hamster-web 0.1.0.pre.2

data/lib/hamster/database/postgres.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+require "socket"
+require "securerandom"
+require "digest"
+require_relative "../data"
+
+if RUBY_ENGINE == "ruby"
+  require "openssl"
+  require "pg/client"
+else
+  require "pg"
+end
+
+module Hamster
+  class Database
+    class Postgres
+      def self.connect(configuration)
+        if RUBY_ENGINE == "ruby"
+          transport = RubyTransport.new(configuration.host, configuration.port)
+          connection = PgClientCore.new(transport, configuration.username, configuration.database,
+                                        configuration.password, SecureRandom.urlsafe_base64(18))
+          connection.connect!
+          connection
+        else
+          PG.connect(configuration.host, configuration.port, configuration.database,
+                     configuration.username, configuration.password)
+        end
+      rescue PG::Error => error
+        raise ConnectionError.new("postgres connection failed", original: error,
+                                  sqlstate: sqlstate(error))
+      rescue StandardError => error
+        raise ConnectionError.new("postgres connection failed: #{error.message}", original: error)
+      end
+
+      def self.sqlstate(error)
+        error.result.error_field(PG::PG_DIAG_SQLSTATE)
+      rescue StandardError
+        nil
+      end
+
+      class RubyTransport
+        def initialize(host, port)
+          @socket = TCPSocket.new(host, port)
+        end
+
+        def write(data)
+          offset = 0
+          while offset < data.bytesize
+            offset += @socket.write(data.byteslice(offset, data.bytesize - offset))
+          end
+          offset
+        end
+
+        def read_some(max)
+          @socket.readpartial(max)
+        rescue EOFError
+          ""
+        end
+
+        def close
+          @socket.close unless @socket.closed?
+        end
+      end
+    end
+  end
+end

data/lib/hamster/database/result.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module Hamster
+  class Database
+    class Result
+      attr_reader :columns, :rows, :types, :command_tag
+
+      def initialize(columns:, rows:, types:, command_tag:)
+        @columns = columns
+        @rows = rows
+        @types = types
+        @command_tag = command_tag
+      end
+
+      def each_row
+        return enum_for(:each_row) unless block_given?
+
+        rows.each { |row| yield row }
+      end
+
+      def hashes
+        rows.map do |row|
+          columns.each_with_index.each_with_object({}) do |(column, index), result|
+            result[column] = row[index]
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hamster/schema_validation.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+require_relative "data"
+
+module Hamster
+  module SchemaValidation
+    def self.run(database, tables = Table.registry)
+      database.with_connection { |connection| Read::Schema.validate(connection, tables) }
+    ensure
+      database.shutdown
+    end
+  end
+end

data/lib/hamster/web/action/base.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module Hamster
+  module Action
+    class Base
+      STATUSES = {ok: 200, see_other: 303, unauthorized: 401, forbidden: 403,
+                  not_found: 404, method_not_allowed: 405, unprocessable_entity: 422,
+                  upgrade_required: 426, service_unavailable: 503}.freeze
+      attr_reader :context
+
+      def self.status_code(status)
+        return status unless status.is_a?(Symbol)
+        STATUSES.fetch(status) { raise ArgumentError, "unknown HTTP status #{status.inspect}" }
+      end
+
+      def initialize(context)
+        @context = context
+      end
+
+      private
+
+      def respond(view: nil, body: nil, locals: {}, layout: "layouts/application",
+                  status: :ok, type: :html, headers: {})
+        raise ArgumentError, "respond requires exactly one of view: or body:" if view.nil? == body.nil?
+        raise ArgumentError, "respond locals: must be a Hash" unless locals.is_a?(Hash)
+        body = Hamster::View.render(view, locals, layout: layout) if view
+        Http.response(status, body, headers, type: type)
+      end
+
+      def redirect_to(path, cookie: nil)
+        Http.redirect(path, cookie: cookie)
+      end
+
+      def upgrade(handler)
+        [101, {"cache-control" => "no-store"}, handler]
+      end
+    end
+  end
+end

data/lib/hamster/web/application.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Hamster
+  class Application
+    attr_reader :database
+
+    def initialize(routes:, database: nil)
+      @router = Router.new(routes)
+      @database = database
+    end
+
+    def call(env)
+      return @router.call(env) unless database
+      database.with_connection { |connection| @router.call(env, connection) }
+    rescue StandardError
+      Http.response(500, "<!doctype html><title>Server error</title><h1>Server error</h1>")
+    end
+
+    def shutdown
+      database.shutdown if database
+    end
+  end
+end

data/lib/hamster/web/context.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module Hamster
+  class Context
+    attr_reader :env, :connection
+
+    def initialize(env, connection = nil)
+      @env = env
+      @connection = connection
+    end
+
+    def params
+      env.fetch("route_params", {})
+    end
+
+    def form
+      @form ||= Http.parse_parameters(env.fetch("rack.input").read.to_s)
+    end
+
+    def same_origin?
+      expected = "#{env.fetch('rack.url_scheme', 'http')}://#{env.fetch('HTTP_HOST', '')}"
+      env["HTTP_ORIGIN"] == expected
+    end
+  end
+end

data/lib/hamster/web/html.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+module Hamster
+  module HTML
+    ATTRIBUTE_NAME = /\A[a-z][a-z0-9_:-]*\z/
+    TAG_NAME = /\A[a-z][a-z0-9-]*\z/
+    URL_ATTRIBUTES = %w[href src action formaction].freeze
+    VOID_TAGS = %w[area base br col embed hr img input link meta param source track wbr].freeze
+
+    class Fragment
+      attr_reader :html
+
+      def initialize(html)
+        @html = html.to_s.freeze
+        freeze
+      end
+
+      def to_s
+        @html
+      end
+
+      def +(other)
+        Fragment.new(@html + HTML.escape(other).to_s)
+      end
+    end
+
+    module_function
+
+    def escape(value)
+      return value if value.instance_of?(Fragment)
+
+      Fragment.new(value.to_s.gsub("&", "&amp;").gsub("<", "&lt;").gsub(">", "&gt;")
+        .gsub('"', "&quot;").gsub("'", "&#39;"))
+    end
+
+    # Use only where a helper has built and reviewed safe markup from escaped values.
+    def raw_reviewed(html)
+      Fragment.new(html)
+    end
+
+    def join(parts)
+      Fragment.new(parts.map { |part| escape(part).to_s }.join)
+    end
+
+    def tag(name, content = nil, attributes = {})
+      name = name.to_s
+      raise ArgumentError, "invalid HTML tag" unless name.match?(TAG_NAME) && name != "script" && name != "style"
+
+      opening = "<#{name}#{attribute_text(attributes)}>"
+      return Fragment.new(opening) if VOID_TAGS.include?(name) && content.nil?
+      raise ArgumentError, "#{name} cannot contain content" if VOID_TAGS.include?(name)
+
+      Fragment.new("#{opening}#{escape(content)}</#{name}>")
+    end
+
+    def link_to(content, url, attributes = {})
+      raise ArgumentError, "link attributes cannot include href" if attributes.keys.any? { |key| key.to_s == "href" }
+
+      tag(:a, content, attributes.merge(href: url))
+    end
+
+    def attribute_text(attributes)
+      attributes.map do |key, value|
+        name = key.to_s.tr("_", "-")
+        if name == "data" || name == "aria"
+          raise ArgumentError, "#{name} must be a hash" unless value.instance_of?(Hash)
+          value.map { |nested, nested_value| attribute_text("#{name}-#{nested}" => nested_value) }.join
+        else
+          raise ArgumentError, "invalid HTML attribute #{name}" unless name.match?(ATTRIBUTE_NAME)
+          raise ArgumentError, "unsafe HTML attribute #{name}" if name.start_with?("on") || name == "style" || name == "srcdoc"
+          next "" if value.nil? || value == false
+          next " #{name}" if value == true
+
+          View.validate_url!(value, "tag", 1) if URL_ATTRIBUTES.include?(name)
+          " #{name}=\"#{escape(value.to_s)}\""
+        end
+      end.join
+    end
+  end
+end

data/lib/hamster/web/http.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+module Hamster
+  module Http
+    MIME = {html: "text/html; charset=utf-8", turbo: "text/html; charset=utf-8",
+            turbo_stream: "text/vnd.turbo-stream.html; charset=utf-8"}.freeze
+    module_function
+
+    def parse_parameters(encoded)
+      encoded.split("&").each_with_object({}) do |part, values|
+        key, value = part.split("=", 2)
+        values[decode(key)] = decode(value.to_s)
+      end
+    end
+
+    def decode(value)
+      value.to_s.gsub("+", " ").gsub(/%([0-9A-Fa-f]{2})/) { [$1.to_i(16)].pack("C") }.force_encoding("UTF-8")
+    end
+
+    def response(status, body, headers = {}, type: :html)
+      content_type = MIME.fetch(type) { raise ArgumentError, "unknown response type #{type.inspect}" }
+      status = Action::Base.status_code(status)
+      defaults = {"content-type" => content_type, "cache-control" => "no-store"}
+      defaults["vary"] = "Accept, Turbo-Frame" if type != :html
+      [status, defaults.merge(headers), [body.to_s]]
+    end
+
+    def redirect(path, cookie: nil)
+      headers = {"location" => path, "cache-control" => "no-store"}
+      headers["set-cookie"] = cookie if cookie
+      [303, headers, [""]]
+    end
+  end
+end

data/lib/hamster/web/instrumentation.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module Hamster
+  # The web runtime works without a telemetry backend. The telemetry entry point
+  # can replace this boundary while preserving the instrumented block's result.
+  module Instrumentation
+    SQL_OPERATIONS = %w[SELECT INSERT UPDATE DELETE BEGIN COMMIT ROLLBACK CREATE ALTER DROP TRUNCATE WITH SAVEPOINT RELEASE].freeze
+
+    def self.sql_operation(sql)
+      operation = sql.lstrip.split(/\s+/, 2).first.to_s.upcase
+      SQL_OPERATIONS.include?(operation) ? operation : "OTHER"
+    end
+
+    def self.diagnostic
+      $stderr.write("HAMSTER_TELEMETRY_FAILED\n")
+    rescue StandardError
+      nil
+    end
+
+    def self.instrument(name, attributes: {}, kind: "internal")
+      yield({})
+    end
+
+    def self.record(name, operation)
+      instrument("record.#{operation}", attributes: {"record.name" => name}) { yield }
+    end
+  end
+end

data/lib/hamster/web/router.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module Hamster
+  class Router
+    NOT_FOUND = "<!doctype html><title>Not found</title><h1>Not found</h1>".freeze
+    METHOD_NOT_ALLOWED = "<!doctype html><title>Method not allowed</title><h1>Method not allowed</h1>".freeze
+
+    def initialize(mapping)
+      @routes = mapping.routes
+    end
+
+    def call(env, connection = nil)
+      method = env.fetch("REQUEST_METHOD", "GET").upcase
+      path = env.fetch("PATH_INFO", "/")
+      route = @routes.find { |candidate| candidate.match(method, path) }
+      unless route
+        allowed = @routes.select { |candidate| candidate.match(method, path, method_only: true) }
+        return Http.response(:method_not_allowed, METHOD_NOT_ALLOWED,
+                             {"allow" => allowed.map(&:method).uniq.join(", ")}) unless allowed.empty?
+        return Http.response(:not_found, NOT_FOUND)
+      end
+
+      env["route_params"] = route.match(method, path)
+      route.action.new(Context.new(env, connection)).call
+    end
+  end
+end

data/lib/hamster/web/routing/base.rb

@@ -0,0 +1,131 @@
+# frozen_string_literal: true
+
+module Hamster
+  module Routing
+    class Route
+      attr_reader :name, :method, :pattern, :action
+
+      def initialize(name, method, pattern, action)
+        @name, @method, @pattern, @action = name, method, pattern, action
+        @segments = pattern.split("/").reject(&:empty?)
+      end
+
+      def match(request_method, path, method_only: false)
+        return nil unless method_only || method == request_method
+
+        path_segments = path.split("/").reject(&:empty?)
+        return nil unless path_segments.length == @segments.length
+
+        params = {}
+        @segments.zip(path_segments).each do |route_segment, path_segment|
+          if route_segment.start_with?(":")
+            return nil if route_segment == ":id" && !path_segment.match?(/\A[0-9]+\z/)
+            params[route_segment.delete_prefix(":")] = path_segment
+          elsif route_segment != path_segment
+            return nil
+          end
+        end
+        params
+      end
+
+      def path(params = {}, query: {}, **keywords)
+        params = params.merge(keywords)
+        required = @segments.select { |segment| segment.start_with?(":") }.map { |segment| segment.delete_prefix(":") }
+        supplied = params.keys.map(&:to_s)
+        missing, extra = required - supplied, supplied - required
+        raise ArgumentError, "#{name}: missing path parameter #{missing.join(', ')}" unless missing.empty?
+        raise ArgumentError, "#{name}: unknown path parameter #{extra.join(', ')}" unless extra.empty?
+
+        segments = @segments.map do |segment|
+          next segment unless segment.start_with?(":")
+          key = segment.delete_prefix(":")
+          value = params.key?(key.to_sym) ? params[key.to_sym] : params[key]
+          raise ArgumentError, "#{name}: empty path parameter #{key}" if value.nil? || value.to_s.empty?
+          raise ArgumentError, "#{name}: #{key} must be numeric" if key == "id" && !value.to_s.match?(/\A[0-9]+\z/)
+          self.class.encode(value)
+        end
+        result = "/#{segments.join('/')}"
+        query.empty? ? result : "#{result}?#{query.map { |key, value| "#{self.class.encode(key)}=#{self.class.encode(value)}" }.join('&')}"
+      end
+
+      def self.encode(value)
+        value.to_s.bytes.map do |byte|
+          if (byte >= 65 && byte <= 90) || (byte >= 97 && byte <= 122) || (byte >= 48 && byte <= 57) || [45, 46, 95, 126].include?(byte)
+            byte.chr
+          else
+            "%#{byte.to_s(16).upcase.rjust(2, '0')}"
+          end
+        end.join
+      end
+    end
+
+    class Base
+      SUPPORTED_METHODS = %w[GET POST PATCH DELETE].freeze
+      CONVENTIONAL_ACTIONS = {"New" => "new", "Edit" => "edit", "Create" => "create", "Update" => "update", "Destroy" => "destroy"}.freeze
+
+      def self.routes
+        (@routes ||= []).dup.freeze
+      end
+
+      def self.get(path, to:, as: nil); add_route("GET", path, to, as); end
+      def self.post(path, to:, as: nil); add_route("POST", path, to, as); end
+      def self.patch(path, to:, as: nil); add_route("PATCH", path, to, as); end
+      def self.delete(path, to:, as: nil); add_route("DELETE", path, to, as); end
+
+      def self.namespace(name, &block)
+        raise ArgumentError, "namespace requires a block" unless block
+        segment = name.to_s
+        raise ArgumentError, "invalid namespace #{name.inspect}" unless segment.match?(/\A[a-z][a-z0-9_]*\z/)
+        scopes = @route_scopes ||= []
+        scopes << segment
+        block.call
+      ensure
+        scopes.pop if scopes && !scopes.empty?
+      end
+
+      def self.add_route(method, path, action, name)
+        raise ArgumentError, "unsupported HTTP method #{method}" unless SUPPORTED_METHODS.include?(method)
+        raise ArgumentError, "route path must be a literal absolute path" unless path.is_a?(String) && path.start_with?("/") && !path.include?("?")
+        raise ArgumentError, "route action must be a class" unless action.is_a?(Class)
+        route_table = @routes ||= []
+        prefix = (@route_scopes || []).join("_")
+        path_prefix = (@route_scopes || []).join("/")
+        path = "/#{path_prefix}#{path == "/" ? "" : path}" unless path_prefix.empty?
+        name = name || infer_name(method, path, action)
+        name = "#{prefix}_#{name}".to_sym unless prefix.empty?
+        raise ArgumentError, "route name must be a Symbol" unless name.is_a?(Symbol)
+        raise ArgumentError, "duplicate route name #{name}" if route_table.any? { |route| route.name == name }
+
+        route_table << Route.new(name, method, path, action)
+        route_table.last
+      end
+
+      def self.infer_name(method, path, action)
+        parts = path.split("/").reject(&:empty?)
+        return :root if parts.empty?
+        action_parts = action.name.to_s.split("::")
+        action_name = action_parts[-1] == "Action" ? action_parts[-2] : action_parts.last
+        resource = parts.find { |part| !part.start_with?(":") }
+        resource = resource.sub(/s\z/, "") if parts.any? { |part| part.start_with?(":") } || CONVENTIONAL_ACTIONS.key?(action_name)
+        conventional = CONVENTIONAL_ACTIONS[action_name]
+        return "#{conventional}_#{resource}".to_sym if conventional && resource
+        return resource.to_sym if method == "GET" && parts.length == 1 && !parts.first.start_with?(":")
+        return resource.to_sym if method == "GET" && parts.length == 2 && parts.last.start_with?(":")
+        container = action_name || "route"
+        container.gsub(/([a-z0-9])([A-Z])/, '\\1_\\2').downcase.to_sym
+      end
+
+      def self.path(name, params = {}, query: {}, **keywords)
+        route = routes.find { |candidate| candidate.name == name.to_sym }
+        raise ArgumentError, "unknown route #{name}" unless route
+        route.path(params, query: query, **keywords)
+      end
+
+      def self.url(name, params = {}, query: {}, base_url:, **keywords)
+        base = base_url.to_s.sub(%r{/+\z}, "")
+        raise ArgumentError, "base_url must be an absolute URL" unless base.match?(%r{\Ahttps?://[^/]+})
+        "#{base}#{path(name, params, query: query, **keywords)}"
+      end
+    end
+  end
+end

data/lib/hamster/web/version.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module Hamster
+  module Web
+    VERSION = "0.1.0.pre.2"
+  end
+end

data/lib/hamster/web/view/form.rb

@@ -0,0 +1,119 @@
+# frozen_string_literal: true
+
+module Hamster
+  module View
+    class Form
+      METHODS = %w[GET POST PATCH DELETE].freeze
+      FIELD = /\A[a-z][a-z0-9_]*\z/
+
+      def initialize(action:, method: "POST", csrf_token: nil, values: {}, errors: {}, namespace: nil)
+        @action = action.to_s
+        View.validate_url!(@action, "form", 1)
+        @method = method.to_s.upcase
+        raise ArgumentError, "unsupported form method #{@method}" unless METHODS.include?(@method)
+        if @method != "GET" && csrf_token.to_s.empty?
+          raise ArgumentError, "CSRF token is required for #{@method} forms"
+        end
+        @csrf_token = csrf_token
+        @values = values
+        @errors = errors
+        raise ArgumentError, "invalid form namespace" if namespace && !namespace.to_s.match?(FIELD)
+        @namespace = namespace
+      end
+
+      def start(attributes = {})
+        raise ArgumentError, "form attributes cannot override action or method" if attributes.keys.any? { |key| %w[action method].include?(key.to_s) }
+
+        form_attributes = {method: @method == "GET" ? "get" : "post", action: @action}.merge(attributes)
+        # The fixed form tag and validated attributes are safe to mark as HTML.
+        opening = HTML.raw_reviewed("<form#{HTML.attribute_text(form_attributes)}>")
+        return opening if @method == "GET"
+
+        fields = [opening, HTML.tag(:input, nil, type: "hidden", name: "csrf_token", value: @csrf_token)]
+        fields << HTML.tag(:input, nil, type: "hidden", name: "_method", value: @method) unless @method == "POST"
+        HTML.join(fields)
+      end
+
+      def text(name, attributes = {})
+        reject_value_attribute!(attributes)
+        type = attributes.fetch(:type, "text").to_s
+        field = field_attributes(name, attributes.merge(type: type))
+        field[:value] = value_for(name) unless type == "password"
+        HTML.tag(:input, nil, field)
+      end
+
+      def textarea(name, attributes = {})
+        reject_value_attribute!(attributes)
+        HTML.tag(:textarea, value_for(name), field_attributes(name, attributes))
+      end
+
+      def hidden(name, value: nil)
+        actual = value.nil? ? value_for(name) : value
+        HTML.tag(:input, nil, name: field_name(name), id: field_id(name), type: "hidden", value: actual)
+      end
+
+      def checkbox(name, value: "1", attributes: {})
+        reject_value_attribute!(attributes)
+        checked = value_for(name) == true || value_for(name).to_s == value.to_s
+        HTML.tag(:input, nil, field_attributes(name, attributes.merge(type: "checkbox", value: value, checked: checked)))
+      end
+
+      def select(name, options, attributes = {})
+        selected = value_for(name).to_s
+        choices = options.map do |label, value|
+          HTML.tag(:option, label, value: value, selected: value.to_s == selected)
+        end
+        HTML.tag(:select, HTML.join(choices), field_attributes(name, attributes))
+      end
+
+      def submit(label, attributes = {})
+        HTML.tag(:button, label, attributes.merge(type: "submit"))
+      end
+
+      def error(name)
+        message = error_for(name)
+        return HTML.join([]) if message.nil? || message.to_s.empty?
+
+        HTML.tag(:p, message, id: "#{field_id(name)}-error", class: "error", role: "alert")
+      end
+
+      def field_id(name)
+        base = field_name(name).tr("_", "-")
+        @namespace ? "#{@namespace}-#{base}" : base
+      end
+
+      private
+
+      def field_name(name)
+        text = name.to_s
+        raise ArgumentError, "invalid form field #{text}" unless text.match?(FIELD)
+
+        text
+      end
+
+      def field_attributes(name, attributes)
+        raise ArgumentError, "field attributes cannot override name or id" if attributes.keys.any? { |key| %w[name id].include?(key.to_s) }
+
+        field = {name: field_name(name), id: field_id(name)}.merge(attributes)
+        message = error_for(name)
+        unless message.nil? || message.to_s.empty?
+          aria = attributes.fetch(:aria, {}).merge(invalid: "true", describedby: "#{field_id(name)}-error")
+          field[:aria] = aria
+        end
+        field
+      end
+
+      def value_for(name)
+        @values.key?(name.to_sym) ? @values[name.to_sym] : @values[name.to_s]
+      end
+
+      def error_for(name)
+        @errors.key?(name.to_sym) ? @errors[name.to_sym] : @errors[name.to_s]
+      end
+
+      def reject_value_attribute!(attributes)
+        raise ArgumentError, "pass form values to Form.new" if attributes.keys.any? { |key| key.to_s == "value" }
+      end
+    end
+  end
+end