker: i) }
+    end
+    threads.each { |t| t.join(5) }
+
+    paths = []
+    paths << requested_paths.pop until requested_paths.empty?
+
+    # Each thread must reach the server with its own marker. Before the fix the
+    # shared class-level state meant every thread sent whichever URL was written
+    # last, so the paths collided instead of covering 0..9.
+    expected = (0...thread_count).map { |i| "/thread_result/#{i}" }
+    expect(paths.sort).to eq(expected.sort)
+  end
+
+  it "builds a parameterised route without mutating the string it was given" do
+    route = "/frozen/:id/:name".freeze
+    proxy = Class.new(Flexirest::ProxyBase)
+
+    expect { proxy.get(route) { passthrough } }.to_not raise_error
+    expect(route).to eq("/frozen/:id/:name")
+
+    mapping = proxy.instance_variable_get(:@mappings).last
+    expect(mapping.param_keys).to eq(%i[id name])
+    expect("/frozen/12/john").to match(mapping.match)
+  end
+
   it "properly passes basic HTTP auth credentials" do
     host, credentials, url_path = 'www.example.com', 'user:pass', '/getAll?id=1'
     ProxyClientExample.base_url "http://#{credentials}@#{host}"

data/spec/lib/request_spec.rb

@@ -453,7 +453,7 @@ describe Flexirest::Request do
   end
 
   it "should get an HTTP connection when called and call get with a body if send_get_body is specified" do
-    expect_any_instance_of(Flexirest::Connection).to receive(:get).with("/get-body", "something=else", an_instance_of(Hash)).and_return(::FaradayResponseMock.new(OpenStruct.new(body:'{"result":true}', response_headers:{})))
+    expect_any_instance_of(Flexirest::Connection).to receive(:get_with_body).with("/get-body", "something=else", an_instance_of(Hash)).and_return(::FaradayResponseMock.new(OpenStruct.new(body:'{"result":true}', response_headers:{})))
     ExampleClient.get_body(something: "else")
   end
 

data/spec/spec_helper.rb

@@ -13,8 +13,6 @@ elsif ENV["TRAVIS"]
   Coveralls.wear!
 end
 
-ActiveSupport::Deprecation.silenced = true
-
 RSpec.configure do |config|
   config.color = true
   # config.formatter     = 'documentation'

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: flexirest
 version: !ruby/object:Gem::Version
-  version: 1.12.5
+  version: 1.13.1
 platform: ruby
 authors:
 - Andy Jeffries
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-02-21 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -192,6 +191,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: ostruct
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: mime-types
   requirement: !ruby/object:Gem::Requirement
@@ -392,7 +405,6 @@ licenses:
 - MIT
 metadata:
   source_code_uri: https://github.com/flexirest/flexirest
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -407,8 +419,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.21
-signing_key:
+rubygems_version: 4.0.10
 specification_version: 4
 summary: This gem is for accessing REST services in a flexible way.  ActiveResource
   already exists for this, but it doesn't work where the resource naming doesn't follow