grape 3.3.4 → 4.0.0

data/lib/grape/util/media_type.rb

@@ -7,6 +7,10 @@ module Grape
 
       # based on the HTTP Accept header with the pattern:
       # application/vnd.:vendor-:version+:format
+      #
+      # Matched against a down-cased media type: they are case-insensitive
+      # (RFC 9110 §8.3.1), while a vendor and version are declared in the DSL
+      # in the case they will be compared in.
       VENDOR_VERSION_HEADER_REGEX = /\Avnd\.(?<vendor>[a-z0-9.\-_!^]+?)(?:-(?<version>[a-z0-9*.]+))?(?:\+(?<format>[a-z0-9*\-.]+))?\z/
 
       def initialize(type:, subtype:)
@@ -41,7 +45,7 @@ module Grape
         def parse(media_type)
           return if media_type.blank?
 
-          type, subtype = media_type.split('/', 2)
+          type, subtype = media_type.downcase.split('/', 2)
           return if type.blank? || subtype.blank?
 
           new(type:, subtype:)
@@ -50,14 +54,17 @@ module Grape
         def match?(media_type)
           return false if media_type.blank?
 
-          subtype = media_type.split('/', 2).last
+          subtype = media_type.downcase.split('/', 2).last
           return false if subtype.blank?
 
           VENDOR_VERSION_HEADER_REGEX.match?(subtype)
         end
 
+        # The available types are registered in lower case and Rack matches them
+        # literally, so the header has to be down-cased to be compared against
+        # them at all.
         def best_quality_media_type(header, available_media_types)
-          header.blank? ? available_media_types.first : Rack::Utils.best_q_match(header, available_media_types)
+          header.blank? ? available_media_types.first : Rack::Utils.best_q_match(header.downcase, available_media_types)
         end
       end
 

data/lib/grape/util/path_normalizer.rb

@@ -14,20 +14,23 @@ module Grape
         return '/' unless path
         return path if path == '/'
 
-        # Fast path for the overwhelming majority of paths that don't need to be normalized
-        return path if path.start_with?('/') && !(path.end_with?('/') || path.match?(%r{%|//}))
+        # Fast path for the overwhelming majority of paths that don't need to be
+        # normalized. Two String#include? calls rather than one `%|//` regexp:
+        # same predicate, and the scan stays in C without building a match.
+        return path if path.start_with?('/') && !(path.end_with?('/') || path.include?('%') || path.include?('//'))
 
-        # Slow path
+        # Slow path. The bangs below are safe because +normalized+ is a fresh
+        # String built here, never the one the caller passed in.
         encoding = path.encoding
-        path = "/#{path}"
-        path.squeeze!('/')
+        normalized = "/#{path}"
+        normalized.squeeze!('/')
 
-        unless path == '/'
-          path.delete_suffix!('/')
-          path.gsub!(/(%[a-f0-9]{2})/) { ::Regexp.last_match(1).upcase }
+        unless normalized == '/'
+          normalized.delete_suffix!('/')
+          normalized.gsub!(/(%[a-f0-9]{2})/) { ::Regexp.last_match(1).upcase }
         end
 
-        path.force_encoding(encoding)
+        normalized.force_encoding(encoding)
       end
     end
   end

data/lib/grape/util/registry.rb

@@ -8,7 +8,7 @@ module Grape
         return if short_name.nil?
 
         warn "#{short_name} is already registered with class #{registry[short_name]}. It will be overridden globally with the following: #{klass.name}" if registry.key?(short_name)
-        registry[short_name] = klass
+        registry[short_name] = registry[short_name.to_sym] = klass
       end
 
       private
@@ -19,8 +19,18 @@ module Grape
         klass.name.demodulize.underscore
       end
 
+      # Every registration under both spellings in one plain Hash, so a lookup
+      # is a single +Hash#[]+. A +HashWithIndifferentAccess+ converted the key
+      # on every read instead -- and these registries are read on the request
+      # path, by +Grape::Formatter+ once per response, by +Grape::Parser+ once
+      # per parsed body and by +Grape::ParamsBuilder+ once per params build,
+      # always with a Symbol, which is the spelling +convert_key+ allocates a
+      # String for.
+      #
+      # +register+ derives the short name as a String, so the Symbol is the
+      # alias.
       def registry
-        @registry ||= ActiveSupport::HashWithIndifferentAccess.new
+        @registry ||= {}
       end
     end
   end

data/lib/grape/util/shadowed_rescue_handlers.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+module Grape
+  module Util
+    # Diagnostics for +rescue_from+ registrations that can never run.
+    #
+    # Middleware::Error resolves with +find+, so within a scope the first
+    # matching class wins and one registered for a class an earlier handler
+    # already covers is dead code — silently, before this warned:
+    #
+    #   rescue_from StandardError do ... end   # wins
+    #   rescue_from ArgumentError do ... end   # never runs
+    #
+    # Warn rather than reorder: which should win is the author's call, and
+    # +rescue_from :all+ (consulted only after the registered handlers) already
+    # offers "broad first, specific still wins" to anyone who wants it.
+    module ShadowedRescueHandlers
+      module_function
+
+      # @param registered [Hash] the scope's own handlers, in registration order
+      # @param mapping [Hash] the handlers being registered now
+      # @return [void]
+      #
+      # Only a scope's own registrations are compared: across scopes the nearest
+      # one deliberately wins, so an inner +rescue_from StandardError+ shadowing
+      # an outer +rescue_from ArgumentError+ is the documented behaviour rather
+      # than a mistake. Classes sharing a handler object are skipped too, since
+      # +rescue_from A, B+ registers one handler for both and the entry that
+      # loses to the other changes nothing.
+      def warn_about(registered, mapping)
+        return if registered.empty?
+
+        mapping.each do |klass, handler|
+          covered_by, = registered.find { |already, existing| klass <= already && !existing.equal?(handler) }
+          next unless covered_by
+
+          warn(message_for(klass, covered_by))
+        end
+      end
+
+      def message_for(klass, covered_by)
+        return "Grape: rescue_from #{klass} was already registered in this scope; the first handler is kept and this one will never run." if klass == covered_by
+
+        "Grape: rescue_from #{klass} will never run — #{covered_by} was registered earlier in the same scope " \
+          'and is matched first. Register the more specific class before the broader one.'
+      end
+    end
+  end
+end

data/lib/grape/util/stackable_values.rb

@@ -2,10 +2,36 @@
 
 module Grape
   module Util
-    class StackableValues < BaseInheritable
+    # A read-only view of one settings scope's stackable registrations.
+    #
+    # Grape stores nothing here anymore: the registrations live on
+    # Grape::Util::InheritableSetting, one Array per key per scope, and are
+    # reached through its semantic accessors (+helpers+, +middleware+,
+    # +namespaces+, ...). This class survives only because grape-swagger
+    # reads InheritableSetting#namespace_stackable directly — including
+    # walking the #inherited_values chain and reading each level's own
+    # #new_values to recover per-scope registrations — and is expected to be
+    # removed once grape-swagger reads those accessors instead.
+    #
+    # Instances are built on demand by InheritableSetting#namespace_stackable
+    # and are not the backing store: writing to #new_values does not register
+    # anything.
+    class StackableValues
       EMPTY = [].freeze
 
-      # Even if there is no value, an empty (frozen) array will be returned.
+      attr_reader :inherited_values, :new_values
+
+      # @param new_values [Hash, nil] the scope's own registrations, one Array
+      #   per key; nil when the scope never registered anything.
+      # @param inherited_values [StackableValues, Hash] the enclosing scope's
+      #   view, or an empty Hash at the root of the chain.
+      def initialize(new_values, inherited_values)
+        @new_values = new_values
+        @inherited_values = inherited_values
+      end
+
+      # Outermost scope first. Even if there is no value, an empty (frozen)
+      # array will be returned.
       def [](name)
         inherited_value = @inherited_values[name]
         new_value = @new_values && @new_values[name]
@@ -15,10 +41,10 @@ module Grape
         concat_values(inherited_value, new_value)
       end
 
-      def []=(name, value)
-        @new_values ||= {}
-        @new_values[name] ||= []
-        @new_values[name].push value
+      def keys
+        return @inherited_values.keys if @new_values.nil? || @new_values.empty?
+
+        (@inherited_values.keys + @new_values.keys).uniq
       end
 
       def to_hash

data/lib/grape/validations/attributes_iterator.rb

@@ -10,10 +10,22 @@ module Grape
       def initialize(attrs, scope)
         @attrs = attrs
         @scope = scope
+        # How many times #do_each may descend into a nested array. The
+        # declaration allows one level per Array-typed scope on the chain, less
+        # the one +Array.wrap+ already consumes in #each. Anything deeper was
+        # put there by the request, not by the declaration.
+        @max_nesting = [scope.array_depth - 1, 0].max
       end
 
       def each(params, &)
         original_params = @scope.params(params)
+        # A scope resolves to a Hash unless the declaration nests arrays, and
+        # then #do_each has nothing to do but hand it straight back: Array.wrap
+        # boxes it, the loop unboxes it on its only iteration, and with no Array
+        # anywhere neither the nesting descent nor the index bookkeeping
+        # applies. Every validator on a flat +params+ block comes through here.
+        return yield_attributes(original_params, &) if original_params.is_a?(Hash) && !@scope.iterates_elements?
+
         # because we need recursion for nested arrays
         do_each(Array.wrap(original_params), original_params, &)
       end
@@ -24,19 +36,24 @@ module Grape
         params_to_process.each_with_index do |resource_params, index|
           # when we get arrays of arrays it means that target element located inside array
           # we need this because we want to know parent arrays indices
-          if resource_params.is_a?(Array)
+          #
+          # Only descend as far as the declaration nests. A request that wraps
+          # its elements deeper than that is yielded as-is, so the attribute
+          # validators see a non-hash and fail it the same way any other
+          # unexpected element type does.
+          if resource_params.is_a?(Array) && parent_indices.size < @max_nesting
             do_each(resource_params, original_params, [index] + parent_indices, &block)
             next
           end
 
-          if @scope.type == Array
+          if @scope.iterates_elements?
             next unless original_params.is_a?(Array) # do not validate content of array if it isn't array
 
             store_indices(@scope, index, parent_indices)
           elsif original_params.is_a?(Array)
             # Lateral scope (no @element) whose params resolved to an array —
-            # delegate index tracking to the nearest array-typed ancestor so
-            # that full_name produces the correct bracketed index.
+            # delegate index tracking to the nearest element-iterating ancestor
+            # so that full_name produces the correct bracketed index.
             target = @scope.nearest_array_ancestor
             store_indices(target, index, parent_indices) if target
           end

data/lib/grape/validations/contract_scope.rb

@@ -9,19 +9,20 @@ module Grape
       # @yield a block yielding a new schema class. Optional.
       def initialize(api, contract = nil, &block)
         # When block is passed, the first arg is either schema or nil.
-        contract = Dry::Schema.Params(parent: contract, &block) if block
+        declared = block ? Dry::Schema.Params(parent: contract, &block) : contract
 
-        if contract.respond_to?(:schema)
+        if declared.respond_to?(:schema)
           # It's a Dry::Validation::Contract, then.
-          contract = contract.new
-          key_map = contract.schema.key_map
+          schema = declared.new
+          key_map = schema.schema.key_map
         else
           # Dry::Schema::Processor, hopefully.
-          key_map = contract.key_map
+          schema = declared
+          key_map = declared.key_map
         end
 
-        api.inheritable_setting.namespace_stackable[:contract_key_map] = key_map
-        api.inheritable_setting.namespace_stackable[:validations] = Validators::ContractScopeValidator.new(schema: contract)
+        api.inheritable_setting.add_contract_key_map(key_map)
+        api.inheritable_setting.add_validation(Validators::ContractScopeValidator.new(schema:))
       end
     end
   end

data/lib/grape/validations/oneof_collector.rb

@@ -8,31 +8,27 @@ module Grape
     # the real API. Exposes only the slice of the API surface that
     # ParamsScope and its helpers touch during definition.
     class OneofCollector
+      extend Forwardable
+
       attr_reader :inheritable_setting
 
+      def_delegator :@inheritable_setting, :validations
+
       def initialize
         @inheritable_setting = Grape::Util::InheritableSetting.new
-        @inheritable_setting.namespace_inheritable[:do_not_document] = true
+        @inheritable_setting.do_not_document!
       end
 
       def configuration
         nil
       end
 
-      def validators
-        inheritable_setting.namespace_stackable[:validations]
-      end
-
-      def declared_params
-        inheritable_setting.namespace_stackable[:declared_params]
-      end
-
       # Evaluate +variant_block+ in a fresh +ParamsScope+ backed by a new
       # collector and return the validators that the block registered.
       def self.collect(variant_block)
         collector = new
         ParamsScope.new(api: collector, type: Hash, &variant_block)
-        collector.validators
+        collector.validations
       end
     end
   end

data/lib/grape/validations/params_documentation.rb

@@ -6,12 +6,12 @@ module Grape
     # +ValidationsSpec+; never mutates the user's validations hash.
     module ParamsDocumentation
       def document_params(attrs, spec)
-        return if @api.inheritable_setting.namespace_inheritable[:do_not_document]
+        return if @api.inheritable_setting.do_not_document?
 
         documented_attrs = attrs.to_h do |name|
           [full_name(name), extract_details(spec)]
         end
-        @api.inheritable_setting.namespace_stackable[:params] = documented_attrs
+        @api.inheritable_setting.add_params_documentation(documented_attrs)
       end
 
       private

data/lib/grape/validations/params_scope.rb

@@ -3,7 +3,7 @@
 module Grape
   module Validations
     class ParamsScope
-      attr_reader :parent, :type, :nearest_array_ancestor, :full_path
+      attr_reader :parent, :type, :nearest_array_ancestor, :array_depth, :full_path
 
       def qualifying_params
         ParamScopeTracker.current&.qualifying_params(self)
@@ -78,6 +78,9 @@ module Grape
         # configure_declared_params consumes it and clears @declared_params to nil.
         @declared_params = []
         @full_path = build_full_path
+        # Read by the validators instantiated from the block below, so it has to
+        # be settled before the instance_eval.
+        @array_depth = find_array_depth
 
         instance_eval(&block) if block
 
@@ -169,6 +172,17 @@ module Grape
         @parent && @element
       end
 
+      # Whether this scope's params resolve to one entry per element, which is
+      # what makes both an element index and a nesting level meaningful.
+      #
+      # +type: Array[JSON]+ counts as much as +type: Array+ does. It is easy to
+      # miss because it evaluates to the Array *instance* +[JSON]+ rather than
+      # the Array class, so an +== Array+ test quietly excluded it.
+      # @return [Boolean]
+      def iterates_elements?
+        @type == Array || @type == SPECIAL_JSON.last
+      end
+
       # A lateral scope is subordinate to its parent, but its keys are at the
       # same level as its parent and thus is not contained within an element.
       # @return [Boolean] whether or not this scope is lateral
@@ -186,12 +200,16 @@ module Grape
 
       # Adds a parameter declaration to our list of validations.
       # @param attrs [Array] (see Grape::DSL::Parameters#requires)
-      def push_declared_params(attrs, **opts)
-        opts[:declared_params_scope] = self unless opts.key?(:declared_params_scope)
-        return @parent.push_declared_params(attrs, **opts) if lateral?
+      # +declared_params_scope+ is the scope an attribute is recorded against.
+      # It defaults to the receiver and is forwarded unchanged when a lateral
+      # scope hands the push to its parent, so an attribute declared inside a
+      # +given+ block stays attributed to the lateral scope that declared it
+      # rather than to the parent that stores it.
+      def push_declared_params(attrs, as: nil, declared_params_scope: self)
+        return @parent.push_declared_params(attrs, as:, declared_params_scope:) if lateral?
 
-        push_renamed_param(full_path + [attrs.first], opts[:as]) if opts[:as]
-        @declared_params.concat(attrs.map { |attr| ::Grape::Validations::ParamsScope::Attr.new(attr, opts[:declared_params_scope]) })
+        push_renamed_param(full_path + [attrs.first], as) if as
+        @declared_params.concat(attrs.map { |attr| ::Grape::Validations::ParamsScope::Attr.new(attr, declared_params_scope) })
       end
 
       private
@@ -211,10 +229,7 @@ module Grape
       # @param new_name [String, Symbol] the new name of the parameter (the
       #   renamed name, with the +as: ...+ semantic)
       def push_renamed_param(path, new_name)
-        api_route_setting = @api.inheritable_setting.route
-        base = api_route_setting[:renamed_params] || {}
-        base[Array(path).map(&:to_s)] = new_name.to_s
-        api_route_setting[:renamed_params] = base
+        @api.inheritable_setting.add_route_renamed_param(Array(path).map(&:to_s), new_name.to_s)
       end
 
       def require_required_and_optional_fields(context, using:, except: nil)
@@ -230,7 +245,7 @@ module Grape
         end
         required_fields.each do |field|
           field_opts = using[field]
-          raise ArgumentError, "required field not exist: #{field}" unless field_opts
+          raise ArgumentError, "required field not exist: `#{field}`" unless field_opts
 
           requires(field, **field_opts)
         end
@@ -252,11 +267,6 @@ module Grape
         end
       end
 
-      def validate_attributes(attrs, **opts, &block)
-        opts[:type] ||= Array if block
-        validates(attrs, opts)
-      end
-
       # Returns a new parameter scope, subordinate to the current one and nested
       # under the given element.
       # @param element [Symbol] the parameter name under which this scope is nested
@@ -266,8 +276,11 @@ module Grape
       #   is optional or not (and hence, whether this block's params will be).
       # @yield parameter scope
       def new_scope(element, type:, as:, optional: false, &)
-        # if required params are grouped and no type or unsupported type is provided, raise an error
-        if element && !optional
+        # A group needs a type: it says whether the nested params sit under one
+        # object or repeat in a list, and without it the `type || Array` below
+        # would quietly pick one. Checked here for `requires` and `optional`
+        # alike — `new_scope` is only reached from their block branch.
+        if element
           raise Grape::Exceptions::MissingGroupType if type.nil?
           raise Grape::Exceptions::UnsupportedGroupType unless Grape::Validations::Types.group?(type)
         end
@@ -316,20 +329,44 @@ module Grape
         push_renamed_param(full_path, @element_renamed) if @element_renamed
         return @parent.push_declared_params [{ @element => @declared_params }] if nested?
 
-        @api.inheritable_setting.namespace_stackable[:declared_params] = @declared_params
+        @api.inheritable_setting.add_declared_params(@declared_params)
       ensure
         @declared_params = nil
       end
 
       def find_nearest_array_ancestor
         scope = @parent
-        scope = scope.parent while scope && scope.type != Array
+        scope = scope.parent while scope && !scope.iterates_elements?
         scope
       end
 
-      def validates(attrs, validations)
-        process_oneof!(validations) if validations.key?(:oneof)
-        spec = ValidationsSpec.from(validations)
+      # Every element-iterating scope on the chain adds one level of nesting to
+      # what {#params} returns, because +map_params+ maps over the array it
+      # resolved from the parent. Counting them tells {AttributesIterator} how
+      # deep the declaration says the params for this scope may legitimately be.
+      def find_array_depth
+        (iterates_elements? ? 1 : 0) + (@parent&.array_depth || 0)
+      end
+
+      # +required+ is the DSL's own signal — +requires+ passes true, +optional+
+      # false. It used to travel as a +:presence+ key that +requires+ wrote into
+      # the caller's option Hash, which is why a user-supplied +presence:+ was
+      # silently overwritten there and silently honoured by +optional+, where
+      # nothing overwrote it. The key is built here from the flag instead, after
+      # the caller has merged in any enclosing +with+ attributes, so a
+      # group-level +message:+ reaches the presence validator.
+      #
+      # A +presence:+ supplied by an API still decides the outcome exactly as it
+      # used to — deprecated rather than dropped, so nothing changes under an
+      # API that relies on it until the key is ignored outright.
+      def validates(attrs, validations, required: false)
+        if validations.key?(:presence)
+          Grape.deprecator.warn('Passing a `presence` option is deprecated and it will be ignored in a future release. Declare the parameter with `requires` to make it required, `optional` to make it optional.')
+        end
+
+        declared = required ? validations.merge(presence: { value: true, message: validations[:message] }) : validations
+        declared = declared.merge(oneof: collected_oneof(declared)) if declared.key?(:oneof)
+        spec = ValidationsSpec.from(declared)
 
         document_params(attrs, spec)
 
@@ -381,14 +418,17 @@ module Grape
       # {OneofCollector} so the full params DSL is available inside variants
       # and the resulting validators are kept out of the real API's
       # registration list.
-      def process_oneof!(validations)
+      # Returns the collected variants rather than writing them back into
+      # +validations+, which is the options Hash the +requires+/+optional+ call
+      # site built.
+      def collected_oneof(validations)
         raise ArgumentError, 'oneof: requires type: Hash' unless validations[:type] == Hash
 
         variants = validations[:oneof]
         raise ArgumentError, 'oneof: must be a non-empty Array of blocks' unless variants.is_a?(Array) && variants.any?
         raise ArgumentError, 'oneof: each variant must be a Proc' unless variants.all?(Proc)
 
-        validations[:oneof] = variants.map { |block| OneofCollector.collect(block) }
+        variants.map { |block| OneofCollector.collect(block) }
       end
 
       def validate(type, options, attrs, required, opts)
@@ -400,7 +440,7 @@ module Grape
           self,
           opts
         )
-        @api.inheritable_setting.namespace_stackable[:validations] = validator_instance
+        @api.inheritable_setting.add_validation(validator_instance)
       end
 
       def all_element_blank?(scoped_params)

data/lib/grape/validations/single_attribute_iterator.rb

@@ -8,9 +8,11 @@ module Grape
       def yield_attributes(val)
         return if skip?(val)
 
-        @attrs.each do |attr_name|
-          yield val, attr_name, empty?(val)
-        end
+        # The emptiness of the scope's params is the same answer for every
+        # attribute in it, and answering it costs a +respond_to?+, so it is
+        # asked once for the whole list rather than once per attribute.
+        empty_val = empty?(val)
+        @attrs.each { |attr_name| yield val, attr_name, empty_val }
       end
 
       # Primitives like Integers and Booleans don't respond to +empty?+.

data/lib/grape/validations/types/array_coercer.rb

@@ -15,7 +15,9 @@ module Grape
         def initialize(type, strict: false)
           super
           @coercer = strict ? DryTypes::Strict::Array : DryTypes::Params::Array
-          @subtype = type.first
+          # Built eagerly: instances are shared across requests (and cached in
+          # Types::CoercerCache), so no lazy state may be created at call time.
+          @elem_coercer = DryTypeCoercer.coercer_instance_for(type.first, strict:)
         end
 
         def call(_val)
@@ -27,7 +29,7 @@ module Grape
 
         protected
 
-        attr_reader :subtype
+        attr_reader :elem_coercer
 
         def coerce_elements(collection)
           return if collection.nil?
@@ -50,10 +52,6 @@ module Grape
         def reject?(val)
           val.nil?
         end
-
-        def elem_coercer
-          @elem_coercer ||= DryTypeCoercer.coercer_instance_for(subtype, strict:)
-        end
       end
     end
   end

data/lib/grape/validations/types/custom_type_coercer.rb

@@ -33,6 +33,8 @@ module Grape
       # contract as +coerced?+, and must be supplied with a coercion
       # +method+.
       class CustomTypeCoercer
+        extend Grape::Util::FreezeOnNew
+
         TYPE_CHECK_METHODS = %i[coerced? parsed?].freeze
         COLLECTION_TYPES = [Array, Set].freeze
         private_constant :TYPE_CHECK_METHODS, :COLLECTION_TYPES
@@ -88,8 +90,12 @@ module Grape
           ->(val) { method.call(val).deep_symbolize_keys }
         end
 
+        # +dup+ before +map!+: the collection is whatever the user's coercion
+        # method returned — possibly frozen, possibly the input itself — so we
+        # must not mutate it in place. +dup+ also preserves the class, keeping a
+        # +Set+ a +Set+ (unlike +map+, which would return an +Array+).
         def collection_symbolizer(method)
-          ->(val) { method.call(val).map! { |item| symbolize_if_hash(item) } }
+          ->(val) { method.call(val).dup.map! { |item| symbolize_if_hash(item) } }
         end
 
         def symbolize_if_hash(item)

data/lib/grape/validations/types/dry_type_coercer.rb

@@ -8,6 +8,8 @@ module Grape
       # but check its type. More information there
       # https://dry-rb.org/gems/dry-types/main/built-in-types/
       class DryTypeCoercer
+        extend Grape::Util::FreezeOnNew
+
         class << self
           # Returns a collection coercer which corresponds to a given type.
           # Example:
@@ -21,7 +23,7 @@ module Grape
             when Set
               SetCoercer
             else
-              raise ArgumentError, "Unknown type: #{type}"
+              raise ArgumentError, "unknown type: `#{type}`"
             end
           end
 

data/lib/grape/validations/types/json.rb

@@ -17,9 +17,7 @@ module Grape
           # @return [Hash,Array<Hash>,nil]
           def parse(input)
             return input if parsed?(input)
-
-            # Allow nulls and blank strings
-            return if input.nil? || input.match?(/^\s*$/)
+            return if input.blank?
 
             JSON.parse(input, symbolize_names: true)
           end

data/lib/grape/validations/types/multiple_type_coercer.rb

@@ -13,6 +13,8 @@ module Grape
       # an allowed type it should be declared last, since it will always
       # successfully "coerce" the value.
       class MultipleTypeCoercer
+        extend Grape::Util::FreezeOnNew
+
         # Construct a new coercer that will attempt to coerce
         # values to the given list of types in the given order.
         #
@@ -28,7 +30,7 @@ module Grape
             else
               Types.build_coercer type, strict: !@method.nil?
             end
-          end
+          end.freeze
         end
 
         # Coerces the given value.
@@ -39,12 +41,12 @@ module Grape
         #   of {InvalidValue} if the value could not be coerced.
         def call(val)
           # once the value is coerced by the custom method, its type should be checked
-          val = @method.call(val) if @method
+          candidate = @method ? @method.call(val) : val
 
           coerced_val = InvalidValue.new
 
           @type_coercers.each do |coercer|
-            coerced_val = coercer.call(val)
+            coerced_val = coercer.call(candidate)
 
             return coerced_val unless coerced_val.is_a?(InvalidValue)
           end