haveapi 0.28.3 → 0.29.0

data/lib/haveapi/tasks/i18n.rb

@@ -0,0 +1,198 @@
+require 'yaml'
+
+module HaveAPI
+  module Tasks
+    class I18nHealth
+      KEY_LITERAL_PATTERN = /['"](haveapi\.[a-z0-9_.]+)['"]/
+
+      RAW_MESSAGE_PATTERNS = [
+        /report_error\([^#\n]*,\s*['"]/,
+        /error!\(\s*['"]/,
+        /HaveAPI::ValidationError(?:\.new)?\(\s*['"]/,
+        /raise\s+HaveAPI::ValidationError,\s*['"]/,
+        /ret\[:message\]\s*=\s*['"]/,
+        /\|\|\s*['"][^'"]+(?:failed|error|denied|not found|invalid|requires|unsupported|missing)/,
+        /@message\s*=\s*take\(\s*:message\s*,\s*['"]/
+      ].freeze
+
+      PARAMETER_METHODS = %w[
+        bool custom datetime float id integer password resource string text
+      ].freeze
+      PARAMETER_CALL_PATTERN = /\A\s*(?:#{PARAMETER_METHODS.join('|')})\b/
+      RAW_PARAMETER_METADATA_PATTERN = /\b(?:label|desc):\s*['"]/
+
+      def initialize(root:)
+        @root = root
+      end
+
+      def check!
+        errors = []
+        errors.concat(missing_key_errors)
+        errors.concat(unused_key_errors)
+        errors.concat(raw_message_errors)
+
+        return true if errors.empty?
+
+        raise "i18n health check failed:\n#{errors.join("\n")}"
+      end
+
+      def normalize!
+        locale_data.each do |locale, data|
+          file = File.join(locale_dir, "#{locale}.yml")
+          File.write(file, YAML.dump(locale.to_s => deep_sort(data)))
+        end
+      end
+
+      private
+
+      def missing_key_errors
+        reference_locale = :en
+        reference_keys = locale_keys.fetch(reference_locale)
+
+        locale_keys.flat_map do |locale, keys|
+          next [] if locale == reference_locale
+
+          (reference_keys - keys).sort.map do |key|
+            "#{locale}: missing #{key}"
+          end
+        end
+      end
+
+      def unused_key_errors
+        keys = locale_keys.fetch(:en)
+        used = used_keys
+
+        (keys - used).sort.map { |key| "unused translation key #{key}" }
+      end
+
+      def raw_message_errors
+        source_files.flat_map do |file|
+          rel = relative_path(file)
+
+          File.readlines(file, chomp: true).each_with_index.filter_map do |line, index|
+            stripped = line.strip
+            next if stripped.empty? || stripped.start_with?('#')
+
+            if RAW_MESSAGE_PATTERNS.any? { |pattern| pattern.match?(line) }
+              "#{rel}:#{index + 1}: raw user-facing framework message"
+            end
+          end
+        end + raw_parameter_metadata_errors
+      end
+
+      def raw_parameter_metadata_errors
+        source_files.flat_map do |file|
+          rel = relative_path(file)
+          inside_parameter = false
+          remaining_lines = 0
+
+          File.readlines(file, chomp: true).each_with_index.filter_map do |line, index|
+            stripped = line.strip
+            next if stripped.empty? || stripped.start_with?('#')
+
+            if PARAMETER_CALL_PATTERN.match?(stripped)
+              inside_parameter = true
+              remaining_lines = 12
+            end
+
+            if inside_parameter && RAW_PARAMETER_METADATA_PATTERN.match?(line)
+              "#{rel}:#{index + 1}: raw action parameter label/description"
+            end
+          ensure
+            if inside_parameter
+              remaining_lines -= 1
+              inside_parameter = false if remaining_lines <= 0 || parameter_call_end?(stripped)
+            end
+          end
+        end
+      end
+
+      def parameter_call_end?(line)
+        return false if line.nil?
+
+        stripped = line.strip
+        return false if stripped.empty?
+        return false if stripped.end_with?(',', '\\')
+
+        true
+      end
+
+      def used_keys
+        @used_keys ||= source_files.each_with_object(Set.new) do |file, ret|
+          File.read(file).scan(KEY_LITERAL_PATTERN) do |match|
+            ret << match.first
+          end
+        end
+      end
+
+      def locale_keys
+        @locale_keys ||= locale_data.transform_values do |data|
+          flatten_keys(data)
+        end
+      end
+
+      def locale_data
+        @locale_data ||= Dir[File.join(locale_dir, '*.yml')].to_h do |file|
+          locale = File.basename(file, '.yml').to_sym
+          data = YAML.safe_load_file(file, aliases: true) || {}
+
+          [locale, data.fetch(locale.to_s)]
+        end
+      end
+
+      def flatten_keys(hash, prefix = nil)
+        hash.each_with_object(Set.new) do |(key, value), ret|
+          name = [prefix, key].compact.join('.')
+
+          if value.is_a?(Hash)
+            ret.merge(flatten_keys(value, name))
+          else
+            ret << name
+          end
+        end
+      end
+
+      def deep_sort(value)
+        case value
+        when Hash
+          value.keys.sort.to_h do |key|
+            [key, deep_sort(value[key])]
+          end
+        else
+          value
+        end
+      end
+
+      def source_files
+        @source_files ||= Dir[File.join(@root, 'lib/haveapi/**/*.rb')].reject do |file|
+          rel = relative_path(file)
+          rel.start_with?('lib/haveapi/public/') ||
+            rel.start_with?('lib/haveapi/views/') ||
+            rel.start_with?('lib/haveapi/client_examples/') ||
+            rel.start_with?('lib/haveapi/spec/') ||
+            rel.start_with?('lib/haveapi/tasks/i18n.rb')
+        end
+      end
+
+      def relative_path(file)
+        file.delete_prefix("#{@root}/")
+      end
+
+      def locale_dir
+        File.join(@root, 'lib/haveapi/locales')
+      end
+    end
+  end
+end
+
+namespace :i18n do
+  desc 'Check HaveAPI translation coverage and raw framework messages'
+  task :health do
+    HaveAPI::Tasks::I18nHealth.new(root: File.expand_path('../../..', __dir__)).check!
+  end
+
+  desc 'Normalize HaveAPI locale files'
+  task :normalize do
+    HaveAPI::Tasks::I18nHealth.new(root: File.expand_path('../../..', __dir__)).normalize!
+  end
+end

data/lib/haveapi/validator_chain.rb

@@ -72,7 +72,7 @@ module HaveAPI
         validator = validator.clone
         next if validator.validate(value, params)
 
-        ret << format(validator.message, value:)
+        ret << HaveAPI.localize(validator.message, value:)
       end
 
       ret.empty? ? true : ret

data/lib/haveapi/validators/acceptance.rb

@@ -23,13 +23,16 @@ module HaveAPI
                  take(:value)
                end
 
-      @message = take(:message, "has to be #{@value}")
+      @message = take(
+        :message,
+        HaveAPI.message('haveapi.validators.acceptance.accepted', value: @value)
+      )
     end
 
     def describe
       {
         value: @value,
-        message: @message
+        message: HaveAPI.localize(@message)
       }
     end
 

data/lib/haveapi/validators/confirmation.rb

@@ -24,7 +24,10 @@ module HaveAPI
       @equal = take(:equal, true)
       @message = take(
         :message,
-        @equal ? "must be the same as #{@param}" : "must be different from #{@param}"
+        HaveAPI.message(
+          @equal ? 'haveapi.validators.confirmation.same' : 'haveapi.validators.confirmation.different',
+          parameter: @param
+        )
       )
     end
 
@@ -32,7 +35,7 @@ module HaveAPI
       {
         equal: @equal ? true : false,
         parameter: @param,
-        message: @message
+        message: HaveAPI.localize(@message)
       }
     end
 

data/lib/haveapi/validators/exclusion.rb

@@ -23,13 +23,13 @@ module HaveAPI
         v.is_a?(::Symbol) ? v.to_s : v
       end
 
-      @message = take(:message, '%{value} cannot be used')
+      @message = take(:message, HaveAPI.message('haveapi.validators.exclusion.excluded'))
     end
 
     def describe
       {
         values: @values,
-        message: @message
+        message: HaveAPI.localize(@message)
       }
     end
 

data/lib/haveapi/validators/format.rb

@@ -20,7 +20,10 @@ module HaveAPI
       @rx = simple? ? take : take(:rx)
       @match = take(:match, true)
       @desc = take(:desc)
-      @message = take(:message, @desc || '%{value} is not in a valid format')
+      @message = take(
+        :message,
+        @desc || HaveAPI.message('haveapi.validators.format.invalid')
+      )
     end
 
     def describe
@@ -28,7 +31,7 @@ module HaveAPI
         rx: @rx.source,
         match: @match,
         description: @desc,
-        message: @message
+        message: HaveAPI.localize(@message)
       }
     end
 

data/lib/haveapi/validators/inclusion.rb

@@ -31,13 +31,13 @@ module HaveAPI
         @values = values.map { |v| v.is_a?(::Symbol) ? v.to_s : v }
       end
 
-      @message = take(:message, '%{value} cannot be used')
+      @message = take(:message, HaveAPI.message('haveapi.validators.inclusion.included'))
     end
 
     def describe
       {
         values: @values,
-        message: @message
+        message: HaveAPI.localize(@message)
       }
     end
 

data/lib/haveapi/validators/length.rb

@@ -30,16 +30,16 @@ module HaveAPI
       end
 
       msg = if @equals
-              "length has to be #{@equals}"
+              HaveAPI.message('haveapi.validators.length.equals', equals: @equals)
 
             elsif @min && !@max
-              "length has to be minimally #{@min}"
+              HaveAPI.message('haveapi.validators.length.min', min: @min)
 
             elsif !@min && @max
-              "length has to be maximally #{@max}"
+              HaveAPI.message('haveapi.validators.length.max', max: @max)
 
             else
-              "length has to be in range <#{@min}, #{@max}>"
+              HaveAPI.message('haveapi.validators.length.range', min: @min, max: @max)
             end
 
       @message = take(:message, msg)
@@ -47,7 +47,7 @@ module HaveAPI
 
     def describe
       ret = {
-        message: @message
+        message: HaveAPI.localize(@message)
       }
 
       if @equals

data/lib/haveapi/validators/numericality.rb

@@ -32,49 +32,47 @@ module HaveAPI
       @even = take(:even)
       @odd = take(:odd)
 
-      msg = if @min && !@max
-              "has to be minimally #{@min}"
-
-            elsif !@min && @max
-              "has to be maximally #{@max}"
-
-            elsif @min && @max
-              "has to be in range <#{@min}, #{@max}>"
-
-            else
-              'has to be a number'
-            end
+      requirements = []
+
+      requirements << if @min && !@max
+                        HaveAPI.message('haveapi.validators.numericality.min', min: @min)
+                      elsif !@min && @max
+                        HaveAPI.message('haveapi.validators.numericality.max', max: @max)
+                      elsif @min && @max
+                        HaveAPI.message('haveapi.validators.numericality.range', min: @min, max: @max)
+                      else
+                        HaveAPI.message('haveapi.validators.numericality.number')
+                      end
 
       if @step
-        msg += '; ' unless msg.empty?
-        msg += "in steps of #{@step}"
+        requirements << HaveAPI.message('haveapi.validators.numericality.step', step: @step)
       end
 
       if @mod
-        msg += '; ' unless msg.empty?
-        msg += "mod #{@step} must equal zero"
+        requirements << HaveAPI.message('haveapi.validators.numericality.mod', mod: @mod)
       end
 
       if @odd
-        msg += '; ' unless msg.empty?
-        msg += 'odd'
+        requirements << HaveAPI.message('haveapi.validators.numericality.odd')
       end
 
       if @even
-        msg += '; ' unless msg.empty?
-        msg += 'even'
+        requirements << HaveAPI.message('haveapi.validators.numericality.even')
       end
 
       if @odd && @even
         raise 'cannot be both odd and even at the same time'
       end
 
-      @message = take(:message, msg)
+      @message = take(
+        :message,
+        HaveAPI.message('haveapi.validators.numericality.composite', requirements:)
+      )
     end
 
     def describe
       ret = {
-        message: @message
+        message: HaveAPI.localize(@message)
       }
 
       ret[:min] = @min if @min

data/lib/haveapi/validators/presence.rb

@@ -21,14 +21,16 @@ module HaveAPI
       @empty = take(:empty, false)
       @message = take(
         :message,
-        @empty ? 'must be present' : 'must be present and non-empty'
+        HaveAPI.message(
+          @empty ? 'haveapi.validators.presence.present' : 'haveapi.validators.presence.non_empty'
+        )
       )
     end
 
     def describe
       {
         empty: @empty,
-        message: @message
+        message: HaveAPI.localize(@message)
       }
     end
 

data/lib/haveapi/version.rb

@@ -1,4 +1,4 @@
 module HaveAPI
   PROTOCOL_VERSION = '2.0'.freeze
-  VERSION = '0.28.3'.freeze
+  VERSION = '0.29.0'.freeze
 end

data/lib/haveapi.rb

@@ -13,6 +13,7 @@ module HaveAPI
   module Actions; end
 end
 
+require_relative 'haveapi/i18n'
 require_relative 'haveapi/params'
 require_rel 'haveapi/parameters/'
 require_rel 'haveapi/*.rb'

data/spec/authentication/oauth2_spec.rb

@@ -218,6 +218,16 @@ describe HaveAPI::Authentication::OAuth2 do
       expect(api_response.message).to match(/too many|multiple/i)
     end
 
+    it 'localizes multiple token conflicts' do
+      header 'Accept-Language', 'cs'
+      header 'Authorization', 'Bearer abc'
+      call_api(:post, '/v1/secures/ping?access_token=abc', {})
+
+      expect(last_response.status).to eq(400)
+      expect(api_response).to be_failed
+      expect(api_response.message).to eq('Bylo poskytnuto více OAuth2 tokenů')
+    end
+
     it 'ignores structured access_token query values before backend lookup' do
       expect do
         call_api(:post, '/v1/secures/ping?access_token[]=abc', {})

data/spec/extensions/exception_mailer_spec.rb

@@ -0,0 +1,195 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'stringio'
+
+module ExceptionMailerSpec
+  class RequestError < StandardError; end
+  class ActionError < StandardError; end
+end
+
+describe HaveAPI::Extensions::ExceptionMailer do
+  api do
+    define_resource(:Test) do
+      version 1
+      auth false
+
+      define_action(:RequestError) do
+        route 'request_error'
+        http_method :get
+
+        authorize do
+          raise ExceptionMailerSpec::RequestError, 'request boom'
+        end
+
+        def exec
+          ok!
+        end
+      end
+
+      define_action(:InputRequestError) do
+        route 'input_request_error'
+        http_method :post
+
+        authorize do
+          raise ExceptionMailerSpec::RequestError, 'request boom'
+        end
+
+        def exec
+          ok!
+        end
+      end
+
+      define_action(:ActionError) do
+        route 'action_error'
+        http_method :get
+        authorize { allow }
+
+        def exec
+          raise ExceptionMailerSpec::ActionError, 'action boom'
+        end
+      end
+    end
+  end
+
+  default_version 1
+
+  def with_exception_mailer(mailer)
+    action_hooks = HaveAPI::Hooks.hooks[HaveAPI::Action][:exec_exception]
+    original_action_listeners = action_hooks[:listeners].dup
+    server = app.settings.api_server
+    original_server_hooks = dup_instance_hooks(server)
+
+    mailer.enabled(server)
+    yield
+  ensure
+    action_hooks[:listeners] = original_action_listeners
+    restore_instance_hooks(server, original_server_hooks)
+  end
+
+  def dup_instance_hooks(server)
+    hooks = server.instance_variable_get(HaveAPI::Hooks::INSTANCE_VARIABLE)
+    return unless hooks
+
+    hooks.transform_values do |hook|
+      hook.merge(listeners: hook[:listeners].dup)
+    end
+  end
+
+  def restore_instance_hooks(server, hooks)
+    if hooks
+      server.instance_variable_set(HaveAPI::Hooks::INSTANCE_VARIABLE, hooks)
+    elsif server.instance_variable_defined?(HaveAPI::Hooks::INSTANCE_VARIABLE)
+      server.remove_instance_variable(HaveAPI::Hooks::INSTANCE_VARIABLE)
+    end
+  end
+
+  def collect_mail_calls(mailer)
+    calls = []
+
+    allow(mailer).to receive(:mail) do |context, exception, body|
+      calls << [context, exception, body]
+    end
+
+    calls
+  end
+
+  def new_mailer
+    described_class.new(
+      from: 'from@example.test',
+      to: 'to@example.test',
+      subject: '[spec] %s',
+      smtp: false
+    )
+  end
+
+  it 'mails request-level exceptions outside action execution' do
+    mailer = new_mailer
+    calls = collect_mail_calls(mailer)
+
+    with_exception_mailer(mailer) do
+      get '/v1/tests/request_error'
+    end
+
+    expect(last_response.status).to eq(500)
+    expect(api_response).not_to be_ok
+    expect(api_response.message).to eq('Server error occurred')
+
+    expect(calls.size).to eq(1)
+    context, exception, body = calls.first
+    expect(context.action.to_s).to include('RequestError')
+    expect(exception).to be_a(ExceptionMailerSpec::RequestError)
+    expect(body).to include('request boom')
+  end
+
+  it 'redacts secrets from request-level exception emails' do
+    mailer = new_mailer
+    calls = collect_mail_calls(mailer)
+    header_secret = %w[HEADER SECRET].join('_')
+    header_token_secret = %w[HEADER TOKEN SECRET].join('_')
+    cookie_secret = %w[COOKIE SECRET].join('_')
+    query_secret = %w[QUERY SECRET].join('_')
+    body_secret = %w[BODY SECRET].join('_')
+    nested_secret = %w[NESTED SECRET].join('_')
+
+    with_exception_mailer(mailer) do
+      header 'Accept', 'application/json'
+      header 'Content-Type', 'application/json'
+      header 'Authorization', "Bearer #{header_secret}"
+      header 'Cookie', "session=#{cookie_secret}"
+      header 'X-Auth-Token', header_token_secret
+      post "/v1/tests/input_request_error?_auth_token=#{query_secret}", JSON.generate({
+        password: body_secret,
+        nested: {
+          token: nested_secret,
+          visible: 'VISIBLE_VALUE'
+        }
+      })
+    end
+
+    body = calls.first[2]
+
+    expect(body).to include('VISIBLE_VALUE')
+    expect(body).to include(HaveAPI::Extensions::ExceptionMailer::FILTERED_VALUE)
+    [
+      header_secret,
+      header_token_secret,
+      cookie_secret,
+      query_secret,
+      body_secret,
+      nested_secret
+    ].each do |secret|
+      expect(body).not_to include(secret)
+    end
+  end
+
+  it 'mails action execution exceptions' do
+    mailer = new_mailer
+    calls = collect_mail_calls(mailer)
+
+    with_exception_mailer(mailer) do
+      get '/v1/tests/action_error'
+    end
+
+    expect(last_response.status).to eq(500)
+    expect(api_response).not_to be_ok
+    expect(calls.size).to eq(1)
+    expect(calls.first[1]).to be_a(ExceptionMailerSpec::ActionError)
+    expect(calls.first[2]).to include('action boom')
+  end
+
+  it 'does not replace the API response when mail delivery fails' do
+    mailer = new_mailer
+    allow(mailer).to receive(:mail).and_raise(StandardError, 'smtp down')
+
+    with_exception_mailer(mailer) do
+      expect do
+        get '/v1/tests/request_error'
+      end.to output(/ExceptionMailer failed: StandardError: smtp down/).to_stderr
+    end
+
+    expect(last_response.status).to eq(500)
+    expect(api_response).not_to be_ok
+    expect(api_response.message).to eq('Server error occurred')
+  end
+end