grape 1.8.0 → 3.3.5

data/lib/grape/validations/attributes_iterator.rb

@@ -3,55 +3,71 @@
 module Grape
   module Validations
     class AttributesIterator
-      include Enumerable
-
-      attr_reader :scope
-
-      def initialize(validator, scope, params)
+      # +attrs+ and +scope+ are static per validator; only +params+ varies
+      # per request, so an instance can be built once and reused (it keeps
+      # no request-derived state). Reused instances are shared across
+      # threads, so +each+ must stay free of mutable instance state.
+      def initialize(attrs, scope)
+        @attrs = attrs
         @scope = scope
-        @attrs = validator.attrs
-        @original_params = scope.params(params)
-        @params = Array.wrap(@original_params)
       end
 
-      def each(&block)
-        do_each(@params, &block) # because we need recursion for nested arrays
+      def each(params, &)
+        original_params = @scope.params(params)
+        # because we need recursion for nested arrays
+        do_each(Array.wrap(original_params), original_params, &)
       end
 
       private
 
-      def do_each(params_to_process, parent_indicies = [], &block)
+      def do_each(params_to_process, original_params, parent_indices = [], &block)
         params_to_process.each_with_index do |resource_params, index|
           # when we get arrays of arrays it means that target element located inside array
-          # we need this because we want to know parent arrays indicies
+          # we need this because we want to know parent arrays indices
           if resource_params.is_a?(Array)
-            do_each(resource_params, [index] + parent_indicies, &block)
+            do_each(resource_params, original_params, [index] + parent_indices, &block)
             next
           end
 
           if @scope.type == Array
-            next unless @original_params.is_a?(Array) # do not validate content of array if it isn't array
-
-            # fill current and parent scopes with correct array indicies
-            parent_scope = @scope.parent
-            parent_indicies.each do |parent_index|
-              parent_scope.index = parent_index
-              parent_scope = parent_scope.parent
-            end
-            @scope.index = index
+            next unless original_params.is_a?(Array) # do not validate content of array if it isn't array
+
+            store_indices(@scope, index, parent_indices)
+          elsif original_params.is_a?(Array)
+            # Lateral scope (no @element) whose params resolved to an array —
+            # delegate index tracking to the nearest array-typed ancestor so
+            # that full_name produces the correct bracketed index.
+            target = @scope.nearest_array_ancestor
+            store_indices(target, index, parent_indices) if target
           end
 
-          yield_attributes(resource_params, @attrs, &block)
+          yield_attributes(resource_params, &block)
+        end
+      end
+
+      def store_indices(target_scope, index, parent_indices)
+        # No tracker means we're outside a ParamScopeTracker.track block (e.g.
+        # a unit test that invokes a validator directly). Index tracking is
+        # skipped — full_name will produce bracket-less names — but validation
+        # continues rather than crashing.
+        tracker = ParamScopeTracker.current or return
+        parent_scope = target_scope.parent
+        parent_indices.each do |parent_index|
+          break unless parent_scope
+
+          tracker.store_index(parent_scope, parent_index)
+          parent_scope = parent_scope.parent
         end
+        tracker.store_index(target_scope, index)
       end
 
-      def yield_attributes(_resource_params, _attrs)
+      def yield_attributes(_resource_params)
         raise NotImplementedError
       end
 
-      # This is a special case so that we can ignore tree's where option
-      # values are missing lower down. Unfortunately we can remove this
-      # are the parameter parsing stage as they are required to ensure
+      # This is a special case so that we can ignore trees where option
+      # values are missing lower down. Unfortunately we can't remove this
+      # at the parameter parsing stage as they are required to ensure
       # the correct indexing is maintained
       def skip?(val)
         val == Grape::DSL::Parameters::EmptyOptionalValue

data/lib/grape/validations/coerce_options.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module Grape
+  module Validations
+    # Immutable value object describing how a parameter is coerced. Assembled
+    # by {ValidationsSpec#coerce_options} from the parsed +type+/+coerce_with+/
+    # +coerce_message+ declaration — never written by the user — and consumed
+    # by {ParamsScope#check_coerce_with} / {ParamsScope#validate_coerce} and by
+    # {Validators::Validators::CoerceValidator} (which receives it as its
+    # +options+ argument).
+    #
+    # All three fields may be +nil+ (e.g. a remountable API evaluated on its
+    # base instance has no resolved +type+ yet).
+    # +coerce_method+ (not +method+) avoids shadowing +Object#method+.
+    CoerceOptions = Data.define(:type, :coerce_method, :message) do
+      def initialize(type: nil, coerce_method: nil, message: nil)
+        super
+      end
+    end
+  end
+end

data/lib/grape/validations/contract_scope.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module Grape
+  module Validations
+    class ContractScope
+      # Declare the contract to be used for the endpoint's parameters.
+      # @param api [API] the API endpoint to modify.
+      # @param contract the contract or schema to be used for validation. Optional.
+      # @yield a block yielding a new schema class. Optional.
+      def initialize(api, contract = nil, &block)
+        # When block is passed, the first arg is either schema or nil.
+        contract = Dry::Schema.Params(parent: contract, &block) if block
+
+        if contract.respond_to?(:schema)
+          # It's a Dry::Validation::Contract, then.
+          contract = contract.new
+          key_map = contract.schema.key_map
+        else
+          # Dry::Schema::Processor, hopefully.
+          key_map = contract.key_map
+        end
+
+        api.inheritable_setting.namespace_stackable[:contract_key_map] = key_map
+        api.inheritable_setting.namespace_stackable[:validations] = Validators::ContractScopeValidator.new(schema: contract)
+      end
+    end
+  end
+end

data/lib/grape/validations/multiple_attributes_iterator.rb

@@ -5,7 +5,7 @@ module Grape
     class MultipleAttributesIterator < AttributesIterator
       private
 
-      def yield_attributes(resource_params, _attrs)
+      def yield_attributes(resource_params)
         yield resource_params unless skip?(resource_params)
       end
     end

data/lib/grape/validations/oneof_collector.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module Grape
+  module Validations
+    # Stand-in for the +@api+ object that {ParamsScope} normally writes to.
+    # Used when evaluating a single variant block of a +oneof:+ schema so that
+    # the variant's validators are captured locally rather than registered on
+    # the real API. Exposes only the slice of the API surface that
+    # ParamsScope and its helpers touch during definition.
+    class OneofCollector
+      attr_reader :inheritable_setting
+
+      def initialize
+        @inheritable_setting = Grape::Util::InheritableSetting.new
+        @inheritable_setting.namespace_inheritable[:do_not_document] = true
+      end
+
+      def configuration
+        nil
+      end
+
+      def validators
+        inheritable_setting.namespace_stackable[:validations]
+      end
+
+      def declared_params
+        inheritable_setting.namespace_stackable[:declared_params]
+      end
+
+      # Evaluate +variant_block+ in a fresh +ParamsScope+ backed by a new
+      # collector and return the validators that the block registered.
+      def self.collect(variant_block)
+        collector = new
+        ParamsScope.new(api: collector, type: Hash, &variant_block)
+        collector.validators
+      end
+    end
+  end
+end

data/lib/grape/validations/param_scope_tracker.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+module Grape
+  module Validations
+    # Holds per-request mutable state that must not live on shared ParamsScope
+    # instances. Both trackers are identity-keyed hashes so that ParamsScope
+    # objects can serve as keys without relying on value equality.
+    #
+    # Lifecycle is managed by Endpoint#run_validators via +.track+.
+    # Use +.current+ to access the instance for the running request.
+    class ParamScopeTracker
+      # Fiber-local key used to store the current tracker.
+      # Fiber[] (Ruby 3.0+) is used instead of Thread.current[] so that
+      # fiber-based servers (e.g. Falcon with async) isolate each request's
+      # tracker within its own fiber rather than sharing state across all
+      # fibers running on the same thread.
+      FIBER_KEY = :grape_param_scope_tracker
+      EMPTY_PARAMS = [].freeze
+
+      def self.track
+        previous = Fiber[FIBER_KEY]
+        Fiber[FIBER_KEY] = new
+        yield
+      ensure
+        Fiber[FIBER_KEY] = previous
+      end
+
+      def self.current
+        Fiber[FIBER_KEY]
+      end
+
+      def store_index(scope, index)
+        index_tracker.store(scope, index)
+      end
+
+      def index_for(scope)
+        index_tracker[scope]
+      end
+
+      # Returns qualifying params for +scope+, or EMPTY_PARAMS if none were stored.
+      # Note: an explicitly stored empty array and "never stored" are treated identically
+      # by callers (both yield a blank result that falls through to the parent params).
+      def qualifying_params(scope)
+        qualifying_params_tracker.fetch(scope, EMPTY_PARAMS)
+      end
+
+      def store_qualifying_params(scope, params)
+        qualifying_params_tracker.store(scope, params)
+      end
+
+      private
+
+      def index_tracker
+        @index_tracker ||= {}.compare_by_identity
+      end
+
+      def qualifying_params_tracker
+        @qualifying_params_tracker ||= {}.compare_by_identity
+      end
+    end
+  end
+end

data/lib/grape/validations/params_documentation.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+module Grape
+  module Validations
+    # Documents parameters of an endpoint. Reads from a frozen
+    # +ValidationsSpec+; never mutates the user's validations hash.
+    module ParamsDocumentation
+      def document_params(attrs, spec)
+        return if @api.inheritable_setting.namespace_inheritable[:do_not_document]
+
+        documented_attrs = attrs.to_h do |name|
+          [full_name(name), extract_details(spec)]
+        end
+        @api.inheritable_setting.namespace_stackable[:params] = documented_attrs
+      end
+
+      private
+
+      def extract_details(spec)
+        details = {}
+        details[:required] = spec.required?
+        details[:type] = TypeCache[spec.coerce_type] if spec.coerce_type
+        details[:values] = spec.values if spec.values
+        details[:except_values] = spec.except_values if spec.except_values
+        details[:default] = spec.default unless spec.default.nil?
+
+        length = spec.raw[:length]
+        if length.is_a?(Hash)
+          details[:min_length] = length[:min] if length.key?(:min)
+          details[:max_length] = length[:max] if length.key?(:max)
+        end
+
+        desc = spec.raw[:desc] || spec.raw[:description]
+        details[:desc] = desc if desc
+
+        documentation = spec.raw[:documentation]
+        details[:documentation] = documentation if documentation
+
+        details
+      end
+
+      class TypeCache < Grape::Util::Cache
+        def initialize
+          super
+          @cache = Hash.new do |h, type|
+            h[type] = type.to_s
+          end
+        end
+      end
+    end
+  end
+end