grape 1.8.0 → 3.3.5

data/lib/grape/exceptions/validation_errors.rb

@@ -1,28 +1,13 @@
 # frozen_string_literal: true
 
-require 'grape/exceptions/base'
-
 module Grape
   module Exceptions
-    class ValidationErrors < Grape::Exceptions::Base
-      ERRORS_FORMAT_KEY = 'grape.errors.format'
-      DEFAULT_ERRORS_FORMAT = '%{attributes} %{message}'
-
-      include Enumerable
-
+    class ValidationErrors < Base
       attr_reader :errors
 
-      def initialize(errors: [], headers: {}, **_options)
-        @errors = errors.group_by(&:params)
-        super message: full_messages.join(', '), status: 400, headers: headers
-      end
-
-      def each
-        errors.each_pair do |attribute, errors|
-          errors.each do |error|
-            yield attribute, error
-          end
-        end
+      def initialize(exceptions: [], headers: {})
+        @errors = exceptions.flat_map(&:errors).group_by(&:params)
+        super(message: full_messages.join(', '), status: 400, headers:)
       end
 
       def as_json(**_opts)
@@ -39,17 +24,28 @@ module Grape
       end
 
       def full_messages
-        messages = map do |attributes, error|
-          I18n.t(
-            ERRORS_FORMAT_KEY,
-            default: DEFAULT_ERRORS_FORMAT,
-            attributes: translate_attributes(attributes),
-            message: error.message
-          )
+        messages = errors.flat_map do |attributes, errs|
+          errs.map do |error|
+            translate(
+              :format,
+              scope: 'grape.errors',
+              default: '%<attributes>s %<message>s',
+              attributes: translate_attributes(attributes),
+              message: error.message
+            )
+          end
         end
         messages.uniq!
         messages
       end
+
+      private
+
+      def translate_attributes(keys)
+        keys.map do |key|
+          translate(key, scope: 'grape.errors.attributes', default: key.to_s)
+        end.join(', ')
+      end
     end
   end
 end

data/lib/grape/formatter/base.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module Grape
+  module Formatter
+    class Base
+      def self.call(_object, _env)
+        raise NotImplementedError
+      end
+
+      def self.inherited(klass)
+        super
+        Formatter.register(klass)
+      end
+    end
+  end
+end

data/lib/grape/formatter/json.rb

@@ -2,13 +2,11 @@
 
 module Grape
   module Formatter
-    module Json
-      class << self
-        def call(object, _env)
-          return object.to_json if object.respond_to?(:to_json)
+    class Json < Base
+      def self.call(object, _env)
+        return object.to_json if object.respond_to?(:to_json)
 
-          ::Grape::Json.dump(object)
-        end
+        ::Grape::Json.dump(object)
       end
     end
   end

data/lib/grape/formatter/serializable_hash.rb

@@ -2,7 +2,7 @@
 
 module Grape
   module Formatter
-    module SerializableHash
+    class SerializableHash < Base
       class << self
         def call(object, _env)
           return object if object.is_a?(String)
@@ -19,15 +19,11 @@ module Grape
         end
 
         def serialize(object)
-          if object.respond_to? :serializable_hash
-            object.serializable_hash
-          elsif array_serializable?(object)
-            object.map(&:serializable_hash)
-          elsif object.is_a?(Hash)
-            object.transform_values { |v| serialize(v) }
-          else
-            object
-          end
+          return object.serializable_hash if object.respond_to?(:serializable_hash)
+          return object.map(&:serializable_hash) if array_serializable?(object)
+          return object.transform_values { |v| serialize(v) } if object.is_a?(Hash)
+
+          object
         end
 
         def array_serializable?(object)

data/lib/grape/formatter/txt.rb

@@ -2,11 +2,9 @@
 
 module Grape
   module Formatter
-    module Txt
-      class << self
-        def call(object, _env)
-          object.respond_to?(:to_txt) ? object.to_txt : object.to_s
-        end
+    class Txt < Base
+      def self.call(object, _env)
+        object.respond_to?(:to_txt) ? object.to_txt : object.to_s
       end
     end
   end

data/lib/grape/formatter/xml.rb

@@ -2,13 +2,11 @@
 
 module Grape
   module Formatter
-    module Xml
-      class << self
-        def call(object, _env)
-          return object.to_xml if object.respond_to?(:to_xml)
+    class Xml < Base
+      def self.call(object, _env)
+        return object.to_xml if object.respond_to?(:to_xml)
 
-          raise Grape::Exceptions::InvalidFormatter.new(object.class, 'xml')
-        end
+        raise Grape::Exceptions::InvalidFormatter.new(object.class, 'xml')
       end
     end
   end

data/lib/grape/formatter.rb

@@ -2,34 +2,16 @@
 
 module Grape
   module Formatter
-    extend Util::Registrable
+    extend Grape::Util::Registry
 
-    class << self
-      def builtin_formatters
-        @builtin_formatters ||= {
-          json: Grape::Formatter::Json,
-          jsonapi: Grape::Formatter::Json,
-          serializable_hash: Grape::Formatter::SerializableHash,
-          txt: Grape::Formatter::Txt,
-          xml: Grape::Formatter::Xml
-        }
-      end
+    module_function
 
-      def formatters(**options)
-        builtin_formatters.merge(default_elements).merge!(options[:formatters] || {})
-      end
+    DEFAULT_LAMBDA_FORMATTER = ->(obj, _env) { obj }
 
-      def formatter_for(api_format, **options)
-        spec = formatters(**options)[api_format]
-        case spec
-        when nil
-          ->(obj, _env) { obj }
-        when Symbol
-          method(spec)
-        else
-          spec
-        end
-      end
+    def formatter_for(api_format, formatters)
+      return formatters[api_format] if formatters&.key?(api_format)
+
+      registry[api_format] || DEFAULT_LAMBDA_FORMATTER
     end
   end
 end

data/lib/grape/json.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+module Grape
+  if defined?(::MultiJSON)
+    # Since multi_json 1.21.0, MultiJSON.dump is deprecated in favor of
+    # MultiJSON.generate (removed in 2.0). Keep Grape's dump surface but route
+    # it to the non-deprecated name — identical output, no deprecation warning.
+    # https://github.com/sferik/multi_json/blob/v1.21.1/CHANGELOG.md#deprecated
+    module Json
+      ParseError = ::MultiJSON::ParseError
+
+      class << self
+        def dump(object)
+          ::MultiJSON.generate(object)
+        end
+
+        # parse is not deprecated; it's re-exposed (not renamed) because this
+        # facade is its own module and no longer inherits MultiJSON's methods.
+        def parse(source)
+          ::MultiJSON.parse(source)
+        end
+      end
+    end
+  elsif defined?(::MultiJson)
+    # Legacy multi_json (< 1.21) predates generate/parse and only exposes
+    # dump/load. Map Grape's surface onto them so the call sites stay
+    # engine-agnostic (these names are not deprecated on < 1.21).
+    module Json
+      # Mutually exclusive with the MultiJSON branch above; only one runs.
+      ParseError = ::MultiJson::ParseError # rubocop:disable Lint/ConstantReassignment
+
+      class << self
+        def dump(object)
+          ::MultiJson.dump(object)
+        end
+
+        def parse(source)
+          ::MultiJson.load(source)
+        end
+      end
+    end
+  else
+    Json = ::JSON
+    Json::ParseError = Json::ParserError
+  end
+end

data/lib/grape/locale/en.yml

@@ -1,55 +1,56 @@
+---
 en:
   grape:
     errors:
-      format: ! '%{attributes} %{message}'
+      format: '%{attributes} %{message}'
       messages:
-        coerce: 'is invalid'
-        presence: 'is missing'
-        regexp: 'is invalid'
+        all_or_none: 'provide all or none of parameters'
+        at_least_one: 'are missing, at least one parameter must be provided'
         blank: 'is empty'
-        values: 'does not have a valid value'
+        coerce: 'is invalid'
+        exactly_one: 'are missing, exactly one parameter must be provided'
         except_values: 'has a value not allowed'
-        same_as: 'is not the same as %{parameter}'
-        missing_vendor_option:
-          problem: 'missing :vendor option'
-          summary: 'when version using header, you must specify :vendor option'
-          resolution: "eg: version 'v1', using: :header, vendor: 'twitter'"
-        missing_mime_type:
-          problem: 'missing mime type for %{new_format}'
-          resolution:
-            "you can choose existing mime type from Grape::ContentTypes::CONTENT_TYPES
-            or add your own with content_type :%{new_format}, 'application/%{new_format}'
-            "
-        invalid_with_option_for_represent:
-          problem: 'you must specify an entity class in the :with option'
-          resolution: 'eg: represent User, :with => Entity::User'
-        missing_option: 'you must specify :%{option} options'
-        invalid_formatter: 'cannot convert %{klass} to %{to_format}'
-        invalid_versioner_option:
-          problem: 'unknown :using for versioner: %{strategy}'
-          resolution: 'available strategy for :using is :path, :header, :accept_version_header, :param'
-        unknown_validator: 'unknown validator: %{validator_type}'
-        unknown_options: 'unknown options: %{options}'
-        unknown_parameter: 'unknown parameter: %{param}'
         incompatible_option_values: '%{option1}: %{value1} is incompatible with %{option2}: %{value2}'
-        mutual_exclusion: 'are mutually exclusive'
-        at_least_one: 'are missing, at least one parameter must be provided'
-        exactly_one: 'are missing, exactly one parameter must be provided'
-        all_or_none: 'provide all or none of parameters'
-        missing_group_type: 'group type is required'
-        unsupported_group_type: 'group type must be Array, Hash, JSON or Array[JSON]'
-        invalid_message_body:
-          problem: "message body does not match declared format"
-          resolution:
-            "when specifying %{body_format} as content-type, you must pass valid
-            %{body_format} in the request's 'body'
-            "
-        empty_message_body: 'empty message body supplied with %{body_format} content-type'
-        too_many_multipart_files: "the number of uploaded files exceeded the system's configured limit (%{limit})"
+        internal_server_error: 'Internal Server Error'
         invalid_accept_header:
           problem: 'invalid accept header'
           resolution: '%{message}'
+        invalid_formatter: 'cannot convert %{klass} to %{to_format}'
+        invalid_message_body:
+          problem: 'message body does not match declared format'
+          resolution: 'when specifying %{body_format} as content-type, you must pass valid %{body_format} in the request''s ''body'' '
+        invalid_response: 'Invalid response'
         invalid_version_header:
           problem: 'invalid version header'
           resolution: '%{message}'
-        invalid_response: 'Invalid response'
+        invalid_versioner_option:
+          problem: 'unknown :using for versioner: %{strategy}'
+          resolution: 'available strategy for :using is :path, :header, :accept_version_header, :param'
+        invalid_with_option_for_represent:
+          problem: 'you must specify an entity class in the :with option'
+          resolution: 'eg: represent User, :with => Entity::User'
+        length: 'is expected to have length within %{min} and %{max}'
+        length_is: 'is expected to have length exactly equal to %{is}'
+        length_max: 'is expected to have length less than or equal to %{max}'
+        length_min: 'is expected to have length greater than or equal to %{min}'
+        missing_group_type: 'group type is required'
+        missing_mime_type:
+          problem: 'missing mime type for %{new_format}'
+          resolution: 'you can choose existing mime type from Grape::ContentTypes::CONTENT_TYPES or add your own with content_type :%{new_format}, ''application/%{new_format}'' '
+        missing_option: 'you must specify :%{option} options'
+        missing_vendor_option:
+          problem: 'missing :vendor option'
+          resolution: 'eg: version ''v1'', using: :header, vendor: ''twitter'''
+          summary: 'when version using header, you must specify :vendor option'
+        mutual_exclusion: 'are mutually exclusive'
+        oneof: 'does not match any of the allowed schemas'
+        presence: 'is missing'
+        regexp: 'is invalid'
+        same_as: 'is not the same as %{parameter}'
+        unknown_auth_strategy: 'unknown auth strategy: %{strategy}'
+        unknown_options: 'unknown options: %{options}'
+        unknown_parameter: 'unknown parameter: %{param}'
+        unknown_params_builder: 'unknown params_builder: %{params_builder_type}'
+        unknown_validator: 'unknown validator: %{validator_type}'
+        unsupported_group_type: 'group type must be Array, Hash, JSON or Array[JSON]'
+        values: 'does not have a valid value'

data/lib/grape/middleware/auth/base.rb

@@ -1,44 +1,22 @@
 # frozen_string_literal: true
 
-require 'rack/auth/basic'
-
 module Grape
   module Middleware
     module Auth
-      class Base
-        include Helpers
-
-        attr_accessor :options, :app, :env
+      class Base < Grape::Middleware::Base
+        def initialize(app, **options)
+          super
+          return unless options.key?(:type)
 
-        def initialize(app, *options)
-          @app = app
-          @options = options.shift
+          @auth_strategy = Grape::Middleware::Auth::Strategies[options[:type]]
+          raise Grape::Exceptions::UnknownAuthStrategy.new(strategy: options[:type]) unless @auth_strategy
         end
 
-        def call(env)
-          dup._call(env)
-        end
-
-        def _call(env)
-          self.env = env
-
-          if options.key?(:type)
-            auth_proc = options[:proc]
-            auth_proc_context = context
-
-            strategy_info = Grape::Middleware::Auth::Strategies[options[:type]]
-
-            throw(:error, status: 401, message: 'API Authorization Failed.') if strategy_info.blank?
-
-            strategy = strategy_info.create(@app, options) do |*args|
-              auth_proc_context.instance_exec(*args, &auth_proc)
-            end
-
-            strategy.call(env)
-
-          else
-            app.call(env)
-          end
+        def call!(env)
+          @env = env
+          @auth_strategy.create(app, options) do |*args|
+            context.instance_exec(*args, &options[:proc])
+          end.call(env)
         end
       end
     end

data/lib/grape/middleware/auth/dsl.rb

@@ -1,45 +1,51 @@
 # frozen_string_literal: true
 
-require 'rack/auth/basic'
-
 module Grape
   module Middleware
     module Auth
       module DSL
-        extend ActiveSupport::Concern
-
-        module ClassMethods
-          # Add an authentication type to the API. Currently
-          # only `:http_basic`, `:http_digest` are supported.
-          def auth(type = nil, options = {}, &block)
-            if type
-              namespace_inheritable(:auth, options.reverse_merge(type: type.to_sym, proc: block))
-              use Grape::Middleware::Auth::Base, namespace_inheritable(:auth)
-            else
-              namespace_inheritable(:auth)
-            end
-          end
+        def auth(type = nil, *legacy_options, **options, &block)
+          namespace_inheritable = inheritable_setting.namespace_inheritable
+          return namespace_inheritable[:auth] unless type
 
-          # Add HTTP Basic authorization to the API.
-          #
-          # @param [Hash] options A hash of options.
-          # @option options [String] :realm "API Authorization" The HTTP Basic realm.
-          def http_basic(options = {}, &block)
-            options[:realm] ||= 'API Authorization'
-            auth :http_basic, options, &block
-          end
+          options = merge_legacy_auth_options(:auth, legacy_options, options)
+          namespace_inheritable[:auth] = { type: type.to_sym, proc: block }.merge!(options)
+          use Grape::Middleware::Auth::Base, namespace_inheritable[:auth]
+        end
 
-          def http_digest(options = {}, &block)
-            options[:realm] ||= 'API Authorization'
+        # Add HTTP Basic authorization to the API.
+        #
+        # @param options [Hash] a hash of options
+        # @option options [String] :realm "API Authorization" the HTTP Basic realm
+        def http_basic(*legacy_options, **options, &)
+          options = merge_legacy_auth_options(:http_basic, legacy_options, options)
+          options[:realm] ||= 'API Authorization'
+          auth(:http_basic, **options, &)
+        end
 
-            if options[:realm].respond_to?(:values_at)
-              options[:realm][:opaque] ||= 'secret'
-            else
-              options[:opaque] ||= 'secret'
-            end
+        def http_digest(*legacy_options, **options, &)
+          options = merge_legacy_auth_options(:http_digest, legacy_options, options)
+          options[:realm] ||= 'API Authorization'
 
-            auth :http_digest, options, &block
+          if options[:realm].respond_to?(:values_at)
+            options[:realm][:opaque] ||= 'secret'
+          else
+            options[:opaque] ||= 'secret'
           end
+
+          auth(:http_digest, **options, &)
+        end
+
+        private
+
+        # @deprecated Passing a positional options Hash is deprecated; pass
+        #   keyword arguments instead. Kept so downstream callers keep working
+        #   through the deprecation cycle.
+        def merge_legacy_auth_options(method_name, legacy_options, options)
+          return options if legacy_options.empty?
+
+          Grape.deprecator.warn("Passing a positional options Hash to `#{method_name}` is deprecated. Pass keyword arguments instead.")
+          legacy_options.first.merge(options)
         end
       end
     end

data/lib/grape/middleware/auth/strategies.rb

@@ -12,8 +12,7 @@ module Grape
 
         def auth_strategies
           @auth_strategies ||= {
-            http_basic: StrategyInfo.new(Rack::Auth::Basic, ->(settings) { [settings[:realm]] }),
-            http_digest: StrategyInfo.new(Rack::Auth::Digest::MD5, ->(settings) { [settings[:realm], settings[:opaque]] })
+            http_basic: StrategyInfo.new(Rack::Auth::Basic, ->(settings) { [settings[:realm]] })
           }
         end
 

data/lib/grape/middleware/base.rb

@@ -1,30 +1,30 @@
 # frozen_string_literal: true
 
-require 'grape/dsl/headers'
-
 module Grape
   module Middleware
     class Base
-      include Helpers
-
-      attr_reader :app, :env, :options
-
-      TEXT_HTML = 'text/html'
-
       include Grape::DSL::Headers
 
+      attr_reader :app, :env, :options, :config
+
       # @param [Rack Application] app The standard argument for a Rack middleware.
-      # @param [Hash] options A hash of options, simply stored for use by subclasses.
-      def initialize(app, *options)
+      # @param [Hash] options Options forwarded to the subclass. When the
+      #   subclass declares an `Options` Data class, the kwargs are routed
+      #   through it and exposed via {#config}; {#options} keeps returning a
+      #   frozen Hash representation for back-compat with subclasses that read
+      #   `options[:key]`. Otherwise the kwargs are deep-merged with the
+      #   subclass's `DEFAULT_OPTIONS` Hash (legacy path) and frozen.
+      def initialize(app, **options)
         @app = app
-        @options = options.any? ? default_options.merge(options.shift) : default_options
+        if (config_class = options_data_class)
+          @config = config_class.new(**options)
+          @options = @config.to_h.freeze
+        else
+          @options = merge_default_options(options).freeze
+        end
         @app_response = nil
       end
 
-      def default_options
-        {}
-      end
-
       def call(env)
         dup.call!(env).to_a
       end
@@ -57,40 +57,63 @@ module Grape
       # @return [Response, nil] a Rack SPEC response or nil to call the application afterwards.
       def after; end
 
-      def response
-        return @app_response if @app_response.is_a?(Rack::Response)
-
-        @app_response = Rack::Response.new(@app_response[2], @app_response[0], @app_response[1])
+      def rack_request
+        @rack_request ||= Rack::Request.new(env)
       end
 
-      def content_type_for(format)
-        HashWithIndifferentAccess.new(content_types)[format]
+      def context
+        env[Grape::Env::API_ENDPOINT]
       end
 
-      def content_types
-        ContentTypes.content_types_for(options[:content_types])
-      end
+      def response
+        return @app_response if @app_response.is_a?(Rack::Response)
 
-      def content_type
-        content_type_for(env[Grape::Env::API_FORMAT] || options[:format]) || TEXT_HTML
+        @app_response = Rack::Response[*@app_response]
       end
 
-      def mime_types
-        @mime_type ||= content_types.each_pair.with_object({}) do |(k, v), types_without_params|
-          types_without_params[v.split(';').first] = k
-        end
+      def query_params
+        rack_request.GET
+      rescue *Grape::RACK_ERRORS
+        raise Grape::Exceptions::RequestError
       end
 
       private
 
       def merge_headers(response)
-        return unless headers.is_a?(Hash)
+        return if @header.blank?
 
         case response
-        when Rack::Response then response.headers.merge!(headers)
-        when Array          then response[1].merge!(headers)
+        when Rack::Response then response.headers.merge!(@header)
+        when Array          then response[1].merge!(@header)
         end
       end
+
+      def merge_default_options(options)
+        return default_options.deep_merge(options) if respond_to?(:default_options)
+
+        default_options_constant&.deep_merge(options) || options
+      end
+
+      # self.class::Options honours middleware inheritance (e.g. Versioner::Path
+      # → Versioner::Base) and, unlike const_defined?, never resolves a
+      # top-level ::Options on Object. Absent an own/inherited Options class,
+      # the lookup raises NameError and we fall back to the legacy path.
+      def options_data_class
+        self.class::Options
+      rescue NameError
+        nil
+      end
+
+      # Same idea as {#options_data_class} for the legacy DEFAULT_OPTIONS Hash.
+      def default_options_constant
+        self.class::DEFAULT_OPTIONS
+      rescue NameError
+        nil
+      end
+
+      def try_scrub(obj)
+        obj.respond_to?(:valid_encoding?) && !obj.valid_encoding? ? obj.scrub : obj
+      end
     end
   end
 end

data/lib/grape/middleware/deprecated_options_hash_access.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Grape
+  module Middleware
+    # Mixin for per-middleware +Options+ +Data+ classes that need to keep
+    # accepting legacy +data[:key]+ Hash-style access while nudging callers
+    # toward the named accessor. Emits a +Grape.deprecator+ warning then
+    # forwards to +public_send(key)+.
+    module DeprecatedOptionsHashAccess
+      def [](key)
+        Grape.deprecator.warn(
+          "`#{self.class.name}#[]` is deprecated. " \
+          "Use the named accessor `#{key}` instead."
+        )
+        public_send(key) if members.include?(key)
+      end
+    end
+  end
+end