funicular 0.2.1 → 0.3.0

data/minitest/middleware_test.rb

@@ -0,0 +1,154 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "tmpdir"
+
+require "test_helper"
+require_relative "support/rails_stub"
+require "funicular/middleware"
+
+# Exercises the development-only recompile middleware: when it decides to
+# recompile (env + source dir presence + mtime), the compiling/last_mtime
+# guard state machine, and that a compiler failure is swallowed so the request
+# still passes through. The real mrbc spawn is stubbed out.
+class MiddlewareTest < Minitest::Test
+  def setup
+    Rails.reset_stub!
+    Rails.env_name = "development"
+    Funicular::Middleware.reset!
+    @downstream_calls = 0
+    @app = ->(env) { @downstream_calls += 1; [200, {}, ["ok"]] }
+  end
+
+  def teardown
+    Rails.reset_stub!
+    Funicular::Middleware.reset!
+  end
+
+  # Builds an app dir with one source file and points Rails.root at it.
+  def with_app
+    Dir.mktmpdir do |dir|
+      FileUtils.mkdir_p(File.join(dir, "app", "funicular"))
+      File.write(File.join(dir, "app", "funicular", "home_component.rb"), "# c\n")
+      Rails.root = Pathname(dir)
+      yield dir
+    end
+  end
+
+  # A compiler double whose #compile just records that it ran.
+  def recording_compiler
+    compiler = Object.new
+    compiler.define_singleton_method(:compiled?) { @compiled ||= false }
+    compiler.define_singleton_method(:compile) { @compiled = true }
+    compiler
+  end
+
+  # Minitest 6 dropped Object#stub, so swap Compiler.new by hand. `replacement`
+  # is returned as the compiler, unless it's callable, in which case it's
+  # invoked with the constructor args (used to assert "never compiled").
+  def stub_compiler_new(replacement)
+    original = Funicular::Compiler.method(:new)
+    Funicular::Compiler.define_singleton_method(:new) do |*args, **kwargs|
+      replacement.respond_to?(:call) ? replacement.call(*args, **kwargs) : replacement
+    end
+    yield
+  ensure
+    Funicular::Compiler.singleton_class.send(:remove_method, :new)
+    Funicular::Compiler.define_singleton_method(:new, original)
+  end
+
+  def test_passes_request_through_downstream
+    with_app do
+      stub_compiler_new(recording_compiler) do
+        status, _headers, body = Funicular::Middleware.new(@app).call({})
+        assert_equal 200, status
+        assert_equal ["ok"], body
+      end
+    end
+    assert_equal 1, @downstream_calls
+  end
+
+  def test_skips_recompile_outside_development
+    Rails.env_name = "production"
+    with_app do
+      stub_compiler_new(->(*) { flunk "should not compile in production" }) do
+        Funicular::Middleware.new(@app).call({})
+      end
+    end
+    assert_nil Funicular::Middleware.last_mtime
+  end
+
+  def test_skips_recompile_when_source_dir_absent
+    Dir.mktmpdir do |dir|
+      Rails.root = Pathname(dir) # no app/funicular
+      stub_compiler_new(->(*) { flunk "should not compile without sources" }) do
+        Funicular::Middleware.new(@app).call({})
+      end
+      assert_nil Funicular::Middleware.last_mtime
+    end
+  end
+
+  def test_compiles_and_records_last_mtime_on_first_request
+    with_app do
+      compiler = recording_compiler
+      stub_compiler_new(compiler) do
+        Funicular::Middleware.new(@app).call({})
+      end
+      assert compiler.compiled?, "expected the compiler to run"
+      refute_nil Funicular::Middleware.last_mtime
+      refute Funicular::Middleware.compiling, "compiling flag must be cleared"
+    end
+  end
+
+  def test_skips_recompile_when_sources_unchanged
+    with_app do
+      # Pretend a compile already happened in the future so nothing is stale.
+      Funicular::Middleware.last_mtime = Time.now + 3600
+      stub_compiler_new(->(*) { flunk "should not recompile unchanged sources" }) do
+        Funicular::Middleware.new(@app).call({})
+      end
+    end
+  end
+
+  def test_compiler_failure_is_swallowed_and_request_continues
+    with_app do
+      exploding = Object.new
+      exploding.define_singleton_method(:compile) { raise "mrbc boom" }
+      stub_compiler_new(exploding) do
+        status, = Funicular::Middleware.new(@app).call({})
+        assert_equal 200, status
+      end
+      # Failure path must still clear the compiling guard.
+      refute Funicular::Middleware.compiling
+    end
+    assert_equal 1, @downstream_calls
+  end
+
+  def test_successful_compile_sweeps_the_asset_pipeline_cache
+    swept = []
+    sweeper = Object.new
+    sweeper.define_singleton_method(:execute) { swept << true }
+    # Struct doubles mirror the Propshaft chain the middleware walks; their
+    # respond_to? answers true for each member, matching the real objects.
+    load_path = Struct.new(:cache_sweeper).new(sweeper)
+    assets = Struct.new(:load_path).new(load_path)
+    Rails.application = Struct.new(:assets).new(assets)
+
+    with_app do
+      stub_compiler_new(recording_compiler) do
+        Funicular::Middleware.new(@app).call({})
+      end
+    end
+
+    assert_equal [true], swept, "expected the Propshaft cache sweeper to run"
+  end
+
+  def test_reset_clears_class_state
+    Funicular::Middleware.last_mtime = Time.now
+    Funicular::Middleware.compiling = true
+    Funicular::Middleware.reset!
+    assert_nil Funicular::Middleware.last_mtime
+    refute Funicular::Middleware.compiling
+    assert_instance_of Mutex, Funicular::Middleware.mutex
+  end
+end

data/minitest/picoruby_helper_test.rb

@@ -0,0 +1,139 @@
+# frozen_string_literal: true
+
+require "tmpdir"
+
+require "test_helper"
+require_relative "support/rails_stub"
+require "action_view"
+require "funicular/helpers/picoruby_helper"
+
+# Exercises the ActionView helpers (Funicular::Helpers::PicorubyHelper): the
+# <script> bootstrap tag across the local/cdn sources, the SSR container, and
+# the security-critical state-tag escaping. A minimal ActionView harness plus
+# the Rails stub stand in for a booted app.
+class PicorubyHelperTest < Minitest::Test
+  # Just enough ActionView plumbing for the helper's tag/raw/safe_join calls.
+  class Harness
+    include ActionView::Helpers::TagHelper
+    include ActionView::Helpers::OutputSafetyHelper
+    include Funicular::Helpers::PicorubyHelper
+  end
+
+  def setup
+    Rails.reset_stub!
+    @view = Harness.new
+    @config = Funicular::Configuration.new
+    Funicular.instance_variable_set(:@configuration, @config)
+  end
+
+  def teardown
+    Rails.reset_stub!
+    Funicular.instance_variable_set(:@configuration, nil)
+  end
+
+  # --- picoruby_include_tag --------------------------------------------
+
+  def test_local_dist_source_emits_script_and_base_style
+    html = @view.picoruby_include_tag(source: :local_dist)
+    assert_includes html, '<script src="/picoruby/dist/init.iife.js?v='
+    assert_includes html, "<style"
+    assert_includes html, "data-funicular-base"
+  end
+
+  def test_local_debug_source_path
+    html = @view.picoruby_include_tag(source: :local_debug)
+    assert_includes html, '<script src="/picoruby/debug/init.iife.js?v='
+  end
+
+  def test_base_styles_can_be_skipped
+    html = @view.picoruby_include_tag(source: :local_dist, base_styles: false)
+    assert_includes html, "<script"
+    refute_includes html, "<style"
+  end
+
+  def test_source_defaults_to_configuration_for_current_env
+    Rails.env_name = "production"
+    @config.production_source = :local_dist
+    html = @view.picoruby_include_tag
+    assert_includes html, "/picoruby/dist/init.iife.js"
+  end
+
+  def test_extra_options_become_script_attributes
+    html = @view.picoruby_include_tag(source: :local_dist, base_styles: false, defer: true)
+    assert_includes html, "defer"
+  end
+
+  def test_cdn_source_uses_versioned_jsdelivr_url
+    @config.cdn_version = "1.2.3"
+    html = @view.picoruby_include_tag(source: :cdn, base_styles: false)
+    assert_includes html,
+                    "https://cdn.jsdelivr.net/npm/@picoruby/wasm-wasi@1.2.3/dist/init.iife.js"
+  end
+
+  def test_cdn_source_without_version_raises
+    @config.define_singleton_method(:cdn_version) { nil }
+    error = assert_raises(ArgumentError) do
+      @view.picoruby_include_tag(source: :cdn)
+    end
+    assert_includes error.message, ":cdn requires a version"
+  end
+
+  def test_unknown_source_raises
+    error = assert_raises(ArgumentError) do
+      @view.picoruby_include_tag(source: :bogus)
+    end
+    assert_includes error.message, "Unknown picoruby source"
+  end
+
+  # --- funicular_app_container -----------------------------------------
+
+  def test_app_container_wraps_html_with_default_id
+    html = @view.funicular_app_container("<h1>Hi</h1>")
+    assert_includes html, '<div id="app">'
+    assert_includes html, "<h1>Hi</h1>" # raw, not escaped
+  end
+
+  def test_app_container_accepts_custom_id_and_attributes
+    html = @view.funicular_app_container("", id: "root", class: "shell")
+    assert_includes html, 'id="root"'
+    assert_includes html, 'class="shell"'
+  end
+
+  # --- funicular_state_tag (XSS-sensitive) -----------------------------
+
+  def test_state_tag_serializes_state_as_json
+    html = @view.funicular_state_tag({ "title" => "Channels" })
+    assert_includes html, "window.__FUNICULAR_STATE__ = "
+    assert_includes html, '"title":"Channels"'
+  end
+
+  def test_state_tag_escapes_script_breaking_characters
+    html = @view.funicular_state_tag({ "x" => "</script><b>&" })
+    refute_includes html, "</script><b>"
+    assert_includes html, "\\u003c"
+    assert_includes html, "\\u003e"
+    assert_includes html, "\\u0026"
+  end
+
+  def test_state_tag_defaults_to_empty_object
+    assert_includes @view.funicular_state_tag, "window.__FUNICULAR_STATE__ = {};"
+    assert_includes @view.funicular_state_tag(nil), "{};"
+  end
+
+  # --- funicular_plugin_include_tags -----------------------------------
+
+  def test_plugin_include_tags_empty_when_no_plugins
+    Dir.mktmpdir do |dir|
+      Rails.root = Pathname(dir)
+      assert_equal "", @view.funicular_plugin_include_tags
+    end
+  end
+
+  # --- base_css --------------------------------------------------------
+
+  def test_base_css_is_read_once
+    css = Funicular::Helpers::PicorubyHelper.base_css
+    assert_kind_of String, css
+    assert_same css, Funicular::Helpers::PicorubyHelper.base_css
+  end
+end

data/minitest/route_parser_test.rb

@@ -0,0 +1,139 @@
+# frozen_string_literal: true
+
+require "tempfile"
+
+require "test_helper"
+require "funicular/route_parser"
+
+# Exercises Funicular::RouteParser, the line-based scanner that extracts route
+# definitions from an app's app/funicular/initializer.rb (used by the
+# `funicular:routes` command). It is deliberately regex-free string slicing, so
+# the tests cover the quoting, `to:`/`as:` and legacy `add_route` shapes.
+class RouteParserTest < Minitest::Test
+  def parse(source)
+    Tempfile.create(["initializer", ".rb"]) do |f|
+      f.write(source)
+      f.flush
+      Funicular::RouteParser.new(f.path).parse
+    end
+  end
+
+  def test_missing_file_returns_empty
+    assert_equal [], Funicular::RouteParser.new("/no/such/file.rb").parse
+  end
+
+  def test_parses_get_with_to_and_as
+    routes = parse(<<~RUBY)
+      router.get("/channels", to: ChannelsComponent, as: "channels")
+    RUBY
+
+    assert_equal 1, routes.size
+    assert_equal(
+      { method: "GET", path: "/channels", component: "ChannelsComponent", helper: "channels_path" },
+      routes.first
+    )
+  end
+
+  def test_upcases_each_http_method
+    routes = parse(<<~RUBY)
+      router.get("/a", to: A)
+      router.post("/b", to: B)
+      router.put("/c", to: C)
+      router.patch("/d", to: D)
+      router.delete("/e", to: E)
+    RUBY
+
+    assert_equal %w[GET POST PUT PATCH DELETE], routes.map { |r| r[:method] }
+  end
+
+  def test_legacy_add_route_uses_second_argument_and_get_method
+    routes = parse(<<~RUBY)
+      router.add_route('/legacy', LegacyComponent)
+    RUBY
+
+    assert_equal(
+      { method: "GET", path: "/legacy", component: "LegacyComponent", helper: nil },
+      routes.first
+    )
+  end
+
+  def test_helper_is_nil_without_as_option
+    routes = parse(<<~RUBY)
+      router.get("/plain", to: PlainComponent)
+    RUBY
+
+    assert_nil routes.first[:helper]
+  end
+
+  def test_single_and_double_quotes_are_both_accepted
+    routes = parse(<<~RUBY)
+      router.get('/single', to: Single)
+      router.get("/double", to: Double)
+    RUBY
+
+    assert_equal ["/single", "/double"], routes.map { |r| r[:path] }
+  end
+
+  def test_comments_and_blank_lines_are_skipped
+    routes = parse(<<~RUBY)
+      # router.get("/commented", to: Commented)
+
+        # indented comment
+      router.get("/real", to: Real)
+    RUBY
+
+    assert_equal ["/real"], routes.map { |r| r[:path] }
+  end
+
+  def test_non_router_lines_are_ignored
+    routes = parse(<<~RUBY)
+      Funicular.configure do |config|
+        config.something = true
+      end
+      router.get("/only", to: Only)
+    RUBY
+
+    assert_equal 1, routes.size
+    assert_equal "/only", routes.first[:path]
+  end
+
+  def test_line_without_path_is_skipped
+    routes = parse(<<~RUBY)
+      router.get(to: NoPath)
+    RUBY
+
+    assert_equal [], routes
+  end
+
+  def test_line_without_component_is_skipped
+    routes = parse(<<~RUBY)
+      router.get("/orphan")
+    RUBY
+
+    assert_equal [], routes
+  end
+
+  def test_component_before_trailing_options_is_isolated
+    routes = parse(<<~RUBY)
+      router.get("/x", to: XComponent, as: "x", extra: :ignored)
+    RUBY
+
+    assert_equal "XComponent", routes.first[:component]
+    assert_equal "x_path", routes.first[:helper]
+  end
+
+  def test_component_at_end_of_line_without_trailing_delimiter
+    routes = parse("router.get \"/y\", to: YComponent")
+
+    assert_equal "YComponent", routes.first[:component]
+  end
+
+  def test_as_option_without_a_quoted_value_yields_nil_helper
+    routes = parse(<<~RUBY)
+      router.get("/z", to: ZComponent, as: some_variable)
+    RUBY
+
+    assert_equal "ZComponent", routes.first[:component]
+    assert_nil routes.first[:helper]
+  end
+end

data/minitest/schema_test.rb

@@ -88,6 +88,29 @@ class SchemaDerivationTest < Minitest::Test
     assert_equal({ "update" => { method: "PATCH", path: "/x/:id" } }, schema[:endpoints])
   end
 
+  def test_length_range_is_serialized_as_min_and_max
+    klass = Class.new do
+      include ActiveModel::Validations
+      def self.name = "Ranged"
+      attr_accessor :bio
+      validates :bio, length: { in: 2..10 }
+    end
+    result = Funicular::Schema.validations_for(klass, ["bio"])
+    assert_equal({ "minimum" => 2, "maximum" => 10 }, result["bio"]["length"])
+  end
+
+  def test_format_multiline_flag_is_translated
+    klass = Class.new do
+      include ActiveModel::Validations
+      def self.name = "Multi"
+      attr_accessor :body
+      validates :body, format: { with: /\Aline/m }
+    end
+    result = Funicular::Schema.validations_for(klass, ["body"])
+    assert_equal "m", result["body"]["format"]["flags"]
+    assert_equal "^line", result["body"]["format"]["with"]
+  end
+
   def test_extended_regexp_is_skipped
     klass = Class.new do
       include ActiveModel::Validations

data/minitest/ssr_test.rb

@@ -59,6 +59,36 @@ class SSRTest < Minitest::Test
                  serialize(el("a", { href: "javascript:alert(1)" }, ["x"]))
   end
 
+  def test_security_checks_are_case_insensitive
+    assert_equal "<button>Go</button>",
+                 serialize(el("button", { "ONCLICK" => "alert(1)" }, ["Go"]))
+    assert_equal "<a>x</a>",
+                 serialize(el("a", { "HREF" => "JAVASCRIPT:alert(1)" }, ["x"]))
+  end
+
+  def test_blocks_obfuscated_javascript_uri
+    assert_equal "<a>x</a>",
+                 serialize(el("a", { href: "java\nscript:alert(1)" }, ["x"]))
+    assert_equal "<a>x</a>",
+                 serialize(el("a", { href: "\x01javascript:alert(1)" }, ["x"]))
+  end
+
+  def test_blocks_srcdoc
+    assert_equal "<div></div>",
+                 serialize(el("div", { srcdoc: "<script>alert(1)</script>" }))
+  end
+
+  def test_rejects_invalid_attribute_name
+    assert_raises(ArgumentError) do
+      el("div", { 'x" autofocus onfocus' => "alert(1)" })
+    end
+  end
+
+  def test_rejects_invalid_and_active_tag_names
+    assert_raises(ArgumentError) { el('div><script>alert(1)</script><div') }
+    assert_raises(ArgumentError) { el("script", {}, ["alert(1)"]) }
+  end
+
   # --- Full SSR render (runtime + fixture app) --------------------------
 
   def test_render_injects_server_state
@@ -91,4 +121,31 @@ class SSRTest < Minitest::Test
     result = Funicular::SSR.render(path: "/greet/42", source_dir: APP_DIR)
     assert_includes result[:html], "greeting"
   end
+
+  def test_symbolize_keys_handles_nil_and_string_keys
+    assert_equal({}, Funicular::SSR.symbolize_keys(nil))
+    assert_equal({ a: 1, b: 2 }, Funicular::SSR.symbolize_keys("a" => 1, "b" => 2))
+  end
+
+  # --- Runtime lifecycle flags -----------------------------------------
+
+  def test_framework_reports_loaded_after_setup
+    assert Funicular::SSR::Runtime.framework_loaded?
+  end
+
+  def test_reset_app_allows_rebooting_a_different_app
+    Funicular::SSR::Runtime.boot!(APP_DIR)
+    Funicular::SSR::Runtime.reset_app!
+    # A second boot after reset re-`load`s the fixture, which redefines its
+    # methods; that "method redefined" warning is expected here (it's the whole
+    # point of reset_app!), so silence it rather than leak noise into the run.
+    original_verbose = $VERBOSE
+    $VERBOSE = nil
+    begin
+      Funicular::SSR::Runtime.boot!(APP_DIR)
+    ensure
+      $VERBOSE = original_verbose
+    end
+    assert Funicular::SSR::Runtime.framework_loaded?
+  end
 end

data/minitest/support/rails_stub.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+require "logger"
+require "pathname"
+
+# A tiny stand-in for the slice of Rails the funicular gem touches, so the
+# Rails-integration units (middleware, view helpers, the CLI command) can be
+# exercised under plain minitest without booting a real application.
+#
+# Only what the gem actually reads is implemented: Rails.env (with the
+# `env.development?` style predicates), Rails.root, Rails.logger, and
+# Rails.application. Everything is resettable so tests stay isolated.
+module Rails
+  # String subclass answering `development?` / `production?` / `test?` etc.,
+  # mirroring ActiveSupport::StringInquirer closely enough for the gem's needs.
+  class EnvInquirer < String
+    def method_missing(name, *args)
+      str = name.to_s
+      return super unless str.end_with?("?")
+
+      self == str.chomp("?")
+    end
+
+    def respond_to_missing?(name, _include_private = false)
+      name.to_s.end_with?("?") || super
+    end
+  end
+
+  class << self
+    attr_writer :root, :logger, :application
+    attr_accessor :env_name
+
+    def env
+      EnvInquirer.new(env_name || "test")
+    end
+
+    def root
+      @root
+    end
+
+    def logger
+      @logger ||= Logger.new(IO::NULL)
+    end
+
+    def application
+      @application
+    end
+
+    # Restore defaults between tests.
+    def reset_stub!
+      @root = nil
+      @logger = Logger.new(IO::NULL)
+      @application = nil
+      @env_name = "test"
+    end
+  end
+
+  reset_stub!
+end

data/minitest/test_helper.rb

@@ -1,5 +1,25 @@
 # frozen_string_literal: true
 
+# Coverage must start before any lib/ file is required so every line is
+# tracked. Opt in via `rake test:coverage` (or COVERAGE=1) to avoid slowing
+# down focused, single-file runs.
+if ENV["COVERAGE"]
+  require "simplecov"
+  SimpleCov.start do
+    # Only the gem's own Ruby implementation (lib/) is in scope here. The
+    # PicoRuby runtime (mrblib/), the client test suite (test/), and the
+    # minitest suite itself are out of scope for this coverage report.
+    root File.expand_path("..", __dir__)
+    add_filter %r{\A/(minitest|test|mrblib|sig|exe|bin)/}
+    track_files "lib/**/*.rb"
+
+    add_group "Core",       "lib/funicular"
+    add_group "SSR",        "lib/funicular/ssr"
+    add_group "Rails",      %r{lib/funicular/(railtie|middleware|helpers|commands|tasks)}
+    add_group "Generators", "lib/generators"
+  end
+end
+
 $LOAD_PATH.unshift File.expand_path("../lib", __dir__)
 require "funicular"
 require "minitest/autorun"