hanami 2.0.0.alpha7.1 → 2.0.0.beta1.1

data/spec/unit/hanami/configuration/actions/content_security_policy_spec.rb

@@ -0,0 +1,102 @@
+# frozen_string_literal: true
+
+require "hanami/configuration/actions"
+
+RSpec.describe Hanami::Configuration::Actions, "#content_security_policy" do
+  let(:configuration) { described_class.new }
+  subject(:content_security_policy) { configuration.content_security_policy }
+
+  context "no CSP config specified" do
+    context "without assets_server_url" do
+
+      it "has defaults" do
+        expect(content_security_policy[:base_uri]).to eq("'self'")
+
+        expected = [
+          %(base-uri 'self';),
+          %(child-src 'self';),
+          %(connect-src 'self';),
+          %(default-src 'none';),
+          %(font-src 'self';),
+          %(form-action 'self';),
+          %(frame-ancestors 'self';),
+          %(frame-src 'self';),
+          %(img-src 'self' https: data:;),
+          %(media-src 'self';),
+          %(object-src 'none';),
+          %(plugin-types application/pdf;),
+          %(script-src 'self';),
+          %(style-src 'self' 'unsafe-inline' https:)
+        ].join("\n")
+
+        expect(content_security_policy.to_str).to eq(expected)
+      end
+    end
+
+    context "with assets_server_url" do
+      let(:configuration) { described_class.new(assets_server_url: assets_server_url) }
+      let(:assets_server_url) { "http://localhost:8080" }
+
+      it "includes server url" do
+        expect(content_security_policy[:script_src]).to eq("'self' #{assets_server_url}")
+        expect(content_security_policy[:style_src]).to eq("'self' 'unsafe-inline' https: #{assets_server_url}")
+      end
+    end
+  end
+
+  context "CSP settings specified" do
+    let(:cdn_url) { "https://assets.hanamirb.test" }
+
+    it "appends to default values" do
+      content_security_policy[:script_src] += " #{cdn_url}"
+
+      expect(content_security_policy[:script_src]).to eq("'self' #{cdn_url}")
+      expect(content_security_policy.to_str).to match("'self' #{cdn_url}")
+    end
+
+    it "overrides default values" do
+      content_security_policy[:style_src] = cdn_url
+
+      expect(content_security_policy[:style_src]).to eq(cdn_url)
+      expect(content_security_policy.to_str).to match(cdn_url)
+    end
+
+    it "nullifies value" do
+      content_security_policy[:plugin_types] = nil
+
+      expect(content_security_policy[:plugin_types]).to be(nil)
+      expect(content_security_policy.to_str).to match("plugin-types ;")
+    end
+
+    it "deletes key" do
+      content_security_policy.delete(:object_src)
+
+      expect(content_security_policy[:object_src]).to be(nil)
+      expect(content_security_policy.to_str).to_not match("object-src")
+    end
+
+    it "adds a custom key" do
+      content_security_policy[:a_custom_key] = "foo"
+
+      expect(content_security_policy[:a_custom_key]).to eq("foo")
+      expect(content_security_policy.to_str).to match("a-custom-key foo")
+    end
+  end
+
+  context "with CSP enabled" do
+    it "sets default header" do
+      configuration.finalize!
+
+      expect(configuration.default_headers.fetch("Content-Security-Policy")).to eq(content_security_policy.to_str)
+    end
+  end
+
+  context "with CSP disabled" do
+    it "doesn't set default header" do
+      configuration.content_security_policy = false
+      configuration.finalize!
+
+      expect(configuration.default_headers.key?("Content-Security-Policy")).to be(false)
+    end
+  end
+end

data/spec/unit/hanami/configuration/actions/cookies_spec.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require "hanami/configuration/actions"
+
+RSpec.describe Hanami::Configuration::Actions, "#cookies" do
+  let(:configuration) { described_class.new }
+  subject(:cookies) { configuration.cookies }
+
+  context "default config" do
+    it "is enabled" do
+      expect(cookies).to be_enabled
+    end
+
+    it "is an empty hash" do
+      expect(cookies.to_h).to eq({})
+    end
+  end
+
+  context "options given" do
+    before do
+      configuration.cookies = {max_age: 300}
+    end
+
+    it "is enabled" do
+      expect(cookies).to be_enabled
+    end
+
+    it "returns the given options" do
+      expect(cookies.to_h).to eq(max_age: 300)
+    end
+  end
+
+  context "nil value given" do
+    before do
+      configuration.cookies = nil
+    end
+
+    it "is not enabled" do
+      expect(cookies).not_to be_enabled
+    end
+
+    it "returns an empty hash" do
+      expect(cookies.to_h).to eq({})
+    end
+  end
+end

data/spec/unit/hanami/configuration/actions/csrf_protection_spec.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+require "hanami/configuration/actions"
+
+RSpec.describe Hanami::Configuration::Actions, "#csrf_protection" do
+  let(:configuration) { described_class.new }
+  subject(:value) { configuration.csrf_protection }
+
+  context "non-finalized configuration" do
+    it "returns a default of nil" do
+      is_expected.to be_nil
+    end
+
+    it "can be explicitly enabled" do
+      configuration.csrf_protection = true
+      is_expected.to be true
+    end
+
+    it "can be explicitly disabled" do
+      configuration.csrf_protection = false
+      is_expected.to be false
+    end
+  end
+
+  context "finalized configuration" do
+    context "sessions enabled" do
+      before do
+        configuration.sessions = :cookie, {secret: "abc"}
+        configuration.finalize!
+      end
+
+      it "is true" do
+        is_expected.to be true
+      end
+
+      context "explicitly disabled" do
+        before do
+          configuration.csrf_protection = false
+        end
+
+        it "is false" do
+          is_expected.to be false
+        end
+      end
+    end
+
+    context "sessions not enabled" do
+      before do
+        configuration.finalize!
+      end
+
+      it "is true" do
+        is_expected.to be false
+      end
+    end
+  end
+end

data/spec/unit/hanami/configuration/actions/default_values_spec.rb

@@ -0,0 +1,52 @@
+require "hanami/configuration/actions"
+
+RSpec.describe Hanami::Configuration::Actions, "default values" do
+  subject(:configuration) { described_class.new }
+
+  describe "sessions" do
+    specify { expect(configuration.sessions).not_to be_enabled }
+  end
+
+  describe "name_inference_base" do
+    specify { expect(configuration.name_inference_base).to eq "actions" }
+  end
+
+  describe "view_context_identifier" do
+    specify { expect(configuration.view_context_identifier).to eq "views.context" }
+  end
+
+  describe "view_name_inferrer" do
+    specify { expect(configuration.view_name_inferrer).to eq Hanami::Slice::ViewNameInferrer }
+  end
+
+  describe "view_name_inference_base" do
+    specify { expect(configuration.view_name_inference_base).to eq "views" }
+  end
+
+  describe "new default values applied to base action settings" do
+    describe "default_request_format" do
+      specify { expect(configuration.default_request_format).to eq :html }
+    end
+
+    describe "default_response_format" do
+      specify { expect(configuration.default_response_format).to eq :html }
+    end
+
+    describe "content_security_policy" do
+      specify { expect(configuration.content_security_policy).to be_kind_of(Hanami::Configuration::Actions::ContentSecurityPolicy) }
+    end
+
+    describe "default_headers" do
+      specify {
+        configuration.finalize!
+
+        expect(configuration.default_headers).to eq(
+          "X-Frame-Options" => "DENY",
+          "X-Content-Type-Options" => "nosniff",
+          "X-XSS-Protection" => "1; mode=block",
+          "Content-Security-Policy" => configuration.content_security_policy.to_str
+        )
+      }
+    end
+  end
+end

data/spec/unit/hanami/configuration/actions/sessions_spec.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+require "hanami/configuration/actions"
+
+RSpec.describe Hanami::Configuration::Actions, "#sessions" do
+  let(:configuration) { described_class.new }
+  subject(:sessions) { configuration.sessions }
+
+  context "no session config specified" do
+    it "is not enabled" do
+      expect(sessions).not_to be_enabled
+    end
+
+    it "returns nil storage" do
+      expect(sessions.storage).to be_nil
+    end
+
+    it "returns empty options" do
+      expect(sessions.options).to eq []
+    end
+
+    it "returns no session middleware" do
+      expect(sessions.middleware).to eq []
+    end
+  end
+
+  context "valid session config provided" do
+    before do
+      configuration.sessions = :cookie, {secret: "abc"}
+    end
+
+    it "is enabled" do
+      expect(sessions).to be_enabled
+    end
+
+    it "returns the given storage" do
+      expect(sessions.storage).to eq :cookie
+    end
+
+    it "returns the given options" do
+      expect(sessions.options).to eq [secret: "abc"]
+    end
+
+    it "returns an array of middleware classes and options" do
+      expect(sessions.middleware).to eq [
+        [Rack::Session::Cookie, [secret: "abc"]]
+      ]
+    end
+  end
+end

data/spec/unit/hanami/configuration/actions_spec.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+require "hanami/configuration"
+require "hanami/configuration/actions"
+require "hanami/action/configuration"
+
+RSpec.describe Hanami::Configuration, "#actions" do
+  let(:configuration) { described_class.new(app_name: app_name, env: :development) }
+  let(:app_name) { "MyApp::app" }
+
+  subject(:actions) { configuration.actions }
+
+  context "Hanami::Action available" do
+    it "is a full actions configuration" do
+      is_expected.to be_an_instance_of(Hanami::Configuration::Actions)
+
+      is_expected.to respond_to(:default_response_format)
+      is_expected.to respond_to(:default_response_format=)
+    end
+
+    it "configures base action settings" do
+      expect { actions.default_request_format = :json }
+        .to change { actions.default_request_format }
+        .to :json
+    end
+
+    it "configures base actions settings using custom methods" do
+      actions.formats = {}
+
+      expect { actions.format json: "app/json" }
+        .to change { actions.formats }
+        .to("app/json" => :json)
+    end
+
+    it "can be finalized" do
+      is_expected.to respond_to(:finalize!)
+    end
+
+    describe "#settings" do
+      it "returns a set of available settings" do
+        expect(actions.settings).to be_a(Set)
+        expect(actions.settings).to include(:view_context_identifier, :handled_exceptions)
+      end
+
+      it "includes all base action settings" do
+        expect(actions.settings).to include(Hanami::Action::Configuration.settings)
+      end
+    end
+  end
+
+  context "Hanami::Action not available" do
+    before do
+      load_error = LoadError.new.tap do |error|
+        error.instance_variable_set :@path, "hanami/action"
+      end
+
+      allow_any_instance_of(described_class)
+        .to receive(:require)
+        .with(anything)
+        .and_call_original
+
+      allow_any_instance_of(described_class)
+        .to receive(:require)
+        .with("hanami/action")
+        .and_raise load_error
+    end
+
+    it "does not expose any settings" do
+      is_expected.not_to be_an_instance_of(Hanami::Configuration::Actions)
+      is_expected.not_to respond_to(:default_response_format)
+      is_expected.not_to respond_to(:default_response_format=)
+    end
+
+    it "can be finalized" do
+      is_expected.to respond_to(:finalize!)
+    end
+  end
+end

data/spec/unit/hanami/configuration/base_url_spec.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+require "hanami/configuration"
+require "uri"
+
+RSpec.describe Hanami::Configuration, "base_url" do
+  subject(:config) { described_class.new(app_name: app_name, env: :development) }
+  let(:app_name) { "MyApp::app" }
+
+  it "defaults to a URI of 'http://0.0.0.0:2300'" do
+    expect(config.base_url).to eq URI("http://0.0.0.0:2300")
+  end
+
+  it "can be changed to another URI via a string" do
+    expect { config.base_url = "http://example.com" }
+      .to change { config.base_url }
+      .to(URI("http://example.com"))
+  end
+
+  it "can be changed to another URI object" do
+    expect { config.base_url = URI("http://example.com") }
+      .to change { config.base_url }
+      .to(URI("http://example.com"))
+  end
+end

data/spec/unit/hanami/configuration/inflector_spec.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+require "hanami/configuration"
+
+RSpec.describe Hanami::Configuration do
+  subject(:config) { described_class.new(app_name: app_name, env: :development) }
+  let(:app_name) { "MyApp::app" }
+
+  describe "inflector" do
+    it "defaults to a Dry::Inflector instance" do
+      expect(config.inflector).to be_kind_of(Dry::Inflector)
+    end
+
+    it "can be replaced with another inflector" do
+      new_inflector = double(:inflector)
+
+      expect { config.inflector = new_inflector }
+        .to change { config.inflector }
+        .to new_inflector
+    end
+  end
+
+  describe "inflections" do
+    it "configures a new inflector with the given inflections" do
+      expect(config.inflector.pluralize("hanami")).to eq("hanamis")
+
+      config.inflections do |i|
+        i.uncountable("hanami")
+      end
+
+      expect(config.inflector).to be_kind_of(Dry::Inflector)
+      expect(config.inflector.pluralize("hanami")).to eq("hanami")
+    end
+  end
+end

data/spec/unit/hanami/configuration/logger_spec.rb

@@ -0,0 +1,203 @@
+# frozen_string_literal: true
+
+require "hanami/configuration/logger"
+require "hanami/slice_name"
+require "dry/inflector"
+require "logger"
+
+RSpec.describe Hanami::Configuration::Logger do
+  subject { described_class.new(app_name: app_name, env: env) }
+  let(:app_name) { Hanami::SliceName.new(double(name: "MyApp::app"), inflector: -> { Dry::Inflector.new }) }
+  let(:env) { :development }
+
+  describe "#logger_class" do
+    it "defaults to Hanami::Logger" do
+      expect(subject.logger_class).to eql Hanami::Logger
+    end
+
+    it "can be changed to another class" do
+      another_class = Class.new
+
+      expect { subject.logger_class = another_class }
+        .to change { subject.logger_class }
+        .to(another_class)
+    end
+  end
+
+  describe "#level" do
+    it "defaults to :debug" do
+      expect(subject.level).to eq(:debug)
+    end
+
+    context "when :production environment" do
+      let(:env) { :production }
+
+      it "returns :info" do
+        expect(subject.level).to eq(:info)
+      end
+    end
+  end
+
+  describe "#level=" do
+    it "a value" do
+      expect { subject.level = :warn }
+        .to change { subject.level }
+        .to(:warn)
+    end
+  end
+
+  describe "#stream" do
+    it "defaults to $stdout" do
+      expect(subject.stream).to eq($stdout)
+    end
+
+    context "when :test environment" do
+      let(:env) { :test }
+
+      it "returns a file" do
+        expected = File.join("log", "test.log")
+
+        expect(subject.stream).to eq(expected)
+      end
+    end
+  end
+
+  describe "#stream=" do
+    it "accepts a IO object or a path to a file" do
+      expect { subject.stream = "/dev/null" }
+        .to change { subject.stream }
+        .to("/dev/null")
+    end
+  end
+
+  describe "#formatter" do
+    it "defaults to nil" do
+      expect(subject.formatter).to eq(nil)
+    end
+
+    context "when :production environment" do
+      let(:env) { :production }
+
+      it "returns :json" do
+        expect(subject.formatter).to eq(:json)
+      end
+    end
+  end
+
+  describe "#formatter=" do
+    it "accepts a formatter" do
+      expect { subject.formatter = :json }
+        .to change { subject.formatter }
+        .to(:json)
+    end
+  end
+
+  describe "#colors" do
+    it "defaults to nil" do
+      expect(subject.colors).to eq(nil)
+    end
+
+    context "when :test environment" do
+      let(:env) { :test }
+
+      it "returns false" do
+        expect(subject.colors).to eq(false)
+      end
+    end
+
+    context "when :production environment" do
+      let(:env) { :production }
+
+      it "returns false" do
+        expect(subject.colors).to eq(false)
+      end
+    end
+  end
+
+  describe "#colors=" do
+    it "accepts a value" do
+      expect { subject.colors = false }
+        .to change { subject.colors }
+        .to(false)
+    end
+  end
+
+  describe "#filters" do
+    it "defaults to a standard array of sensitive param names" do
+      expect(subject.filters).to include(*%w[_csrf password password_confirmation])
+    end
+
+    it "can have other params names added" do
+      expect { subject.filters << "secret" }
+        .to change { subject.filters }
+        .to array_including("secret")
+
+      expect { subject.filters += ["yet", "another"] }
+        .to change { subject.filters }
+        .to array_including(["yet", "another"])
+    end
+
+    it "can be changed to another array" do
+      expect { subject.filters = ["secret"] }
+        .to change { subject.filters }
+        .to ["secret"]
+    end
+  end
+
+  describe "#options" do
+    it "defaults to empty array" do
+      expect(subject.options).to eq([])
+    end
+  end
+
+  describe "#options=" do
+    it "accepts value" do
+      subject.options = expected = "daily"
+
+      expect(subject.options).to eq([expected])
+    end
+
+    it "accepts values" do
+      subject.options = expected = [0, 1048576]
+
+      expect(subject.options).to eq(expected)
+    end
+  end
+end
+
+RSpec.describe Hanami::Configuration do
+  subject(:config) { described_class.new(app_name: app_name, env: env) }
+  let(:app_name) { Hanami::SliceName.new(double(name: "SOS::app"), inflector: -> { Dry::Inflector.new }) }
+  let(:env) { :development }
+
+  describe "#logger" do
+    before do
+      config.inflections do |inflections|
+        inflections.acronym "SOS"
+      end
+
+      config.logger.finalize!
+    end
+
+    describe "#app_name" do
+      it "defaults to Hanami::Configuration#app_name" do
+        expect(config.logger.app_name).to eq(config.app_name)
+      end
+    end
+  end
+
+  describe "#logger_instance" do
+    it "defaults to an Hanami::Logger instance, based on the default logger settings" do
+      expect(config.logger_instance).to be_an_instance_of config.logger.logger_class
+      expect(config.logger_instance.level).to eq Logger::DEBUG
+    end
+
+    it "can be changed to a pre-initialized instance via #logger=" do
+      logger_instance = Object.new
+
+      expect { config.logger = logger_instance }
+        .to change { config.logger_instance }
+        .to logger_instance
+    end
+  end
+end