grape 1.8.0 → 4.0.1

data/lib/grape/validations/types.rb

@@ -1,8 +1,5 @@
 # frozen_string_literal: true
 
-require 'grape/validations/types/json'
-require 'grape/validations/types/file'
-
 module Grape
   module Validations
     # Module for code related to grape's system for
@@ -78,7 +75,7 @@ module Grape
       # @return [Boolean] +true+ if the given value will be treated as
       #   a list of types.
       def multiple?(type)
-        (type.is_a?(Array) || type.is_a?(Set)) && type.size > 1
+        array_or_set?(type) && type.size > 1
       end
 
       # Does Grape provide special coercion and validation
@@ -101,17 +98,18 @@ module Grape
         GROUPS.include? type
       end
 
+      def array_or_set?(type)
+        type.is_a?(Array) || type.is_a?(Set)
+      end
+
       # A valid custom type must implement a class-level `parse` method, taking
       # one String argument and returning the parsed value in its correct type.
       #
       # @param type [Class] type to check
       # @return [Boolean] whether or not the type can be used as a custom type
       def custom?(type)
-        !primitive?(type) &&
-          !structure?(type) &&
-          !multiple?(type) &&
-          type.respond_to?(:parse) &&
-          type.method(:parse).arity == 1
+        !(primitive?(type) || structure?(type) || multiple?(type)) &&
+          type.respond_to?(:parse) && type.method(:parse).arity == 1
       end
 
       # Is the declared type an +Array+ or +Set+ of a {#custom?} type?
@@ -120,9 +118,7 @@ module Grape
       # @return [Boolean] true if +type+ is a collection of a type that implements
       #   its own +#parse+ method.
       def collection_of_custom?(type)
-        (type.is_a?(Array) || type.is_a?(Set)) &&
-          type.length == 1 &&
-          (custom?(type.first) || special?(type.first))
+        array_or_set?(type) && type.length == 1 && (custom?(type.first) || special?(type.first))
       end
 
       def map_special(type)
@@ -158,59 +154,38 @@ module Grape
       # @return [Object] object to be used
       #   for coercion and type validation
       def build_coercer(type, method: nil, strict: false)
-        cache_instance(type, method, strict) do
-          create_coercer_instance(type, method, strict)
-        end
-      end
+        # no cache since unique
+        return create_coercer_instance(type, method, strict) if method.respond_to?(:call)
 
-      def create_coercer_instance(type, method, strict)
-        # Maps a custom type provided by Grape, it doesn't map types wrapped by collections!!!
-        type = Types.map_special(type)
-
-        # Use a special coercer for multiply-typed parameters.
-        if Types.multiple?(type)
-          MultipleTypeCoercer.new(type, method)
-
-          # Use a special coercer for custom types and coercion methods.
-        elsif method || Types.custom?(type)
-          CustomTypeCoercer.new(type, method)
-
-          # Special coercer for collections of types that implement a parse method.
-          # CustomTypeCoercer (above) already handles such types when an explicit coercion
-          # method is supplied.
-        elsif Types.collection_of_custom?(type)
-          Types::CustomTypeCollectionCoercer.new(
-            Types.map_special(type.first), type.is_a?(Set)
-          )
-        else
-          DryTypeCoercer.coercer_instance_for(type, strict)
-        end
+        CoercerCache[[type, method, strict]]
       end
 
-      def cache_instance(type, method, strict, &_block)
-        key = cache_key(type, method, strict)
+      def create_coercer_instance(type, method, strict)
+        # map_special doesn't recurse into collections — applied only to the top-level type here.
+        mapped = map_special(type)
 
-        return @__cache[key] if @__cache.key?(key)
+        # Multiply-typed parameters, e.g. types: [Integer, String].
+        return MultipleTypeCoercer.new(mapped, method) if multiple?(mapped)
 
-        instance = yield
+        # User-supplied coercion method, or a custom type with its own #parse.
+        return CustomTypeCoercer.new(mapped, method) if method || custom?(mapped)
 
-        @__cache_write_lock.synchronize do
-          @__cache[key] = instance
-        end
+        # Array/Set of a custom type — CustomTypeCoercer already handles single
+        # custom types when an explicit coercion method is supplied.
+        return CustomTypeCollectionCoercer.new(map_special(mapped.first), set: mapped.is_a?(Set)) if collection_of_custom?(mapped)
 
-        instance
+        # Fallback: let dry-types handle primitives, structures, and known specials.
+        DryTypeCoercer.coercer_instance_for(mapped, strict:)
       end
 
-      def cache_key(type, method, strict)
-        [type, method, strict].each_with_object(+'_') do |val, memo|
-          next if val.nil?
-
-          memo << '_' << val.to_s
+      class CoercerCache < Grape::Util::Cache
+        def initialize
+          super
+          @cache = Hash.new do |h, (type, method, strict)|
+            h[[type, method, strict]] = Grape::Validations::Types.create_coercer_instance(type, method, strict)
+          end
         end
       end
-
-      instance_variable_set(:@__cache,            {})
-      instance_variable_set(:@__cache_write_lock, Mutex.new)
     end
   end
 end

data/lib/grape/validations/validations_spec.rb

@@ -0,0 +1,164 @@
+# frozen_string_literal: true
+
+module Grape
+  module Validations
+    # Frozen value object holding everything {ParamsScope#validates} needs to
+    # know about a single +requires+/+optional+ declaration. Built once from
+    # the raw validations hash supplied by the DSL; the raw hash is never
+    # mutated.
+    #
+    # Splits the raw entries into three logical buckets:
+    #
+    # * Spec-consumed keys (type/types/coerce*, presence/message,
+    #   default/fail_fast, doc keys) — exposed via named accessors and never
+    #   handed to validator dispatch.
+    # * Shared opts (allow_blank, fail_fast) — read by every validator at
+    #   construction time via {#shared_opts}.
+    # * Validator entries (everything else, e.g. +regexp+, +length+, +values+,
+    #   +allow_blank+, custom validators) — exposed via {#validator_entries}
+    #   for the dispatch loop.
+    #
+    # Same key can land in more than one bucket (e.g. +allow_blank+ is both a
+    # shared opt and a validator entry; +length+ is both a doc source and a
+    # validator entry).
+    class ValidationsSpec
+      # Keys consumed by the spec itself; must NOT be dispatched as validators
+      # by the caller. Documentation-only keys are filtered through a separate
+      # set so that dual-purpose keys (length, default, values, except_values)
+      # aren't accidentally swallowed.
+      SPEC_CONSUMED_KEYS = %i[
+        type types coerce coerce_with coerce_message
+        presence message
+        fail_fast
+        desc description documentation
+      ].freeze
+
+      attr_reader :raw, :coerce_type, :coerce_method, :coerce_message, :presence_options, :values, :except_values, :default, :allow_blank, :fail_fast, :shared_opts, :validator_entries
+
+      def self.from(validations)
+        new(validations)
+      end
+
+      def initialize(raw)
+        raise ArgumentError, ':type may not be supplied with :types' if raw.key?(:type) && raw.key?(:types)
+
+        @raw = raw
+        @coerce_type, @coerce_message, @coerce_method = parse_coerce(raw)
+        @values = resolve_value(raw[:values])
+        @except_values = resolve_value(raw[:except_values])
+        @default = raw[:default]
+        @presence_options = raw[:presence]
+        @allow_blank = resolve_value(raw[:allow_blank])
+        @fail_fast = raw[:fail_fast] || false
+
+        @guessed_coerce_type = guess_coerce_type(declared_coerce_type, @values, @except_values)
+        @shared_opts = { allow_blank: @allow_blank, fail_fast: @fail_fast }.freeze
+        @validator_entries = build_validator_entries(raw)
+
+        validate!
+
+        freeze
+      end
+
+      def required?
+        !@presence_options.nil? && @presence_options != false
+      end
+
+      def coerce_options
+        CoerceOptions.new(type: @coerce_type, coerce_method: @coerce_method, message: @coerce_message)
+      end
+
+      private
+
+      # Cross-field consistency checks on the parsed declaration. Run at
+      # construction so an incoherent spec (e.g. a +default+ outside +values+,
+      # or +values+ whose elements don't match +type+) can never exist —
+      # callers no longer have to remember to invoke these separately.
+      #
+      # NB. +@guessed_coerce_type+ is used only for this check, never for
+      # +coerce_options+ — a bare +type: Array+ combined with scalar
+      # +values:+ must still coerce to +Array+ at runtime (only the elements
+      # are scalar), so the real +@coerce_type+ is never overwritten by it.
+      def validate!
+        check_incompatible_option_values(@default, @values, @except_values)
+        validate_value_coercion(@guessed_coerce_type, @values, @except_values)
+      end
+
+      def check_incompatible_option_values(default, values, except_values)
+        return if default.nil? || default.is_a?(Proc)
+
+        raise Grape::Exceptions::IncompatibleOptionValues.new(:default, default, :values, values) if values && !values.is_a?(Proc) && Array(default).any? { |def_val| !values.include?(def_val) }
+
+        return unless except_values && !except_values.is_a?(Proc) && Array(default).any? { |def_val| except_values.include?(def_val) }
+
+        raise Grape::Exceptions::IncompatibleOptionValues.new(:default, default, :except, except_values)
+      end
+
+      def validate_value_coercion(coerce_type, *values_list)
+        return unless coerce_type
+
+        element_type = coerce_type.is_a?(Enumerable) ? coerce_type.first : coerce_type
+        values_list.each do |values|
+          next if !values || values.is_a?(Proc)
+
+          value_types = values.is_a?(Range) ? [values.begin, values.end].compact : values
+          value_types = value_types.map { |type| Grape::API::Boolean.build(type) } if element_type == Grape::API::Boolean
+          raise Grape::Exceptions::IncompatibleOptionValues.new(:type, element_type, :values, values) unless value_types.all?(element_type)
+        end
+      end
+
+      def build_validator_entries(raw)
+        raw.reject do |k, _|
+          SPEC_CONSUMED_KEYS.include?(k) || ParamsScope::RESERVED_DOCUMENTATION_KEYWORDS.include?(k)
+        end.freeze
+      end
+
+      def parse_coerce(raw)
+        if raw.key?(:type)
+          coerce, coerce_message = extract_value_and_message(raw[:type])
+          coerce_with = raw[:coerce_with]
+          return [Types::VariantCollectionCoercer.new(coerce, coerce_with), coerce_message, nil] if Types.multiple?(coerce)
+        elsif raw.key?(:types)
+          coerce, coerce_message = extract_value_and_message(raw[:types])
+          coerce_with = raw[:coerce_with]
+        else
+          coerce = raw[:coerce]
+          coerce_message = raw[:coerce_message]
+          coerce_with = raw[:coerce_with]
+        end
+
+        [coerce, coerce_message, coerce_with]
+      end
+
+      def extract_value_and_message(opt)
+        return [opt, nil] unless opt.is_a?(Hash)
+
+        [opt[:value], opt[:message]]
+      end
+
+      def resolve_value(opt)
+        opt.is_a?(Hash) ? opt[:value] : opt
+      end
+
+      # The type as written in the DSL. Identical to +@coerce_type+ except for
+      # a multiple-type declaration (+type: [Integer, String]+), where
+      # {#parse_coerce} wraps the declared list in a
+      # {Types::VariantCollectionCoercer} for runtime coercion — the
+      # definition-time coherence checks need the list back, since the wrapper
+      # matches nothing under +===+.
+      def declared_coerce_type
+        @coerce_type.is_a?(Types::VariantCollectionCoercer) ? @coerce_type.types : @coerce_type
+      end
+
+      def guess_coerce_type(coerce_type, *values_list)
+        return coerce_type unless coerce_type == Array
+
+        values_list.each do |values|
+          next if !values || values.is_a?(Proc)
+          return values.first.class if values.is_a?(Range) || !values.empty?
+        end
+        coerce_type
+      end
+    end
+  end
+end

data/lib/grape/validations/validators/all_or_none_of_validator.rb

@@ -4,11 +4,14 @@ module Grape
   module Validations
     module Validators
       class AllOrNoneOfValidator < MultipleParamsBase
+        default_message_key :all_or_none
+
         def validate_params!(params)
-          keys = keys_in_common(params)
-          return if keys.empty? || keys.length == all_keys.length
+          known_keys = all_keys
+          keys = keys_in_common(params, known_keys)
+          return if keys.empty? || keys.length == attrs.length
 
-          raise Grape::Exceptions::Validation.new(params: all_keys, message: message(:all_or_none))
+          validation_error!(known_keys)
         end
       end
     end

data/lib/grape/validations/validators/allow_blank_validator.rb

@@ -4,15 +4,20 @@ module Grape
   module Validations
     module Validators
       class AllowBlankValidator < Base
-        def validate_param!(attr_name, params)
-          return if (options_key?(:value) ? @option[:value] : @option) || !params.is_a?(Hash)
+        default_message_key :blank
+
+        def initialize(attrs, options, required, scope, opts)
+          super
+          @value = option_value
+        end
 
-          value = params[attr_name]
-          value = value.strip if value.respond_to?(:strip)
+        def validate_param!(attr_name, params)
+          return if @value || !hash_like?(params)
 
+          value = scrub(params[attr_name])
           return if value == false || value.present?
 
-          raise Grape::Exceptions::Validation.new(params: [@scope.full_name(attr_name)], message: message(:blank))
+          validation_error!(attr_name)
         end
       end
     end

data/lib/grape/validations/validators/at_least_one_of_validator.rb

@@ -4,10 +4,13 @@ module Grape
   module Validations
     module Validators
       class AtLeastOneOfValidator < MultipleParamsBase
+        default_message_key :at_least_one
+
         def validate_params!(params)
-          return unless keys_in_common(params).empty?
+          known_keys = all_keys
+          return if hash_like?(params) && known_keys.intersect?(params.keys.map { |attr| scope.full_name(attr) })
 
-          raise Grape::Exceptions::Validation.new(params: all_keys, message: message(:at_least_one))
+          validation_error!(known_keys)
         end
       end
     end

data/lib/grape/validations/validators/base.rb

@@ -3,25 +3,72 @@
 module Grape
   module Validations
     module Validators
+      # Base class for all parameter validators.
+      #
+      # == Freeze contract
+      # Validator instances are shared across requests and are frozen after
+      # initialization (via +.new+). All inputs (+options+, +opts+, +attrs+)
+      # arrive pre-frozen from the DSL boundary, so subclass ivars derived
+      # from them are frozen by construction. Lazy ivar assignment
+      # (e.g. +memoize+, <tt>||=</tt>) will raise +FrozenError+ at request time.
       class Base
+        extend Forwardable
+        extend Grape::Util::FreezeOnNew
+        include Grape::Util::Translation
+
         attr_reader :attrs
 
+        # +allow_blank+ / +fail_fast+ are read straight off the internal
+        # {Grape::Validations::SharedOptions} value object; no per-validator
+        # ivars. The object is built from the +opts+ Hash in #initialize, so
+        # the public 5th-argument contract stays a plain Hash.
+        def_delegators :@opts, :allow_blank, :fail_fast
+
+        alias fail_fast? fail_fast
+        alias allow_blank? allow_blank
+
+        class << self
+          # Declares the default I18n message key used by +validation_error!+.
+          # Subclasses that only need a single fixed error message can declare it
+          # at the class level instead of overriding +initialize+:
+          #
+          #   class MyValidator < Grape::Validations::Validators::Base
+          #     default_message_key :my_error
+          #   end
+          #
+          # The key is resolved through +message+, so a per-option +:message+
+          # override still takes precedence.
+          def default_message_key(key = nil)
+            if key
+              @default_message_key = key
+            else
+              @default_message_key || (superclass.respond_to?(:default_message_key) ? superclass.default_message_key : nil)
+            end
+          end
+
+          def inherited(klass)
+            super
+            Validations.register(klass)
+          end
+        end
+
         # Creates a new Validator from options specified
         # by a +requires+ or +optional+ directive during
         # parameter definition.
         # @param attrs [Array] names of attributes to which the Validator applies
-        # @param options [Object] implementation-dependent Validator options
+        # @param options [Object] implementation-dependent Validator options; deep-frozen on assignment
         # @param required [Boolean] attribute(s) are required or optional
         # @param scope [ParamsScope] parent scope for this Validator
-        # @param opts [Array] additional validation options
-        def initialize(attrs, options, required, scope, *opts)
-          @attrs = Array(attrs)
-          @option = options
+        # @param opts [Hash] shared validator options; only +:allow_blank+ and
+        #   +:fail_fast+ are consulted (other keys ignored, as before)
+        def initialize(attrs, options, required, scope, opts)
+          @attrs = Array(attrs).freeze
+          @options = Grape::Util::DeepFreeze.deep_freeze(options)
           @required = required
           @scope = scope
-          opts = opts.any? ? opts.shift : {}
-          @fail_fast = opts.fetch(:fail_fast, false)
-          @allow_blank = opts.fetch(:allow_blank, false)
+          @opts = SharedOptions.new(**opts.slice(:allow_blank, :fail_fast))
+          @exception_message = message(self.class.default_message_key) if self.class.default_message_key
+          @iterator = iterator_class.new(@attrs, @scope).freeze
         end
 
         # Validates a given request.
@@ -30,62 +77,96 @@ module Grape
         # @raise [Grape::Exceptions::Validation] if validation failed
         # @return [void]
         def validate(request)
-          return unless @scope.should_validate?(request.params)
+          params = request.params
+          return unless scope.should_validate?(params)
 
-          validate!(request.params)
+          validate!(params)
         end
 
         # Validates a given parameter hash.
-        # @note Override #validate if you need to access the entire request.
+        # @note Override #validate_param! for per-parameter validation,
+        #   or #validate if you need access to the entire request.
         # @param params [Hash] parameters to validate
         # @raise [Grape::Exceptions::Validation] if validation failed
         # @return [void]
         def validate!(params)
-          attributes = SingleAttributeIterator.new(self, @scope, params)
           # we collect errors inside array because
           # there may be more than one error per field
-          array_errors = []
+          array_errors = nil
 
-          attributes.each do |val, attr_name, empty_val|
-            next if !@scope.required? && empty_val
-            next unless @scope.meets_dependency?(val, params)
+          @iterator.each(params) do |val, attr_name, empty_val|
+            next if !scope.required? && empty_val
+            next unless scope.meets_dependency?(val, params)
 
-            validate_param!(attr_name, val) if @required || (val.respond_to?(:key?) && val.key?(attr_name))
+            validate_param!(attr_name, val) if required? || (hash_like?(val) && val.key?(attr_name))
           rescue Grape::Exceptions::Validation => e
-            array_errors << e
+            (array_errors ||= []) << e
           end
 
-          raise Grape::Exceptions::ValidationArrayErrors.new(array_errors) if array_errors.any?
+          raise Grape::Exceptions::ValidationArrayErrors.new(array_errors) if array_errors
+        end
+
+        protected
+
+        # Validates a single attribute. Override in subclasses.
+        # @param attr_name [Symbol, String] the attribute name
+        # @param params [Hash] the parameter hash containing the attribute
+        # @raise [Grape::Exceptions::Validation] if validation failed
+        # @return [void]
+        def validate_param!(attr_name, params)
+          raise NotImplementedError
+        end
+
+        private
+
+        attr_reader :options, :scope, :required, :exception_message
+
+        alias required? required
+
+        # The AttributesIterator subclass used to walk this validator's
+        # attributes. Built once in #initialize and reused across requests.
+        def iterator_class
+          SingleAttributeIterator
         end
 
-        def self.inherited(klass)
-          return if klass.name.blank?
+        def validation_error!(attr_name_or_params, message = exception_message)
+          params = attr_name_or_params.is_a?(Array) ? attr_name_or_params : scope.full_name(attr_name_or_params)
+          raise Grape::Exceptions::Validation.new(params:, message:)
+        end
 
-          short_validator_name = klass.name.demodulize.underscore.delete_suffix('_validator')
-          Validations.register_validator(short_validator_name, klass)
+        def hash_like?(obj)
+          obj.respond_to?(:key?)
         end
 
+        def options_key?(key, given_options = nil)
+          current_options = given_options || options
+          hash_like?(current_options) && current_options.key?(key) && !current_options[key].nil?
+        end
+
+        # Returns the effective message for a validation error.
+        # Prefers an explicit +:message+ option, then +default_key+.
+        # If both are nil, the block (if given) is called to compute a fallback —
+        # useful for validators that build a message Hash for deferred i18n interpolation.
+        # @example
+        #   @exception_message = message(:presence)             # symbol key or custom message
+        #   @exception_message = message { build_hash_message } # computed fallback
         def message(default_key = nil)
-          options = instance_variable_get(:@option)
-          options_key?(:message) ? options[:message] : default_key
+          key = options_key?(:message) ? options[:message] : default_key
+          return key unless key.nil?
+
+          yield if block_given?
         end
 
-        def options_key?(key, options = nil)
-          options = instance_variable_get(:@option) if options.nil?
-          options.respond_to?(:key?) && options.key?(key) && !options[key].nil?
+        def option_value
+          options_key?(:value) ? options[:value] : options
         end
 
-        def fail_fast?
-          @fail_fast
+        def scrub(value)
+          return value if !value.respond_to?(:valid_encoding?) || value.valid_encoding?
+
+          value.scrub
         end
       end
     end
   end
 end
-
-Grape::Validations::Base = Class.new(Grape::Validations::Validators::Base) do
-  def self.inherited(*)
-    ActiveSupport::Deprecation.warn 'Grape::Validations::Base is deprecated! Use Grape::Validations::Validators::Base instead.'
-    super
-  end
-end

data/lib/grape/validations/validators/coerce_validator.rb

@@ -4,22 +4,35 @@ module Grape
   module Validations
     module Validators
       class CoerceValidator < Base
-        def initialize(attrs, options, required, scope, **opts)
+        default_message_key :coerce
+
+        def initialize(attrs, options, required, scope, opts)
           super
 
-          @converter = if type.is_a?(Grape::Validations::Types::VariantCollectionCoercer)
-                         type
-                       else
-                         Types.build_coercer(type, method: @option[:method])
-                       end
+          @exception_message = options.message if options.message
+
+          raw_type = options.type
+          type = hash_like?(raw_type) ? raw_type[:value] : raw_type
+          @converter =
+            if type.is_a?(Grape::Validations::Types::VariantCollectionCoercer)
+              type
+            else
+              Types.build_coercer(type, method: options.coerce_method)
+            end
         end
 
+        # The attribute is read once and held: +coerce_value+ only ever sees the
+        # value, never the Hash, so the two further reads the identity check
+        # used to make came back with the same object -- through a
+        # HashWithIndifferentAccess key conversion each time, for every coerced
+        # attribute of every request.
         def validate_param!(attr_name, params)
-          raise validation_exception(attr_name) unless params.is_a? Hash
+          validation_error!(attr_name) unless hash_like?(params)
 
-          new_value = coerce_value(params[attr_name])
+          value = params[attr_name]
+          new_value = coerce_value(value)
 
-          raise validation_exception(attr_name, new_value.message) unless valid_type?(new_value)
+          validation_error!(attr_name, new_value.message || exception_message) if new_value.is_a?(Types::InvalidValue)
 
           # Don't assign a value if it is identical. It fixes a problem with Hashie::Mash
           # which looses wrappers for hashes and arrays after reassigning values
@@ -30,45 +43,20 @@ module Grape
           #     h[:list] = list
           #     h
           #     => #<Hashie::Mash list=[1, 2, 3, 4]>
-          return if params[attr_name].instance_of?(new_value.class) && params[attr_name] == new_value
+          return if value.instance_of?(new_value.class) && value == new_value
 
           params[attr_name] = new_value
         end
 
         private
 
-        # @!attribute [r] converter
-        # Object that will be used for parameter coercion and type checking.
-        #
-        # See {Types.build_coercer}
-        #
-        # @return [Object]
-        attr_reader :converter
-
-        def valid_type?(val)
-          !val.is_a?(Types::InvalidValue)
-        end
-
+        # Calls the converter built at definition time.
+        # Custom coercers may raise; any StandardError is treated as an invalid value.
         def coerce_value(val)
-          converter.call(val)
-          # Some custom types might fail, so it should be treated as an invalid value
+          @converter.call(val)
         rescue StandardError
           Types::InvalidValue.new
         end
-
-        # Type to which the parameter will be coerced.
-        #
-        # @return [Class]
-        def type
-          @option[:type].is_a?(Hash) ? @option[:type][:value] : @option[:type]
-        end
-
-        def validation_exception(attr_name, custom_msg = nil)
-          Grape::Exceptions::Validation.new(
-            params: [@scope.full_name(attr_name)],
-            message: custom_msg || message(:coerce)
-          )
-        end
       end
     end
   end