grape 2.4.0 → 4.0.1

data/lib/grape/validations/validators/length_validator.rb

@@ -5,43 +5,44 @@ module Grape
     module Validators
       class LengthValidator < Base
         def initialize(attrs, options, required, scope, opts)
-          @min = options[:min]
-          @max = options[:max]
-          @is = options[:is]
-
           super
 
-          raise ArgumentError, 'min must be an integer greater than or equal to zero' if !@min.nil? && (!@min.is_a?(Integer) || @min.negative?)
-          raise ArgumentError, 'max must be an integer greater than or equal to zero' if !@max.nil? && (!@max.is_a?(Integer) || @max.negative?)
-          raise ArgumentError, "min #{@min} cannot be greater than max #{@max}" if !@min.nil? && !@max.nil? && @min > @max
+          @min, @max, @is = options.values_at(:min, :max, :is)
+          validate_boundary!(:min, @min)
+          validate_boundary!(:max, @max)
+          raise ArgumentError, "min `#{@min}` cannot be greater than max `#{@max}`" if @min && @max && @min > @max
 
           return if @is.nil?
-          raise ArgumentError, 'is must be an integer greater than zero' if !@is.is_a?(Integer) || !@is.positive?
-          raise ArgumentError, 'is cannot be combined with min or max' if !@min.nil? || !@max.nil?
+          raise ArgumentError, 'is must be an integer greater than zero' unless @is.is_a?(Integer) && @is.positive?
+          raise ArgumentError, 'is cannot be combined with min or max' unless @min.nil? && @max.nil?
         end
 
         def validate_param!(attr_name, params)
+          return unless hash_like?(params)
+
           param = params[attr_name]
 
           return unless param.respond_to?(:length)
 
           return unless (!@min.nil? && param.length < @min) || (!@max.nil? && param.length > @max) || (!@is.nil? && param.length != @is)
 
-          raise Grape::Exceptions::Validation.new(params: [@scope.full_name(attr_name)], message: build_message)
+          validation_error!(attr_name, message do
+            if @min && @max
+              translate(:length, min: @min, max: @max)
+            elsif @min
+              translate(:length_min, min: @min)
+            elsif @max
+              translate(:length_max, max: @max)
+            else
+              translate(:length_is, is: @is)
+            end
+          end)
         end
 
-        def build_message
-          if options_key?(:message)
-            @option[:message]
-          elsif @min && @max
-            format I18n.t(:length, scope: 'grape.errors.messages'), min: @min, max: @max
-          elsif @min
-            format I18n.t(:length_min, scope: 'grape.errors.messages'), min: @min
-          elsif @max
-            format I18n.t(:length_max, scope: 'grape.errors.messages'), max: @max
-          else
-            format I18n.t(:length_is, scope: 'grape.errors.messages'), is: @is
-          end
+        private
+
+        def validate_boundary!(name, val)
+          raise ArgumentError, "`#{name}` must be an integer greater than or equal to zero" if !val.nil? && (!val.is_a?(Integer) || val.negative?)
         end
       end
     end

data/lib/grape/validations/validators/multiple_params_base.rb

@@ -5,28 +5,31 @@ module Grape
     module Validators
       class MultipleParamsBase < Base
         def validate!(params)
-          attributes = MultipleAttributesIterator.new(self, @scope, params)
-          array_errors = []
+          array_errors = nil
 
-          attributes.each do |resource_params|
+          @iterator.each(params) do |resource_params|
             validate_params!(resource_params)
           rescue Grape::Exceptions::Validation => e
-            array_errors << e
+            (array_errors ||= []) << e
           end
 
-          raise Grape::Exceptions::ValidationArrayErrors.new(array_errors) if array_errors.any?
+          raise Grape::Exceptions::ValidationArrayErrors.new(array_errors) if array_errors
         end
 
         private
 
-        def keys_in_common(resource_params)
-          return [] unless resource_params.is_a?(Hash)
+        def iterator_class
+          MultipleAttributesIterator
+        end
+
+        def keys_in_common(resource_params, known_keys = all_keys)
+          return [] unless hash_like?(resource_params)
 
-          all_keys & resource_params.keys.map! { |attr| @scope.full_name(attr) }
+          known_keys & resource_params.keys.map! { |attr| scope.full_name(attr) }
         end
 
         def all_keys
-          attrs.map { |attr| @scope.full_name(attr) }
+          attrs.map { |attr| scope.full_name(attr) }
         end
       end
     end

data/lib/grape/validations/validators/{mutual_exclusion_validator.rb → mutually_exclusive_validator.rb}

@@ -3,12 +3,14 @@
 module Grape
   module Validations
     module Validators
-      class MutualExclusionValidator < MultipleParamsBase
+      class MutuallyExclusiveValidator < MultipleParamsBase
+        default_message_key :mutual_exclusion
+
         def validate_params!(params)
           keys = keys_in_common(params)
           return if keys.length <= 1
 
-          raise Grape::Exceptions::Validation.new(params: keys, message: message(:mutual_exclusion))
+          validation_error!(keys)
         end
       end
     end

data/lib/grape/validations/validators/oneof_validator.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+module Grape
+  module Validations
+    module Validators
+      # Validates that a Hash parameter matches at least one of a set of
+      # variant schemas. Each variant is a list of pre-built validators
+      # captured by evaluating the variant's block in a {Grape::Validations::OneofCollector}-backed
+      # {ParamsScope}. At request time we try each variant in order against
+      # a deep-dup of the value; the first variant that produces no errors
+      # wins and its (possibly coerced) hash replaces the original.
+      class OneofValidator < Base
+        default_message_key :oneof
+
+        def initialize(attrs, options, required, scope, opts)
+          super
+          @variants = Array(options)
+        end
+
+        def validate_param!(attr_name, params)
+          return unless hash_like?(params)
+
+          value = params[attr_name]
+          return if value.nil? && !required?
+
+          winning_candidate = nil
+          @variants.each do |variant_validators|
+            candidate = value.deep_dup
+            if variant_matches?(variant_validators, candidate)
+              winning_candidate = candidate
+              break
+            end
+          end
+
+          return params[attr_name] = winning_candidate if winning_candidate
+
+          validation_error!(attr_name)
+        end
+
+        private
+
+        def variant_matches?(variant_validators, candidate)
+          variant_validators.each { |v| v.validate!(candidate) }
+          true
+        rescue Grape::Exceptions::Validation, Grape::Exceptions::ValidationArrayErrors
+          false
+        end
+      end
+    end
+  end
+end

data/lib/grape/validations/validators/presence_validator.rb

@@ -4,10 +4,12 @@ module Grape
   module Validations
     module Validators
       class PresenceValidator < Base
+        default_message_key :presence
+
         def validate_param!(attr_name, params)
-          return if params.try(:key?, attr_name)
+          return if hash_like?(params) && params.key?(attr_name)
 
-          raise Grape::Exceptions::Validation.new(params: [@scope.full_name(attr_name)], message: message(:presence))
+          validation_error!(attr_name)
         end
       end
     end

data/lib/grape/validations/validators/regexp_validator.rb

@@ -4,11 +4,19 @@ module Grape
   module Validations
     module Validators
       class RegexpValidator < Base
+        default_message_key :regexp
+
+        def initialize(attrs, options, required, scope, opts)
+          super
+          @value = option_value
+        end
+
         def validate_param!(attr_name, params)
-          return unless params.try(:key?, attr_name)
-          return if Array.wrap(params[attr_name]).all? { |param| param.nil? || param.to_s.scrub.match?((options_key?(:value) ? @option[:value] : @option)) }
+          return unless hash_like?(params) && params.key?(attr_name)
+
+          return if Array.wrap(params[attr_name]).all? { |param| param.nil? || scrub(param.to_s).match?(@value) }
 
-          raise Grape::Exceptions::Validation.new(params: [@scope.full_name(attr_name)], message: message(:regexp))
+          validation_error!(attr_name)
         end
       end
     end

data/lib/grape/validations/validators/same_as_validator.rb

@@ -4,24 +4,16 @@ module Grape
   module Validations
     module Validators
       class SameAsValidator < Base
-        def validate_param!(attr_name, params)
-          confirmation = options_key?(:value) ? @option[:value] : @option
-          return if params[attr_name] == params[confirmation]
-
-          raise Grape::Exceptions::Validation.new(
-            params: [@scope.full_name(attr_name)],
-            message: build_message
-          )
+        def initialize(attrs, options, required, scope, opts)
+          super
+          @value = option_value
         end
 
-        private
+        def validate_param!(attr_name, params)
+          return unless hash_like?(params)
+          return if params[attr_name] == params[@value]
 
-        def build_message
-          if options_key?(:message)
-            @option[:message]
-          else
-            format I18n.t(:same_as, scope: 'grape.errors.messages'), parameter: @option
-          end
+          validation_error!(attr_name, message { translate(:same_as, parameter: @value) })
         end
       end
     end

data/lib/grape/validations/validators/values_validator.rb

@@ -4,55 +4,63 @@ module Grape
   module Validations
     module Validators
       class ValuesValidator < Base
+        default_message_key :values
+
         def initialize(attrs, options, required, scope, opts)
-          @values = options.is_a?(Hash) ? options[:value] : options
           super
+          values = option_value
+
+          # Zero-arity procs return a collection per-request (e.g. DB-backed lists).
+          # Non-zero-arity procs are per-element predicates, called directly at validation time.
+          # Non-Proc values are wrapped in a zero-arity lambda for a uniform call interface.
+          if values.is_a?(Proc)
+            @values_call = values
+            @values_is_predicate = !values.arity.zero?
+          else
+            @values_call = -> { values }
+            @values_is_predicate = false
+          end
         end
 
         def validate_param!(attr_name, params)
-          return unless params.is_a?(Hash)
+          return unless hash_like?(params)
 
-          val = params[attr_name]
+          val = scrub(params[attr_name])
 
           return if val.nil? && !required_for_root_scope?
-
-          val = val.scrub if val.respond_to?(:scrub)
-
-          # don't forget that +false.blank?+ is true
-          return if val != false && val.blank? && @allow_blank
-
+          return if val != false && val.blank? && allow_blank?
           return if check_values?(val, attr_name)
 
-          raise Grape::Exceptions::Validation.new(
-            params: [@scope.full_name(attr_name)],
-            message: message(:values)
-          )
+          validation_error!(attr_name)
         end
 
         private
 
         def check_values?(val, attr_name)
-          values = @values.is_a?(Proc) && @values.arity.zero? ? @values.call : @values
-          return true if values.nil?
-
           param_array = val.nil? ? [nil] : Array.wrap(val)
-          return param_array.all? { |param| values.include?(param) } unless values.is_a?(Proc)
 
-          begin
-            param_array.all? { |param| values.call(param) }
-          rescue StandardError => e
-            warn "Error '#{e}' raised while validating attribute '#{attr_name}'"
-            false
+          if @values_is_predicate
+            begin
+              param_array.all? { |param| @values_call.call(param) }
+            rescue StandardError => e
+              warn "Error '#{e}' raised while validating attribute '#{attr_name}'"
+              false
+            end
+          else
+            values = @values_call.call
+            return true if values.nil?
+
+            param_array.all? { |param| values.include?(param) }
           end
         end
 
         def required_for_root_scope?
-          return false unless @required
+          return false unless required?
 
-          scope = @scope
-          scope = scope.parent while scope.lateral?
+          current_scope = scope
+          current_scope = current_scope.parent while current_scope.lateral?
 
-          scope.root?
+          current_scope.root?
         end
       end
     end

data/lib/grape/version.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
 module Grape
-  # The current version of Grape.
-  VERSION = '2.4.0'
+  VERSION = '4.0.1'
 end

data/lib/grape/xml.rb

@@ -1,7 +1,14 @@
 # frozen_string_literal: true
 
 module Grape
-  if defined?(::MultiXml)
+  # Since multi_xml 0.9.0 the canonical constant is MultiXML; MultiXml is a
+  # deprecated alias (removed in v1.0) that warns on use. Prefer MultiXML so
+  # Grape::Xml.parse doesn't trip the deprecation, falling back to the legacy
+  # constant and then ActiveSupport::XmlMini.
+  # https://github.com/sferik/multi_xml/blob/v0.9.1/CHANGELOG.md
+  if defined?(::MultiXML)
+    Xml = ::MultiXML
+  elsif defined?(::MultiXml)
     Xml = ::MultiXml
   else
     Xml = ::ActiveSupport::XmlMini

data/lib/grape.rb

@@ -1,31 +1,22 @@
 # frozen_string_literal: true
 
 require 'logger'
+require 'monitor'
 require 'active_support'
-require 'active_support/concern'
-require 'active_support/configurable'
-require 'active_support/version'
-require 'active_support/isolated_execution_state' if ActiveSupport::VERSION::MAJOR > 6
-require 'active_support/core_ext/array/conversions'
-require 'active_support/core_ext/array/extract_options'
+require 'active_support/isolated_execution_state'
+require 'active_support/core_ext/array/conversions' # to_xml
 require 'active_support/core_ext/array/wrap'
-require 'active_support/core_ext/enumerable'
-require 'active_support/core_ext/hash/conversions'
+require 'active_support/core_ext/hash/conversions' # to_xml
 require 'active_support/core_ext/hash/deep_merge'
-require 'active_support/core_ext/hash/except'
-require 'active_support/core_ext/hash/indifferent_access'
-require 'active_support/core_ext/hash/keys'
-require 'active_support/core_ext/hash/reverse_merge'
-require 'active_support/core_ext/hash/slice'
-require 'active_support/core_ext/module/delegation'
+require 'active_support/core_ext/hash/deep_transform_values'
+require 'active_support/core_ext/hash/indifferent_access' # nested_under_indifferent_access, required by HashWithIndifferentAccess.new
+require 'active_support/hash_with_indifferent_access'
+require 'active_support/core_ext/module/delegation' # delegate_missing_to
 require 'active_support/core_ext/object/blank'
 require 'active_support/core_ext/object/deep_dup'
-require 'active_support/core_ext/object/try'
 require 'active_support/core_ext/object/duplicable'
-require 'active_support/core_ext/string/output_safety'
-require 'active_support/core_ext/string/exclude'
+require 'active_support/core_ext/string/inflections' # demodulize, underscore
 require 'active_support/deprecation'
-require 'active_support/inflector'
 require 'active_support/ordered_options'
 require 'active_support/notifications'
 
@@ -33,15 +24,15 @@ require 'English'
 require 'bigdecimal'
 require 'date'
 require 'dry-types'
+require 'dry-configurable'
 require 'forwardable'
 require 'json'
-require 'mustermann/grape'
-require 'pathname'
+require 'mustermann'
+require 'mustermann/ast/pattern'
 require 'rack'
 require 'rack/auth/basic'
 require 'rack/builder'
 require 'rack/head'
-require 'set'
 require 'singleton'
 require 'zeitwerk'
 
@@ -51,16 +42,33 @@ loader.inflector.inflect(
   'dsl' => 'DSL'
 )
 railtie = "#{__dir__}/grape/railtie.rb"
-loader.do_not_eager_load(railtie)
+# Grape::Testing is a test-environment helper -- it extends Grape::Endpoint with
+# `before_each` and prepends a hook to Grape::Endpoint#run. It is documented as
+# opt-in (`require 'grape/testing'`), which eager loading quietly contradicted
+# by installing it in every process.
+testing = "#{__dir__}/grape/testing.rb"
+loader.do_not_eager_load(railtie, testing)
 loader.setup
 
 I18n.load_path << File.expand_path('grape/locale/en.yml', __dir__)
 
 module Grape
-  include ActiveSupport::Configurable
+  extend Dry::Configurable
+
+  setting :param_builder, default: :hash_with_indifferent_access
+  setting :lint, default: false
+  setting :warn_on_helper_overrides, default: false
+  # Let an error response that cannot be rendered propagate out of the
+  # middleware stack instead of being answered with a failsafe 500.
+  setting :raise_rendering_errors, default: false
+
+  # The HTTP QUERY method (RFC 10008): a safe, idempotent request whose content
+  # carries the query. Rack has no constant for it yet, hence the literal.
+  QUERY = 'QUERY'
 
   HTTP_SUPPORTED_METHODS = [
     Rack::GET,
+    QUERY,
     Rack::POST,
     Rack::PUT,
     Rack::PATCH,
@@ -69,18 +77,37 @@ module Grape
     Rack::OPTIONS
   ].freeze
 
-  def self.deprecator
-    @deprecator ||= ActiveSupport::Deprecation.new('2.0', 'Grape')
-  end
+  # Rack errors that should be rescued and wrapped as Grape::Exceptions::RequestError.
+  # Rack 3.1.0 introduced Rack::BadRequest as a marker module included by all bad request
+  # exception classes, allowing a single rescue entry to cover them all.
+  # Before, these errors are raised as individual exception classes.
+  RACK_ERRORS =
+    if Gem::Version.new(Rack.release) >= Gem::Version.new('3.1.0')
+      [EOFError, Rack::BadRequest]
+    else
+      [
+        EOFError,
+        Rack::Multipart::MultipartPartLimitError,
+        Rack::Multipart::MultipartTotalPartLimitError,
+        Rack::Utils::ParameterTypeError,
+        Rack::Utils::InvalidParameterError,
+        Rack::QueryParser::ParamsTooDeepError
+      ]
+    end.freeze
 
-  configure do |config|
-    config.param_builder = :hash_with_indifferent_access
-    config.lint = false
-    config.compile_methods!
+  # The deprecation horizon is the version a deprecation announces as its
+  # removal point, so it is the *next* major rather than the current one, and
+  # it is derived from VERSION rather than written out. Written out, it went
+  # stale: it said '2.0' from 2023 (#2353) through all of 2.x, 3.x and 4.x, so
+  # a method deprecated through this deprecator announced a removal version
+  # that had already shipped, and every custom `behavior` lambda -- how a Rails
+  # app consumes deprecations -- was handed the same wrong number.
+  def self.deprecator
+    @deprecator ||= ActiveSupport::Deprecation.new("#{Gem::Version.new(VERSION).segments.first + 1}.0", 'Grape')
   end
 end
 
 # https://api.rubyonrails.org/classes/ActiveSupport/Deprecation.html
 # adding Grape.deprecator to Rails App if any
-require 'grape/railtie' if defined?(Rails::Railtie) && ActiveSupport.gem_version >= Gem::Version.new('7.1')
+require 'grape/railtie' if defined?(Rails::Railtie)
 loader.eager_load