grape 4.0.0 → 4.1.0

data/lib/grape/validations/types/dry_type_coercer.rb

@@ -14,17 +14,13 @@ module Grape
           # Returns a collection coercer which corresponds to a given type.
           # Example:
           #
-          #    collection_coercer_for(Array)
+          #    collection_coercer_for([Integer])
           #    #=> Grape::Validations::Types::ArrayCoercer
           def collection_coercer_for(type)
-            case type
-            when Array
-              ArrayCoercer
-            when Set
-              SetCoercer
-            else
-              raise ArgumentError, "unknown type: `#{type}`"
-            end
+            return ArrayCoercer if type.is_a?(Array)
+            return SetCoercer if type.is_a?(Set)
+
+            raise ArgumentError, "unknown type: `#{type}`"
           end
 
           # Returns an instance of a coercer for a given type
@@ -43,13 +39,25 @@ module Grape
         # Coerces the given value to a type which was specified during
         # initialization as a type argument.
         #
+        # Given a block, dry-types reports a value it cannot coerce by calling
+        # the block instead of raising. Raising is what cost: its CoercionError
+        # is re-raised with the backtrace of the error underneath, and building
+        # that backtrace as strings at request depth took about 25 µs for every
+        # rejected value -- every `types: [Integer, String]` param given a
+        # string, every 400 for a mistyped value.
+        #
+        # Every coercion dry-types runs takes that block, so none of them
+        # raises a CoercionError here. Anything that raises something else --
+        # +Kernel#String+, which +Coercible::String+ is built from, ignores the
+        # block and raises TypeError -- is answered by
+        # +CoerceValidator#coerce_value+, which rescues StandardError with the
+        # same InvalidValue.
+        #
         # @param val [Object]
         def call(val)
           return if val.nil?
 
-          @coercer[val]
-        rescue Dry::Types::CoercionError
-          InvalidValue.new
+          @coercer.call(val) { InvalidValue.new }
         end
 
         protected

data/lib/grape/validations/types/multiple_type_coercer.rb

@@ -35,8 +35,7 @@ module Grape
 
         # Coerces the given value.
         #
-        # @param val [String] value to be coerced, in grape
-        #   this should always be a string.
+        # @param val [Object] value to be coerced
         # @return [Object,InvalidValue] the coerced result, or an instance
         #   of {InvalidValue} if the value could not be coerced.
         def call(val)

data/lib/grape/validations/types/primitive_coercer.rb

@@ -19,9 +19,16 @@ module Grape
           @coercer = cache_coercer[type]
           @rejected_inputs = REJECTED_INPUTS[type]
           @treat_empty_as_nil = type != String
+          @integer = type == Integer
         end
 
         def call(val)
+          # A value already of the declared type is what the dry-types coercer
+          # hands back for it -- the very same object, in both the params and
+          # the strict cache -- so the round trip through it only costs time.
+          # +instance_of?+ rather than +is_a?+: a subclass is not covered by
+          # that, and Coercible::String does rebuild one.
+          return val if val.instance_of?(@type)
           return InvalidValue.new if reject?(val)
           return if val.nil? || treat_as_nil?(val)
 
@@ -37,11 +44,21 @@ module Grape
         # but Virtus wouldn't accept it. So, this method only exists to not introduce
         # breaking changes.
         def reject?(val)
+          return fractional?(val) if @integer
           return false unless @rejected_inputs
 
           @rejected_inputs.any? { |klass| val.is_a?(klass) }
         end
 
+        # dry-types turns a number into an Integer with Kernel#Integer, which
+        # truncates, so a JSON body's 2.99 became 2 while the same value in a
+        # query string, "2.99", was rejected. A number with a fractional part
+        # is refused instead; a whole one such as 1.0 still becomes 1. Complex
+        # numbers have no fractional part to test and are left to dry-types.
+        def fractional?(val)
+          val.is_a?(Numeric) && val.real? && !(val % 1).zero?
+        end
+
         # Dry-Types treats an empty string as invalid. However, Grape considers an empty string as
         # absence of a value and coerces it into nil. See a discussion there
         # https://github.com/ruby-grape/grape/pull/2045

data/lib/grape/validations/types/variant_collection_coercer.rb

@@ -41,23 +41,37 @@ module Grape
 
         # Coerce the given value.
         #
+        # A value that is not an Array, and an Array holding a member none of
+        # the types accepts, are invalid, as they are for a collection of one
+        # type. A coercion method is handed the value whatever it is, as it is
+        # for +types:+, so it can build the collection out of a String.
+        #
         # @param value [Array<String>] collection of values to be coerced
-        # @return [Array<Object>,Set<Object>,InvalidValue]
-        #   the coerced result, or an instance
-        #   of {InvalidValue} if the value could not be coerced.
+        # @return [Array<Object>,Set<Object>,InvalidValue,nil]
+        #   the coerced result, nil when the value is nil or an empty String,
+        #   or an instance of {InvalidValue} if the value could not be coerced.
         def call(value)
-          return unless value.is_a? Array
+          return if value.nil? || (value.is_a?(String) && value.empty?)
 
-          coerced =
-            if @method
-              @method.call(value)
-            else
-              value.map { |v| @member_coercer.call(v) }
-            end
+          coerced = @method ? @method.call(value) : coerce_members(value)
+          return coerced if coerced.is_a?(InvalidValue)
           return Set.new coerced if @types.is_a? Set
 
           coerced
         end
+
+        private
+
+        def coerce_members(value)
+          return InvalidValue.new unless value.is_a?(Array)
+
+          value.map do |member|
+            coerced = @member_coercer.call(member)
+            return coerced if coerced.is_a?(InvalidValue)
+
+            coerced
+          end
+        end
       end
     end
   end

data/lib/grape/validations/types.rb

@@ -9,8 +9,8 @@ module Grape
     # Grape uses a number of tests and assertions to
     # work out exactly how a parameter should be handled,
     # based on the +type+ and +coerce_with+ options that
-    # may be supplied to {Grape::Dsl::Parameters#requires}
-    # and {Grape::Dsl::Parameters#optional}. The main
+    # may be supplied to {Grape::DSL::Parameters#requires}
+    # and {Grape::DSL::Parameters#optional}. The main
     # entry point for this process is {Types.build_coercer}.
     module Types
       module_function
@@ -112,11 +112,10 @@ module Grape
           type.respond_to?(:parse) && type.method(:parse).arity == 1
       end
 
-      # Is the declared type an +Array+ or +Set+ of a {#custom?} type?
+      # Is the declared type an +Array+ or +Set+ of a {#custom?} or {#special?} type?
       #
       # @param type [Array<Class>,Class] type to check
-      # @return [Boolean] true if +type+ is a collection of a type that implements
-      #   its own +#parse+ method.
+      # @return [Boolean] true if +type+ is a one-element collection of such a type
       def collection_of_custom?(type)
         array_or_set?(type) && type.length == 1 && (custom?(type.first) || special?(type.first))
       end
@@ -131,26 +130,21 @@ module Grape
       #
       # There are a few very special coercers which might be returned.
       #
-      # +Grape::Types::MultipleTypeCoercer+ is a coercer which is returned when
-      # the given type implies values in an array with different types.
-      # For example, +[Integer, String]+ allows integer and string values in
-      # an array.
+      # +MultipleTypeCoercer+ is returned for a value that may be one of
+      # several types, e.g. +types: [Integer, String]+.
       #
-      # +Grape::Types::CustomTypeCoercer+ is a coercer which is returned when
-      # a method is specified by a user with +coerce_with+ option or the user
-      # specifies a custom type which implements requirments of
-      # +Grape::Types::CustomTypeCoercer+.
+      # +CustomTypeCoercer+ is returned for a +coerce_with+ method or a type
+      # with its own +parse+ (see {#custom?}).
       #
-      # +Grape::Types::CustomTypeCollectionCoercer+ is a very similar to the
-      # previous one, but it expects an array or set of values having a custom
-      # type implemented by the user.
+      # +CustomTypeCollectionCoercer+ is returned for an array or set of such
+      # a type (see {#collection_of_custom?}).
       #
       # There is also a group of custom types implemented by Grape, check
       # +Grape::Validations::Types::SPECIAL+ to get the full list.
       #
-      # @param type [Class] the type to which input strings
-      #   should be coerced
+      # @param type [Class] the type to which input values should be coerced
       # @param method [Class,#call] the coercion method to use
+      # @param strict [Boolean] check the type rather than coerce
       # @return [Object] object to be used
       #   for coercion and type validation
       def build_coercer(type, method: nil, strict: false)

data/lib/grape/validations/validations_spec.rb

@@ -9,9 +9,8 @@ module Grape
     #
     # Splits the raw entries into three logical buckets:
     #
-    # * Spec-consumed keys (type/types/coerce*, presence/message,
-    #   default/fail_fast, doc keys) — exposed via named accessors and never
-    #   handed to validator dispatch.
+    # * Spec-consumed keys (type/types/coerce*, presence/message, fail_fast,
+    #   doc keys) — never handed to validator dispatch.
     # * Shared opts (allow_blank, fail_fast) — read by every validator at
     #   construction time via {#shared_opts}.
     # * Validator entries (everything else, e.g. +regexp+, +length+, +values+,
@@ -33,6 +32,9 @@ module Grape
         desc description documentation
       ].freeze
 
+      BOOLEAN_VALUES = [true, false].freeze
+      private_constant :BOOLEAN_VALUES
+
       attr_reader :raw, :coerce_type, :coerce_method, :coerce_message, :presence_options, :values, :except_values, :default, :allow_blank, :fail_fast, :shared_opts, :validator_entries
 
       def self.from(validations)
@@ -44,15 +46,11 @@ module Grape
 
         @raw = raw
         @coerce_type, @coerce_message, @coerce_method = parse_coerce(raw)
-        @values = resolve_value(raw[:values])
-        @except_values = resolve_value(raw[:except_values])
-        @default = raw[:default]
+        read_values(raw)
         @presence_options = raw[:presence]
-        @allow_blank = resolve_value(raw[:allow_blank])
-        @fail_fast = raw[:fail_fast] || false
+        read_shared_opts(raw)
 
         @guessed_coerce_type = guess_coerce_type(declared_coerce_type, @values, @except_values)
-        @shared_opts = { allow_blank: @allow_blank, fail_fast: @fail_fast }.freeze
         @validator_entries = build_validator_entries(raw)
 
         validate!
@@ -70,6 +68,20 @@ module Grape
 
       private
 
+      # The values the declaration accepts, rejects and defaults to.
+      def read_values(raw)
+        @values = resolve_value(raw[:values])
+        @except_values = resolve_value(raw[:except_values])
+        @default = raw[:default]
+      end
+
+      # What every validator of the declaration reads (see #shared_opts).
+      def read_shared_opts(raw)
+        @allow_blank = resolve_value(raw[:allow_blank])
+        @fail_fast = raw[:fail_fast] || false
+        @shared_opts = { allow_blank: @allow_blank, fail_fast: @fail_fast }.freeze
+      end
+
       # Cross-field consistency checks on the parsed declaration. Run at
       # construction so an incoherent spec (e.g. a +default+ outside +values+,
       # or +values+ whose elements don't match +type+) can never exist —
@@ -87,11 +99,25 @@ module Grape
       def check_incompatible_option_values(default, values, except_values)
         return if default.nil? || default.is_a?(Proc)
 
-        raise Grape::Exceptions::IncompatibleOptionValues.new(:default, default, :values, values) if values && !values.is_a?(Proc) && Array(default).any? { |def_val| !values.include?(def_val) }
+        defaults = Array(default)
+        raise Grape::Exceptions::IncompatibleOptionValues.new(:default, default, :values, values) if any_outside?(defaults, values)
+        raise Grape::Exceptions::IncompatibleOptionValues.new(:default, default, :except, except_values) if any_among?(defaults, except_values)
+      end
+
+      # Whether one of +defaults+ is outside +values+, known now (see #fixed_values?).
+      def any_outside?(defaults, values)
+        fixed_values?(values) && defaults.any? { |default| !values.include?(default) }
+      end
 
-        return unless except_values && !except_values.is_a?(Proc) && Array(default).any? { |def_val| except_values.include?(def_val) }
+      # Whether one of +defaults+ is among +values+, known now (see #fixed_values?).
+      def any_among?(defaults, values)
+        fixed_values?(values) && defaults.any? { |default| values.include?(default) }
+      end
 
-        raise Grape::Exceptions::IncompatibleOptionValues.new(:default, default, :except, except_values)
+      # A +values+ or +except_values+ list known at definition time: given,
+      # and not a Proc called on every request.
+      def fixed_values?(values)
+        values && !values.is_a?(Proc)
       end
 
       def validate_value_coercion(coerce_type, *values_list)
@@ -99,14 +125,19 @@ module Grape
 
         element_type = coerce_type.is_a?(Enumerable) ? coerce_type.first : coerce_type
         values_list.each do |values|
-          next if !values || values.is_a?(Proc)
+          next unless fixed_values?(values)
 
           value_types = values.is_a?(Range) ? [values.begin, values.end].compact : values
-          value_types = value_types.map { |type| Grape::API::Boolean.build(type) } if element_type == Grape::API::Boolean
-          raise Grape::Exceptions::IncompatibleOptionValues.new(:type, element_type, :values, values) unless value_types.all?(element_type)
+          raise Grape::Exceptions::IncompatibleOptionValues.new(:type, element_type, :values, values) unless all_of_type?(value_types, element_type)
         end
       end
 
+      def all_of_type?(values, type)
+        return values.all? { |value| BOOLEAN_VALUES.include?(value) } if type == Grape::API::Boolean
+
+        values.all?(type)
+      end
+
       def build_validator_entries(raw)
         raw.reject do |k, _|
           SPEC_CONSUMED_KEYS.include?(k) || ParamsScope::RESERVED_DOCUMENTATION_KEYWORDS.include?(k)
@@ -114,17 +145,15 @@ module Grape
       end
 
       def parse_coerce(raw)
+        coerce_with = raw[:coerce_with]
         if raw.key?(:type)
           coerce, coerce_message = extract_value_and_message(raw[:type])
-          coerce_with = raw[:coerce_with]
           return [Types::VariantCollectionCoercer.new(coerce, coerce_with), coerce_message, nil] if Types.multiple?(coerce)
         elsif raw.key?(:types)
           coerce, coerce_message = extract_value_and_message(raw[:types])
-          coerce_with = raw[:coerce_with]
         else
-          coerce = raw[:coerce]
-          coerce_message = raw[:coerce_message]
-          coerce_with = raw[:coerce_with]
+          coerce, message = extract_value_and_message(raw[:coerce])
+          coerce_message = raw[:coerce_message] || message
         end
 
         [coerce, coerce_message, coerce_with]
@@ -154,8 +183,10 @@ module Grape
         return coerce_type unless coerce_type == Array
 
         values_list.each do |values|
-          next if !values || values.is_a?(Proc)
-          return values.first.class if values.is_a?(Range) || !values.empty?
+          next unless fixed_values?(values)
+          # A beginless Range has no first element to ask.
+          return (values.begin || values.end).class if values.is_a?(Range)
+          return values.first.class unless values.empty?
         end
         coerce_type
       end

data/lib/grape/validations/validators/allow_blank_validator.rb

@@ -14,8 +14,8 @@ module Grape
         def validate_param!(attr_name, params)
           return if @value || !hash_like?(params)
 
-          value = scrub(params[attr_name])
-          return if value == false || value.present?
+          value = params[attr_name]
+          return if value == false || !Grape::Util::Scrub.blank?(value)
 
           validation_error!(attr_name)
         end

data/lib/grape/validations/validators/as_validator.rb

@@ -4,9 +4,8 @@ module Grape
   module Validations
     module Validators
       class AsValidator < Base
-        # We use a validator for renaming parameters. This is just a marker for
-        # the parameter scope to handle the renaming. No actual validation
-        # happens here.
+        # Never dispatched: +as:+ renaming is handled by ParamsScope. No
+        # validation happens here.
         def validate_param!(*); end
       end
     end

data/lib/grape/validations/validators/base.rb

@@ -7,10 +7,10 @@ module Grape
       #
       # == Freeze contract
       # Validator instances are shared across requests and are frozen after
-      # initialization (via +.new+). All inputs (+options+, +opts+, +attrs+)
-      # arrive pre-frozen from the DSL boundary, so subclass ivars derived
-      # from them are frozen by construction. Lazy ivar assignment
-      # (e.g. +memoize+, <tt>||=</tt>) will raise +FrozenError+ at request time.
+      # initialization (via +.new+). #initialize freezes +attrs+ and
+      # deep-freezes +options+, so subclass ivars derived from them are frozen
+      # by construction. Lazy ivar assignment (e.g. +memoize+, <tt>||=</tt>)
+      # will raise +FrozenError+ at request time.
       class Base
         extend Forwardable
         extend Grape::Util::FreezeOnNew
@@ -68,7 +68,8 @@ module Grape
           @scope = scope
           @opts = SharedOptions.new(**opts.slice(:allow_blank, :fail_fast))
           @exception_message = message(self.class.default_message_key) if self.class.default_message_key
-          @iterator = iterator_class.new(@attrs, @scope).freeze
+          @iterator = AttributesIterator.new(@scope).freeze
+          choose_validation_path(scope)
         end
 
         # Validates a given request.
@@ -78,7 +79,7 @@ module Grape
         # @return [void]
         def validate(request)
           params = request.params
-          return unless scope.should_validate?(params)
+          return unless @always_validated || scope.should_validate?(params)
 
           validate!(params)
         end
@@ -90,20 +91,12 @@ module Grape
         # @raise [Grape::Exceptions::Validation] if validation failed
         # @return [void]
         def validate!(params)
-          # we collect errors inside array because
-          # there may be more than one error per field
-          array_errors = nil
+          return validate_elements!(scope.params(params)) if @direct_elements
 
-          @iterator.each(params) do |val, attr_name, empty_val|
-            next if !scope.required? && empty_val
-            next unless scope.meets_dependency?(val, params)
+          scoped = scope.params(params) if @direct
+          return validate_attributes!(scoped) if scoped.is_a?(Hash)
 
-            validate_param!(attr_name, val) if required? || (hash_like?(val) && val.key?(attr_name))
-          rescue Grape::Exceptions::Validation => e
-            (array_errors ||= []) << e
-          end
-
-          raise Grape::Exceptions::ValidationArrayErrors.new(array_errors) if array_errors
+          validate_iterated!(params)
         end
 
         protected
@@ -123,10 +116,117 @@ module Grape
 
         alias required? required
 
-        # The AttributesIterator subclass used to walk this validator's
-        # attributes. Built once in #initialize and reused across requests.
-        def iterator_class
-          SingleAttributeIterator
+        # A scope's parent, optionality, dependency and type are all set
+        # before its block declares anything, so these are settled by the
+        # time a validator is built. See #validate and #validate!.
+        def choose_validation_path(scope)
+          @always_validated = scope.always_validated?
+          @direct = @always_validated && !scope.iterates_elements?
+          @direct_elements = scope.validated_when_given? && scope.iterates_elements? && scope.array_depth == 1
+        end
+
+        # #validate! on a scope that always validates and does not iterate
+        # elements, once its params resolved to a Hash: the root scope and the
+        # required Hash scopes under it, which is most validators of most
+        # endpoints. There the iterator hands back that Hash alone, and every
+        # scope on the chain is required with no dependency, so the checks
+        # around the attribute loop drop out. The machinery cost more than
+        # the validation itself.
+        def validate_attributes!(params)
+          array_errors = nil
+
+          @attrs.each do |attr_name|
+            validate_param!(attr_name, params) if required? || params.key?(attr_name)
+          rescue Grape::Exceptions::Validation => e
+            (array_errors ||= []) << e
+          end
+
+          raise Grape::Exceptions::ValidationArrayErrors.new(array_errors) if array_errors
+        end
+
+        # #validate_attributes! for each element of an Array scope, such as
+        # +requires :items, type: Array do+ at the root, when it is the only
+        # scope on the chain that iterates elements: its params are then the
+        # request's Array as it came in, with no nesting for the iterator to
+        # descend into. It depends on no other param and every scope above it
+        # is always validated, so the iterator's per-element checks come down
+        # to the index it records for the error names and passing over the
+        # placeholder of an optional scope that was left out. An optional
+        # scope whose elements are all empty is passed over too, as the
+        # iterator does; otherwise an empty element was sent, and is validated
+        # like any other. An element that is not a Hash goes through the same
+        # +hash_like?+ test as on the iterator path, and the members of a scope
+        # that did not get an Array are left alone, as they are there: the
+        # scope's own type check reports it.
+        def validate_elements!(elements)
+          return unless elements.is_a?(Array)
+          return if passed_over_elements?(elements)
+
+          tracker = ParamScopeTracker.current
+          array_errors = nil
+
+          elements.each_with_index do |element, index|
+            tracker&.store_index(scope, index)
+            next if ParamsScope::EmptyOptionalValue.equal?(element)
+
+            array_errors = validate_element_attributes(element, array_errors)
+          end
+
+          raise Grape::Exceptions::ValidationArrayErrors.new(array_errors) if array_errors
+        end
+
+        # #validate! on every other scope: each value the iterator yields is
+        # validated, unless the scope passes it over or depends on a param it
+        # does not meet.
+        def validate_iterated!(params)
+          # we collect errors inside array because
+          # there may be more than one error per field
+          array_errors = nil
+
+          @iterator.each(params) do |val, element|
+            next if passed_over?(val, element)
+            next unless scope.meets_dependency?(val, params)
+
+            array_errors = validate_element_attributes(val, array_errors)
+          end
+
+          raise Grape::Exceptions::ValidationArrayErrors.new(array_errors) if array_errors
+        end
+
+        # Runs #validate_param! for each attribute +element+ holds, or for every
+        # one when they are required, and returns +array_errors+ with what
+        # failed appended, allocating it on the first failure.
+        def validate_element_attributes(element, array_errors)
+          @attrs.each do |attr_name|
+            validate_param!(attr_name, element) if required? || (hash_like?(element) && element.key?(attr_name))
+          rescue Grape::Exceptions::Validation => e
+            (array_errors ||= []) << e
+          end
+          array_errors
+        end
+
+        # Whether #validate! leaves +val+ alone: in an optional scope, an empty
+        # value that is not an element the request sent (see AttributesIterator).
+        def passed_over?(val, element)
+          !scope.required? && !element && empty_element?(val)
+        end
+
+        # Whether #validate_elements! leaves +elements+ alone: an optional
+        # scope's Array whose elements are all empty, as the iterator does.
+        def passed_over_elements?(elements)
+          !scope.required? && elements.all? { |element| empty_element?(element) }
+        end
+
+        # What an optional scope passes over: its params given empty in an
+        # element of an Array further up, or the placeholder +map_params+ puts
+        # where they were not given at all. The iterator drops that placeholder
+        # itself; #validate_elements! meets it when a scope above was handed an
+        # Array instead of a Hash. An empty element of the scope's own Array is
+        # passed over only when every element of that Array is empty.
+        def empty_element?(element)
+          return true if ParamsScope::EmptyOptionalValue.equal?(element)
+
+          element.respond_to?(:empty?) ? element.empty? : element.nil?
         end
 
         def validation_error!(attr_name_or_params, message = exception_message)
@@ -161,10 +261,9 @@ module Grape
           options_key?(:value) ? options[:value] : options
         end
 
+        # Listed among the helpers a custom validator can call (see README).
         def scrub(value)
-          return value if !value.respond_to?(:valid_encoding?) || value.valid_encoding?
-
-          value.scrub
+          Grape::Util::Scrub.scrub(value)
         end
       end
     end

data/lib/grape/validations/validators/coerce_validator.rb

@@ -11,8 +11,7 @@ module Grape
 
           @exception_message = options.message if options.message
 
-          raw_type = options.type
-          type = hash_like?(raw_type) ? raw_type[:value] : raw_type
+          type = options.type
           @converter =
             if type.is_a?(Grape::Validations::Types::VariantCollectionCoercer)
               type
@@ -35,7 +34,7 @@ module Grape
           validation_error!(attr_name, new_value.message || exception_message) if new_value.is_a?(Types::InvalidValue)
 
           # Don't assign a value if it is identical. It fixes a problem with Hashie::Mash
-          # which looses wrappers for hashes and arrays after reassigning values
+          # which loses wrappers for hashes and arrays after reassigning values
           #
           #     h = Hashie::Mash.new(list: [1, 2, 3, 4])
           #     => #<Hashie::Mash list=#<Hashie::Array [1, 2, 3, 4]>>

data/lib/grape/validations/validators/default_validator.rb

@@ -18,10 +18,26 @@ module Grape
         end
 
         def validate!(params)
-          @iterator.each(params) do |resource_params, attr_name|
+          scoped = scope.params(params) if @direct
+          return apply_defaults(scoped) if scoped.is_a?(Hash)
+
+          @iterator.each(params) do |resource_params|
             next unless scope.meets_dependency?(resource_params, params)
 
-            resource_params[attr_name] = @default_call.call(resource_params) if hash_like?(resource_params) && resource_params[attr_name].nil?
+            apply_defaults(resource_params) if hash_like?(resource_params)
+          end
+        end
+
+        private
+
+        # Also #validate!'s whole job where Base#validate_attributes! applies:
+        # a scope that is always validated and does not iterate elements, once
+        # its params resolved to a Hash -- the root scope of every +params+
+        # block with a default in it. A scope like that depends on no other
+        # param, so the iterator and its dependency check have nothing to add.
+        def apply_defaults(params)
+          @attrs.each do |attr_name|
+            params[attr_name] = @default_call.call(params) if params[attr_name].nil?
           end
         end
       end

data/lib/grape/validations/validators/except_values_validator.rb

@@ -13,14 +13,19 @@ module Grape
           raise ArgumentError, 'except_values Proc must have arity of zero (use values: with a one-arity predicate for per-element checks)' if except_proc && !except.arity.zero?
 
           # Zero-arity procs (e.g. -> { User.pluck(:role) }) must be called per-request,
-          # not at definition time, so they are wrapped in a lambda to defer execution.
-          @excepts_call = except_proc ? except : -> { except }
+          # not at definition time. Anything else is the collection itself, held
+          # as it came rather than behind a lambda that would only hand it back.
+          if except_proc
+            @excepts_call = except
+          else
+            @excepts = except
+          end
         end
 
         def validate_param!(attr_name, params)
           return unless hash_like?(params) && params.key?(attr_name)
 
-          excepts = @excepts_call.call
+          excepts = current_excepts
           return if excepts.nil?
 
           param_array = params[attr_name].nil? ? [nil] : Array.wrap(params[attr_name])
@@ -28,6 +33,14 @@ module Grape
 
           validation_error!(attr_name)
         end
+
+        private
+
+        # The values ruled out, asked of the Proc on every request when they
+        # come from one.
+        def current_excepts
+          @excepts_call ? @excepts_call.call : @excepts
+        end
       end
     end
   end