grape 3.2.1 → 3.3.0

data/lib/grape/error_formatter/txt.rb

@@ -5,16 +5,16 @@ module Grape
     class Txt < Base
       def self.format_structured_message(structured_message)
         message = structured_message[:message] || Grape::Json.dump(structured_message)
-        Array.wrap(message).tap do |final_message|
-          if structured_message.key?(:backtrace)
-            final_message << 'backtrace:'
-            final_message.concat(structured_message[:backtrace])
-          end
-          if structured_message.key?(:original_exception)
-            final_message << 'original exception:'
-            final_message << structured_message[:original_exception]
-          end
-        end.join("\r\n ")
+        final_message = Array.wrap(message)
+        if structured_message.key?(:backtrace)
+          final_message << 'backtrace:'
+          final_message.concat(structured_message[:backtrace])
+        end
+        if structured_message.key?(:original_exception)
+          final_message << 'original exception:'
+          final_message << structured_message[:original_exception]
+        end
+        final_message.join("\r\n ")
       end
     end
   end

data/lib/grape/exceptions/base.rb

@@ -5,7 +5,7 @@ module Grape
     class Base < StandardError
       include Grape::Util::Translation
 
-      MESSAGE_STEPS = %w[problem summary resolution].to_h { |s| [s, s.capitalize] }.freeze
+      MESSAGE_STEPS = %w[problem summary resolution].to_h { |s| [s.to_sym, s.capitalize] }.freeze
 
       attr_reader :status, :headers
 
@@ -27,6 +27,8 @@ module Grape
         return short_message unless short_message.is_a?(Hash)
 
         MESSAGE_STEPS.filter_map do |step, label|
+          next unless short_message.key?(step)
+
           detail = translate_message(:"#{key}.#{step}", **)
           "\n#{label}:\n  #{detail}" if detail.present?
         end.join

data/lib/grape/exceptions/error_response.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module Grape
+  module Exceptions
+    # Value object representing the payload thrown via `throw :error, ...`
+    # and consumed by `Middleware::Error#error_response`. Replaces the
+    # implicit-schema Hash that previously circulated between throw sites
+    # and the error middleware.
+    ErrorResponse = Data.define(:status, :message, :headers, :backtrace, :original_exception) do
+      def initialize(status: nil, message: nil, headers: nil, backtrace: nil, original_exception: nil)
+        super
+      end
+
+      def to_s
+        "#<#{self.class.name} status=#{status.inspect} message=#{message.inspect} headers=#{headers.inspect}>"
+      end
+
+      def self.from_exception(exception)
+        new(
+          status: exception.status,
+          message: exception.message,
+          headers: exception.headers,
+          backtrace: exception.backtrace,
+          original_exception: exception
+        )
+      end
+
+      # Normalize heterogeneous inputs into an ErrorResponse. Preserves the
+      # public contract that users can still `throw :error, hash` from their
+      # own middleware or `rescue_from` handlers.
+      def self.coerce(input)
+        case input
+        when ErrorResponse
+          input
+        when Grape::Exceptions::Base
+          from_exception(input)
+        when Hash
+          new(**input.slice(:status, :message, :headers, :backtrace, :original_exception))
+        else
+          new
+        end
+      end
+    end
+  end
+end

data/lib/grape/exceptions/internal_server_error.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module Grape
+  module Exceptions
+    # Raised internally when a +rescue_from+ handler itself raises an
+    # unrecognised exception. The framework substitutes the original
+    # exception with this safe stand-in for rendering, while preserving
+    # the original on +env[Grape::Env::GRAPE_EXCEPTION]+ for upstream
+    # observability (loggers, error trackers, etc.).
+    class InternalServerError < Base
+      def initialize
+        super(status: 500, message: compose_message(:internal_server_error))
+      end
+    end
+  end
+end

data/lib/grape/exceptions/validation.rb

@@ -3,6 +3,8 @@
 module Grape
   module Exceptions
     class Validation < Base
+      EMPTY_BACKTRACE = [].freeze
+
       attr_reader :params, :message_key
 
       def initialize(params:, message: nil, status: nil, headers: nil)
@@ -16,6 +18,10 @@ module Grape
         end
 
         super(status:, message:, headers:)
+        # Pre-seed the backtrace so Ruby's raise skips capture. Validation errors are
+        # a hot path (raised per bad attribute) and end up as 400 Bad Request responses;
+        # backtraces here point into Grape internals and have no diagnostic value.
+        set_backtrace(EMPTY_BACKTRACE)
       end
 
       # Remove all the unnecessary stuff from Grape::Exceptions::Base like status
@@ -23,6 +29,14 @@ module Grape
       def as_json(*_args)
         to_s
       end
+
+      # Returns +self+ so callers (e.g. +ValidationErrors#initialize+) can treat
+      # a single +Validation+ and a +ValidationArrayErrors+ wrapper uniformly via
+      # +flat_map(&:errors)+ — Array returns flatten in, non-Array returns
+      # (i.e. this +self+) append as one element.
+      def errors
+        self
+      end
     end
   end
 end

data/lib/grape/exceptions/validation_array_errors.rb

@@ -3,11 +3,15 @@
 module Grape
   module Exceptions
     class ValidationArrayErrors < Base
+      EMPTY_BACKTRACE = [].freeze
+
       attr_reader :errors
 
       def initialize(errors)
         super()
         @errors = errors
+        # Skip backtrace capture — see Grape::Exceptions::Validation for rationale.
+        set_backtrace(EMPTY_BACKTRACE)
       end
     end
   end

data/lib/grape/exceptions/validation_errors.rb

@@ -3,23 +3,13 @@
 module Grape
   module Exceptions
     class ValidationErrors < Base
-      include Enumerable
-
       attr_reader :errors
 
-      def initialize(errors: [], headers: {})
-        @errors = errors.group_by(&:params)
+      def initialize(exceptions: [], headers: {})
+        @errors = exceptions.flat_map(&:errors).group_by(&:params)
         super(message: full_messages.join(', '), status: 400, headers:)
       end
 
-      def each
-        errors.each_pair do |attribute, errors|
-          errors.each do |error|
-            yield attribute, error
-          end
-        end
-      end
-
       def as_json(**_opts)
         errors.map do |k, v|
           {
@@ -34,14 +24,16 @@ module Grape
       end
 
       def full_messages
-        messages = map do |attributes, error|
-          translate(
-            :format,
-            scope: 'grape.errors',
-            default: '%<attributes>s %<message>s',
-            attributes: translate_attributes(attributes),
-            message: error.message
-          )
+        messages = errors.flat_map do |attributes, errs|
+          errs.map do |error|
+            translate(
+              :format,
+              scope: 'grape.errors',
+              default: '%<attributes>s %<message>s',
+              attributes: translate_attributes(attributes),
+              message: error.message
+            )
+          end
         end
         messages.uniq!
         messages

data/lib/grape/formatter/serializable_hash.rb

@@ -19,15 +19,11 @@ module Grape
         end
 
         def serialize(object)
-          if object.respond_to? :serializable_hash
-            object.serializable_hash
-          elsif array_serializable?(object)
-            object.map(&:serializable_hash)
-          elsif object.is_a?(Hash)
-            object.transform_values { |v| serialize(v) }
-          else
-            object
-          end
+          return object.serializable_hash if object.respond_to?(:serializable_hash)
+          return object.map(&:serializable_hash) if array_serializable?(object)
+          return object.transform_values { |v| serialize(v) } if object.is_a?(Hash)
+
+          object
         end
 
         def array_serializable?(object)

data/lib/grape/json.rb

@@ -1,8 +1,44 @@
 # frozen_string_literal: true
 
 module Grape
-  if defined?(::MultiJson)
-    Json = ::MultiJson
+  if defined?(::MultiJSON)
+    # Since multi_json 1.21.0, MultiJSON.dump is deprecated in favor of
+    # MultiJSON.generate (removed in 2.0). Keep Grape's dump surface but route
+    # it to the non-deprecated name — identical output, no deprecation warning.
+    # https://github.com/sferik/multi_json/blob/v1.21.1/CHANGELOG.md#deprecated
+    module Json
+      ParseError = ::MultiJSON::ParseError
+
+      class << self
+        def dump(object)
+          ::MultiJSON.generate(object)
+        end
+
+        # parse is not deprecated; it's re-exposed (not renamed) because this
+        # facade is its own module and no longer inherits MultiJSON's methods.
+        def parse(source)
+          ::MultiJSON.parse(source)
+        end
+      end
+    end
+  elsif defined?(::MultiJson)
+    # Legacy multi_json (< 1.21) predates generate/parse and only exposes
+    # dump/load. Map Grape's surface onto them so the call sites stay
+    # engine-agnostic (these names are not deprecated on < 1.21).
+    module Json
+      # Mutually exclusive with the MultiJSON branch above; only one runs.
+      ParseError = ::MultiJson::ParseError # rubocop:disable Lint/ConstantReassignment
+
+      class << self
+        def dump(object)
+          ::MultiJson.dump(object)
+        end
+
+        def parse(source)
+          ::MultiJson.load(source)
+        end
+      end
+    end
   else
     Json = ::JSON
     Json::ParseError = Json::ParserError

data/lib/grape/locale/en.yml

@@ -11,6 +11,7 @@ en:
         exactly_one: 'are missing, exactly one parameter must be provided'
         except_values: 'has a value not allowed'
         incompatible_option_values: '%{option1}: %{value1} is incompatible with %{option2}: %{value2}'
+        internal_server_error: 'Internal Server Error'
         invalid_accept_header:
           problem: 'invalid accept header'
           resolution: '%{message}'
@@ -42,6 +43,7 @@ en:
           resolution: 'eg: version ''v1'', using: :header, vendor: ''twitter'''
           summary: 'when version using header, you must specify :vendor option'
         mutual_exclusion: 'are mutually exclusive'
+        oneof: 'does not match any of the allowed schemas'
         presence: 'is missing'
         regexp: 'is invalid'
         same_as: 'is not the same as %{parameter}'

data/lib/grape/middleware/auth/base.rb

@@ -8,9 +8,8 @@ module Grape
           super
           return unless options.key?(:type)
 
-          @auth_strategy = Grape::Middleware::Auth::Strategies[options[:type]].tap do |auth_strategy|
-            raise Grape::Exceptions::UnknownAuthStrategy.new(strategy: options[:type]) unless auth_strategy
-          end
+          @auth_strategy = Grape::Middleware::Auth::Strategies[options[:type]]
+          raise Grape::Exceptions::UnknownAuthStrategy.new(strategy: options[:type]) unless @auth_strategy
         end
 
         def call!(env)

data/lib/grape/middleware/auth/dsl.rb

@@ -4,24 +4,27 @@ module Grape
   module Middleware
     module Auth
       module DSL
-        def auth(type = nil, options = {}, &block)
+        def auth(type = nil, *legacy_options, **options, &block)
           namespace_inheritable = inheritable_setting.namespace_inheritable
           return namespace_inheritable[:auth] unless type
 
-          namespace_inheritable[:auth] = options.reverse_merge(type: type.to_sym, proc: block)
+          options = merge_legacy_auth_options(:auth, legacy_options, options)
+          namespace_inheritable[:auth] = { type: type.to_sym, proc: block }.merge!(options)
           use Grape::Middleware::Auth::Base, namespace_inheritable[:auth]
         end
 
         # Add HTTP Basic authorization to the API.
         #
-        # @param [Hash] options A hash of options.
-        # @option options [String] :realm "API Authorization" The HTTP Basic realm.
-        def http_basic(options = {}, &)
+        # @param options [Hash] a hash of options
+        # @option options [String] :realm "API Authorization" the HTTP Basic realm
+        def http_basic(*legacy_options, **options, &)
+          options = merge_legacy_auth_options(:http_basic, legacy_options, options)
           options[:realm] ||= 'API Authorization'
-          auth(:http_basic, options, &)
+          auth(:http_basic, **options, &)
         end
 
-        def http_digest(options = {}, &)
+        def http_digest(*legacy_options, **options, &)
+          options = merge_legacy_auth_options(:http_digest, legacy_options, options)
           options[:realm] ||= 'API Authorization'
 
           if options[:realm].respond_to?(:values_at)
@@ -30,7 +33,19 @@ module Grape
             options[:opaque] ||= 'secret'
           end
 
-          auth(:http_digest, options, &)
+          auth(:http_digest, **options, &)
+        end
+
+        private
+
+        # @deprecated Passing a positional options Hash is deprecated; pass
+        #   keyword arguments instead. Kept so downstream callers keep working
+        #   through the deprecation cycle.
+        def merge_legacy_auth_options(method_name, legacy_options, options)
+          return options if legacy_options.empty?
+
+          Grape.deprecator.warn("Passing a positional options Hash to `#{method_name}` is deprecated. Pass keyword arguments instead.")
+          legacy_options.first.merge(options)
         end
       end
     end

data/lib/grape/middleware/base.rb

@@ -5,13 +5,25 @@ module Grape
     class Base
       include Grape::DSL::Headers
 
-      attr_reader :app, :env, :options
+      attr_reader :app, :env, :options, :config
 
       # @param [Rack Application] app The standard argument for a Rack middleware.
-      # @param [Hash] options A hash of options, simply stored for use by subclasses.
+      # @param [Hash] options Options forwarded to the subclass. When the
+      #   subclass declares an `Options` Data class, the kwargs are routed
+      #   through it and exposed via {#config}; {#options} keeps returning a
+      #   frozen Hash representation for back-compat with subclasses that read
+      #   `options[:key]`. Otherwise the kwargs are deep-merged with the
+      #   subclass's `DEFAULT_OPTIONS` Hash (legacy path) and frozen.
       def initialize(app, **options)
         @app = app
-        @options = merge_default_options(options)
+        if self.class.const_defined?(:Options)
+          # Search ancestors so subclasses (e.g. Versioner::Path → Versioner::Base)
+          # inherit their parent's Options Data class without redeclaring it.
+          @config = self.class::Options.new(**options)
+          @options = @config.to_h.freeze
+        else
+          @options = merge_default_options(options).freeze
+        end
         @app_response = nil
       end
 
@@ -61,22 +73,6 @@ module Grape
         @app_response = Rack::Response[*@app_response]
       end
 
-      def content_types
-        @content_types ||= Grape::ContentTypes.content_types_for(options[:content_types])
-      end
-
-      def mime_types
-        @mime_types ||= Grape::ContentTypes.mime_types_for(content_types)
-      end
-
-      def content_type_for(format)
-        content_types_indifferent_access[format]
-      end
-
-      def content_type
-        content_type_for(env[Grape::Env::API_FORMAT] || options[:format]) || 'text/html'
-      end
-
       def query_params
         rack_request.GET
       rescue *Grape::RACK_ERRORS
@@ -86,26 +82,19 @@ module Grape
       private
 
       def merge_headers(response)
-        return unless headers.is_a?(Hash)
+        return if @header.blank?
 
         case response
-        when Rack::Response then response.headers.merge!(headers)
-        when Array          then response[1].merge!(headers)
+        when Rack::Response then response.headers.merge!(@header)
+        when Array          then response[1].merge!(@header)
         end
       end
 
-      def content_types_indifferent_access
-        @content_types_indifferent_access ||= content_types.with_indifferent_access
-      end
-
       def merge_default_options(options)
-        if respond_to?(:default_options)
-          default_options.deep_merge(options)
-        elsif self.class.const_defined?(:DEFAULT_OPTIONS)
-          self.class::DEFAULT_OPTIONS.deep_merge(options)
-        else
-          options
-        end
+        return default_options.deep_merge(options) if respond_to?(:default_options)
+        return self.class::DEFAULT_OPTIONS.deep_merge(options) if self.class.const_defined?(:DEFAULT_OPTIONS)
+
+        options
       end
 
       def try_scrub(obj)

data/lib/grape/middleware/deprecated_options_hash_access.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Grape
+  module Middleware
+    # Mixin for per-middleware +Options+ +Data+ classes that need to keep
+    # accepting legacy +data[:key]+ Hash-style access while nudging callers
+    # toward the named accessor. Emits a +Grape.deprecator+ warning then
+    # forwards to +public_send(key)+.
+    module DeprecatedOptionsHashAccess
+      def [](key)
+        Grape.deprecator.warn(
+          "`#{self.class.name}#[]` is deprecated. " \
+          "Use the named accessor `#{key}` instead."
+        )
+        public_send(key) if members.include?(key)
+      end
+    end
+  end
+end