hanami-controller 2.3.0.beta2 → 2.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 194fc2615c1034ce507513f72e4f218a45fafe60ad53823e0b04e07cae0469f6
-  data.tar.gz: fff5370bd197844f24e83d88490a950fac8cb44c1683c489da94cbb8b5d92402
+  metadata.gz: 58ef38ac204ec7e5940d6fec35a08d82d0d56cf14dcc38d04ca4ccbaaa4fa5b1
+  data.tar.gz: 63ced9248a7253f22b4b781f00a2c25cedf182297d9b9a2829304c7366674315
 SHA512:
-  metadata.gz: f61ceab1aba8a83b459e1c07698802f45fc27f5852454578a4cb135cf520bcf6c12a9a70ae90763dbdb0f1e0dde927da3eb67f071045344c44bb32bc86c8981a
-  data.tar.gz: f2d5905a9d93d09b4a328dbc27d564226293f89a54bb23155b5bd2ececfece6fe768a58d9e3473a228659e790c83018ee90b9f0b1ce1d783bba82679351abc1c
+  metadata.gz: 5b2e5966dbb034f812dde17d173a4faf7ad514e0343f4ad81a8adfc8054ec95285f09f1b494d6d278bfef286eebfa32413a75fd3cc489db13b68bc6cb6a8c26a
+  data.tar.gz: ee83b4b9f13357dc222524af57ddd095daa29aed1d6768a1053b48ebbb35de3d00644b1e861e79e6f984c56eda707e9dd5f838053737114204b6c2d0765d4edd

data/CHANGELOG.md

@@ -2,6 +2,32 @@
 
 Complete, fast and testable actions for Rack
 
+## v2.3.0 - 2025-11-12
+
+### Added
+
+- Fetch CSRF tokens from `X-CSRF-Token` request header, in addition to body params. (@masterT in #422)
+
+### Changed
+
+- Allow `config.handle_exception` to receive an exception class name as a string. (@mathewdbutton in #488)
+
+  This allows you to handle exceptions in your actions without having to require the Ruby files that define the exception constants, which is often awkward if those exceptions come from far-removed layers of your app.
+
+  ```ruby
+  class MyAction < Hanami::Action
+    config.handle_exception "ROM::TupleCountMismatchError" => 404
+  end
+  ```
+- Allow both `:unprocessable_entity` and `:unprocessable_content` and  to be used to refer to the 422 HTTP status code (Rack v3 dropped the former and replaced it with the latter). (@alassek in #490)
+
+  ```ruby
+  def handle(request, response)
+    # Or :unprocessable_content, both work, on all Rack versions
+    response.status = :unprocessable_entity
+  end
+  ```
+
 ## v2.3.0.beta2 - 2025-10-17
 
 ### Added

data/README.md

@@ -5,9 +5,8 @@ Complete, fast, and testable actions for Rack and [Hanami](http://hanamirb.org)
 ## Status
 
 [![Gem Version](https://badge.fury.io/rb/hanami-controller.svg)](https://badge.fury.io/rb/hanami-controller)
-[![CI](https://github.com/hanami/controller/actions/workflows/ci.yml/badge.svg)](https://github.com/hanami/controller/actions?query=workflow%3Aci+branch%3Amain)
-[![Test Coverage](https://codecov.io/gh/hanami/controller/branch/main/graph/badge.svg)](https://codecov.io/gh/hanami/controller)
-[![Depfu](https://badges.depfu.com/badges/7cd17419fba78b726be1353118fb01de/overview.svg)](https://depfu.com/github/hanami/controller?project=Bundler)
+[![CI](https://github.com/hanami/hanami-controller/actions/workflows/ci.yml/badge.svg)](https://github.com/hanami/hanami-controller/actions?query=workflow%3Aci+branch%3Amain)
+[![Test Coverage](https://codecov.io/gh/hanami/hanami-controller/branch/main/graph/badge.svg)](https://codecov.io/gh/hanami/hanami-controller)
 
 ## Contact
 
@@ -21,8 +20,6 @@ Complete, fast, and testable actions for Rack and [Hanami](http://hanamirb.org)
 
 ## Installation
 
-__Hanami::Controller__ supports Ruby (MRI) 3.1+
-
 Add this line to your application's Gemfile:
 
 ```ruby

data/hanami-controller.gemspec

@@ -7,8 +7,8 @@ require "hanami/controller/version"
 Gem::Specification.new do |spec|
   spec.name          = "hanami-controller"
   spec.version       = Hanami::Controller::VERSION
-  spec.authors       = ["Luca Guidi"]
-  spec.email         = ["me@lucaguidi.com"]
+  spec.authors       = ["Hanakai team"]
+  spec.email         = ["info@hanakai.org"]
   spec.description   = "Complete, fast and testable actions for Rack"
   spec.summary       = "Complete, fast and testable actions for Rack and Hanami"
   spec.homepage      = "http://hanamirb.org"
@@ -21,7 +21,7 @@ Gem::Specification.new do |spec|
   spec.required_ruby_version = ">= 3.2"
 
   spec.add_dependency "rack", ">= 2.1"
-  spec.add_dependency "hanami-utils", "~> 2.3.0.beta1"
+  spec.add_dependency "hanami-utils", "~> 2.3.0"
   spec.add_dependency "dry-configurable", "~> 1.0", "< 2"
   spec.add_dependency "dry-core", "~> 1.0"
   spec.add_dependency "zeitwerk", "~> 2.6"

data/lib/hanami/action/csrf_protection.rb

@@ -13,10 +13,11 @@ module Hanami
     # This security mechanism is enabled automatically if sessions are turned on.
     #
     # It stores a "challenge" token in session. For each "state changing request"
-    # (eg. <tt>POST</tt>, <tt>PATCH</tt> etc..), we should send a special param:
-    # <tt>_csrf_token</tt>.
+    # (eg. <tt>POST</tt>, <tt>PATCH</tt> etc..), we should send a special param
+    # <tt>_csrf_token</tt> or header <tt>X-CSRF-Token</tt> which contain the "challenge"
+    # token.
     #
-    # If the param matches with the challenge token, the flow can continue.
+    # If the request token matches with the challenge token, the flow can continue.
     # Otherwise the application detects an attack attempt, it reset the session
     # and <tt>Hanami::Action::InvalidCSRFTokenError</tt> is raised.
     #
@@ -107,6 +108,16 @@ module Hanami
         res.session[CSRF_TOKEN] ||= generate_csrf_token
       end
 
+      # Get CSRF Token in request.
+      #
+      # Retreives the CSRF token from the request param <tt>_csrf_token</tt> or the request header
+      # <tt>X-CSRF-Token</tt>.
+      #
+      # @api private
+      def request_csrf_token(req)
+        req.params.raw[CSRF_TOKEN.to_s] || req.get_header("HTTP_X_CSRF_TOKEN")
+      end
+
       # Verify if CSRF token from params, matches the one stored in session.
       # If not, it raises an error.
       #
@@ -131,14 +142,14 @@ module Hanami
         return false unless verify_csrf_token?(req, res)
 
         missing_csrf_token?(req, res) ||
-          !::Rack::Utils.secure_compare(req.session[CSRF_TOKEN], req.params.raw[CSRF_TOKEN.to_s])
+          !::Rack::Utils.secure_compare(req.session[CSRF_TOKEN], request_csrf_token(req))
       end
 
       # Verify the CSRF token was passed in params.
       #
       # @api private
       def missing_csrf_token?(req, *)
-        Hanami::Utils::Blank.blank?(req.params.raw[CSRF_TOKEN.to_s])
+        Hanami::Utils::Blank.blank?(request_csrf_token(req))
       end
 
       # Generates a random CSRF Token

data/lib/hanami/action.rb

@@ -433,7 +433,12 @@ module Hanami
     # @api private
     def exception_handler(exception)
       config.handled_exceptions.each do |exception_class, handler|
-        return handler if exception.is_a?(exception_class)
+        case exception_class
+        when String
+          return handler if exception.class.name == exception_class # rubocop:disable Style/ClassEqualityComparison
+        else
+          return handler if exception.is_a?(exception_class)
+        end
       end
 
       nil

data/lib/hanami/controller/version.rb

@@ -8,6 +8,6 @@ module Hanami
     #
     # @since 0.1.0
     # @api public
-    VERSION = "2.3.0.beta2"
+    VERSION = "2.3.0"
   end
 end

data/lib/hanami/http/status.rb

@@ -21,7 +21,10 @@ module Hanami
       #
       # @since 2.0.2
       # @api private
-      SYMBOLS = ::Rack::Utils::SYMBOL_TO_STATUS_CODE
+      SYMBOLS = ::Rack::Utils::SYMBOL_TO_STATUS_CODE.merge(
+        unprocessable_content: 422,
+        unprocessable_entity: 422
+      )
 
       # Return a status for the given code
       #

metadata

@@ -1,10 +1,10 @@
 --- !ruby/object:Gem::Specification
 name: hanami-controller
 version: !ruby/object:Gem::Version
-  version: 2.3.0.beta2
+  version: 2.3.0
 platform: ruby
 authors:
-- Luca Guidi
+- Hanakai team
 bindir: bin
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
@@ -29,14 +29,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.3.0.beta1
+        version: 2.3.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.3.0.beta1
+        version: 2.3.0
 - !ruby/object:Gem::Dependency
   name: dry-configurable
   requirement: !ruby/object:Gem::Requirement
@@ -163,7 +163,7 @@ dependencies:
         version: '1.0'
 description: Complete, fast and testable actions for Rack
 email:
-- me@lucaguidi.com
+- info@hanakai.org
 executables: []
 extensions: []
 extra_rdoc_files: []