haveapi 0.27.3 → 0.28.0

data/spec/server/integration_spec.rb

@@ -1,5 +1,19 @@
 # frozen_string_literal: true
 
+module ServerIntegrationSpec
+  module State
+    class << self
+      def reset!
+        writes.clear
+      end
+
+      def writes
+        @writes ||= []
+      end
+    end
+  end
+end
+
 describe HaveAPI::Server do
   describe 'integration' do
     api do
@@ -24,10 +38,38 @@ describe HaveAPI::Server do
           end
         end
       end
+
+      define_resource(:Transfer) do
+        version 1
+        auth false
+
+        define_action(:Create) do
+          route ''
+          http_method :post
+          authorize { allow }
+
+          input(:hash) do
+            integer :amount, required: true
+          end
+
+          output(:hash) do
+            bool :created
+          end
+
+          def exec
+            ServerIntegrationSpec::State.writes << input[:amount]
+            { created: true }
+          end
+        end
+      end
     end
 
     default_version 1
 
+    before do
+      ServerIntegrationSpec::State.reset!
+    end
+
     it 'returns 406 for unsupported Accept' do
       header 'Accept', 'text/plain'
       options '/v1/'
@@ -45,6 +87,54 @@ describe HaveAPI::Server do
       expect(api_response.message).to match(/Bad JSON syntax/)
     end
 
+    it 'returns 400 for non-object JSON bodies' do
+      header 'Content-Type', 'application/json'
+      header 'Accept', 'application/json'
+
+      ['[]', '"msg"', '123', 'true', 'null'].each do |body|
+        post '/v1/tests/echo', body
+
+        expect(last_response.status).to eq(400)
+        expect(api_response).not_to be_ok
+        expect(api_response.message).to eq('JSON body must be an object')
+      end
+    end
+
+    it 'does not accept query-string input for non-GET actions' do
+      header 'Accept', 'application/json'
+      post '/v1/transfers?transfer[amount]=250', nil, {
+        'CONTENT_TYPE' => 'application/x-www-form-urlencoded'
+      }
+
+      expect(last_response.status).to eq(400)
+      expect(api_response).not_to be_ok
+      expect(ServerIntegrationSpec::State.writes).to be_empty
+    end
+
+    it 'rejects non-JSON content types for JSON action bodies' do
+      header 'Accept', 'application/json'
+      post '/v1/transfers', '{"transfer":{"amount":250}}', {
+        'CONTENT_TYPE' => 'text/plain'
+      }
+
+      expect(last_response.status).to eq(415)
+      expect(api_response).not_to be_ok
+      expect(api_response.message).to eq('Unsupported Content-Type')
+      expect(ServerIntegrationSpec::State.writes).to be_empty
+    end
+
+    it 'returns 400 for malformed Accept headers' do
+      invalid_accept = (+"\xFF").force_encoding(Encoding::UTF_8)
+      header 'Accept', invalid_accept
+      header 'Content-Type', 'application/json'
+
+      post '/v1/tests/echo', '{}'
+
+      expect(last_response.status).to eq(400)
+      expect(api_response).not_to be_ok
+      expect(api_response.message).to eq('Bad Accept header')
+    end
+
     it 'returns JSON envelope for unknown route' do
       header 'Accept', 'application/json'
       get '/does-not-exist'

data/spec/validator_chain_spec.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module HaveAPI::Validators
+  class CloneProbe < HaveAPI::Validator
+    name :clone_probe
+    takes :clone_probe
+
+    class << self
+      attr_accessor :seen
+    end
+
+    self.seen = []
+
+    def setup
+      @message = 'invalid'
+    end
+
+    def describe
+      {}
+    end
+
+    def valid?(_v)
+      self.class.seen << object_id
+      true
+    end
+  end
+end
+
+describe HaveAPI::ValidatorChain do
+  it 'validates with per-call validator clones' do
+    chain = described_class.new(clone_probe: true)
+    original = chain.instance_variable_get(:@validators).first
+
+    HaveAPI::Validators::CloneProbe.seen.clear
+    expect(chain.validate('value', {})).to be true
+
+    expect(HaveAPI::Validators::CloneProbe.seen).not_to include(original.object_id)
+  end
+end

data/spec/validators/confirmation_spec.rb

@@ -41,4 +41,18 @@ describe HaveAPI::Validators::Confirmation do
       expect(validator.validate('bar', { other_param: 'foo' })).to be true
     end
   end
+
+  context 'with a string parameter reference' do
+    let(:validator) do
+      described_class.new(:confirm, {
+        param: 'other_param',
+        equal: false
+      })
+    end
+
+    it 'looks up normalized input keys' do
+      expect(validator.validate('foo', { other_param: 'foo' })).to be false
+      expect(validator.validate('bar', { other_param: 'foo' })).to be true
+    end
+  end
 end

data/spec/validators/format_spec.rb

@@ -49,4 +49,11 @@ describe HaveAPI::Validators::Format do
       expect(validator.valid?('b')).to be true
     end
   end
+
+  it 'rejects values that cannot be converted to strings' do
+    validator = described_class.new(:format, /\A[a-z]+\z/)
+
+    expect(validator.valid?(['abc'])).to be false
+    expect(validator.valid?({ value: 'abc' })).to be false
+  end
 end

data/spec/validators/length_spec.rb

@@ -42,4 +42,10 @@ describe HaveAPI::Validators::Length do
     expect(v.valid?('a' * 4)).to be true
     expect(v.valid?('a' * 5)).to be false
   end
+
+  it 'rejects values without length' do
+    validator = described_class.new(:length, { min: 2 })
+
+    expect(validator.valid?(1)).to be false
+  end
 end

data/spec/validators/numericality_spec.rb

@@ -77,4 +77,11 @@ describe HaveAPI::Validators::Numericality do
     v = described_class.new(:number, { min: 5 })
     expect(v.valid?('abc')).to be false
   end
+
+  it 'rejects non-numeric values before numeric operations' do
+    validator = described_class.new(:number, { odd: true })
+
+    expect(validator.valid?(['5'])).to be false
+    expect(validator.valid?({ value: 5 })).to be false
+  end
 end

data/spec/validators/presence_spec.rb

@@ -8,6 +8,8 @@ describe HaveAPI::Validators::Presence do
       expect(validator.valid?(nil)).to be false
       expect(validator.valid?('')).to be false
       expect(validator.valid?(" \t" * 4)).to be false
+      expect(validator.valid?([])).to be false
+      expect(validator.valid?({})).to be false
     end
   end
 

data/test_support/client_test_api.rb

@@ -270,6 +270,7 @@ module HaveAPI
 
         define_action(:Index, superclass: HaveAPI::Actions::Default::Index) do
           extend DocFilter
+
           resolve { |obj| obj[:id] }
           output(:object_list) { use :all }
           authorize { allow }
@@ -285,6 +286,7 @@ module HaveAPI
 
         define_action(:Show, superclass: HaveAPI::Actions::Default::Show) do
           extend DocFilter
+
           resolve { |obj| obj[:id] }
           output(:object) { use :all }
           authorize { allow }
@@ -298,6 +300,7 @@ module HaveAPI
 
         define_action(:Create, superclass: HaveAPI::Actions::Default::Create) do
           extend DocFilter
+
           resolve { |obj| obj[:id] }
           input(:hash) do
             string :name, required: true
@@ -324,6 +327,7 @@ module HaveAPI
 
           define_action(:Index, superclass: HaveAPI::Actions::Default::Index) do
             extend DocFilter
+
             resolve { |obj| [obj[:project_id], obj[:id]] }
             output(:object_list) { use :all }
             authorize { allow }
@@ -339,6 +343,7 @@ module HaveAPI
 
           define_action(:Show, superclass: HaveAPI::Actions::Default::Show) do
             extend DocFilter
+
             resolve { |obj| [obj[:project_id], obj[:id]] }
             output(:object) { use :all }
             authorize { allow }
@@ -352,6 +357,7 @@ module HaveAPI
 
           define_action(:Create, superclass: HaveAPI::Actions::Default::Create) do
             extend DocFilter
+
             resolve { |obj| [obj[:project_id], obj[:id]] }
             input(:hash) do
               string :label, required: true
@@ -371,6 +377,7 @@ module HaveAPI
 
           define_action(:Update, superclass: HaveAPI::Actions::Default::Update) do
             extend DocFilter
+
             resolve { |obj| [obj[:project_id], obj[:id]] }
             input(:hash) do
               bool :done
@@ -391,6 +398,7 @@ module HaveAPI
 
           define_action(:Run) do
             extend DocFilter
+
             route '{task_id}/run'
             http_method :post
             blocking true
@@ -420,6 +428,7 @@ module HaveAPI
 
         define_action(:Fail) do
           extend DocFilter
+
           route 'fail'
           http_method :get
           output(:hash) {}
@@ -430,8 +439,23 @@ module HaveAPI
           end
         end
 
+        define_action(:Slow) do
+          extend DocFilter
+
+          route 'slow'
+          http_method :get
+          output(:hash) {}
+          authorize { allow }
+
+          def exec
+            sleep 1
+            {}
+          end
+        end
+
         define_action(:Echo) do
           extend DocFilter
+
           route 'echo'
           http_method :post
           input(:hash) do
@@ -459,6 +483,7 @@ module HaveAPI
 
         define_action(:EchoOptional) do
           extend DocFilter
+
           route 'echo_optional'
           http_method :post
           input(:hash) do
@@ -483,6 +508,7 @@ module HaveAPI
 
         define_action(:EchoOptionalGet) do
           extend DocFilter
+
           route 'echo_optional_get'
           http_method :get
           input(:hash) do
@@ -507,6 +533,7 @@ module HaveAPI
 
         define_action(:EchoResource) do
           extend DocFilter
+
           route 'echo_resource'
           http_method :post
           input(:hash) do
@@ -524,6 +551,7 @@ module HaveAPI
 
         define_action(:EchoResourceOptional) do
           extend DocFilter
+
           route 'echo_resource_optional'
           http_method :get
           input(:hash) do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: haveapi
 version: !ruby/object:Gem::Version
-  version: 0.27.3
+  version: 0.28.0
 platform: ruby
 authors:
 - Jakub Skokan
@@ -29,14 +29,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.27.3
+        version: 0.28.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.27.3
+        version: 0.28.0
 - !ruby/object:Gem::Dependency
   name: json
   requirement: !ruby/object:Gem::Requirement
@@ -293,7 +293,6 @@ files:
 - lib/haveapi/views/version_sidebar.erb
 - lib/haveapi/views/version_sidebar/auth_nav.erb
 - lib/haveapi/views/version_sidebar/resource_nav.erb
-- shell.nix
 - spec/.rubocop.yml
 - spec/action/authorize_spec.rb
 - spec/action/dsl_spec.rb
@@ -302,9 +301,13 @@ files:
 - spec/authentication/basic_spec.rb
 - spec/authentication/oauth2_spec.rb
 - spec/authentication/token_spec.rb
+- spec/authentication/token_version_routes_spec.rb
 - spec/authorization_spec.rb
 - spec/common_spec.rb
 - spec/documentation/auth_filtering_spec.rb
+- spec/documentation/current_user_html_escaping_spec.rb
+- spec/documentation/examples_spec.rb
+- spec/documentation/host_html_escaping_spec.rb
 - spec/documentation_spec.rb
 - spec/envelope_spec.rb
 - spec/extensions/action_exceptions_spec.rb
@@ -315,6 +318,7 @@ files:
 - spec/resource_spec.rb
 - spec/server/integration_spec.rb
 - spec/spec_helper.rb
+- spec/validator_chain_spec.rb
 - spec/validators/acceptance_spec.rb
 - spec/validators/confirmation_spec.rb
 - spec/validators/custom_spec.rb

data/shell.nix

@@ -1,20 +0,0 @@
-let
-  pkgs = import <nixpkgs> {};
-  stdenv = pkgs.stdenv;
-
-in stdenv.mkDerivation rec {
-  name = "haveapi";
-
-  buildInputs = with pkgs;[
-    ruby_3_3
-    git
-    openssl
-  ];
-
-  shellHook = ''
-    export GEM_HOME=$(pwd)/../../.gems
-    export PATH="$GEM_HOME/bin:$PATH"
-    gem install bundler
-    bundle install
-  '';
-}