hanami 2.0.0.alpha7 → 2.0.0.beta1

data/spec/integration/project_initializers_spec.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+RSpec.describe "Project initializers", type: :integration do
+  it "mounts Rack middleware" do
+    with_project("project_initializers", gems: ["i18n"]) do
+      write "config/locales/en.yml", <<~EOF
+        en:
+          greeting: "Welcome stranger"
+      EOF
+
+      write "config/initializers/i18n.rb", <<~EOF
+        require 'i18n'
+        I18n.load_path = Dir['config/locales/*.yml']
+        I18n.backend.load_translations
+      EOF
+
+      generate "action web home#index --url=/"
+      rewrite "apps/web/views/home/index.rb", <<~EOF
+        module Web::Views::Home
+          class Index
+            include Web::View
+
+            def greeting
+              I18n.t(:greeting)
+            end
+          end
+        end
+      EOF
+
+      rewrite "apps/web/templates/home/index.html.erb", <<~EOF
+        <h1><%= greeting%></h1>
+      EOF
+      server do
+        get "/"
+
+        expect(last_response.body).to include("Welcome stranger")
+      end
+    end
+  end
+end

data/spec/integration/rackup_spec.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+RSpec.describe "rackup", type: :integration do
+  it "serves contents from database" do
+    with_project do
+      setup_model
+      console do |input, _, _|
+        input.puts("BookRepository.new.create(title: 'Learn Hanami')")
+        input.puts("exit")
+      end
+
+      generate "action web books#show --url=/books/:id"
+      rewrite  "apps/web/controllers/books/show.rb", <<~EOF
+        module Web::Controllers::Books
+          class Show
+            include Web::Action
+            expose :book
+
+            def call(params)
+              @book = BookRepository.new.find(params[:id]) or halt(404)
+            end
+          end
+        end
+      EOF
+      rewrite "apps/web/templates/books/show.html.erb", <<~EOF
+        <h1><%= book.title %></h1>
+      EOF
+
+      rackup do
+        visit "/books/1"
+        expect(page).to have_content("Learn Hanami")
+      end
+    end
+  end
+end

data/spec/integration/rake/with_minitest_spec.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+RSpec.describe "Rake: default task", type: :integration do
+  context "with Minitest" do
+    xit "runs tests" do
+      with_project("bookshelf", test: "minitest") do
+        setup_model
+
+        prepare_development_database
+        generate_development_data
+
+        prepare_test_database
+
+        write "spec/bookshelf/repositories/book_repository_spec.rb", <<~EOF
+          require 'spec_helper'
+
+          describe BookRepository do
+            before do
+              BookRepository.new.clear
+            end
+
+            it 'finds all the records' do
+              BookRepository.new.all.to_a.must_equal []
+            end
+          end
+        EOF
+
+        bundle_exec "rake"
+        expect(out).to include("2 runs, 3 assertions, 0 failures, 0 errors, 0 skips")
+
+        assert_development_data
+      end
+    end
+  end
+
+  private
+
+  def prepare_development_database
+    prepare_database
+  end
+
+  def prepare_test_database
+    prepare_database env: "test"
+  end
+
+  def generate_development_data
+    migrate
+
+    console do |input, _, _|
+      input.puts("BookRepository.new.create(title: 'Learn Hanami')")
+      input.puts("exit")
+    end
+  end
+
+  def assert_development_data
+    console do |input, _, _|
+      input.puts("BookRepository.new.all.to_a.count")
+      input.puts("exit")
+    end
+
+    expect(out).to include("\n1")
+  end
+
+  def prepare_database(env: nil)
+    hanami "db prepare", env: env
+  end
+end

data/spec/integration/rake/with_rspec_spec.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+RSpec.describe "Rake: default task", type: :integration do
+  context "with RSpec" do
+    it "runs tests" do
+      with_project("bookshelf", test: "rspec") do
+        setup_model
+
+        prepare_development_database
+        generate_development_data
+
+        prepare_test_database
+
+        generate "mailer bookshelf"
+
+        write "spec/bookshelf/repositories/book_repository_spec.rb", <<~EOF
+          RSpec.describe BookRepository do
+            before do
+              described_class.new.clear
+            end
+
+            it 'finds all the records' do
+              expect(described_class.new.all.to_a).to eq([])
+            end
+          end
+        EOF
+
+        bundle_exec "rake"
+
+        # The default mailer_spec fails on purpose so you set the correct delivery information.
+        expect(out).to include("3 examples, 1 failure")
+
+        assert_development_data
+      end
+    end
+  end
+
+  private
+
+  def prepare_development_database
+    prepare_database
+  end
+
+  def prepare_test_database
+    prepare_database env: "test"
+  end
+
+  def generate_development_data
+    migrate
+
+    console do |input, _, _|
+      input.puts("BookRepository.new.create(title: 'Learn Hanami')")
+      input.puts("exit")
+    end
+  end
+
+  def assert_development_data
+    console do |input, _, _|
+      input.puts("BookRepository.new.all.to_a.count")
+      input.puts("exit")
+    end
+
+    expect(out).to include("\n1")
+  end
+
+  def prepare_database(env: nil)
+    hanami "db prepare", env: env
+  end
+end

data/spec/integration/routing_helpers_spec.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+RSpec.describe "Routing helpers", type: :integration do
+  it "uses routing helpers within action" do
+    with_project do
+      generate "action web home#index --url=/"
+      generate "action web books#index --url=/books"
+
+      # Add `as:` option, so it can be used by the routing helper
+      replace "apps/web/config/routes.rb", "/books", "get '/books', to: 'books#index', as: :books"
+      rewrite "apps/web/controllers/home/index.rb", <<~EOF
+        module Web::Controllers::Home
+          class Index
+            include Web::Action
+
+            def call(params)
+              redirect_to routes.books_url
+            end
+          end
+        end
+      EOF
+
+      server do
+        visit "/"
+
+        expect(current_path).to eq("/books")
+      end
+    end
+  end
+
+  it "uses routing helpers within view" do
+    with_project do
+      generate "action web books#index --url=/books"
+      generate "action web books#show --url=/books/:id"
+
+      # Add `as:` option, so it can be used by the routing helper
+      replace "apps/web/config/routes.rb", "/books/:id", "get '/books/:id', to: 'books#show', as: :book"
+      rewrite "apps/web/views/books/index.rb", <<~EOF
+        module Web::Views::Books
+          class Index
+            include Web::View
+
+            def featured_book_path
+              routes.path(:book, id: 23)
+            end
+          end
+        end
+      EOF
+      rewrite "apps/web/templates/books/index.html.erb", <<~EOF
+        <h1>Books</h1>
+        <h2><a href="<%= featured_book_path %>">Featured Book</a></h2>
+      EOF
+
+      server do
+        visit "/books"
+
+        expect(page.body).to include(%(<a href="/books/23">Featured Book</a>))
+      end
+    end
+  end
+end

data/spec/integration/security/content_security_policy_spec.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+RSpec.describe "Content-Security-Policy header", type: :integration do
+  it "returns default value" do
+    with_project do
+      generate "action web home#index --url=/"
+
+      server do
+        get "/"
+
+        expect(last_response.status).to                             eq(200)
+        expect(last_response.headers["Content-Security-Policy"]).to eq("form-action 'self'; frame-ancestors 'self'; base-uri 'self'; default-src 'none'; script-src 'self'; connect-src 'self'; img-src 'self' https: data:; style-src 'self' 'unsafe-inline' https:; font-src 'self'; object-src 'none'; plugin-types app/pdf; child-src 'self'; frame-src 'self'; media-src 'self'")
+      end
+    end
+  end
+
+  it "returns custom value" do
+    with_project do
+      generate "action web home#index --url=/"
+
+      replace "apps/web/app.rb", "script-src 'self';", "script-src 'self' https://code.jquery.com;"
+
+      server do
+        get "/"
+
+        expect(last_response.status).to                             eq(200)
+        expect(last_response.headers["Content-Security-Policy"]).to eq("form-action 'self'; frame-ancestors 'self'; base-uri 'self'; default-src 'none'; script-src 'self' https://code.jquery.com; connect-src 'self'; img-src 'self' https: data:; style-src 'self' 'unsafe-inline' https:; font-src 'self'; object-src 'none'; plugin-types app/pdf; child-src 'self'; frame-src 'self'; media-src 'self'")
+      end
+    end
+  end
+
+  it "doesn't send header if setting is removed" do
+    with_project do
+      generate "action web home#index --url=/"
+
+      replace "apps/web/app.rb", "security.content_security_policy %{", "%{"
+
+      server do
+        get "/"
+
+        expect(last_response.status).to      eq(200)
+        expect(last_response.headers).to_not have_key("Content-Security-Policy")
+      end
+    end
+  end
+end

data/spec/integration/security/csrf_protection_spec.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+RSpec.describe "CSRF protection", type: :integration do
+  it "protects POST endpoints from invalid token" do
+    with_project do
+      generate "action web books#create --url=/books --method=POST"
+      replace "apps/web/app.rb", "# sessions :cookie, secret: ENV['WEB_SESSIONS_SECRET']", "sessions :cookie, secret: ENV['WEB_SESSIONS_SECRET']"
+
+      server do
+        post "/books", title: "TDD", _csrf_token: "invalid"
+
+        expect(last_response.status).to eq(500)
+      end
+    end
+  end
+
+  it "protects PATCH endpoints from invalid token" do
+    with_project do
+      generate "action web books#update --url=/books/:id --method=PATCH"
+      replace "apps/web/app.rb", "# sessions :cookie, secret: ENV['WEB_SESSIONS_SECRET']", "sessions :cookie, secret: ENV['WEB_SESSIONS_SECRET']"
+
+      server do
+        patch "/books/1", title: "Foo", _csrf_token: "invalid"
+
+        expect(last_response.status).to eq(500)
+      end
+    end
+  end
+
+  it "protects DELETE endpoints from invalid token" do
+    with_project do
+      generate "action web books#destroy --url=/books/:id --method=DELETE"
+      replace "apps/web/app.rb", "# sessions :cookie, secret: ENV['WEB_SESSIONS_SECRET']", "sessions :cookie, secret: ENV['WEB_SESSIONS_SECRET']"
+
+      server do
+        delete "/books/1", _csrf_token: "invalid"
+
+        expect(last_response.status).to eq(500)
+      end
+    end
+  end
+end

data/spec/integration/security/force_ssl_spec.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+RSpec.describe "force SSL", type: :integration do
+  it "forces SSL" do
+    project = "bookshelf_force_ssl"
+
+    with_project(project, server: :puma) do
+      generate "action web home#index --url=/"
+
+      inject_line_after "apps/web/app.rb", "configure do", "force_ssl true"
+
+      RSpec::Support::Env["HANAMI_ENV"]   = "production"
+      RSpec::Support::Env["DATABASE_URL"] = "sqlite://#{Pathname.new('db').join('bookshelf.sqlite')}"
+      RSpec::Support::Env["SMTP_HOST"]    = "localhost"
+      RSpec::Support::Env["SMTP_PORT"]    = "25"
+
+      # key  = Pathname.new(__dir__).join("..", "fixtures", "openssl", "server.key").realpath
+      # cert = Pathname.new(__dir__).join("..", "fixtures", "openssl", "server.crt").realpath
+
+      # bundle_exec "puma -b 'ssl://127.0.0.1:2300?key=#{key}&cert=#{cert}'" do
+      server do
+        # FIXME: I know, it's lame how I solved this problem, but I can't get Excon to do SSL handshake
+        expect do
+          get "/"
+        end.to raise_error(Excon::Error::Socket)
+      end
+    end
+  end
+end

data/spec/integration/security/x_content_type_options_spec.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+RSpec.describe "X-Content-Type-Options header", type: :integration do
+  it "returns default value" do
+    with_project do
+      generate "action web home#index --url=/"
+
+      server do
+        get "/"
+
+        expect(last_response.status).to                            eq(200)
+        expect(last_response.headers["X-Content-Type-Options"]).to eq("nosniff")
+      end
+    end
+  end
+
+  it "returns custom value" do
+    with_project do
+      generate "action web home#index --url=/"
+
+      replace "apps/web/app.rb", "security.x_content_type_options 'nosniff'", "security.x_content_type_options 'foo'"
+
+      server do
+        get "/"
+
+        expect(last_response.status).to                            eq(200)
+        expect(last_response.headers["X-Content-Type-Options"]).to eq("foo")
+      end
+    end
+  end
+
+  it "doesn't send header if setting is removed" do
+    with_project do
+      generate "action web home#index --url=/"
+
+      replace "apps/web/app.rb", "security.x_content_type_options 'nosniff'", ""
+
+      server do
+        get "/"
+
+        expect(last_response.status).to      eq(200)
+        expect(last_response.headers).to_not have_key("X-Content-Type-Options")
+      end
+    end
+  end
+end

data/spec/integration/security/x_frame_options_spec.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+RSpec.describe "X-Frame-Options header", type: :integration do
+  it "returns default value" do
+    with_project do
+      generate "action web home#index --url=/"
+
+      server do
+        get "/"
+
+        expect(last_response.status).to                     eq(200)
+        expect(last_response.headers["X-Frame-Options"]).to eq("DENY")
+      end
+    end
+  end
+
+  it "returns custom value" do
+    with_project do
+      generate "action web home#index --url=/"
+
+      replace "apps/web/app.rb", "security.x_frame_options 'DENY'", "security.x_frame_options 'ALLOW-FROM https://example.test/'"
+
+      server do
+        get "/"
+
+        expect(last_response.status).to                     eq(200)
+        expect(last_response.headers["X-Frame-Options"]).to eq("ALLOW-FROM https://example.test/")
+      end
+    end
+  end
+
+  it "doesn't send header if setting is removed" do
+    with_project do
+      generate "action web home#index --url=/"
+
+      replace "apps/web/app.rb", "security.x_frame_options 'DENY'", ""
+
+      server do
+        get "/"
+
+        expect(last_response.status).to      eq(200)
+        expect(last_response.headers).to_not have_key("X-Frame-Options")
+      end
+    end
+  end
+end

data/spec/integration/security/x_xss_protection_spec.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+RSpec.describe "X-XSS-Protection header", type: :integration do
+  it "returns default value" do
+    with_project do
+      generate "action web home#index --url=/"
+
+      server do
+        get "/"
+
+        expect(last_response.status).to                      eq(200)
+        expect(last_response.headers["X-XSS-Protection"]).to eq("1; mode=block")
+      end
+    end
+  end
+
+  it "returns custom value" do
+    with_project do
+      generate "action web home#index --url=/"
+
+      replace "apps/web/app.rb", "security.x_xss_protection '1; mode=block'", "security.x_xss_protection '0'"
+
+      server do
+        get "/"
+
+        expect(last_response.status).to                      eq(200)
+        expect(last_response.headers["X-XSS-Protection"]).to eq("0")
+      end
+    end
+  end
+
+  it "doesn't send header if setting is removed" do
+    with_project do
+      generate "action web home#index --url=/"
+
+      replace "apps/web/app.rb", "security.x_xss_protection '1; mode=block'", ""
+
+      server do
+        get "/"
+
+        expect(last_response.status).to      eq(200)
+        expect(last_response.headers).to_not have_key("X-XSS-Protection")
+      end
+    end
+  end
+end

data/spec/integration/send_file_spec.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+RSpec.describe "Send file", type: :integration do
+  it "sends file from the public directory" do
+    with_project do
+      write "public/static.txt", "Static file"
+      generate "action web home#index --url=/"
+      rewrite "apps/web/controllers/home/index.rb", <<~EOF
+        module Web::Controllers::Home
+          class Index
+            include Web::Action
+
+            def call(params)
+              send_file "static.txt"
+            end
+          end
+        end
+      EOF
+
+      server do
+        get "/"
+
+        expect(last_response.status).to eq(200)
+        expect(last_response.body).to   include("Static file")
+      end
+    end
+  end
+
+  it "doesn't send file outside of public directory" do
+    with_project do
+      generate "action web home#index --url=/"
+      rewrite "apps/web/controllers/home/index.rb", <<~EOF
+        module Web::Controllers::Home
+          class Index
+            include Web::Action
+
+            def call(params)
+              send_file __FILE__
+            end
+          end
+        end
+      EOF
+
+      server do
+        get "/"
+
+        expect(last_response.status).to eq(404)
+      end
+    end
+  end
+end