hanami 1.3.5 → 2.0.0.alpha1

data/lib/hanami/cli/commands/server.rb

@@ -1,35 +1,84 @@
+# frozen_string_literal: true
+
 module Hanami
+  # Hanami CLI
+  #
+  # @since 1.1.0
   class CLI
     module Commands
       # @since 1.1.0
       # @api private
       class Server < Command
-        requires 'code_reloading'
-
         desc "Start Hanami server (only for development)"
 
-        option :server,         desc: "Force a server engine (eg, webrick, puma, thin, etc..)"
-        option :host,           desc: "The host address to bind to"
-        option :port,           desc: "The port to run the server on", aliases: ["-p"]
-        option :debug,          desc: "Turn on debug output"
-        option :warn,           desc: "Turn on warnings"
-        option :daemonize,      desc: "Daemonize the server"
-        option :pid,            desc: "Path to write a pid file after daemonize"
-        option :code_reloading, desc: "Code reloading", type: :boolean, default: true
+        option :server,    desc: "Force a server engine (eg, webrick, puma, thin, etc..)"
+        option :host,      desc: "The host address to bind to"
+        option :port,      desc: "The port to run the server on", aliases: ["-p"]
+        option :debug,     desc: "Turn on debug output", type: :boolean
+        option :warn,      desc: "Turn on warnings", type: :boolean
+        option :daemonize, desc: "Daemonize the server", type: :boolean
+        option :pid,       desc: "Path to write a pid file after daemonize"
 
         example [
           "                    # Basic usage (it uses the bundled server engine)",
           "--server=webrick    # Force `webrick` server engine",
           "--host=0.0.0.0      # Bind to a host",
-          "--port=2306         # Bind to a port",
-          "--no-code-reloading # Disable code reloading"
+          "--port=2306         # Bind to a port"
         ]
 
         # @since 1.1.0
         # @api private
-        def call(*)
+        def call(**args)
+          require "hanami"
+          require "hanami/container"
           require "hanami/server"
-          Hanami::Server.new.start
+
+          options = parse_arguments(args)
+          Hanami::Server.new(options).start
+        end
+
+        private
+
+        DEFAULT_CONFIG = "config.ru"
+        private_constant :DEFAULT_CONFIG
+
+        DEFAULT_HOST = "0.0.0.0"
+        private_constant :DEFAULT_HOST
+
+        DEFAULT_PORT = "2300"
+        private_constant :DEFAULT_PORT
+
+        OPTIONAL_SETTINGS = %i[
+          server
+          debug
+          warn
+          daemonize
+          pid
+        ].freeze
+
+        def parse_arguments(args)
+          Hanami::Container.start(:env)
+
+          {
+            config: DEFAULT_CONFIG,
+            Host: host(args),
+            Port: port(args),
+            AccessLog: []
+          }.merge(
+            args.slice(*OPTIONAL_SETTINGS)
+          )
+        end
+
+        def host(args)
+          args.fetch(:host) do
+            ENV.fetch("HANAMI_HOST", DEFAULT_HOST)
+          end
+        end
+
+        def port(args)
+          args.fetch(:port) do
+            ENV.fetch("HANAMI_PORT", DEFAULT_PORT)
+          end
         end
       end
     end

data/lib/hanami/cli/commands.rb

@@ -1,5 +1,6 @@
-require 'dry/cli'
-require 'ostruct'
+# frozen_string_literal: true
+
+require "hanami/cli"
 
 module Hanami
   # Hanami CLI
@@ -23,7 +24,7 @@ module Hanami
     #       module CLI
     #         module Commands
     #           class Generate < Hanami::CLI::Command
-    #             desc "Generate Webpack config"
+    #             desc "Generate Webpack configuration"
     #
     #             def call(*)
     #               # ...
@@ -54,48 +55,10 @@ module Hanami
     # @since 1.1.0
     # @api private
     module Commands
-      extend Dry::CLI::Registry
-
-      # CLI command context
-      #
-      # @since 1.1.0
-      # @api private
-      class Context < OpenStruct
-        # @since 1.1.0
-        # @api private
-        def initialize(data)
-          data = data.each_with_object({}) do |(k, v), result|
-            v = Utils::String.new(v) if v.is_a?(::String)
-            result[k] = v
-          end
-
-          super(data)
-          freeze
-        end
-
-        # @since 1.1.0
-        # @api private
-        def with(data)
-          self.class.new(to_h.merge(data))
-        end
-
-        # @since 1.1.0
-        # @api private
-        def binding
-          super
-        end
-      end
+      extend Hanami::CLI::Registry
 
       require "hanami/cli/commands/command"
-      require "hanami/cli/commands/assets"
-      require "hanami/cli/commands/console"
-      require "hanami/cli/commands/db"
-      require "hanami/cli/commands/destroy"
-      require "hanami/cli/commands/generate"
-      require "hanami/cli/commands/new"
-      require "hanami/cli/commands/routes"
       require "hanami/cli/commands/server"
-      require "hanami/cli/commands/version"
     end
   end
 end

data/lib/hanami/configuration/cookies.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module Hanami
+  class Configuration
+    # Hanami configuration for HTTP cookies
+    #
+    # @since 2.0.0
+    class Cookies
+      def self.null
+        { null: true }
+      end
+
+      attr_reader :options
+
+      def initialize(options)
+        @options = options
+      end
+
+      def enabled?
+        options != self.class.null
+      end
+    end
+  end
+end

data/lib/hanami/configuration/middleware.rb

@@ -1,40 +1,20 @@
-require "concurrent"
+# frozen_string_literal: true
 
 module Hanami
-  # @api private
   class Configuration
-    # Middleware configuration
-    # @since 1.2.0
+    # Hanami application configured Rack middleware
+    #
+    # @since 2.0.0
     class Middleware
-      # @api private
-      # @since 1.2.0
       def initialize
-        @middleware = Concurrent::Array.new
+        @stack = []
       end
 
-      # Use a Rack middleware
-      #
-      # @param middleware [#call] a Rack middleware
-      # @param args [Array<Object>] an optional set of options
-      # @param blk [Proc] an optional block to pass to the middleware
-      #
-      # @since 1.2.0
-      #
-      # @example
-      #   # config/environment.rb
-      #   # ...
-      #   Hanami.configure do
-      #     middleware.use MyRackMiddleware
-      #   end
-      def use(middleware, *args, &blk)
-        @middleware.push([middleware, args, blk])
+      def use(middleware, *args)
+        stack.push([middleware, *args])
       end
 
-      # @api private
-      # @since 1.2.0
-      def each(&blk)
-        @middleware.each(&blk)
-      end
+      attr_reader :stack
     end
   end
 end

data/lib/hanami/configuration/security.rb

@@ -0,0 +1,141 @@
+# frozen_string_literal: true
+
+require "concurrent/hash"
+require "hanami/utils/string"
+
+module Hanami
+  class Configuration
+    # Hanami configuration security settings
+    #
+    # @since 2.0.0
+    class Security
+      def initialize
+        @settings = Concurrent::Hash.new
+        settings[:x_frame_options]         = Setting.new(HEADER_X_FRAME_OPTIONS, DEFAULT_X_FRAME_OPTIONS)
+        settings[:x_content_type_options]  = Setting.new(HEADER_X_CONTENT_TYPE_OPTIONS, DEFAULT_X_CONTENT_TYPE_OPTIONS)
+        settings[:x_xss_protection]        = Setting.new(HEADER_X_XSS_PROTECTION, DEFAULT_X_XSS_PROTECTION)
+        settings[:content_security_policy] = ContentSecurityPolicy.new(HEADER_CONTENT_SECURITY_POLICY, DEFAULT_CONTENT_SECURITY_POLICY.dup)
+      end
+
+      def x_frame_options=(value)
+        settings[:x_frame_options].value = value
+      end
+
+      def x_frame_options
+        settings.fetch(:x_frame_options)
+      end
+
+      def x_content_type_options=(value)
+        settings[:x_content_type_options].value = value
+      end
+
+      def x_content_type_options
+        settings.fetch(:x_content_type_options)
+      end
+
+      def x_xss_protection=(value)
+        settings[:x_xss_protection].value = value
+      end
+
+      def x_xss_protection
+        settings.fetch(:x_xss_protection)
+      end
+
+      def content_security_policy=(options)
+        settings[:content_security_policy].value = options
+      end
+
+      def content_security_policy
+        settings.fetch(:content_security_policy)
+      end
+
+      def to_hash
+        settings.each_with_object({}) do |(_, v), result|
+          next if v.value.nil?
+
+          result[v.header] = v.value
+        end
+      end
+
+      private
+
+      # X-Frame-Options
+      HEADER_X_FRAME_OPTIONS = "X-Frame-Options"
+      private_constant :HEADER_X_FRAME_OPTIONS
+
+      DEFAULT_X_FRAME_OPTIONS = "DENY"
+      private_constant :DEFAULT_X_FRAME_OPTIONS
+
+      # X-Content-Type-Optionx
+      HEADER_X_CONTENT_TYPE_OPTIONS = "X-Content-Type-Options"
+      private_constant :HEADER_X_CONTENT_TYPE_OPTIONS
+
+      DEFAULT_X_CONTENT_TYPE_OPTIONS = "nosniff"
+      private_constant :DEFAULT_X_CONTENT_TYPE_OPTIONS
+
+      # X-XSS-Protection
+      HEADER_X_XSS_PROTECTION = "X-XSS-Protection"
+      private_constant :HEADER_X_XSS_PROTECTION
+
+      DEFAULT_X_XSS_PROTECTION = "1; mode=block"
+      private_constant :DEFAULT_X_XSS_PROTECTION
+
+      # Content-Security-Policy
+      HEADER_CONTENT_SECURITY_POLICY = "Content-Security-Policy"
+      private_constant :HEADER_CONTENT_SECURITY_POLICY
+
+      DEFAULT_CONTENT_SECURITY_POLICY = {
+        form_action: "'self'",
+        frame_ancestors: "'self'",
+        base_uri: "'self'",
+        default_src: "'none'",
+        script_src: "'self'",
+        connect_src: "'self'",
+        img_src: "'self' https: data:",
+        style_src: "'self' 'unsafe-inline' https:",
+        font_src: "'self'",
+        object_src: "'none'",
+        plugin_types: "application/pdf",
+        child_src: "'self'",
+        frame_src: "'self'",
+        media_src: "'self'"
+      }.freeze
+      private_constant :DEFAULT_CONTENT_SECURITY_POLICY
+
+      # Security setting
+      #
+      # @api private
+      # @since 2.0.0
+      class Setting
+        attr_accessor :header, :value
+
+        def initialize(header, value)
+          @header = header.freeze
+          @value = value
+        end
+      end
+
+      # Content security policy settings
+      #
+      # @api private
+      # @since 2.0.0
+      class ContentSecurityPolicy < Setting
+        def value
+          @value.map do |k, v|
+            "#{Utils::String.dasherize(k)} #{v}" unless v.nil?
+          end.compact.join("; ")
+        end
+
+        def [](key)
+          @value[key]
+        end
+
+        def []=(key, value)
+          @value[key] = value
+        end
+      end
+
+      attr_reader :settings
+    end
+  end
+end

data/lib/hanami/configuration/sessions.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+require "hanami/utils/string"
+require "hanami/utils/class"
+
+module Hanami
+  class Configuration
+    # Hanami configuration for HTTP sessions
+    #
+    # @since 2.0.0
+    class Sessions
+      def self.null
+        NULL_STORAGE
+      end
+
+      attr_reader :storage, :options
+
+      def initialize(*args)
+        storage, options, = Array(args.dup).flatten
+
+        @storage = storage
+        @options = options || {}
+      end
+
+      def enabled?
+        storage != NULL_STORAGE
+      end
+
+      def middleware
+        [[storage_middleware, options]]
+      end
+
+      private
+
+      NULL_STORAGE = :null
+      private_constant :NULL_STORAGE
+
+      def storage_middleware
+        require_storage
+
+        name = Utils::String.classify(storage)
+        Utils::Class.load!(name, Rack::Session)
+      end
+
+      def require_storage
+        require "rack/session/#{storage}"
+      end
+    end
+  end
+end