lotusrb 0.2.1 → 0.3.0

data/lib/lotus/generators/slice/application.rb.tt

@@ -1,3 +1,5 @@
+require 'lotus/helpers'
+
 module <%= config[:classified_slice_name] %>
   class Application < Lotus::Application
     configure do
@@ -6,12 +8,12 @@ module <%= config[:classified_slice_name] %>
       #
 
       # Define the root path of this application.
-      # All the paths specified in this configuration are relative to this one.
+      # All paths specified in this configuration are relative to path below.
       #
       root __dir__
 
       # Relative load paths where this application will recursively load the code.
-      # Remember to add directories here when you create new.
+      # When you add new directories, remember to add them here.
       #
       load_paths << [
         'controllers',
@@ -87,7 +89,7 @@ module <%= config[:classified_slice_name] %>
       #           uri:  String, 'file:///db/bookshelf'
       #                         'memory://localhost/bookshelf'
       #                         'sqlite:memory:'
-      #                         'sqlite://db/bookshelf.db'
+      #                         'sqlite://db/bookshelf.sqlite3'
       #                         'postgres://localhost/bookshelf'
       #                         'mysql://localhost/bookshelf'
       #
@@ -102,13 +104,13 @@ module <%= config[:classified_slice_name] %>
       # TEMPLATES
       #
 
-      # The layout to be used by all the views
+      # The layout to be used by all views
       #
       layout :application # It will load <%= config[:classified_slice_name] %>::Views::ApplicationLayout
 
-      # The relative path where to find the templates
+      # The relative path to templates
       #
-      # templates 'templates'
+      templates 'templates'
 
       ##
       # ASSETS
@@ -126,12 +128,62 @@ module <%= config[:classified_slice_name] %>
       #
       # serve_assets false
 
+      ##
+      # SECURITY
+      #
+
+      # X-Frame-Options is a HTTP header supported by modern browsers.
+      # It determines if a web page can or cannot be included via <frame> and
+      # <iframe> tags by untrusted domains.
+      #
+      # Web applications can send this header to prevent Clickjacking attacks.
+      #
+      # Read more at:
+      #
+      #   * https://developer.mozilla.org/en-US/docs/Web/HTTP/X-Frame-Options
+      #   * https://www.owasp.org/index.php/Clickjacking
+      #
+      security.x_frame_options "DENY"
+
+      # Content-Security-Policy (CSP) is a HTTP header supported by modern browsers.
+      # It determines trusted sources of execution for dynamic contents
+      # (JavaScript) or other web related assets: stylesheets, images, fonts,
+      # plugins, etc.
+      #
+      # Web applications can send this header to mitigate Cross Site Scripting
+      # (XSS) attacks.
+      #
+      # The default value allows images, scripts, AJAX, and CSS from the same
+      # origin, and does not allow any other resources to load (eg object,
+      # frame, media, etc).
+      #
+      # Inline JavaScript is NOT allowed. To enable it, please use:
+      # "script-src 'unsafe-inline'".
+      #
+      # Content Security Policy introduction:
+      #
+      #  * http://www.html5rocks.com/en/tutorials/security/content-security-policy/
+      #  * https://www.owasp.org/index.php/Content_Security_Policy
+      #  * https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29
+      #
+      # Inline and eval JavaScript risks:
+      #
+      #   * http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
+      #   * http://www.html5rocks.com/en/tutorials/security/content-security-policy/#eval-too
+      #
+      # Content Security Policy usage:
+      #
+      #  * http://content-security-policy.com/
+      #  * https://developer.mozilla.org/en-US/docs/Web/Security/CSP/Using_Content_Security_Policy
+      #
+      security.content_security_policy "default-src 'none'; script-src 'self'; connect-src 'self'; img-src 'self'; style-src 'self';"
+
       ##
       # FRAMEWORKS
       #
 
-      # Configure the code to be yielded each time <%= config[:classified_slice_name] %>::Action will be included
-      # This is useful for share common functionalities
+      # Configure the code that will yield each time <%= config[:classified_slice_name] %>::Action is included
+      # This is useful for sharing common functionality
       #
       # See: http://www.rubydoc.info/gems/lotus-controller#Configuration
       controller.prepare do
@@ -139,12 +191,12 @@ module <%= config[:classified_slice_name] %>
         # before :authenticate!    # run an authentication before callback
       end
 
-      # Configure the code to be yielded each time <%= config[:classified_slice_name] %>::View will be included
-      # This is useful for share common functionalities
+      # Configure the code that will yield each time <%= config[:classified_slice_name] %>::View is included
+      # This is useful for sharing common functionality
       #
       # See: http://www.rubydoc.info/gems/lotus-view#Configuration
       view.prepare do
-        # include MyRoutingHelpers # included in all the views
+        include Lotus::Helpers
       end
     end
 

data/lib/lotus/generators/slice/config/mapping.rb.tt

@@ -1,4 +1,7 @@
-# Configure your database mapping here
+# Configure your database mapping here.
+#
+# Intended for specifying specific slice mappings.
+#
 # See: http://www.rubydoc.info/gems/lotus-model/#Usage
 #
 # collection :users do

data/lib/lotus/loader.rb

@@ -5,6 +5,7 @@ require 'lotus/routes'
 require 'lotus/routing/default'
 require 'lotus/action/cookies'
 require 'lotus/action/session'
+require 'lotus/config/security'
 
 module Lotus
   # Load an application
@@ -49,8 +50,15 @@ module Lotus
         controller = Lotus::Controller.duplicate(namespace) do
           handle_exceptions config.handle_exceptions
           default_format    config.default_format
-
-          prepare { include Lotus::Action::Cookies } if config.cookies
+          default_headers({
+            Lotus::Config::Security::X_FRAME_OPTIONS_HEADER         => config.security.x_frame_options,
+            Lotus::Config::Security::CONTENT_SECURITY_POLICY_HEADER => config.security.content_security_policy
+          })
+
+          if config.cookies.enabled?
+            prepare { include Lotus::Action::Cookies }
+            cookies config.cookies.default_options
+          end
           prepare { include Lotus::Action::Session } if config.sessions.enabled?
 
           config.controller.__apply(self)

data/lib/lotus/lotusrc.rb

@@ -0,0 +1,146 @@
+require 'pathname'
+require 'dotenv'
+
+module Lotus
+  # Create and read the .lotusrc file in the root of the application
+  #
+  # @since 0.3.0
+  # @api private
+  class Lotusrc
+    # Lotusrc name file
+    #
+    # @since 0.3.0
+    # @api private
+    #
+    # @see Lotus::Lotusrc#path_file
+    FILE_NAME = '.lotusrc'.freeze
+
+    # Architecture default value
+    #
+    # @since 0.3.0
+    # @api private
+    #
+    # @see Lotus::Lotusrc#read
+    DEFAULT_ARCHITECTURE = 'container'.freeze
+
+    # Architecture key for writing the lotusrc file
+    #
+    # @since 0.3.0
+    # @api private
+    #
+    # @see Lotus::Lotusrc#read
+    ARCHITECTURE_KEY = 'architecture'.freeze
+
+    # Test suite default value
+    #
+    # @since 0.3.0
+    # @api private
+    #
+    # @see Lotus::Lotusrc#read
+    DEFAULT_TEST_SUITE = 'minitest'.freeze
+
+    # Test suite key for writing the lotusrc file
+    #
+    # @since 0.3.0
+    # @api private
+    #
+    # @see Lotus::Lotusrc#read
+    TEST_KEY = 'test'.freeze
+
+    # Template default value
+    #
+    # @since 0.3.0
+    # @api private
+    #
+    # @see Lotus::Lotusrc#read
+    DEFAULT_TEMPLATE = 'erb'.freeze
+
+    # Template key for writing the lotusrc file
+    #
+    # @since 0.3.0
+    # @api private
+    #
+    # @see Lotus::Lotusrc#read
+    TEMPLATE_KEY = 'template'.freeze
+
+    # Initialize Lotusrc class with application's root and enviroment options.
+    # Create the lotusrc file if it doesn't exist in the root given.
+    #
+    # @param root [Pathname] Application's root
+    # @param options [Hash] Environment's options
+    #
+    # @see Lotus::Environment#initialize
+    def initialize(root, options = {})
+      @root    = root
+      @options = options
+
+      # NOTE this line is here in order to auto-upgrade applications generated
+      # with lotusrb < 0.3.0. Consider to remove it in the future.
+      create
+    end
+
+    # Read lotusrc file and parse it's values.
+    #
+    # @return [Lotus::Utils::Hash] parsed values
+    #
+    # @example Default values if file doesn't exist
+    #   Lotus::Lotusrc.new(Pathname.new(Dir.pwd)).read
+    #    # => { architecture: 'container', test: 'minitest', template: 'erb' }
+    #
+    # @example Custom values if file doesn't exist
+    #   options = { architect: 'application', test: 'rspec', template: 'slim' }
+    #   Lotus::Lotusrc.new(Pathname.new(Dir.pwd), options).read
+    #    # => { architecture: 'application', test: 'rspec', template: 'slim' }
+    def read
+      if exists?
+        lotusrc_options = Dotenv.load path_file
+        Utils::Hash.new(lotusrc_options).symbolize!
+      end
+    end
+
+    private
+
+    # Create lotusrc file if exists
+    #
+    # @since 0.3.0
+    # @api private
+    #
+    # @see Lotus::Lotusrc::DEFAULT_ARCHITECTURE
+    # @see Lotus::Lotusrc::ARCHITECTURE_KEY
+    # @see Lotus::Lotusrc::DEFAULT_TEST_SUITE
+    # @see Lotus::Lotusrc::TEST_KEY
+    # @see Lotus::Lotusrc::DEFAULT_TEMPLATE
+    # @see Lotus::Lotusrc::TEMPLATE_KEY
+    def create
+      unless exists?
+        rcfile = File.new(path_file, "w")
+        rcfile.puts "#{ ARCHITECTURE_KEY }=#{ @options.fetch(:architecture, DEFAULT_ARCHITECTURE) }"
+        rcfile.puts "#{ TEST_KEY }=#{ @options.fetch(:test, DEFAULT_TEST_SUITE) }"
+        rcfile.puts "#{ TEMPLATE_KEY }=#{ @options.fetch(:template, DEFAULT_TEMPLATE) }"
+        rcfile.close
+      end
+    end
+
+    # Check if lotusrc file exists
+    #
+    # @since 0.3.0
+    # @api private
+    #
+    # @return [Boolean] lotusrc file's path existing
+    def exists?
+      path_file.exist?
+    end
+
+    # Return the lotusrc file's path
+    #
+    # @since 0.3.0
+    # @api private
+    #
+    # @return [Pathname] lotusrc file's path
+    #
+    # @see Lotus::Lotusrc::FILE_NAME
+    def path_file
+      @root.join FILE_NAME
+    end
+  end
+end

data/lib/lotus/middleware.rb

@@ -55,8 +55,8 @@ module Lotus
     # Add a middleware to the stack.
     #
     # @param middleware [Object] a Rack middleware
-    # @param *args [Array] optional arguments to pass to the Rack middleware
-    # @param &blk [Proc] an optional block to pass to the Rack middleware
+    # @param args [Array] optional arguments to pass to the Rack middleware
+    # @param blk [Proc] an optional block to pass to the Rack middleware
     #
     # @return [Array] the middleware that was added
     #

data/lib/lotus/routes.rb

@@ -1,3 +1,5 @@
+require 'lotus/utils/escape'
+
 module Lotus
   # Routes factory
   #
@@ -23,7 +25,7 @@ module Lotus
     # @param args [Array,nil] an optional set of arguments that is passed down
     #   to the wrapped route set.
     #
-    # @return [String] the corresponding relative URL
+    # @return [Lotus::Utils::Escape::SafeString] the corresponding relative URL
     #
     # @raise Lotus::Routing::InvalidRouteException
     #
@@ -31,7 +33,7 @@ module Lotus
     #
     # @see http://rdoc.info/gems/lotus-router/Lotus/Router#path-instance_method
     #
-    # @example
+    # @example Basic example
     #   require 'lotus'
     #
     #   module Bookshelf
@@ -49,8 +51,27 @@ module Lotus
     #
     #   Bookshelf::Routes.path(:login, return_to: '/dashboard')
     #     # => '/login?return_to=%2Fdashboard'
+    #
+    # @example Dynamic finders
+    #   require 'lotus'
+    #
+    #   module Bookshelf
+    #     class Application < Lotus::Application
+    #       configure do
+    #         routes do
+    #           get '/login', to: 'sessions#new', as: :login
+    #         end
+    #       end
+    #     end
+    #   end
+    #
+    #   Bookshelf::Routes.login_path
+    #     # => '/login'
+    #
+    #   Bookshelf::Routes.login_path(return_to: '/dashboard')
+    #     # => '/login?return_to=%2Fdashboard'
     def path(name, *args)
-      @routes.path(name, *args)
+      Utils::Escape::SafeString.new(@routes.path(name, *args))
     end
 
     # Return an absolute path for the given route name
@@ -59,7 +80,7 @@ module Lotus
     # @param args [Array,nil] an optional set of arguments that is passed down
     #   to the wrapped route set.
     #
-    # @return [String] the corresponding absolute URL
+    # @return [Lotus::Utils::Escape::SafeString] the corresponding absolute URL
     #
     # @raise Lotus::Routing::InvalidRouteException
     #
@@ -67,7 +88,7 @@ module Lotus
     #
     # @see http://rdoc.info/gems/lotus-router/Lotus/Router#url-instance_method
     #
-    # @example
+    # @example Basic example
     #   require 'lotus'
     #
     #   module Bookshelf
@@ -88,8 +109,43 @@ module Lotus
     #
     #   Bookshelf::Routes.url(:login, return_to: '/dashboard')
     #     # => 'https://bookshelf.org/login?return_to=%2Fdashboard'
+    #
+    # @example Dynamic finders
+    #   require 'lotus'
+    #
+    #   module Bookshelf
+    #     class Application < Lotus::Application
+    #       configure do
+    #         routes do
+    #           scheme 'https'
+    #           host   'bookshelf.org'
+    #
+    #           get '/login', to: 'sessions#new', as: :login
+    #         end
+    #       end
+    #     end
+    #   end
+    #
+    #   Bookshelf::Routes.login_url
+    #     # => 'https://bookshelf.org/login'
+    #
+    #   Bookshelf::Routes.login_url(return_to: '/dashboard')
+    #     # => 'https://bookshelf.org/login?return_to=%2Fdashboard'
     def url(name, *args)
-      @routes.url(name, *args)
+      Utils::Escape::SafeString.new(@routes.url(name, *args))
+    end
+
+    protected
+    # @since 0.3.0
+    # @api private
+    def method_missing(m, *args)
+      named_route, type = m.to_s.split(/\_(path|url)\z/)
+
+      if type
+        public_send(type, named_route.to_sym, *args)
+      else
+        super
+      end
     end
   end
 end

data/lib/lotus/version.rb

@@ -2,5 +2,5 @@ module Lotus
   # Defines the version
   #
   # @since 0.1.0
-  VERSION = '0.2.1'.freeze
+  VERSION = '0.3.0'.freeze
 end

data/lotusrb.gemspec

@@ -13,16 +13,17 @@ Gem::Specification.new do |spec|
   spec.homepage      = 'http://lotusrb.org'
   spec.license       = 'MIT'
 
-  spec.files         = `git ls-files -z -- lib/* bin/* LICENSE.md README.md CHANGELOG.md lotusrb.gemspec`.split("\x0")
+  spec.files         = `git ls-files -z -- lib/* bin/* LICENSE.md README.md CHANGELOG.md FEATURES.md lotusrb.gemspec`.split("\x0")
   spec.executables   = spec.files.grep(%r{^bin/}) { |f| File.basename(f) }
   spec.test_files    = spec.files.grep(%r{^(test)/})
   spec.require_paths = ['lib']
   spec.required_ruby_version = '>= 2.0.0'
 
-  spec.add_dependency 'lotus-utils',      '~> 0.3', '>= 0.3.4'
-  spec.add_dependency 'lotus-router',     '~> 0.2', '>= 0.2.1'
-  spec.add_dependency 'lotus-controller', '~> 0.3', '>= 0.3.2'
-  spec.add_dependency 'lotus-view',       '~> 0.3'
+  spec.add_dependency 'lotus-utils',      '~> 0.4'
+  spec.add_dependency 'lotus-router',     '~> 0.3'
+  spec.add_dependency 'lotus-controller', '~> 0.4'
+  spec.add_dependency 'lotus-view',       '~> 0.4'
+  spec.add_dependency 'lotus-helpers',    '~> 0.1'
   spec.add_dependency 'shotgun',          '~> 0.9'
   spec.add_dependency 'dotenv',           '~> 1.0'
   spec.add_dependency 'thor',             '~> 0.19'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: lotusrb
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.3.0
 platform: ruby
 authors:
 - Luca Guidi
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-02-06 00:00:00.000000000 Z
+date: 2015-03-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: lotus-utils
@@ -16,74 +16,70 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.3'
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 0.3.4
+        version: '0.4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.3'
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 0.3.4
+        version: '0.4'
 - !ruby/object:Gem::Dependency
   name: lotus-router
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.2'
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 0.2.1
+        version: '0.3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.2'
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 0.2.1
+        version: '0.3'
 - !ruby/object:Gem::Dependency
   name: lotus-controller
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.3'
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 0.3.2
+        version: '0.4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.3'
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 0.3.2
+        version: '0.4'
 - !ruby/object:Gem::Dependency
   name: lotus-view
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.3'
+        version: '0.4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.3'
+        version: '0.4'
+- !ruby/object:Gem::Dependency
+  name: lotus-helpers
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.1'
 - !ruby/object:Gem::Dependency
   name: shotgun
   requirement: !ruby/object:Gem::Requirement
@@ -191,6 +187,7 @@ extensions: []
 extra_rdoc_files: []
 files:
 - CHANGELOG.md
+- FEATURES.md
 - LICENSE.md
 - README.md
 - bin/lotus
@@ -199,22 +196,35 @@ files:
 - lib/lotus/application_name.rb
 - lib/lotus/cli.rb
 - lib/lotus/commands/console.rb
+- lib/lotus/commands/db.rb
+- lib/lotus/commands/db/console.rb
+- lib/lotus/commands/generate.rb
 - lib/lotus/commands/new.rb
 - lib/lotus/commands/routes.rb
 - lib/lotus/commands/server.rb
 - lib/lotus/config/assets.rb
 - lib/lotus/config/configure.rb
+- lib/lotus/config/cookies.rb
 - lib/lotus/config/framework_configuration.rb
 - lib/lotus/config/load_paths.rb
 - lib/lotus/config/mapper.rb
 - lib/lotus/config/mapping.rb
 - lib/lotus/config/routes.rb
+- lib/lotus/config/security.rb
 - lib/lotus/config/sessions.rb
 - lib/lotus/configuration.rb
 - lib/lotus/container.rb
 - lib/lotus/environment.rb
 - lib/lotus/frameworks.rb
 - lib/lotus/generators/abstract.rb
+- lib/lotus/generators/action.rb
+- lib/lotus/generators/action/action.rb.tt
+- lib/lotus/generators/action/action_spec.minitest.tt
+- lib/lotus/generators/action/action_spec.rspec.tt
+- lib/lotus/generators/action/template.tt
+- lib/lotus/generators/action/view.rb.tt
+- lib/lotus/generators/action/view_spec.minitest.tt
+- lib/lotus/generators/action/view_spec.rspec.tt
 - lib/lotus/generators/application/container.rb
 - lib/lotus/generators/application/container/.gitkeep
 - lib/lotus/generators/application/container/Gemfile.tt
@@ -229,10 +239,12 @@ files:
 - lib/lotus/generators/application/container/db/.gitkeep
 - lib/lotus/generators/application/container/features_helper.rb.minitest.tt
 - lib/lotus/generators/application/container/features_helper.rb.rspec.tt
+- lib/lotus/generators/application/container/gitignore.tt
 - lib/lotus/generators/application/container/lib/app_name.rb.tt
 - lib/lotus/generators/application/container/lib/chirp/entities/.gitkeep
 - lib/lotus/generators/application/container/lib/chirp/repositories/.gitkeep
 - lib/lotus/generators/application/container/lib/config/mapping.rb.tt
+- lib/lotus/generators/application/container/lotusrc.tt
 - lib/lotus/generators/application/container/rspec.rspec.tt
 - lib/lotus/generators/application/container/spec_helper.rb.minitest.tt
 - lib/lotus/generators/application/container/spec_helper.rb.rspec.tt
@@ -248,6 +260,7 @@ files:
 - lib/lotus/generators/slice/views/application_layout.rb.tt
 - lib/lotus/loader.rb
 - lib/lotus/logger.rb
+- lib/lotus/lotusrc.rb
 - lib/lotus/middleware.rb
 - lib/lotus/rendering_policy.rb
 - lib/lotus/routes.rb