grape 1.8.0 → 4.0.1

data/lib/grape/parser.rb

@@ -2,32 +2,14 @@
 
 module Grape
   module Parser
-    extend Util::Registrable
+    extend Grape::Util::Registry
 
-    class << self
-      def builtin_parsers
-        @builtin_parsers ||= {
-          json: Grape::Parser::Json,
-          jsonapi: Grape::Parser::Json,
-          xml: Grape::Parser::Xml
-        }
-      end
+    module_function
 
-      def parsers(**options)
-        builtin_parsers.merge(default_elements).merge!(options[:parsers] || {})
-      end
+    def parser_for(format, parsers = nil)
+      return parsers[format] if parsers&.key?(format)
 
-      def parser_for(api_format, **options)
-        spec = parsers(**options)[api_format]
-        case spec
-        when nil
-          nil
-        when Symbol
-          method(spec)
-        else
-          spec
-        end
-      end
+      registry[format]
     end
   end
 end

data/lib/grape/path.rb

@@ -1,98 +1,12 @@
 # frozen_string_literal: true
 
-require 'grape/util/cache'
-
 module Grape
-  # Represents a path to an endpoint.
-  class Path
-    def self.prepare(raw_path, namespace, settings)
-      Path.new(raw_path, namespace, settings)
-    end
-
-    attr_reader :raw_path, :namespace, :settings
-
-    def initialize(raw_path, namespace, settings)
-      @raw_path = raw_path
-      @namespace = namespace
-      @settings = settings
-    end
-
-    def mount_path
-      settings[:mount_path]
-    end
-
-    def root_prefix
-      split_setting(:root_prefix)
-    end
-
-    def uses_specific_format?
-      if settings.key?(:format) && settings.key?(:content_types)
-        (settings[:format] && Array(settings[:content_types]).size == 1)
-      else
-        false
-      end
-    end
-
-    def uses_path_versioning?
-      if settings.key?(:version) && settings[:version_options] && settings[:version_options].key?(:using)
-        (settings[:version] && settings[:version_options][:using] == :path)
-      else
-        false
-      end
-    end
-
-    def namespace?
-      namespace&.match?(/^\S/) && namespace != '/'
-    end
-
-    def path?
-      raw_path&.match?(/^\S/) && raw_path != '/'
-    end
-
-    def suffix
-      if uses_specific_format?
-        "(.#{settings[:format]})"
-      elsif !uses_path_versioning? || (namespace? || path?)
-        '(.:format)'
-      else
-        '(/.:format)'
-      end
-    end
-
-    def path
-      Grape::Router.normalize_path(PartsCache[parts])
-    end
-
-    def path_with_suffix
-      "#{path}#{suffix}"
-    end
-
-    def to_s
-      path_with_suffix
-    end
-
-    private
-
-    class PartsCache < Grape::Util::Cache
-      def initialize
-        @cache = Hash.new do |h, parts|
-          h[parts] = -parts.join('/')
-        end
-      end
-    end
-
-    def parts
-      parts = [mount_path, root_prefix].compact
-      parts << ':version' if uses_path_versioning?
-      parts << namespace.to_s
-      parts << raw_path.to_s
-      parts.flatten.reject { |part| part == '/' }
-    end
-
-    def split_setting(key)
-      return if settings[key].nil?
-
-      settings[key].to_s.split('/')
-    end
-  end
+  # @deprecated +Grape::Path+ moved to {Grape::Router::Pattern::Path}, since it
+  #   is a router-internal detail that only exists to build a
+  #   {Grape::Router::Pattern}. Reference the new constant instead.
+  Path = ActiveSupport::Deprecation::DeprecatedConstantProxy.new(
+    'Grape::Path',
+    'Grape::Router::Pattern::Path',
+    Grape.deprecator
+  )
 end

data/lib/grape/precompiled_json.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module Grape
+  # Marks a body as JSON that has already been rendered, so the JSON formatters
+  # serve it verbatim instead of encoding it a second time.
+  #
+  # +Grape::Formatter::Json+ calls +to_json+ on whatever the endpoint returned, so a
+  # String holding pre-rendered JSON — a blob cached in Redis, a +json_agg+ column read
+  # straight from Postgres, output from another serializer — comes back encoded twice:
+  #
+  #   '{"a":1}'  =>  "\"{\\\"a\\\":1}\""
+  #
+  # Wrapping the body opts that one response out of encoding:
+  #
+  #   get '/cached' do
+  #     body Grape::PrecompiledJson.new(Rails.cache.read('payload'))
+  #   end
+  #
+  # An Array is joined into a JSON array without its members being parsed, which is
+  # what makes a cached collection cheap — N rendered blobs are spliced together
+  # rather than round-tripped:
+  #
+  #   Grape::PrecompiledJson.new(['{"id":1}', '{"id":2}']).to_s # => '[{"id":1},{"id":2}]'
+  #
+  # +Array#join+ calls +to_s+ on each member, so members may themselves be
+  # +PrecompiledJson+ instances.
+  #
+  # Wrap only the whole body. A wrapper nested inside a Hash or Array that is then
+  # handed to an encoder is serialized as an ordinary object — +ActiveSupport::JSON+
+  # renders it through +as_json+ as +{"value":"{\"a\":1}"}+ — because no encoder knows
+  # to unwrap it. Nothing checks that the String actually holds JSON; that is the
+  # caller's responsibility.
+  class PrecompiledJson
+    # @param value [String, Array<String>] pre-rendered JSON
+    def initialize(value)
+      @value = value
+    end
+
+    # @return [String] the JSON to serve
+    # @raise [Grape::Exceptions::InvalidFormatter] if the value is neither a String
+    #   nor an Array; the formatter middleware turns this into a 500 rather than
+    #   letting a body Rack cannot serve reach the SPEC check.
+    def to_s
+      return @value if @value.is_a?(String)
+      return "[#{@value.join(',')}]" if @value.is_a?(Array)
+
+      raise Grape::Exceptions::InvalidFormatter.new(@value.class, 'json')
+    end
+  end
+end

data/lib/grape/railtie.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+module Grape
+  class Railtie < ::Rails::Railtie
+    initializer 'grape.deprecator' do |app|
+      app.deprecators[:grape] = Grape.deprecator
+    end
+  end
+end

data/lib/grape/request.rb

@@ -1,53 +1,227 @@
 # frozen_string_literal: true
 
-require 'grape/util/lazy_object'
-
 module Grape
   class Request < Rack::Request
-    HTTP_PREFIX = 'HTTP_'
+    # Based on rack 3 KNOWN_HEADERS
+    # https://github.com/rack/rack/blob/4f15e7b814922af79605be4b02c5b7c3044ba206/lib/rack/headers.rb#L10
+
+    KNOWN_HEADERS = %w[
+      Accept
+      Accept-CH
+      Accept-Encoding
+      Accept-Language
+      Accept-Patch
+      Accept-Ranges
+      Accept-Version
+      Access-Control-Allow-Credentials
+      Access-Control-Allow-Headers
+      Access-Control-Allow-Methods
+      Access-Control-Allow-Origin
+      Access-Control-Expose-Headers
+      Access-Control-Max-Age
+      Age
+      Allow
+      Alt-Svc
+      Authorization
+      Cache-Control
+      Client-Ip
+      Connection
+      Content-Disposition
+      Content-Encoding
+      Content-Language
+      Content-Length
+      Content-Location
+      Content-MD5
+      Content-Range
+      Content-Security-Policy
+      Content-Security-Policy-Report-Only
+      Content-Type
+      Cookie
+      Date
+      Delta-Base
+      Dnt
+      ETag
+      Expect-CT
+      Expires
+      Feature-Policy
+      Forwarded
+      Host
+      If-Modified-Since
+      If-None-Match
+      IM
+      Last-Modified
+      Link
+      Location
+      NEL
+      P3P
+      Permissions-Policy
+      Pragma
+      Preference-Applied
+      Proxy-Authenticate
+      Public-Key-Pins
+      Range
+      Referer
+      Referrer-Policy
+      Refresh
+      Report-To
+      Retry-After
+      Sec-Fetch-Dest
+      Sec-Fetch-Mode
+      Sec-Fetch-Site
+      Sec-Fetch-User
+      Server
+      Set-Cookie
+      Status
+      Strict-Transport-Security
+      Timing-Allow-Origin
+      Tk
+      Trailer
+      Transfer-Encoding
+      Upgrade
+      Upgrade-Insecure-Requests
+      User-Agent
+      Vary
+      Version
+      Via
+      Warning
+      WWW-Authenticate
+      X-Accel-Buffering
+      X-Accel-Charset
+      X-Accel-Expires
+      X-Accel-Limit-Rate
+      X-Accel-Mapping
+      X-Accel-Redirect
+      X-Access-Token
+      X-Auth-Request-Access-Token
+      X-Auth-Request-Email
+      X-Auth-Request-Groups
+      X-Auth-Request-Preferred-Username
+      X-Auth-Request-Redirect
+      X-Auth-Request-Token
+      X-Auth-Request-User
+      X-Cascade
+      X-Client-Ip
+      X-Content-Duration
+      X-Content-Security-Policy
+      X-Content-Type-Options
+      X-Correlation-Id
+      X-Download-Options
+      X-Forwarded-Access-Token
+      X-Forwarded-Email
+      X-Forwarded-For
+      X-Forwarded-Groups
+      X-Forwarded-Host
+      X-Forwarded-Port
+      X-Forwarded-Preferred-Username
+      X-Forwarded-Proto
+      X-Forwarded-Scheme
+      X-Forwarded-Ssl
+      X-Forwarded-Uri
+      X-Forwarded-User
+      X-Frame-Options
+      X-HTTP-Method-Override
+      X-Permitted-Cross-Domain-Policies
+      X-Powered-By
+      X-Real-IP
+      X-Redirect-By
+      X-Request-Id
+      X-Requested-With
+      X-Runtime
+      X-Sendfile
+      X-Sendfile-Type
+      X-UA-Compatible
+      X-WebKit-CS
+      X-XSS-Protection
+    ].to_h do |header|
+      ["HTTP_#{header.upcase.tr('-', '_')}", header]
+    end.freeze
 
     alias rack_params params
+    alias rack_cookies cookies
 
-    def initialize(env, **options)
-      extend options[:build_params_with] || Grape.config.param_builder
+    def initialize(env, build_params_with: nil)
       super(env)
+      @build_params_with = build_params_with
     end
 
     def params
-      @params ||= build_params
-    rescue EOFError
-      raise Grape::Exceptions::EmptyMessageBody.new(content_type)
-    rescue Rack::Multipart::MultipartPartLimitError
-      raise Grape::Exceptions::TooManyMultipartFiles.new(Rack::Utils.multipart_part_limit)
+      @params ||= make_params
     end
 
     def headers
       @headers ||= build_headers
     end
 
+    def cookies
+      @cookies ||= Grape::Cookies.new(rack_cookies)
+    end
+
+    # True once the cookie jar has been materialized (a cookie was read or
+    # written this request). Lets the endpoint skip response-cookie flushing,
+    # and the Grape::Cookies allocation it triggers, when no cookie was
+    # touched on the request.
+    def cookies?
+      !@cookies.nil?
+    end
+
     private
 
-    def grape_routing_args
-      args = env[Grape::Env::GRAPE_ROUTING_ARGS].dup
-      # preserve version from query string parameters
-      args.delete(:version)
-      args.delete(:route_info)
-      args
+    # Resolved on first use rather than in the constructor: a request that never
+    # reads +params+ -- an endpoint with no validations whose block does not ask
+    # for them -- pays neither the registry lookup nor the global config read,
+    # and every request builds a Grape::Request.
+    def params_builder
+      @params_builder ||= Grape::ParamsBuilder.params_builder_for(@build_params_with || Grape.config[:param_builder])
     end
 
-    def build_headers
-      Grape::Util::LazyObject.new do
-        env.each_pair.with_object({}) do |(k, v), headers|
-          next unless k.to_s.start_with? HTTP_PREFIX
+    def make_params
+      params = params_builder.call(rack_params)
+      filtered = routing_args_as_params(env[Grape::Env::GRAPE_ROUTING_ARGS])
+      return params if filtered.blank?
 
-          transformed_header = Grape::Http::Headers::HTTP_HEADERS[k] || transform_header(k)
-          headers[transformed_header] = v
-        end
-      end
+      params.deep_merge!(filtered)
+    rescue *Grape::RACK_ERRORS
+      raise Grape::Exceptions::RequestError
     end
 
-    def transform_header(header)
-      -header[5..].split('_').each(&:capitalize!).join('-')
+    # The routing args carry two things that are not request params:
+    # +:route_info+, which is always Grape's own, and +:version+, which is only
+    # Grape's own when the API declared a version — that is captured as a path
+    # segment and exposed through +env['api.version']+ instead.
+    #
+    # An API that declares no version can legitimately name a param +:version+
+    # (`route_param :version`, `get '/:version'`), and that capture belongs to
+    # the application. Dropping it unconditionally left `params[:version]` nil
+    # on a route that had matched, losing the segment silently.
+    def routing_args_as_params(routing_args)
+      return if routing_args.nil?
+      return routing_args.except(:version, :route_info) if grape_owns_version?(routing_args)
+
+      routing_args.except(:route_info)
+    end
+
+    # A route reports a +version+ only when the API declared one, which is the
+    # case where the captured segment is Grape's rather than the application's.
+    def grape_owns_version?(routing_args)
+      return false unless routing_args.key?(:version)
+
+      route = routing_args[:route_info]
+      route.respond_to?(:version) && !route.version.nil?
+    end
+
+    # Uses a plain `each_header` block instead of `each_header.with_object`:
+    # `with_object` can only pass the block one value plus the memo, so the
+    # `k, v` pair would be boxed into a throwaway Array on every header. A
+    # two-arg block receives `k`/`v` directly and allocates nothing extra.
+    def build_headers
+      headers = Grape::Util::Header.new
+      each_header do |k, v|
+        next unless k.start_with? 'HTTP_'
+
+        transformed_header = KNOWN_HEADERS.fetch(k) { -k[5..].tr('_', '-').downcase }
+        headers[transformed_header] = v
+      end
+      headers
     end
   end
 end

data/lib/grape/router/base_route.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+module Grape
+  class Router
+    class BaseRoute
+      extend Forwardable
+
+      delegate_missing_to :@options
+
+      attr_reader :options, :pattern, :prefix, :settings, :namespace
+
+      # +version+, +anchor+ and +requirements+ shape the matcher, so they are
+      # read from the pattern rather than stored again on the route.
+      def_delegators :@pattern, :path, :origin, :version, :anchor, :requirements
+      def_delegators :@options, :description, *Grape::Util::ApiDescription::DSL_METHODS
+
+      def initialize(pattern, options = {}, namespace: nil, prefix: nil, settings: nil)
+        @pattern = pattern
+        @options = options.is_a?(ActiveSupport::OrderedOptions) ? options : ActiveSupport::OrderedOptions.new.update(options)
+        @namespace = namespace
+        @prefix = prefix
+        @settings = settings
+      end
+
+      # +success+ and +failure+ are the +desc+ DSL's names for +entity+ and
+      # +http_codes+: the block form writes the canonical key, a keyword option
+      # keeps the name it was written with, so both spellings are read here.
+      # Without this they resolve through +delegate_missing_to+, which answers
+      # nil for whichever of the two keys the description did not use.
+      def success
+        @options[:entity] || @options[:success]
+      end
+
+      def failure
+        @options[:http_codes] || @options[:failure]
+      end
+
+      # @deprecated Use {#default_response}, the name grape-swagger asks for.
+      #   This one has to be written out rather than delegated like the rest:
+      #   an ActiveSupport::OrderedOptions answers an unknown name with that
+      #   key's value, but +default+ is not unknown to it — it is +Hash#default+,
+      #   the Hash's own default value — so a delegator would report nil for
+      #   every route.
+      def default
+        Grape.deprecator.warn('`Grape::Router::Route#default` is deprecated. Use `#default_response` instead.')
+        default_response
+      end
+
+      # Assigned eagerly in {#to_regexp} (router compilation) rather than
+      # memoized here: this reader is called from request-time route matching
+      # on instances shared across threads, so it must not write state.
+      attr_reader :regexp_capture_index
+
+      # The number of the group this route occupies in the union the router
+      # compiled it into. Only the union can say what it is, so it is written
+      # back by {Router#compile!} right after building one, and like
+      # +regexp_capture_index+ it is never assigned at request time.
+      attr_reader :regexp_capture_group
+
+      def pattern_regexp
+        @pattern.to_regexp
+      end
+
+      def to_regexp(index)
+        @regexp_capture_index = CaptureIndexCache[index]
+        Regexp.new("(?<#{regexp_capture_index}>#{pattern_regexp})")
+      end
+
+      # @api private
+      # @see #regexp_capture_group
+      def resolve_capture_group!(union_named_captures)
+        @regexp_capture_group = union_named_captures.fetch(regexp_capture_index).first
+      end
+
+      class CaptureIndexCache < Grape::Util::Cache
+        def initialize
+          super
+          @cache = Hash.new do |h, index|
+            h[index] = "_#{index}"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/grape/router/greedy_route.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+# Act like a Grape::Router::Route but for greedy_match
+# see @neutral_map
+
+module Grape
+  class Router
+    class GreedyRoute < BaseRoute
+      extend Forwardable
+
+      def_delegators :@endpoint, :call
+
+      attr_reader :endpoint, :allow_header
+
+      def initialize(pattern, endpoint:, allow_header:)
+        super(pattern)
+        @endpoint = endpoint
+        @allow_header = allow_header
+      end
+
+      def params
+        nil
+      end
+
+      def params_for(_input)
+        nil
+      end
+    end
+  end
+end

data/lib/grape/router/mustermann_pattern.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module Grape
+  class Router
+    # Grape-style path patterns for Mustermann: `:param`, `*splat`, `{name}` /
+    # `{+splat}`, `( )` optionals, `|`, and an Integer digit-only constraint
+    # (driven by Grape's `params` option).
+    #
+    # Inlined from the mustermann-grape gem (MIT) by namusyaka, Konstantin Haase
+    # and Daniel Doubrovkine. Grape instantiates this class directly (see
+    # {Grape::Router::Pattern}), so unlike the gem it is not registered as a
+    # Mustermann `type: :grape`.
+    class MustermannPattern < ::Mustermann::AST::Pattern
+      supported_options :params
+
+      on(nil, '?', ')') { |c| unexpected(c) }
+
+      on('*') { |_c| scan(/\w+/) ? node(:named_splat, buffer.matched) : node(:splat) }
+      on(':') do |_c|
+        param_name = scan(/\w+/)
+        # Integer params (declared via Grape's `params` option) match digits only;
+        # any other capture matches a single path segment (anything but / ? # .).
+        param_type = pattern&.options&.dig(:params, param_name, :type)
+        constraint = param_type == 'Integer' ? /\d/ : '[^/?#.]'
+        node(:capture, param_name, constraint:) { scan(/\w+/) }
+      end
+      on('\\') { |_c| node(:char, expect(/./)) }
+      on('(') { |_c| node(:optional, node(:group) { read unless scan(')') }) }
+      on('|') { |_c| node(:or) }
+
+      on('{') do |_c|
+        type = scan('+') ? :named_splat : :capture
+        name = expect(/[\w.]+/)
+        type = :splat if (type == :named_splat) && (name == 'splat')
+        expect('}')
+        node(type, name)
+      end
+
+      suffix('?') do |_c, element|
+        node(:optional, element)
+      end
+    end
+  end
+end

data/lib/grape/router/pattern/path.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+module Grape
+  class Router
+    class Pattern
+      # Assembles the path template a {Pattern} compiles into a matcher. It turns
+      # a raw path plus the path-settings snapshot taken by
+      # {Grape::Util::InheritableSetting#path_settings} (mount paths, root
+      # prefix, path-versioning and format) into an +origin+ (the route prefix)
+      # and a +suffix+ (the format segment). {Pattern.build} is the entry point
+      # that wires this into pattern construction.
+      class Path
+        DEFAULT_FORMAT_SEGMENT = '(/.:format)'
+        NO_VERSIONING_WITH_VALID_PATH_FORMAT_SEGMENT = '(.:format)'
+        VERSION_SEGMENT = ':version'
+
+        attr_reader :origin, :suffix
+
+        def initialize(raw_path, raw_namespace, settings)
+          @origin = PartsCache[build_parts(raw_path, raw_namespace, settings)]
+          @suffix = build_suffix(raw_path, raw_namespace, settings)
+        end
+
+        def to_s
+          "#{origin}#{suffix}"
+        end
+
+        private
+
+        def build_suffix(raw_path, raw_namespace, settings)
+          return "(.#{settings.format})" if uses_specific_format?(settings)
+          return NO_VERSIONING_WITH_VALID_PATH_FORMAT_SEGMENT if !uses_path_versioning?(settings) || valid_part?(raw_namespace) || valid_part?(raw_path)
+
+          DEFAULT_FORMAT_SEGMENT
+        end
+
+        def build_parts(raw_path, raw_namespace, settings)
+          parts = []
+          add_part(parts, settings.mount_path)
+          add_part(parts, settings.root_prefix)
+          parts << VERSION_SEGMENT if uses_path_versioning?(settings)
+          add_part(parts, raw_namespace)
+          add_part(parts, raw_path)
+          parts
+        end
+
+        def add_part(parts, value)
+          parts << value if value && not_slash?(value)
+        end
+
+        def not_slash?(value)
+          value != '/'
+        end
+
+        def uses_specific_format?(settings)
+          settings.format && Array(settings.content_types).size == 1
+        end
+
+        def uses_path_versioning?(settings)
+          settings.version && settings.version_options&.using == :path
+        end
+
+        def valid_part?(part)
+          part&.match?(/\A\S/) && not_slash?(part)
+        end
+
+        class PartsCache < Grape::Util::Cache
+          def initialize
+            super
+            @cache = Hash.new do |h, parts|
+              h[parts] = Grape::Util::PathNormalizer.call(parts.join('/'))
+            end
+          end
+        end
+      end
+    end
+  end
+end