gemstack-http 0.2.4 → 0.3.0

data/lib/gemstack/http/middleware/request_logger.rb

@@ -1,39 +0,0 @@
-# frozen_string_literal: true
-
-module GemStack
-  module HTTP
-    module Middleware
-      # One structured log line per request, written when the response body is
-      # closed so streamed responses are timed correctly:
-      #
-      #   INFO  GET /api/products status=200 ms=1.84 id=5f0c...
-      #
-      # Query strings are not logged (they often carry tokens).
-      class RequestLogger
-        def initialize(app, logger: nil)
-          @app = app
-          @logger = logger
-        end
-
-        def call(env)
-          started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-          status, headers, body = @app.call(env)
-          body = Rack::BodyProxy.new(body) { log(env, status, started) }
-          [status, headers, body]
-        end
-
-        private
-
-        def log(env, status, started)
-          logger = @logger || GemStack.logger
-          return unless logger.info?
-
-          ms = ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - started) * 1000).round(2)
-          severity = status >= 500 ? :error : :info
-          logger.public_send(severity, "#{env[Rack::REQUEST_METHOD]} #{env[Rack::PATH_INFO]}",
-                             status: status, ms: ms, id: env[REQUEST_ID])
-        end
-      end
-    end
-  end
-end

data/lib/gemstack/http/middleware/security_headers.rb

@@ -1,31 +0,0 @@
-# frozen_string_literal: true
-
-module GemStack
-  module HTTP
-    module Middleware
-      # Adds config.http.security_headers to responses that don't already set
-      # them, plus Strict-Transport-Security on HTTPS requests when
-      # config.http.hsts is set (production by default).
-      class SecurityHeaders
-        def initialize(app, config)
-          @app = app
-          @headers = config.security_headers.transform_keys { |key| key.to_s.downcase }.freeze
-          @hsts = config.hsts
-        end
-
-        def call(env)
-          status, headers, body = @app.call(env)
-          @headers.each { |key, value| headers[key] = value unless headers.key?(key) }
-          headers["strict-transport-security"] ||= @hsts if @hsts && https?(env)
-          [status, headers, body]
-        end
-
-        private
-
-        def https?(env)
-          env[Rack::RACK_URL_SCHEME] == "https" || env["HTTP_X_FORWARDED_PROTO"]&.start_with?("https")
-        end
-      end
-    end
-  end
-end

data/lib/gemstack/http/middleware_stack.rb

@@ -1,96 +0,0 @@
-# frozen_string_literal: true
-
-module GemStack
-  module HTTP
-    # An ordered, editable list of Rack middleware, compiled once into a
-    # nested Rack app when the application is built.
-    #
-    #   config.http.middleware.use Rack::Attack
-    #   config.http.middleware.insert_before GemStack::HTTP::Middleware::ErrorHandler, MyTiming
-    #   config.http.middleware.swap GemStack::HTTP::Middleware::RequestLogger, MyLogger
-    #   config.http.middleware.delete GemStack::HTTP::Middleware::SecurityHeaders
-    #
-    # Targets are middleware classes or integer positions. Any Rack
-    # middleware (`new(app, *args)`, `#call(env)`) works.
-    class MiddlewareStack
-      include Enumerable
-
-      Entry = Struct.new(:klass, :args, :kwargs, :block) do
-        def build(app) = klass.new(app, *args, **kwargs, &block)
-        def name = klass.respond_to?(:name) && klass.name ? klass.name : klass.inspect
-      end
-
-      def self.default(config)
-        new.tap do |stack|
-          stack.use Middleware::RequestId, config
-          stack.use Middleware::RequestLogger
-          stack.use Middleware::Compression, config
-          stack.use Middleware::ErrorHandler, config
-          stack.use Middleware::SecurityHeaders, config
-          stack.use Middleware::Cors, config
-          stack.use Middleware::BodyLimit, config
-          stack.use Middleware::HealthCheck, config
-          stack.use Middleware::ETags, config
-        end
-      end
-
-      def initialize
-        @entries = []
-      end
-
-      def use(klass, *args, **kwargs, &block)
-        @entries << Entry.new(klass, args, kwargs, block)
-        self
-      end
-
-      def unshift(klass, *args, **kwargs, &block)
-        @entries.unshift(Entry.new(klass, args, kwargs, block))
-        self
-      end
-
-      def insert_before(target, klass, *args, **kwargs, &block)
-        @entries.insert(index!(target), Entry.new(klass, args, kwargs, block))
-        self
-      end
-
-      def insert_after(target, klass, *args, **kwargs, &block)
-        @entries.insert(index!(target) + 1, Entry.new(klass, args, kwargs, block))
-        self
-      end
-
-      def swap(target, klass, *args, **kwargs, &block)
-        @entries[index!(target)] = Entry.new(klass, args, kwargs, block)
-        self
-      end
-
-      def delete(target)
-        @entries.delete_at(index!(target))
-        self
-      end
-
-      def include?(klass) = @entries.any? { |entry| entry.klass == klass }
-      def each(&) = @entries.each(&)
-      def size = @entries.size
-      def names = @entries.map(&:name)
-
-      # Wraps endpoint so that the first middleware in the list runs first.
-      def build(endpoint)
-        @entries.reverse.inject(endpoint) { |app, entry| entry.build(app) }
-      end
-
-      def initialize_copy(source)
-        super
-        @entries = source.to_a.dup
-      end
-
-      private
-
-      def index!(target)
-        index = target.is_a?(Integer) ? target : @entries.index { |entry| entry.klass == target }
-        raise ArgumentError, "no middleware #{target.inspect} in the stack" unless index && @entries[index]
-
-        index
-      end
-    end
-  end
-end

data/lib/gemstack/http/page.rb

@@ -1,36 +0,0 @@
-# frozen_string_literal: true
-
-module GemStack
-  module HTTP
-    # One page of a collection, rendered as the pagination envelope
-    # (DECISIONS D-034):
-    #
-    #   { "data": [ ... ], "meta": { "page": 2, "per_page": 25, "total": 180, "total_pages": 8 } }
-    #
-    # Built by Controller#paginate. `GemStack::Page[ProductSerializer]` is the
-    # matching type for `returns`, so the TypeScript client gets `Paginated<Product>`.
-    # Always namespaced, so an app's own Page model never collides with it.
-    class Page
-      # Type marker for the contract: Page[ProductSerializer].
-      Type = Struct.new(:item)
-
-      def self.[](item_type) = Type.new(item_type)
-
-      attr_reader :items, :page, :per_page, :total
-
-      def initialize(items, page:, per_page:, total:)
-        @items = items
-        @page = page
-        @per_page = per_page
-        @total = total
-      end
-
-      def total_pages = total.zero? ? 0 : (total.to_f / per_page).ceil
-
-      def meta = { page: page, per_page: per_page, total: total, total_pages: total_pages }
-    end
-  end
-
-  # Public name, used in controllers: `returns :index, GemStack::Page[ProductSerializer]`.
-  Page = HTTP::Page
-end

data/lib/gemstack/http/params.rb

@@ -1,140 +0,0 @@
-# frozen_string_literal: true
-
-module GemStack
-  module HTTP
-    # Request parameters with indifferent (string/symbol) key access and
-    # explicit allow-listing for anything that reaches the application:
-    #
-    #   params[:id]                              # path, query or body
-    #   params.require(:product)                 # 400 if missing/blank
-    #   params.permit(:name, :price, tags: [], dimensions: [:width, :height])
-    #   # => { name: "Lamp", price: "9.99", tags: ["home"], dimensions: { width: 3, height: 5 } }
-    #
-    # #permit only returns scalars (and arrays/hashes that are explicitly
-    # declared), so unexpected nested structures never reach models.
-    class Params
-      include Enumerable
-
-      class ParameterMissing < BadRequest
-        def initialize(key)
-          super("Missing parameter: #{key}", code: "parameter_missing", details: { key.to_s => ["is required"] })
-        end
-      end
-
-      SCALARS = [String, Integer, Float, TrueClass, FalseClass, NilClass].freeze
-
-      def initialize(hash = {})
-        @hash = hash.transform_keys(&:to_s)
-      end
-
-      def [](key) = wrap(@hash[key.to_s])
-      def key?(key) = @hash.key?(key.to_s)
-      alias has_key? key?
-      alias include? key?
-      def keys = @hash.keys
-      def empty? = @hash.empty?
-      def size = @hash.size
-      def each(&) = @hash.each { |key, value| yield key, wrap(value) }
-
-      def fetch(key, *default, &)
-        wrap(@hash.fetch(key.to_s, *default, &))
-      end
-
-      def dig(key, *rest)
-        value = self[key]
-        rest.empty? || value.nil? ? value : value.dig(*rest)
-      end
-
-      # Returns the value for key, raising ParameterMissing (400) when it is
-      # absent, nil, or an empty string/collection.
-      def require(key)
-        value = @hash[key.to_s]
-        raise ParameterMissing, key if blank?(value)
-
-        wrap(value)
-      end
-
-      def slice(*keys) = Params.new(@hash.slice(*keys.map(&:to_s)))
-      def except(*keys) = Params.new(@hash.except(*keys.map(&:to_s)))
-
-      # Allow-list. Returns a plain Hash with symbol keys.
-      def permit(*filters)
-        filters.each_with_object({}) do |filter, result|
-          case filter
-          when Symbol, String
-            key = filter.to_s
-            value = @hash[key]
-            result[filter.to_sym] = value if @hash.key?(key) && scalar?(value)
-          when Hash
-            filter.each { |key, nested| permit_nested(result, key, nested) }
-          else
-            raise ArgumentError, "invalid permit filter #{filter.inspect}"
-          end
-        end
-      end
-
-      # Validates and coerces against a schema (see GemStack::Schema), returning
-      # a symbol-keyed Hash of declared fields or raising a 422 ValidationError:
-      #
-      #   attrs = params.validate do
-      #     required :name, :string
-      #     required :price, :decimal, gt: 0
-      #   end
-      #   attrs = params.validate(ProductInput)
-      def validate(schema = nil, &)
-        schema ||= Schema.define(&)
-        schema.call(@hash)
-      end
-
-      # Unfiltered, deep copy with string keys. Prefer #permit for input
-      # that will be persisted.
-      def to_h = deep_dup(@hash)
-      alias to_unsafe_h to_h
-
-      def ==(other)
-        to_h == (other.is_a?(Params) ? other.to_h : other)
-      end
-
-      def inspect = "#<#{self.class.name} #{@hash.inspect}>"
-
-      private
-
-      def permit_nested(result, key, nested)
-        value = @hash[key.to_s]
-        return unless @hash.key?(key.to_s)
-
-        if nested == [] # array of scalars
-          result[key.to_sym] = value.select { |v| scalar?(v) } if value.is_a?(Array)
-        elsif value.is_a?(Hash)
-          result[key.to_sym] = Params.new(value).permit(*nested)
-        elsif value.is_a?(Array) && value.all?(Hash) # array of objects
-          result[key.to_sym] = value.map { |item| Params.new(item).permit(*nested) }
-        end
-      end
-
-      def wrap(value)
-        case value
-        when Hash then Params.new(value)
-        when Array then value.map { |v| wrap(v) }
-        else value
-        end
-      end
-
-      def scalar?(value) = SCALARS.any? { |type| value.is_a?(type) } || uploaded_file?(value)
-
-      def uploaded_file?(value) = defined?(Rack::Multipart::UploadedFile) && value.is_a?(Rack::Multipart::UploadedFile)
-
-      def blank?(value)
-        value.nil? || (value.respond_to?(:empty?) && value.empty?) || (value.is_a?(String) && value.strip.empty?)
-      end
-
-      def deep_dup(value)
-        case value
-        when Hash then value.transform_values { |v| deep_dup(v) }
-        when Array then value.map { |v| deep_dup(v) }
-        else value
-        end
-      end
-    end
-  end
-end

data/lib/gemstack/http/request.rb

@@ -1,64 +0,0 @@
-# frozen_string_literal: true
-
-module GemStack
-  module HTTP
-    # Rack::Request plus GemStack conveniences. Bodies are parsed lazily:
-    # nothing is read from the socket until params or #json is used.
-    class Request < Rack::Request
-      JSON_TYPE = %r{\Aapplication/(?:[\w.+-]+\+)?json\b}i
-
-      def request_id = get_header(REQUEST_ID)
-      def path_params = get_header(PATH_PARAMS) || {}
-      def route = get_header(ROUTE)
-
-      def json?
-        JSON_TYPE.match?(content_type.to_s)
-      end
-
-      # The parsed JSON body (any JSON value), or nil for an empty body.
-      # Raises BadRequest for malformed JSON or excessive nesting.
-      def json
-        return @json if defined?(@json)
-
-        raw = body&.read.to_s
-        body&.rewind if body.respond_to?(:rewind)
-        @json = raw.strip.empty? ? nil : codec.load(raw)
-      rescue ::JSON::NestingError
-        raise BadRequest.new("JSON body is nested too deeply", code: "invalid_json")
-      rescue ::JSON::ParserError, EncodingError
-        raise BadRequest.new("Request body is not valid JSON", code: "invalid_json")
-      end
-
-      # Parameters from the body: a JSON object, or form/multipart fields.
-      # Non-object JSON bodies (arrays, scalars) are available via #json.
-      def body_params
-        @body_params ||=
-          if json?
-            value = json
-            value.is_a?(Hash) ? value : {}
-          elsif form_data? || parseable_data?
-            self.POST
-          else
-            {}
-          end
-      end
-
-      # Query, then body, then path parameters (later sources win).
-      def all_params
-        query = self.GET
-        body = body_params
-        path = path_params
-        return query if body.empty? && path.empty?
-
-        query.merge(body).merge(path)
-      rescue Rack::QueryParser::ParameterTypeError, Rack::QueryParser::InvalidParameterError,
-             Rack::Multipart::MultipartPartLimitError => e
-        raise BadRequest.new(e.message, code: "invalid_parameters")
-      end
-
-      private
-
-      def codec = get_header(JSON_CODEC) || JSONCodec.default
-    end
-  end
-end