grape 1.8.0 → 2.1.0

data/UPGRADING.md

@@ -1,6 +1,234 @@
 Upgrading Grape
 ===============
 
+### Upgrading to >= 2.1.0
+
+#### Optional Builder
+
+The `builder` gem dependency has been made optional as it's only used when generating XML. If your code does, add `builder` to your `Gemfile`.
+
+See [#2445](https://github.com/ruby-grape/grape/pull/2445) for more information.
+
+#### Deep Merging of Parameter Attributes
+
+Grape now uses `deep_merge` to combine parameter attributes within the `with` method. Previously, attributes defined at the parameter level would override those defined at the group level.
+With deep merge, attributes are now combined, allowing for more detailed and nuanced API specifications.
+
+For example:
+
+```ruby
+with(documentation: { in: 'body' }) do
+  optional :vault, documentation: { default: 33 }
+end
+```
+
+Before it was equivalent to:
+
+```ruby
+optional :vault, documentation: { default: 33 }
+```
+
+After it is an equivalent of:
+
+```ruby
+optional :vault, documentation: { in: 'body', default: 33 }
+```
+
+See [#2432](https://github.com/ruby-grape/grape/pull/2432) for more information.
+
+#### Zeitwerk
+
+Grape's autoloader has been updated and it's now based on [Zeitwerk](https://github.com/fxn/zeitwerk).
+If you MP (Monkey Patch) some files and you're not following the [file structure](https://github.com/fxn/zeitwerk?tab=readme-ov-file#file-structure), you might end up with a Zeitwerk error.
+
+See [#2363](https://github.com/ruby-grape/grape/pull/2363) for more information.
+
+#### Changes in rescue_from
+
+The `rack_response` method has been deprecated and the `error_response` method has been removed. Use `error!` instead.
+
+See [#2414](https://github.com/ruby-grape/grape/pull/2414) for more information.
+
+#### Change in parameters precedence
+
+When using together with `Grape::Extensions::Hash::ParamBuilder`, `route_param` takes higher precedence over a regular parameter defined with same name, which now matches the default param builder behavior.
+
+This was a regression introduced by [#2326](https://github.com/ruby-grape/grape/pull/2326) in Grape v1.8.0.
+
+```ruby
+grape.configure do |config|
+  config.param_builder = Grape::Extensions::Hash::ParamBuilder
+end
+
+params do
+  requires :foo, type: String
+end
+route_param :foo do
+  get do
+    { value: params[:foo] }
+  end
+end
+```
+
+Request:
+
+```bash
+curl -X POST -H "Content-Type: application/json" localhost:9292/bar -d '{"foo": "baz"}'
+```
+
+Response prior to v1.8.0:
+
+```json
+{
+  "value": "bar"
+}
+```
+
+v1.8.0..v2.0.0:
+
+```json
+{
+  "value": "baz"
+}
+```
+
+v2.1.0+:
+
+```json
+{
+  "value": "bar"
+}
+```
+
+See [#2378](https://github.com/ruby-grape/grape/pull/2378) for details.
+
+#### Grape::Router::Route.route_xxx methods have been removed
+
+- `route_method` is accessible through `request_method`
+- `route_path` is accessible through `path`
+- Any other `route_xyz` are accessible through `options[xyz]`
+
+#### Instance variables scope
+
+Due to the changes done in [#2377](https://github.com/ruby-grape/grape/pull/2377), the instance variables defined inside each of the endpoints (or inside a `before` validator) are now accessible inside the `rescue_from`. The behavior of the instance variables was undefined until `2.1.0`.
+
+If you were using the same variable name defined inside an endpoint or `before` validator inside a `rescue_from` handler, you need to take in mind that you can start getting different values or you can be overriding values.
+
+Before:
+```ruby
+class TwitterAPI < Grape::API
+  before do
+    @var = 1
+  end
+
+  get '/' do
+    puts @var # => 1
+    raise
+  end
+
+  rescue_from :all do
+    puts @var # => nil
+  end
+end
+```
+
+After:
+```ruby
+class TwitterAPI < Grape::API
+  before do
+    @var = 1
+  end
+
+  get '/' do
+    puts @var # => 1
+    raise
+  end
+
+  rescue_from :all do
+    puts @var # => 1
+  end
+end
+```
+
+#### Recognizing Path
+
+Grape now considers the types of the configured `route_params` in order to determine the endpoint that matches with the performed request.
+
+So taking into account this `Grape::API` class
+
+```ruby
+class Books < Grape::API
+  resource :books do
+    route_param :id, type: Integer do
+      # GET /books/:id
+      get do
+        #...
+      end
+    end
+
+    resource :share do
+      # POST /books/share
+      post do
+      # ....
+      end
+    end
+  end
+end
+```
+
+Before:
+```ruby
+API.recognize_path '/books/1' # => /books/:id
+API.recognize_path '/books/share' # => /books/:id
+API.recognize_path '/books/other' # => /books/:id
+```
+
+After:
+```ruby
+API.recognize_path '/books/1' # => /books/:id
+API.recognize_path '/books/share' # => /books/share
+API.recognize_path '/books/other' # => nil
+```
+
+This implies that before this changes, when you performed `/books/other` and it matched with the `/books/:id` endpoint, you get a `400 Bad Request` response because the type of the provided `:id` param was not an `Integer`. However, after upgrading to version `2.1.0` you will get a `404 Not Found` response, because there is not a defined endpoint that matches with `/books/other`.
+
+See [#2379](https://github.com/ruby-grape/grape/pull/2379) for more information.
+
+### Upgrading to >= 2.0.0
+
+#### Headers
+
+As per [rack/rack#1592](https://github.com/rack/rack/issues/1592) Rack 3 is following the HTTP/2+ semantics which require header names to be lower case. To avoid compatibility issues, starting with Grape 1.9.0, headers will be cased based on what version of Rack you are using.
+
+Given this request:
+
+```shell
+curl -H "Content-Type: application/json" -H "Secret-Password: foo" ...
+```
+
+If you are using Rack 3 in your application then the headers will be set to:
+
+```ruby
+{ "content-type" => "application/json", "secret-password" => "foo"}
+```
+
+This means if you are checking for header values in your application, you would need to change your code to use downcased keys.
+
+```ruby
+get do
+  # This would use headers['Secret-Password'] in Rack < 3
+  error!('Unauthorized', 401) unless headers['secret-password'] == 'swordfish'
+end
+```
+
+See [#2355](https://github.com/ruby-grape/grape/pull/2355) for more information.
+
+#### Digest auth deprecation
+
+Digest auth has been removed along with the deprecation of `Rack::Auth::Digest` in Rack 3.
+
+See [#2294](https://github.com/ruby-grape/grape/issues/2294) for more information.
+
 ### Upgrading to >= 1.7.0
 
 #### Exceptions renaming
@@ -439,8 +667,7 @@ end
 
 ##### `name` (and other caveats) of the mounted API
 
-After the patch, the mounted API is no longer a Named class inheriting from `Grape::API`, it is an anonymous class
-which inherit from `Grape::API::Instance`.
+After the patch, the mounted API is no longer a Named class inheriting from `Grape::API`, it is an anonymous class which inherit from `Grape::API::Instance`.
 
 What this means in practice, is:
 
@@ -820,8 +1047,7 @@ See [#1114](https://github.com/ruby-grape/grape/pull/1114) for more information.
 
 #### Bypasses formatters when status code indicates no content
 
-To be consistent with rack and it's handling of standard responses associated with no content, both default and custom formatters will now
-be bypassed when processing responses for status codes defined [by rack](https://github.com/rack/rack/blob/master/lib/rack/utils.rb#L567)
+To be consistent with rack and it's handling of standard responses associated with no content, both default and custom formatters will now be bypassed when processing responses for status codes defined [by rack](https://github.com/rack/rack/blob/master/lib/rack/utils.rb#L567)
 
 See [#1190](https://github.com/ruby-grape/grape/pull/1190) for more information.
 
@@ -1262,8 +1488,7 @@ As replacement can be used
 * `Grape::Middleware::Auth::Digest` => [`Rack::Auth::Digest::MD5`](https://github.com/rack/rack/blob/master/lib/rack/auth/digest/md5.rb)
 * `Grape::Middleware::Auth::OAuth2` => [warden-oauth2](https://github.com/opperator/warden-oauth2) or [rack-oauth2](https://github.com/nov/rack-oauth2)
 
-If this is not possible you can extract the middleware files from [grape v0.7.0](https://github.com/ruby-grape/grape/tree/v0.7.0/lib/grape/middleware/auth)
-and host these files within your application
+If this is not possible you can extract the middleware files from [grape v0.7.0](https://github.com/ruby-grape/grape/tree/v0.7.0/lib/grape/middleware/auth) and host these files within your application
 
 See [#703](https://github.com/ruby-grape/Grape/pull/703) for more information.
 

data/grape.gemspec

@@ -20,17 +20,13 @@ Gem::Specification.new do |s|
     'source_code_uri' => "https://github.com/ruby-grape/grape/tree/v#{s.version}"
   }
 
-  s.add_runtime_dependency 'activesupport', '>= 5'
-  s.add_runtime_dependency 'builder'
+  s.add_runtime_dependency 'activesupport', '>= 6'
   s.add_runtime_dependency 'dry-types', '>= 1.1'
-  s.add_runtime_dependency 'mustermann-grape', '~> 1.0.0'
-  s.add_runtime_dependency 'rack', '>= 1.3.0'
-  s.add_runtime_dependency 'rack-accept'
+  s.add_runtime_dependency 'mustermann-grape', '~> 1.1.0'
+  s.add_runtime_dependency 'rack', '>= 2'
+  s.add_runtime_dependency 'zeitwerk'
 
-  s.files         = %w[CHANGELOG.md CONTRIBUTING.md README.md grape.png UPGRADING.md LICENSE]
-  s.files        += %w[grape.gemspec]
-  s.files        += Dir['lib/**/*']
-  s.test_files    = Dir['spec/**/*']
+  s.files = Dir['lib/**/*', 'CHANGELOG.md', 'CONTRIBUTING.md', 'README.md', 'grape.png', 'UPGRADING.md', 'LICENSE', 'grape.gemspec']
   s.require_paths = ['lib']
-  s.required_ruby_version = '>= 2.6.0'
+  s.required_ruby_version = '>= 2.7.0'
 end

data/lib/grape/api/instance.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require 'grape/router'
-
 module Grape
   class API
     # The API Instance class, is the engine behind Grape::API. Each class that inherits
@@ -112,7 +110,7 @@ module Grape
         end
 
         def evaluate_as_instance_with_configuration(block, lazy: false)
-          lazy_block = Grape::Util::LazyBlock.new do |configuration|
+          lazy_block = Grape::Util::Lazy::Block.new do |configuration|
             value_for_configuration = configuration
             self.configuration = value_for_configuration.evaluate if value_for_configuration.respond_to?(:lazy?) && value_for_configuration.lazy?
             response = instance_eval(&block)
@@ -127,6 +125,7 @@ module Grape
         end
 
         def inherited(subclass)
+          super
           subclass.reset!
           subclass.logger = logger.clone
         end
@@ -162,9 +161,13 @@ module Grape
 
       # Handle a request. See Rack documentation for what `env` is.
       def call(env)
-        result = @router.call(env)
-        result[1].delete(Grape::Http::Headers::X_CASCADE) unless cascade?
-        result
+        status, headers, response = @router.call(env)
+        unless cascade?
+          headers = Grape::Util::Header.new.merge(headers)
+          headers.delete(Grape::Http::Headers::X_CASCADE)
+        end
+
+        [status, headers, response]
       end
 
       # Some requests may return a HTTP 404 error if grape cannot find a matching
@@ -203,11 +206,11 @@ module Grape
 
               allowed_methods = config[:methods].dup
 
-              allowed_methods |= [Grape::Http::Headers::HEAD] if !self.class.namespace_inheritable(:do_not_route_head) && allowed_methods.include?(Grape::Http::Headers::GET)
+              allowed_methods |= [Rack::HEAD] if !self.class.namespace_inheritable(:do_not_route_head) && allowed_methods.include?(Rack::GET)
 
-              allow_header = (self.class.namespace_inheritable(:do_not_route_options) ? allowed_methods : [Grape::Http::Headers::OPTIONS] | allowed_methods)
+              allow_header = (self.class.namespace_inheritable(:do_not_route_options) ? allowed_methods : [Rack::OPTIONS] | allowed_methods)
 
-              config[:endpoint].options[:options_route_enabled] = true unless self.class.namespace_inheritable(:do_not_route_options) || allowed_methods.include?(Grape::Http::Headers::OPTIONS)
+              config[:endpoint].options[:options_route_enabled] = true unless self.class.namespace_inheritable(:do_not_route_options) || allowed_methods.include?(Rack::OPTIONS)
 
               attributes = config.merge(allowed_methods: allowed_methods, allow_header: allow_header)
               generate_not_allowed_method(config[:pattern], **attributes)
@@ -218,7 +221,7 @@ module Grape
 
       def collect_route_config_per_pattern
         all_routes       = self.class.endpoints.map(&:routes).flatten
-        routes_by_regexp = all_routes.group_by { |route| route.pattern.to_regexp }
+        routes_by_regexp = all_routes.group_by(&:pattern_regexp)
 
         # Build the configuration based on the first endpoint and the collection of methods supported.
         routes_by_regexp.values.map do |routes|

data/lib/grape/api.rb

@@ -1,8 +1,5 @@
 # frozen_string_literal: true
 
-require 'grape/router'
-require 'grape/api/instance'
-
 module Grape
   # The API class is the primary entry point for creating Grape APIs. Users
   # should subclass this class in order to build an API.
@@ -26,8 +23,8 @@ module Grape
       attr_accessor :base_instance, :instances
 
       # Rather than initializing an object of type Grape::API, create an object of type Instance
-      def new(*args, &block)
-        base_instance.new(*args, &block)
+      def new(...)
+        base_instance.new(...)
       end
 
       # When inherited, will create a list of all instances (times the API was mounted)
@@ -77,8 +74,8 @@ module Grape
       # the headers, and the body. See [the rack specification]
       # (http://www.rubydoc.info/github/rack/rack/master/file/SPEC) for more.
       # NOTE: This will only be called on an API directly mounted on RACK
-      def call(*args, &block)
-        instance_for_rack.call(*args, &block)
+      def call(...)
+        instance_for_rack.call(...)
       end
 
       # Alleviates problems with autoloading by tring to search for the constant
@@ -128,7 +125,6 @@ module Grape
       end
 
       def compile!
-        require 'grape/eager_load'
         instance_for_rack.compile! # See API::Instance.compile!
       end
 
@@ -150,6 +146,19 @@ module Grape
         @instances.each do |instance|
           last_response = replay_step_on(instance, setup_step)
         end
+
+        # Updating all previously mounted classes in the case that new methods have been executed.
+        if method != :mount && @setup.any?
+          previous_mount_steps = @setup.select { |step| step[:method] == :mount }
+          previous_mount_steps.each do |mount_step|
+            refresh_mount_step = mount_step.merge(method: :refresh_mounted_api)
+            @setup += [refresh_mount_step]
+            @instances.each do |instance|
+              replay_step_on(instance, refresh_mount_step)
+            end
+          end
+        end
+
         last_response
       end
 

data/lib/grape/content_types.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require 'grape/util/registrable'
-
 module Grape
   module ContentTypes
     extend Util::Registrable

data/lib/grape/cookies.rb

@@ -33,9 +33,10 @@ module Grape
       @cookies.each(&block)
     end
 
+    # see https://github.com/rack/rack/blob/main/lib/rack/utils.rb#L338-L340
     # rubocop:disable Layout/SpaceBeforeBrackets
     def delete(name, **opts)
-      options = opts.merge(value: 'deleted', expires: Time.at(0))
+      options = opts.merge(max_age: '0', value: '', expires: Time.at(0))
       self.[]=(name, options)
     end
     # rubocop:enable Layout/SpaceBeforeBrackets

data/lib/grape/dry_types.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require 'dry-types'
-
 module Grape
   module DryTypes
     # Call +Dry.Types()+ to add all registered types to +DryTypes+ which is

data/lib/grape/dsl/desc.rb

@@ -5,6 +5,27 @@ module Grape
     module Desc
       include Grape::DSL::Settings
 
+      ROUTE_ATTRIBUTES = %i[
+        body_name
+        consumes
+        default
+        deprecated
+        description
+        detail
+        entity
+        headers
+        hidden
+        http_codes
+        is_array
+        named
+        nickname
+        params
+        produces
+        security
+        summary
+        tags
+      ].freeze
+
       # Add a description to the next namespace or function.
       # @param description [String] descriptive string for this endpoint
       #   or namespace
@@ -68,7 +89,7 @@ module Grape
           end
 
           config_class.configure(&config_block)
-          ActiveSupport::Deprecation.warn('Passing a options hash and a block to `desc` is deprecated. Move all hash options to block.') if options.any?
+          Grape.deprecator.warn('Passing a options hash and a block to `desc` is deprecated. Move all hash options to block.') if options.any?
           options = config_class.settings
         else
           options = options.merge(description: description)
@@ -81,26 +102,7 @@ module Grape
       # Returns an object which configures itself via an instance-context DSL.
       def desc_container(endpoint_configuration)
         Module.new do
-          include Grape::Util::StrictHashConfiguration.module(
-            :summary,
-            :description,
-            :detail,
-            :params,
-            :entity,
-            :http_codes,
-            :named,
-            :body_name,
-            :headers,
-            :hidden,
-            :deprecated,
-            :is_array,
-            :nickname,
-            :produces,
-            :consumes,
-            :security,
-            :tags,
-            :default
-          )
+          include Grape::Util::StrictHashConfiguration.module(*ROUTE_ATTRIBUTES)
           config_context.define_singleton_method(:configuration) do
             endpoint_configuration
           end

data/lib/grape/dsl/headers.rb

@@ -12,7 +12,7 @@ module Grape
         if key
           val ? header[key.to_s] = val : header.delete(key.to_s)
         else
-          @header ||= {}
+          @header ||= Grape::Util::Header.new
         end
       end
       alias headers header

data/lib/grape/dsl/inside_route.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require 'grape/dsl/headers'
-
 module Grape
   module DSL
     module InsideRoute
@@ -31,11 +29,17 @@ module Grape
           options = options.reverse_merge(include_missing: true, include_parent_namespaces: true, evaluate_given: false)
           declared_params ||= optioned_declared_params(**options)
 
-          if passed_params.is_a?(Array)
-            declared_array(passed_params, options, declared_params, params_nested_path)
-          else
-            declared_hash(passed_params, options, declared_params, params_nested_path)
+          res = if passed_params.is_a?(Array)
+                  declared_array(passed_params, options, declared_params, params_nested_path)
+                else
+                  declared_hash(passed_params, options, declared_params, params_nested_path)
+                end
+
+          if (key_maps = namespace_stackable(:contract_key_map))
+            key_maps.each { |key_map| key_map.write(passed_params, res) }
           end
+
+          res
         end
 
         private
@@ -99,7 +103,7 @@ module Grape
 
           route_options_params = options[:route_options][:params] || {}
           type = route_options_params.dig(key, :type)
-          has_children = route_options_params.keys.any? { |k| k != key && k.start_with?(key) }
+          has_children = route_options_params.keys.any? { |k| k != key && k.start_with?("#{key}[") }
 
           if type == 'Hash' && !has_children
             {}
@@ -162,9 +166,27 @@ module Grape
       # @param status [Integer] the HTTP Status Code. Defaults to default_error_status, 500 if not set.
       # @param additional_headers [Hash] Addtional headers for the response.
       def error!(message, status = nil, additional_headers = nil)
-        self.status(status || namespace_inheritable(:default_error_status))
+        status = self.status(status || namespace_inheritable(:default_error_status))
         headers = additional_headers.present? ? header.merge(additional_headers) : header
-        throw :error, message: message, status: self.status, headers: headers
+        throw :error, message: message, status: status, headers: headers
+      end
+
+      # Creates a Rack response based on the provided message, status, and headers.
+      # The content type in the headers is set to the default content type unless provided.
+      # The message is HTML-escaped if the content type is 'text/html'.
+      #
+      # @param message [String] The content of the response.
+      # @param status [Integer] The HTTP status code.
+      # @params headers [Hash] (optional) Headers for the response
+      #                      (default: {Rack::CONTENT_TYPE => content_type}).
+      #
+      # Returns:
+      # A Rack::Response object containing the specified message, status, and headers.
+      #
+      def rack_response(message, status = 200, headers = { Rack::CONTENT_TYPE => content_type })
+        Grape.deprecator.warn('The rack_response method has been deprecated, use error! instead.')
+        message = Rack::Utils.escape_html(message) if headers[Rack::CONTENT_TYPE] == 'text/html'
+        Rack::Response.new(Array.wrap(message), Rack::Utils.status_code(status), headers)
       end
 
       # Redirect to a new url.
@@ -178,14 +200,14 @@ module Grape
         if permanent
           status 301
           body_message ||= "This resource has been moved permanently to #{url}."
-        elsif env[Grape::Http::Headers::HTTP_VERSION] == 'HTTP/1.1' && request.request_method.to_s.upcase != Grape::Http::Headers::GET
+        elsif http_version == 'HTTP/1.1' && !request.get?
           status 303
           body_message ||= "An alternate resource is located at #{url}."
         else
           status 302
           body_message ||= "This resource has been moved temporarily to #{url}."
         end
-        header 'Location', url
+        header Grape::Http::Headers::LOCATION, url
         content_type 'text/plain'
         body body_message
       end
@@ -204,10 +226,9 @@ module Grape
         when nil
           return @status if instance_variable_defined?(:@status) && @status
 
-          case request.request_method.to_s.upcase
-          when Grape::Http::Headers::POST
+          if request.post?
             201
-          when Grape::Http::Headers::DELETE
+          elsif request.delete?
             if instance_variable_defined?(:@body) && @body.present?
               200
             else
@@ -224,9 +245,9 @@ module Grape
       # Set response content-type
       def content_type(val = nil)
         if val
-          header(Grape::Http::Headers::CONTENT_TYPE, val)
+          header(Rack::CONTENT_TYPE, val)
         else
-          header[Grape::Http::Headers::CONTENT_TYPE]
+          header[Rack::CONTENT_TYPE]
         end
       end
 
@@ -280,13 +301,13 @@ module Grape
       # Deprecated method to send files to the client. Use `sendfile` or `stream`
       def file(value = nil)
         if value.is_a?(String)
-          ActiveSupport::Deprecation.warn('Use sendfile or stream to send files.')
+          Grape.deprecator.warn('Use sendfile or stream to send files.')
           sendfile(value)
         elsif !value.is_a?(NilClass)
-          ActiveSupport::Deprecation.warn('Use stream to use a Stream object.')
+          Grape.deprecator.warn('Use stream to use a Stream object.')
           stream(value)
         else
-          ActiveSupport::Deprecation.warn('Use sendfile or stream to send files.')
+          Grape.deprecator.warn('Use sendfile or stream to send files.')
           sendfile
         end
       end
@@ -328,9 +349,9 @@ module Grape
       def stream(value = nil)
         return if value.nil? && @stream.nil?
 
-        header 'Content-Length', nil
-        header 'Transfer-Encoding', nil
-        header 'Cache-Control', 'no-cache' # Skips ETag generation (reading the response up front)
+        header Rack::CONTENT_LENGTH, nil
+        header Grape::Http::Headers::TRANSFER_ENCODING, nil
+        header Rack::CACHE_CONTROL, 'no-cache' # Skips ETag generation (reading the response up front)
         if value.is_a?(String)
           file_body = Grape::ServeStream::FileBody.new(value)
           @stream = Grape::ServeStream::StreamResponse.new(file_body)
@@ -436,6 +457,10 @@ module Grape
         embeds[:version] = env[Grape::Env::API_VERSION] if env.key?(Grape::Env::API_VERSION)
         entity_class.represent(object, **embeds.merge(options))
       end
+
+      def http_version
+        env['HTTP_VERSION'] || env[Rack::SERVER_PROTOCOL]
+      end
     end
   end
 end