hanami 0.0.0 → 0.7.0

data/bin/hanami

@@ -0,0 +1,5 @@
+#!/usr/bin/env ruby
+
+require 'bundler'
+require 'hanami/cli'
+Hanami::Cli.start

data/hanami.gemspec

@@ -4,20 +4,35 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 require 'hanami/version'
 
 Gem::Specification.new do |spec|
-  spec.name          = "hanami"
+  spec.name          = 'hanami'
   spec.version       = Hanami::VERSION
-  spec.authors       = ["Luca Guidi"]
-  spec.email         = ["me@lucaguidi.com"]
-
-  spec.summary       = %q{The web, with simplicity}
+  spec.authors       = ['Luca Guidi', 'Trung Lê', 'Alfonso Uceda Pompa']
+  spec.email         = ['me@lucaguidi.com', 'trung.le@ruby-journal.com', 'uceda73@gmail.com']
+  spec.summary       = %q{The web, with simplicity.}
   spec.description   = %q{Hanami is a web framework for Ruby}
-  spec.homepage      = "http://hanamirb.org"
+  spec.homepage      = 'http://hanamirb.org'
+  spec.license       = 'MIT'
+
+  spec.files         = `git ls-files -z -- lib/* bin/* LICENSE.md README.md CHANGELOG.md FEATURES.md hanami.gemspec`.split("\x0")
+  spec.executables   = spec.files.grep(%r{^bin/}) { |f| File.basename(f) }
+  spec.test_files    = spec.files.grep(%r{^(test)/})
+  spec.require_paths = ['lib']
+  spec.required_ruby_version = '>= 2.0.0'
 
-  spec.files         = `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
-  spec.bindir        = "exe"
-  spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
-  spec.require_paths = ["lib"]
+  spec.add_dependency 'hanami-utils',      '~> 0.7'
+  spec.add_dependency 'hanami-router',     '~> 0.6'
+  spec.add_dependency 'hanami-controller', '~> 0.6'
+  spec.add_dependency 'hanami-view',       '~> 0.6'
+  spec.add_dependency 'hanami-helpers',    '~> 0.3'
+  spec.add_dependency 'hanami-mailer',     '~> 0.2'
+  spec.add_dependency 'hanami-assets',     '~> 0.2'
+  spec.add_dependency 'shotgun',           '~> 0.9'
+  spec.add_dependency 'dotenv',            '~> 2.0'
+  spec.add_dependency 'thor',              '~> 0.19'
+  spec.add_dependency 'bundler',           '~> 1.6'
 
-  spec.add_development_dependency "bundler", "~> 1.11"
-  spec.add_development_dependency "rake", "~> 10.0"
+  spec.add_development_dependency 'minispec-metadata', '~> 3.2.1'
+  spec.add_development_dependency 'minitest',          '~> 5'
+  spec.add_development_dependency 'rack-test',         '~> 0.6'
+  spec.add_development_dependency 'rake',              '~> 10'
 end

data/lib/hanami.rb

@@ -1,5 +1,81 @@
-require "hanami/version"
+require 'hanami/version'
+require 'hanami/application'
+require 'hanami/container'
+require 'hanami/environment'
 
+# A complete web framework for Ruby
+#
+# @since 0.1.0
+#
+# @see http://hanamirb.org
 module Hanami
-  # Your code goes here...
+  DEFAULT_PUBLIC_DIRECTORY = 'public'.freeze
+
+  # Return root of the project (top level directory).
+  #
+  # @return [Pathname] root path
+  #
+  # @since 0.3.2
+  #
+  # @example
+  #   Hanami.root # => #<Pathname:/Users/luca/Code/bookshelf>
+  def self.root
+    environment.root
+  end
+
+  def self.public_directory
+    root.join(DEFAULT_PUBLIC_DIRECTORY)
+  end
+
+  # Return the current environment
+  #
+  # @return [String] the current environment
+  #
+  # @since 0.3.1
+  #
+  # @see Hanami::Environment#environment
+  #
+  # @example
+  #   Hanami.env => "development"
+  def self.env
+    environment.environment
+  end
+
+  # Check to see if specified environment(s) matches the current environment.
+  #
+  # If multiple names are given, it returns true, if at least one of them
+  # matches the current environment.
+  #
+  # @return [TrueClass,FalseClass] the result of the check
+  #
+  # @since 0.3.1
+  #
+  # @see Hanami.env
+  #
+  # @example Single name
+  #   puts ENV['HANAMI_ENV'] # => "development"
+  #
+  #   Hanami.env?(:development)  # => true
+  #   Hanami.env?('development') # => true
+  #
+  #   Hanami.env?(:production)   # => false
+  #
+  # @example Multiple names
+  #   puts ENV['HANAMI_ENV'] # => "development"
+  #
+  #   Hanami.env?(:development, :test)   # => true
+  #   Hanami.env?(:production, :staging) # => false
+  def self.env?(*names)
+    environment.environment?(*names)
+  end
+
+  # Return environment
+  #
+  # @return [Hanami::Environment] environment
+  #
+  # @api private
+  # @since 0.3.2
+  def self.environment
+    Environment.new
+  end
 end

data/lib/hanami/action/csrf_protection.rb

@@ -0,0 +1,167 @@
+require 'securerandom'
+
+module Hanami
+  module Action
+    # Invalid CSRF Token
+    #
+    # @since 0.4.0
+    class InvalidCSRFTokenError < ::StandardError
+    end
+
+    # CSRF Protection
+    #
+    # This security mechanism is enabled automatically if sessions are turned on.
+    #
+    # It stores a "challenge" token in session. For each "state changing request"
+    # (eg. <tt>POST</tt>, <tt>PATCH</tt> etc..), we should send a special param:
+    # <tt>_csrf_token</tt>.
+    #
+    # If the param matches with the challenge token, the flow can continue.
+    # Otherwise the application detects an attack attempt, it reset the session
+    # and <tt>Hanami::Action::InvalidCSRFTokenError</tt> is raised.
+    #
+    # We can specify a custom handling strategy, by overriding <tt>#handle_invalid_csrf_token</tt>.
+    #
+    # Form helper (<tt>#form_for</tt>) automatically sets a hidden field with the
+    # correct token. A special view method (<tt>#csrf_token</tt>) is available in
+    # case the form markup is manually crafted.
+    #
+    # We can disable this check on action basis, by overriding <tt>#verify_csrf_token?</tt>.
+    #
+    # @since 0.4.0
+    #
+    # @see https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29
+    # @see https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet
+    #
+    # @example Custom Handling
+    #   module Web::Controllers::Books
+    #     class Create
+    #       include Web::Action
+    #
+    #       def call(params)
+    #         # ...
+    #       end
+    #
+    #       private
+    #
+    #       def handle_invalid_csrf_token
+    #         Web::Logger.warn "CSRF attack: expected #{ session[:_csrf_token] }, was #{ params[:_csrf_token] }"
+    #         # manual handling
+    #       end
+    #     end
+    #   end
+    #
+    # @example Bypass Security Check
+    #   module Web::Controllers::Books
+    #     class Create
+    #       include Web::Action
+    #
+    #       def call(params)
+    #         # ...
+    #       end
+    #
+    #       private
+    #
+    #       def verify_csrf_token?
+    #         false
+    #       end
+    #     end
+    #   end
+    module CSRFProtection
+      # Session and params key for CSRF token.
+      #
+      # This key is shared with <tt>hanami-controller</tt> and <tt>hanami-helpers</tt>
+      #
+      # @since 0.4.0
+      # @api private
+      CSRF_TOKEN = :_csrf_token
+
+      # Idempotent HTTP methods
+      #
+      # By default, the check isn't performed if the request method is included
+      # in this list.
+      #
+      # @since 0.4.0
+      # @api private
+      IDEMPOTENT_HTTP_METHODS = Hash[
+        'GET'     => true,
+        'HEAD'    => true,
+        'TRACE'   => true,
+        'OPTIONS' => true
+      ].freeze
+
+      # @since 0.4.0
+      # @api private
+      def self.included(action)
+        action.class_eval do
+          before :set_csrf_token, :verify_csrf_token
+        end unless Hanami.env?(:test)
+      end
+
+      private
+      # Set CSRF Token in session
+      #
+      # @since 0.4.0
+      # @api private
+      def set_csrf_token
+        session[CSRF_TOKEN] ||= generate_csrf_token
+      end
+
+      # Verify if CSRF token from params, matches the one stored in session.
+      # If not, it raises an error.
+      #
+      # Don't override this method.
+      #
+      # To bypass the security check, please override <tt>#verify_csrf_token?</tt>.
+      # For custom handling of an attack, please override <tt>#handle_invalid_csrf_token</tt>.
+      #
+      # @since 0.4.0
+      # @api private
+      def verify_csrf_token
+        handle_invalid_csrf_token if invalid_csrf_token?
+      end
+
+      # Verify if CSRF token from params, matches the one stored in session.
+      #
+      # Don't override this method.
+      #
+      # @since 0.4.0
+      # @api private
+      def invalid_csrf_token?
+        verify_csrf_token? &&
+          ! ::Rack::Utils.secure_compare(session[CSRF_TOKEN], params[CSRF_TOKEN])
+      end
+
+      # Generates a random CSRF Token
+      #
+      # @since 0.4.0
+      # @api private
+      def generate_csrf_token
+        SecureRandom.hex(32)
+      end
+
+      # Decide if perform the check or not.
+      #
+      # Override and return <tt>false</tt> if you want to bypass security check.
+      #
+      # @since 0.4.0
+      def verify_csrf_token?
+        !IDEMPOTENT_HTTP_METHODS[request_method]
+      end
+
+      # Handle CSRF attack.
+      #
+      # The default policy resets the session and raises an exception.
+      #
+      # Override this method, for custom handling.
+      #
+      # @raise [Hanami::Action::InvalidCSRFTokenError]
+      #
+      # @since 0.4.0
+      def handle_invalid_csrf_token
+        session.clear
+        raise InvalidCSRFTokenError.new
+      end
+    end
+  end
+end

data/lib/hanami/action/routing_helpers.rb

@@ -0,0 +1,40 @@
+require 'hanami/utils/string'
+
+module Hanami
+  module Action
+    # Routing helper for full stack Hanami web applications.
+    #
+    # For a given application called <tt>Web::Application</tt>, at runtime
+    # Hanami creates a routes factory called <tt>Web::Routes</tt>.
+    #
+    # Included by default in every controller.
+    #
+    # @since 0.3.2
+    #
+    # @example Usage in controller
+    #   require 'hanami'
+    #
+    #   module Web::Controllers::Protected
+    #     class Index
+    #       include Web::Action
+    #
+    #       def call(params)
+    #         redirect_to routes.root_path
+    #       end
+    #     end
+    #   end
+    module RoutingHelpers
+      def self.included(base)
+        factory = "#{ Utils::String.new(base).namespace }::Routes"
+
+        base.class_eval <<-END_EVAL, __FILE__, __LINE__
+          private
+
+          def routes
+            #{ factory }
+          end
+        END_EVAL
+      end
+    end
+  end
+end

data/lib/hanami/application.rb

@@ -0,0 +1,244 @@
+require 'hanami/utils/class_attribute'
+require 'hanami/frameworks'
+require 'hanami/configuration'
+require 'hanami/loader'
+require 'hanami/logger'
+require 'hanami/rendering_policy'
+require 'hanami/middleware'
+
+module Hanami
+  # A full stack Hanami application
+  #
+  # @since 0.1.0
+  #
+  # @example
+  #   require 'hanami'
+  #
+  #   module Bookshelf
+  #     class Application < Hanami::Application
+  #     end
+  #   end
+  class Application
+    # Override Ruby's Class#inherited
+    #
+    # @since 0.2.0
+    # @api private
+    #
+    # @see http://www.ruby-doc.org/core/Class.html#method-i-inherited
+    def self.inherited(base)
+      super
+
+      base.class_eval do
+        include Hanami::Utils::ClassAttribute
+
+        class_attribute :configuration
+        self.configuration = Configuration.new
+      end
+
+      synchronize do
+        applications.add(base)
+      end
+    end
+
+    # Registry of Hanami applications in the current Ruby process
+    #
+    # @return [Set] a set of all the registered applications
+    #
+    # @since 0.2.0
+    # @api private
+    def self.applications
+      synchronize do
+        @@applications ||= Set.new
+      end
+    end
+
+    # Configure the application.
+    # It yields the given block in the context of the configuration
+    #
+    # @param environment [Symbol,nil] the configuration environment name
+    # @param blk [Proc] the configuration block
+    #
+    # @since 0.1.0
+    #
+    # @see Hanami::Configuration
+    #
+    # @example
+    #   require 'hanami'
+    #
+    #   module Bookshelf
+    #     Application < Hanami::Application
+    #       configure do
+    #         # ...
+    #       end
+    #     end
+    #   end
+    def self.configure(environment = nil, &blk)
+      configuration.configure(environment, &blk)
+    end
+
+    # Return the routes for this application
+    #
+    # @return [Hanami::Router] a route set
+    #
+    # @since 0.1.0
+    #
+    # @see Hanami::Configuration#routes
+    attr_reader :routes
+
+    # Set the routes for this application
+    #
+    # @param [Hanami::Router]
+    #
+    # @since 0.1.0
+    # @api private
+    attr_writer :routes
+
+    # Rendering policy
+    #
+    # @param [Hanami::RenderingPolicy]
+    #
+    # @since 0.2.0
+    # @api private
+    attr_accessor :renderer
+
+    # Initialize and load a new instance of the application
+    #
+    # @return [Hanami::Application] a new instance of the application
+    #
+    # @since 0.1.0
+    def initialize(options = {})
+      self.class.configuration.path_prefix options[:path_prefix]
+      self.class.load!(self)
+    end
+
+    # Eager load the application configuration, by activating the framework
+    # duplication mechanisms.
+    #
+    # @param application [Hanami::Application, Class<Hanami::Application>]
+    # @return void
+    #
+    # @since 0.1.1
+    #
+    # @example
+    #   require 'hanami'
+    #
+    #   module OneFile
+    #     class Application < Hanami::Application
+    #       configure do
+    #         routes do
+    #           get '/', to: 'dashboard#index'
+    #         end
+    #       end
+    #
+    #       load!
+    #     end
+    #
+    #     module Controllers::Dashboard
+    #       class Index
+    #         include OneFile::Action
+    #
+    #         def call(params)
+    #           self.body = 'Hello!'
+    #         end
+    #       end
+    #     end
+    #   end
+    def self.load!(application = self)
+      Hanami::Loader.new(application).load!
+    end
+
+    # Preload all the registered applications, by yielding their configurations
+    # and preparing the frameworks.
+    #
+    # This is useful for testing suites, where we want to make Hanami frameworks
+    # ready, but not preload applications code.
+    #
+    # This allows to test components such as views or actions in isolation and
+    # to have faster boot times.
+    #
+    # @return [void]
+    #
+    # @since 0.2.0
+    def self.preload!
+      synchronize do
+        applications.each(&:load!)
+      end
+
+      nil
+    end
+
+    # Full preload for all the registered applications.
+    #
+    # This is useful in console where we want all the application code available.
+    #
+    # @return [void]
+    #
+    # @since 0.2.1
+    # @api private
+    def self.preload_applications!
+      synchronize do
+        applications.each { |app| app.new }
+      end
+
+      nil
+    end
+
+    # Return the configuration for this application
+    #
+    # @since 0.1.0
+    # @api private
+    #
+    # @see Hanami::Application.configuration
+    def configuration
+      self.class.configuration
+    end
+
+    # Return the application name
+    #
+    # @since 0.2.0
+    # @api private
+    def name
+      self.class.name
+    end
+
+    # Process a request.
+    # This method makes Hanami applications compatible with the Rack protocol.
+    #
+    # @param env [Hash] a Rack env
+    #
+    # @return [Array] a serialized Rack response
+    #
+    # @since 0.1.0
+    #
+    # @see http://rack.github.io
+    # @see Hanami::RenderingPolicy#render
+    # @see Hanami::Application#middleware
+    def call(env)
+      renderer.render(env, middleware.call(env))
+    end
+
+    # Rack middleware stack
+    #
+    # @return [Hanami::Middleware] the middleware stack
+    #
+    # @since 0.1.0
+    # @api private
+    #
+    # @see Hanami::Middleware
+    def middleware
+      @middleware ||= configuration.middleware
+    end
+
+    private
+
+    # Yields the given block in a critical section
+    #
+    # @since 0.2.0
+    # @api private
+    def self.synchronize
+      Mutex.new.synchronize do
+        yield
+      end
+    end
+  end
+end