jets.benforeva 3.0.17.pre.mount.pre.fix

data/lib/jets/controller/cookies/jar.rb

@@ -0,0 +1,269 @@
+# Based on sinatra/cookies.rb
+# https://github.com/sinatra/sinatra/blob/master/sinatra-contrib/lib/sinatra/cookies.rb
+module Jets::Controller::Cookies
+  class Jar
+    include Enumerable
+    attr_reader :options
+
+    def initialize(controller)
+      @response_string = nil
+      @response_hash   = {}
+      @response        = controller.response
+      @request         = controller.request
+      @deleted         = []
+
+      @options = {
+        path: @request.script_name.to_s.empty? ? '/' : @request.script_name,
+        domain: @request.host == 'localhost' ? nil : @request.host,
+        secure: @request.ssl?,
+        httponly: true
+      }
+    end
+
+    def ==(other)
+      other.respond_to? :to_hash and to_hash == other.to_hash
+    end
+
+    def [](key)
+      response_cookies[key.to_s] || request_cookies[key.to_s]
+    end
+
+    def []=(key, value)
+      set(key, value: value)
+    end
+
+    def assoc(key)
+      to_hash.assoc(key.to_s)
+    end if Hash.method_defined? :assoc
+
+    def clear
+      each_key { |k| delete(k) }
+    end
+
+    def compare_by_identity?
+      false
+    end
+
+    def default
+      nil
+    end
+
+    alias default_proc default
+
+    def delete(key)
+      result = self[key]
+      @response.delete_cookie(key.to_s, @options)
+      result
+    end
+
+    def delete_if
+      return enum_for(__method__) unless block_given?
+      each { |k, v| delete(k) if yield(k, v) }
+      self
+    end
+
+    def each(&block)
+      return enum_for(__method__) unless block_given?
+      to_hash.each(&block)
+    end
+
+    def each_key(&block)
+      return enum_for(__method__) unless block_given?
+      to_hash.each_key(&block)
+    end
+
+    alias each_pair each
+
+    def each_value(&block)
+      return enum_for(__method__) unless block_given?
+      to_hash.each_value(&block)
+    end
+
+    def empty?
+      to_hash.empty?
+    end
+
+    def fetch(key, &block)
+      response_cookies.fetch(key.to_s) do
+        request_cookies.fetch(key.to_s, &block)
+      end
+    end
+
+    def flatten
+      to_hash.flatten
+    end if Hash.method_defined? :flatten
+
+    def has_key?(key)
+      response_cookies.has_key? key.to_s or request_cookies.has_key? key.to_s
+    end
+
+    def has_value?(value)
+      response_cookies.has_value? value or request_cookies.has_value? value
+    end
+
+    def hash
+      to_hash.hash
+    end
+
+    alias include? has_key?
+    alias member?  has_key?
+
+    def index(value)
+      warn "Hash#index is deprecated; use Hash#key"
+      key(value)
+    end
+
+    def inspect
+      "<##{self.class}: #{to_hash.inspect[1..-2]}>"
+    end
+
+    def invert
+      to_hash.invert
+    end if Hash.method_defined? :invert
+
+    def keep_if
+      return enum_for(__method__) unless block_given?
+      delete_if { |*a| not yield(*a) }
+    end
+
+    def key(value)
+      to_hash.key(value)
+    end
+
+    alias key? has_key?
+
+    def keys
+      to_hash.keys
+    end
+
+    def length
+      to_hash.length
+    end
+
+    def merge(other, &block)
+      to_hash.merge(other, &block)
+    end
+
+    def merge!(other)
+      other.each_pair do |key, value|
+        if block_given? and include? key
+          self[key] = yield(key.to_s, self[key], value)
+        else
+          self[key] = value
+        end
+      end
+    end
+
+    def rassoc(value)
+      to_hash.rassoc(value)
+    end
+
+    def rehash
+      response_cookies.rehash
+      request_cookies.rehash
+      self
+    end
+
+    def reject(&block)
+      return enum_for(__method__) unless block_given?
+      to_hash.reject(&block)
+    end
+
+    alias reject! delete_if
+
+    def replace(other)
+      select! { |k, v| other.include?(k) or other.include?(k.to_s)  }
+      merge! other
+    end
+
+    def select(&block)
+      return enum_for(__method__) unless block_given?
+      to_hash.select(&block)
+    end
+
+    alias select! keep_if if Hash.method_defined? :select!
+
+    def set(key, options = {})
+      @response.set_cookie key.to_s, @options.merge(options)
+    end
+
+    def shift
+      key, value = to_hash.shift
+      delete(key)
+      [key, value]
+    end
+
+    alias size length
+
+    def sort(&block)
+      to_hash.sort(&block)
+    end if Hash.method_defined? :sort
+
+    alias store []=
+
+    def to_hash
+      request_cookies.merge(response_cookies)
+    end
+
+    def to_a
+      to_hash.to_a
+    end
+
+    def to_s
+      to_hash.to_s
+    end
+
+    alias update merge!
+    alias value? has_value?
+
+    def values
+      to_hash.values
+    end
+
+    def values_at(*list)
+      list.map { |k| self[k] }
+    end
+
+    private
+
+    def warn(message)
+      super "#{caller.first[/^[^:]:\d+:/]} warning: #{message}"
+    end
+
+    def deleted
+      parse_response
+      @deleted
+    end
+
+    def response_cookies
+      parse_response
+      @response_hash
+    end
+
+    def parse_response
+      string = @response.headers['Set-Cookie']
+      return if @response_string == string
+
+      hash = {}
+
+      string.each_line do |line|
+        key, value = line.split(';', 2).first.to_s.split('=', 2)
+        next if key.nil?
+        key = Rack::Utils.unescape(key)
+        if line =~ /expires=Thu, 01[-\s]Jan[-\s]1970/
+          @deleted << key
+        else
+          @deleted.delete key
+          hash[key] = value
+        end
+      end
+
+      @response_hash.replace hash
+      @response_string = string
+    end
+
+    def request_cookies
+      @request.cookies.reject { |key, value| deleted.include? key }
+    end
+  end
+end

data/lib/jets/controller/cookies.rb

@@ -0,0 +1,38 @@
+# Based on sinatra/cookies.rb
+# https://github.com/sinatra/sinatra/blob/master/sinatra-contrib/lib/sinatra/cookies.rb
+class Jets::Controller
+  # = Jets::Controller::Cookies
+  #
+  # Easy way to deal with cookies
+  #
+  # == Usage
+  #
+  # Allows you to read cookies:
+  #
+  #   def index
+  #     "value: #{cookies[:something]}"
+  #   end
+  #
+  # And of course to write cookies:
+  #
+  #   def show
+  #     cookies[:something] = 'foobar'
+  #     render json: cookies
+  #   end
+  #
+  # And generally behaves like a hash:
+  #
+  #   def index
+  #     cookies.merge! 'foo' => 'bar', 'bar' => 'baz'
+  #     cookies.keep_if { |key, value| key.start_with? 'b' }
+  #     foo, bar = cookies.values_at 'foo', 'bar'
+  #     puts "size: #{cookies.length}"
+  #     render json: cookies
+  #   end
+  #
+  module Cookies
+    def cookies
+      @cookies ||= Jar.new(self)
+    end
+  end
+end

data/lib/jets/controller/error/invalid_authenticity_token.rb

@@ -0,0 +1,6 @@
+class Jets::Controller
+  class Error
+    class InvalidAuthenticityToken < Error #:nodoc:
+    end
+  end
+end

data/lib/jets/controller/error.rb

@@ -0,0 +1,4 @@
+class Jets::Controller
+  class Error < RuntimeError #:nodoc:
+  end
+end

data/lib/jets/controller/forgery_protection.rb

@@ -0,0 +1,43 @@
+class Jets::Controller
+  module ForgeryProtection
+    extend ActiveSupport::Concern
+
+    included do
+      config = Jets.config
+      default_protect_from_forgery = config.dig(:controllers, :default_protect_from_forgery)
+      if default_protect_from_forgery.nil? && config.mode == "html" || default_protect_from_forgery # true
+        protect_from_forgery
+      end
+    end
+
+    class_methods do
+      def protect_from_forgery(options = {})
+        before_action :verify_authenticity_token, options
+      end
+
+      def skip_forgery_protection
+        skip_before_action :verify_authenticity_token
+      end
+
+      def forgery_protection_enabled?
+        # Example:
+        #
+        #    before_actions [[:verify_authenticity_token, {}], [:set_post, {:only=>[:show, :edit, :update, :delete]}
+        #
+        before_actions.map { |a| a[0] }.include?(:verify_authenticity_token)
+      end
+    end
+
+    # Instance methods
+    def verify_authenticity_token
+      return true if Jets.env.test? || request.get? || request.head?
+
+      token = session[:authenticity_token]
+      verified = !token.nil? && (token == params[:authenticity_token] || token == request.headers["x-csrf-token"])
+
+      unless verified
+        raise Error::InvalidAuthenticityToken
+      end
+    end
+  end
+end

data/lib/jets/controller/layout.rb

@@ -0,0 +1,17 @@
+class Jets::Controller
+  module Layout
+    extend ActiveSupport::Concern
+    included do
+      class_attribute :layout_name
+
+      def self.layout(name=nil)
+        if !name.nil?
+          name = name.to_s if name.is_a?(Symbol)
+          self.layout_name = name
+        else
+          self.layout_name
+        end
+      end
+    end # included
+  end # Layout
+end

data/lib/jets/controller/middleware/cors.rb

@@ -0,0 +1,60 @@
+# The rack cors middleware handles all types of requests locally, this includes the OPTIONS request.
+# Remotely on lambda, the rack cors middleware handles all requests except the OPTIONS request.
+# The options request is handled by a OPTIONS API Gateway Method Mock. This is to allow it to bypass
+# API Gateway authorizers.
+module Jets::Controller::Middleware
+  class Cors
+    extend Memoist
+
+    def initialize(app)
+      @app = app
+    end
+
+    def call(env)
+      if env['REQUEST_METHOD'] == 'OPTIONS'
+        return [200, cors_headers(true), StringIO.new]
+      end
+
+      status, headers, body = @app.call(env)
+      cors_headers.each do |k,v|
+        headers[k] ||= v
+      end
+      [status, headers, body]
+    end
+
+    def cors_headers(preflight=false)
+      headers = case Jets.config.cors
+      when true
+        {
+          "access-control-allow-origin" => "*", # Required for CORS support to work
+          "access-control-allow-credentials" => "true" # Required for cookies, authorization headers with HTTPS
+        }
+      when String
+        {
+          "access-control-allow-origin" => Jets.config.cors, # contains Hash with Access-Control-Allow-* values
+          "access-control-allow-credentials" => "true" # Required for cookies, authorization headers with HTTPS
+        }
+      when Hash
+        Jets.config.cors # contains Hash with Access-Control-Allow-* values
+      else
+        {}
+      end
+
+      headers.merge!(preflight_headers) if preflight
+      headers
+    end
+
+  private
+    # Preflight OPTIONS request has extra headers.
+    # This is only used locally. Remotely on AWS Lambda, OPTIONS requests are handled by an API Gateway Method.
+    def preflight_headers
+      # FYI: Jets as part of the rack processing normalizes the casing of these headers eventually.
+      # IE: Access-Control-Allow-Methods
+      default = {
+        "access-control-allow-methods" => "DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT",
+        "access-control-allow-headers" => "Content-Type,X-Amz-Date,Authorization,Auth,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent",
+      }
+      Jets.config.cors_preflight || default
+    end
+  end
+end

data/lib/jets/controller/middleware/local/api_gateway.rb

@@ -0,0 +1,93 @@
+# Takes a Rack env and converts to ApiGateway event
+class Jets::Controller::Middleware::Local
+  class ApiGateway
+    extend Memoist
+
+    def initialize(route, env)
+      @route, @env = route, env
+    end
+
+    def event
+      resource = @route.path(:api_gateway) # posts/{id}/edit
+      path = @env['PATH_INFO'].sub('/','') # remove beginning slash
+      {
+        "resource" => "/#{resource}", # "/posts/{id}/edit"
+        "path" => @env['PATH_INFO'],  # /posts/tung/edit
+        "httpMethod" => @env['REQUEST_METHOD'], # GET
+        "headers" => request_headers,
+        "queryStringParameters" => query_string_parameters,
+        "pathParameters" => @route.extract_parameters(path),
+        "stageVariables" => nil,
+        "requestContext" => {},
+        "body" => get_body,
+        "isBase64Encoded" => false,
+      }
+    end
+    memoize :event
+
+    # Annoying. The headers part of the AWS Lambda proxy structure
+    # does not consisently use the same casing scheme for the header keys.
+    # Sometimes it looks like this:
+    #   Accept-Encoding
+    # and sometimes it looks like this:
+    #   cache-control
+    # Map for special cases when the casing doesn't match.
+    CASING_MAP = {
+      "Cache-Control" => "cache-control",
+      "Content-Type" => "content-type",
+      "Origin" => "origin",
+      "Upgrade-Insecure-Requests" => "upgrade-insecure-requests",
+    }
+
+    # Map rack env headers to Api Gateway event headers. Most rack env headers are
+    # prepended by HTTP_.
+    #
+    # Some API Gateway Lambda Proxy are also in the rack env headers. Example:
+    #
+    #   "X-Amz-Cf-Id": "W8DF6J-lx1bkV00eCiBwIq5dldTSGGiG4BinJlxvN_4o8fCZtbsVjw==",
+    #   "X-Amzn-Trace-Id": "Root=1-5a0dc1ac-58a7db712a57d6aa4186c2ac",
+    #   "X-Forwarded-For": "88.88.88.88, 54.239.203.117",
+    #   "X-Forwarded-Port": "443",
+    #   "X-Forwarded-Proto": "https",
+    #
+    # For sample dump of the event headers, check out:
+    #   spec/fixtures/samples/event-headers-form-post.json
+    #
+    # We generally do add those API Gateway Lambda specific headers because
+    # they would be fake anyway and by not adding them we can distinguish a
+    # local request from a remote request on API Gateway.
+    def request_headers
+      headers = @env.select { |k,v| k =~ /^HTTP_/ }.inject({}) do |h,(k,v)|
+          # map things like HTTP_USER_AGENT to "User-Agent"
+          key = k.sub('HTTP_','').split('_').map(&:capitalize).join('-')
+          h[key] = v
+          h
+        end
+      # Content type is not prepended with HTTP_
+      headers["Content-Type"] = @env["CONTENT_TYPE"] if @env["CONTENT_TYPE"]
+
+      # Adjust the casing so it matches the Lambda AWS Proxy structure
+      CASING_MAP.each do |nice_casing, bad_casing|
+        if headers.key?(nice_casing)
+          headers[bad_casing] = headers.delete(nice_casing)
+        end
+      end
+
+      headers
+    end
+
+    def query_string_parameters
+      Rack::Utils.parse_nested_query(@env['QUERY_STRING'])
+    end
+
+    # To get the post body:
+    #   rack.input: #<StringIO:0x007f8ccf8db9a0>
+    def get_body
+      input = @env["rack.input"] || StringIO.new
+      body = input.read
+      input.rewind # IMPORTANT or else it screws up other middlewares that use the body
+      # return nil for blank string, because Lambda AWS_PROXY does this
+      body unless body.empty?
+    end
+  end
+end

data/lib/jets/controller/middleware/local/mimic_aws_call.rb

@@ -0,0 +1,38 @@
+class Jets::Controller::Middleware::Local
+  class MimicAwsCall
+    extend Memoist
+
+    def initialize(route, env)
+      @route, @env = route, env
+    end
+
+    def vars
+      {
+        'jets.controller' => controller,
+        'lambda.context' => context,
+        'lambda.event' => event,
+        'lambda.meth' => meth,
+      }
+    end
+
+    # Actual controller instance
+    def controller
+      controller_class = @route.controller_name.constantize
+      meth = @route.action_name
+      controller_class.new(event, context, meth)
+    end
+
+    def meth
+      @route.action_name
+    end
+
+    def event
+      @env['adapter.event'] || ApiGateway.new(@route, @env).event
+    end
+    memoize :event
+
+    def context
+      @env['adapter.context'] || {"fake" => "context in mimic_aws_call.rb"}
+    end
+  end
+end

data/lib/jets/controller/middleware/local/route_matcher.rb

@@ -0,0 +1,22 @@
+class Jets::Controller::Middleware::Local
+  class RouteMatcher
+    def initialize(env)
+      @env = env
+    end
+
+    def find_route
+      Jets::Router::Finder.new(path, method).run
+    end
+
+  private
+    attr_reader :env
+
+    def method
+      env["REQUEST_METHOD"] || "GET"
+    end
+
+    def path
+      env["PATH_INFO"].sub(/^\//,'')
+    end
+  end
+end