mk_framework 0.2.0

data/docs/upgrading.md

@@ -0,0 +1,124 @@
+# Upgrading from the prototype
+
+0.2.0 changes the Ruby API while retaining the original POST mutation URLs by
+default. Upgrade application code before using the new gem. The six samples have
+already been migrated.
+
+## Application boot and class names
+
+Place models, controllers, handlers, and the app in an application module. In each
+file, declare that module explicitly; `require` does not inherit its caller's
+lexical namespace. Configure `root: __dir__` and `namespace: YourApp` in the app,
+and call `YourApp::App.boot!` after its class definition.
+
+Models must be loaded before boot. MK loads action files relative to the configured
+root and resolves action classes there. `boot!` validates and freezes the app;
+calling `app` before boot is an error. Configure middleware and plugins beforehand.
+Restart the process to pick up source changes.
+
+The samples now expose `SampleApp1::App` through `SampleApp6::App` instead of global
+`TodoApp`, `BlogApp`, `KanbanApp`, and `WeatherApp` classes. Their model datasets are
+explicit, so multiple sample apps can coexist without sharing constants or data.
+
+## Automatic action persistence and raw handler data
+
+Previously, handlers interpreted class-name suffixes and saved/deleted the object
+returned by a controller. Remove handler `success`/`error` registration blocks.
+Controllers return the prepared record; framework dispatch persists it according
+to the registered action and converts it to raw attributes before the handler:
+
+```ruby
+# Controller
+route do |r|
+  Post.new(r.input.permit(title: String))
+end
+
+# Handler
+handler do |r|
+  r.response.status = 201
+  {post: fields(model, :id, :title)}
+end
+```
+
+Require `mk_framework/sequel` for this lifecycle. Sequel is optional and must be
+listed in your application's Gemfile. Create/update results receive `save` then
+`values`; delete results receive `destroy` then `values`; show/index results are
+converted without writes. Remove explicit `persist`, `save`, and `destroy` calls
+from standard controllers to avoid duplicate writes. For explicit multi-record
+transactions, return raw data after completing the writes. Custom actions do not
+automatically persist records.
+
+Handlers receive raw hashes/arrays, including materialized nested results. Replace
+model attribute/association methods with hash access and allowlist filtering.
+Select associations in controllers. A handler does not query or write under any
+action name. Validation uses 422 for
+both create and update; expected constraint conflicts use 409. Unexpected failures
+are sanitized 500s. Deliberate `MK::Error` messages are public.
+
+The old `route` declaration in a handler remains an alias for `handler`, but it
+does not move persistence into handlers. Handlers return Hash/Array responses rather
+than calling `to_json`. For an empty success, use `r.halt(204)` in the handler.
+
+## Resource declarations
+
+Replace `register_nested_resource` with a resource tree:
+
+```ruby
+resource_routes do
+  resources :posts do
+    resources :comments
+  end
+  # Optional compatibility URLs for the old shallow member endpoints:
+  resources :comments, only: %i[show update delete]
+end
+```
+
+This exposes fully nested CRUD plus the explicitly requested shallow members.
+For exclusively shallow members, instead use `resources :comments, shallow: true`
+inside the parent. There are no implicit parentless comment collections.
+
+Use `r.path_params` for ancestor and member IDs. Existing `r.params['id']` remains
+supported, but `r.input` deliberately contains only query/body input. `r.params`
+gives URL IDs precedence. Scope all nested member lookups through their parent.
+
+PATCH, PUT, and DELETE now work. POST update/delete aliases remain on by default;
+turn them off using `configure legacy_post_routes: false` when clients migrate.
+
+## Database migration
+
+Server boot no longer creates tables. On a new database, run the sample's
+`bundle exec rake db:migrate` before loading its app. Tests use their own in-memory
+databases and run migrations there.
+
+Do not run the initial migration blindly against a populated prototype database:
+the existing tables will cause it to fail rather than be silently adopted or
+replaced. Back up that database, compare its schema with `db/migrations/001_initial.rb`,
+and write an application-specific upgrade migration or import into a freshly
+migrated database. Backfill null timestamps and missing defaults before adding
+the new constraints. Mark the initial migration applied only after confirming
+schema equivalence. No existing database is automatically altered by this upgrade.
+
+## Responses and clients
+
+Lists are bounded to 25 records by default; use `limit` and `offset`. Maximum limit
+is 100 and maximum offset is 10,000. Nested comments included in parent show
+responses use the same bounds. Adapt clients that previously expected every row.
+
+The weather API uses `OPENWEATHERMAP_API_KEY`, not a file in the user's home. Its
+response field is now `forecast`, containing eight three-hour periods, replacing
+the inaccurate `hourly_forecast` field. Times include a timezone. Upstream failures
+are sanitized 502 responses; an unknown location is 404; a missing key is 503.
+
+Missing-resource responses consistently use an `error` field. Unexpected error
+responses also include a request ID. Do not depend on internal exception messages.
+
+## Tests and dependencies
+
+Use `bundle exec rake` at the repository root to test the framework and every
+sample in isolated processes. Child failures fail the aggregate task. Sample tests
+force `RACK_ENV=test`; they do not open development databases or `DATABASE_URL`.
+
+Install the updated bundles with Ruby 3.2 or later and the locked Bundler version.
+The lockfiles include updates to Roda, Rack, Sequel, SQLite3, Puma, and test tools.
+Puma moved from 6.x to 8.x; review your own server configuration when upgrading.
+See `docs/deployment.md` for deployment and release checks.

data/lib/mk_framework/application.rb

@@ -0,0 +1,147 @@
+# frozen_string_literal: true
+
+module MK
+  class Application < Roda
+    plugin :all_verbs
+    plugin :json
+    plugin :halt
+    plugin :head
+    plugin :json_parser,
+           parser: ->(body) { value = JSON.parse(body); raise BadRequest unless value.is_a?(Hash); value },
+           error_handler: ->(_request) { raise BadRequest, 'Expected a valid JSON object' }
+    plugin RequestPlugin
+    plugin :error_handler do |error|
+      public_error = error.is_a?(MK::Error)
+      response.status = public_error ? error.status : 500
+      details = ErrorDetails.details(error, request, self.class.settings)
+      begin
+        logger.error(JSON.generate(details)) unless public_error
+      rescue StandardError
+        # A failed log sink must not break the error response.
+      end
+      body = {error: public_error ? error.message : 'Server error', request_id: request.env['mk.request_id']}
+      body[:details] = ErrorDetails.filter(error.details, self.class.settings[:filter_parameters]) if public_error && error.details
+      body[:debug] = details if self.class.settings[:environment] == 'development'
+      body
+    end
+
+    class << self
+      attr_reader :settings, :router
+
+      def inherited(subclass)
+        super
+        defaults = @settings || {
+          environment: ENV.fetch('RACK_ENV', 'production'), root: nil, namespace: nil,
+          routes_path: 'routes', legacy_post_routes: true, max_body_bytes: 1_048_576,
+          page_size: 25, max_page_size: 100, max_offset: 10_000,
+          filter_parameters: ErrorDetails::FILTER_KEYS, logger: Logger.new($stdout)
+        }
+        subclass.instance_variable_set(:@settings, defaults.dup)
+        subclass.instance_variable_set(:@route_definitions, @route_definitions)
+        subclass.instance_variable_set(:@request_hooks, Array(@request_hooks).dup)
+        subclass.instance_variable_set(:@booted, false)
+      end
+
+      def configure(**options)
+        raise ConfigurationError, 'Configure the application before boot!' if @booted
+        unknown = options.keys - @settings.keys
+        raise ConfigurationError, "Unknown settings: #{unknown.join(', ')}" unless unknown.empty?
+
+        @settings.merge!(options)
+      end
+
+      def setup_logger(destination = $stdout)
+        configure(logger: Logger.new(destination))
+        logger
+      end
+
+      def logger = settings.fetch(:logger)
+
+      def resource_routes(&block)
+        raise ConfigurationError, 'Define resources before boot!' if @booted
+
+        @route_definitions = block
+      end
+
+      # Runs for generated and ordinary Roda routes, including mounted apps.
+      def before_request(&block)
+        raise ConfigurationError, 'Define hooks before boot!' if @booted
+
+        @request_hooks << block
+      end
+
+      def request_hooks = @request_hooks
+
+      def boot!
+        return self if @booted
+        raise ConfigurationError, 'Set an absolute application root with configure(root: __dir__, namespace: MyApp)' unless settings[:root] && File.absolute_path(settings[:root]) == settings[:root]
+        raise ConfigurationError, 'Set namespace to the module containing your controllers and handlers' unless settings[:namespace].is_a?(Module)
+        %i[max_body_bytes page_size max_page_size max_offset].each do |key|
+          raise ConfigurationError, "#{key} must be a positive integer" unless settings[key].is_a?(Integer) && settings[key].positive?
+        end
+        raise ConfigurationError, 'page_size exceeds max_page_size' if settings[:page_size] > settings[:max_page_size]
+
+        routes_path = File.expand_path(settings[:routes_path], settings[:root])
+        Dir.glob(File.join(routes_path, '**', '*.rb')).sort.each { |file| require file }
+        definitions = Routes.new(namespace: settings[:namespace], legacy: settings[:legacy_post_routes])
+        if @route_definitions
+          definitions.instance_eval(&@route_definitions)
+        else
+          Dir.glob(File.join(routes_path, '*')).sort.select { |path| File.directory?(path) }.each do |path|
+            actions = Dir.glob(File.join(path, 'controllers', '*.rb')).map { |file| File.basename(file, '.rb').to_sym }
+            actions.select! { |action| Routes::ACTIONS.key?(action) }
+            definitions.resources(File.basename(path), only: actions)
+          end
+        end
+        @router = Router.new(definitions.endpoints)
+        @settings[:filter_parameters] = (ErrorDetails::FILTER_KEYS + Array(settings[:filter_parameters])).map { |key| key.to_s.freeze }.uniq.freeze
+        @settings.freeze
+        @request_hooks.freeze
+        custom_route = route_block
+        use RequestBoundary, settings
+        route do |r|
+          self.class.request_hooks.each { |hook| instance_exec(r, &hook) }
+          if custom_route
+            result = instance_exec(r, &custom_route)
+            r.halt(response.status || 200, result) unless result.nil?
+          end
+          r.root { {message: 'Welcome to MK Framework'} }
+          self.class.router.call(r, self)
+        end
+        @booted = true
+        freeze
+      end
+
+      def app
+        raise ConfigurationError, 'Call boot! after defining your application' unless @booted
+
+        super
+      end
+
+      def route_table
+        router.endpoints.map { |entry| "#{entry[:verb].ljust(6)} /#{entry[:path].map { |part| part.is_a?(Symbol) ? ":#{part}" : part }.join('/')} -> #{entry[:controller]} / #{entry[:handler]}" }
+      end
+    end
+
+    def logger = self.class.logger
+
+    def dispatch(endpoint, request)
+      value = endpoint[:controller].new.execute(request)
+      raise NotFound, "#{endpoint[:label]} not found" if value.nil?
+
+      value = prepare_result(value, action: endpoint[:action])
+      result = endpoint[:handler].new(value).execute(request)
+      unless result.is_a?(Hash) || result.is_a?(Array)
+        raise ConfigurationError, 'Handlers must return a Hash or Array, or halt with an explicit response'
+      end
+      result
+    end
+
+    private
+
+    # The optional Sequel integration supplies the record lifecycle here.
+    def prepare_result(value, action:)
+      value
+    end
+  end
+end

data/lib/mk_framework/controller.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module MK
+  class Controller
+    def self.route(&block)
+      define_method(:route_block) { block }
+    end
+
+    def execute(request)
+      instance_exec(request, &route_block)
+    end
+  end
+
+  class Handler
+    attr_reader :model
+
+    def self.handler(&block)
+      define_method(:handler_block) { block }
+    end
+
+    # Old applications used `route` for response blocks.
+    class << self
+      alias route handler
+    end
+
+    def initialize(value)
+      @model = value
+    end
+
+    def execute(request)
+      instance_exec(request, &handler_block)
+    end
+
+    # Select fields explicitly instead of exposing future database columns.
+    def fields(record, *names)
+      names.to_h { |name| [name, record[name]] }
+    end
+  end
+end

data/lib/mk_framework/errors.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+module MK
+  class ConfigurationError < StandardError; end
+
+  class Error < StandardError
+    STATUS = 500
+    MESSAGE = 'Server error'
+    attr_reader :details
+
+    def initialize(message = self.class::MESSAGE, details: nil)
+      super(message)
+      @details = details
+    end
+
+    def status = self.class::STATUS
+  end
+
+  class BadRequest < Error
+    STATUS = 400
+    MESSAGE = 'Bad request'
+  end
+
+  class Unauthorized < Error
+    STATUS = 401
+    MESSAGE = 'Unauthorized'
+  end
+
+  class Forbidden < Error
+    STATUS = 403
+    MESSAGE = 'Forbidden'
+  end
+
+  class NotFound < Error
+    STATUS = 404
+    MESSAGE = 'Not Found'
+  end
+
+  class Conflict < Error
+    STATUS = 409
+    MESSAGE = 'Conflict'
+  end
+
+  class ValidationError < Error
+    STATUS = 422
+    MESSAGE = 'Validation failed'
+  end
+
+  class BadGateway < Error
+    STATUS = 502
+    MESSAGE = 'Upstream service unavailable'
+  end
+
+  module ErrorDetails
+    FILTER_KEYS = %w[password secret token authorization cookie api_key apikey credential].freeze
+
+    def self.filter(value, keys = FILTER_KEYS, depth = 0)
+      return '[TRUNCATED]' if depth > 10
+
+      case value
+      when Hash
+        value.to_h do |key, item|
+          sensitive = keys.any? { |pattern| key.to_s.downcase.include?(pattern.to_s.downcase) }
+          [key, sensitive ? '[FILTERED]' : filter(item, keys, depth + 1)]
+        end
+      when Array
+        value.map { |item| filter(item, keys, depth + 1) }
+      else
+        value
+      end
+    end
+
+    # Never parse input while reporting an error: parsing may be what failed.
+    # SQL exception messages can contain secrets; omit them in production.
+    def self.details(error, request, settings)
+      details = {
+        request_id: request.env['mk.request_id'],
+        method: request.request_method,
+        path: request.path,
+        error_class: error.class.name,
+        params: filter(request.env.fetch('mk.input_params', {}), settings[:filter_parameters]),
+        backtrace: Array(error.backtrace).first(30)
+      }
+      details[:message] = error.message if settings[:environment] == 'development'
+      details
+    end
+  end
+end

data/lib/mk_framework/request.rb

@@ -0,0 +1,102 @@
+# frozen_string_literal: true
+
+module MK
+  # Enforce the limit even for chunked bodies with no Content-Length header.
+  class RequestBoundary
+    def initialize(app, settings)
+      @app, @settings = app, settings
+    end
+
+    def call(env)
+      env['mk.request_id'] = SecureRandom.uuid
+      if (input = env['rack.input'])
+        body = +''
+        while body.bytesize <= @settings[:max_body_bytes]
+          chunk = input.read(@settings[:max_body_bytes] + 1 - body.bytesize)
+          break if chunk.nil? || chunk.empty?
+
+          body << chunk
+        end
+        if body.bytesize > @settings[:max_body_bytes]
+          json = JSON.generate(error: 'Request body too large', request_id: env['mk.request_id'])
+          return [413, {'content-type' => 'application/json', 'content-length' => json.bytesize.to_s,
+                        'x-request-id' => env['mk.request_id']}, env['REQUEST_METHOD'] == 'HEAD' ? [] : [json]]
+        end
+        env['rack.input'] = StringIO.new(body)
+      end
+      status, headers, body = @app.call(env)
+      [status, headers.merge('x-request-id' => env['mk.request_id']), body]
+    end
+  end
+
+  class Input
+    def initialize(params)
+      @params = params
+    end
+
+    def require(name, type: String)
+      raise BadRequest, "Missing parameter: #{name}" unless @params.key?(name.to_s)
+
+      cast(name, @params.fetch(name.to_s), type)
+    end
+
+    # Only explicitly listed fields reach a model. Unknown fields are ignored.
+    def permit(**fields)
+      fields.each_with_object({}) do |(name, type), values|
+        values[name] = cast(name, @params[name.to_s], type) if @params.key?(name.to_s)
+      end
+    end
+
+    def integer(name, default:, min: 0, max: nil)
+      value = @params.fetch(name.to_s, default)
+      valid = value.is_a?(Integer) || (value.is_a?(String) && value.match?(/\A[0-9]+\z/))
+      raise BadRequest, "Invalid parameter: #{name}" unless valid
+
+      value = Integer(value)
+      raise BadRequest, "Invalid parameter: #{name}" if value < min || (max && value > max)
+
+      value
+    end
+
+    private
+
+    def cast(name, value, type)
+      if type == :boolean
+        return true if [true, 'true', '1'].include?(value)
+        return false if [false, 'false', '0'].include?(value)
+      elsif Array(type).any? { |klass| klass === value }
+        return value
+      end
+      raise BadRequest, "Invalid parameter: #{name}"
+    end
+  end
+
+  module RequestPlugin
+    module RequestMethods
+      EMPTY_PARAMS = {}.freeze
+      def path_params = env.fetch('mk.path_params', EMPTY_PARAMS)
+
+      # Compatibility for existing controllers; route identifiers always win.
+      def params
+        input_params = super
+        env['mk.input_params'] = input_params
+        input_params.merge(path_params.transform_keys(&:to_s))
+      rescue Rack::QueryParser::ParameterTypeError, Rack::QueryParser::InvalidParameterError, Rack::QueryParser::ParamsTooDeepError
+        raise BadRequest, 'Invalid request parameters'
+      end
+
+      def input
+        params
+        Input.new(env.fetch('mk.input_params'))
+      end
+
+      def page
+        settings = roda_class.settings
+        {
+          limit: input.integer(:limit, default: settings[:page_size], min: 1, max: settings[:max_page_size]),
+          offset: input.integer(:offset, default: 0, max: settings[:max_offset])
+        }
+      end
+    end
+  end
+end

data/lib/mk_framework/router.rb

@@ -0,0 +1,165 @@
+# frozen_string_literal: true
+
+module MK
+  class Routes
+    ACTIONS = {index: ['GET', false], create: ['POST', false], show: ['GET', true],
+               update: ['PATCH', true], delete: ['DELETE', true]}.freeze
+    attr_reader :endpoints
+
+    def initialize(namespace:, legacy:, endpoints: [], prefix: [], scope_prefix: [])
+      @namespace, @legacy, @endpoints = namespace, legacy, endpoints
+      @prefix, @scope_prefix = prefix, scope_prefix
+    end
+
+    def self.camelize(name) = name.to_s.split('_').map(&:capitalize).join
+
+    def self.singularize(name)
+      irregular = {'people' => 'person', 'children' => 'child', 'men' => 'man', 'women' => 'woman'}
+      irregular.fetch(name) do
+        name.end_with?('ies') ? "#{name[0...-3]}y" : name.sub(/(?<!s)s\z/, '')
+      end
+    end
+
+    def scope(path, &block)
+      parts = path.to_s.split('/').reject(&:empty?)
+      self.class.new(namespace: @namespace, legacy: @legacy, endpoints: @endpoints,
+                     prefix: @prefix + parts, scope_prefix: @scope_prefix + parts).instance_eval(&block)
+    end
+
+    def namespace(name, &block)
+      mod = @namespace.const_get(Routes.camelize(name), false)
+      Routes.new(namespace: mod, legacy: @legacy, endpoints: @endpoints,
+                 prefix: @prefix + [name.to_s], scope_prefix: @scope_prefix + [name.to_s]).instance_eval(&block)
+    end
+
+    def resources(name, only: ACTIONS.keys, singular: nil, param: :id, parent_key: nil,
+                  shallow: false, namespace: @namespace, actions: {}, legacy: @legacy, &block)
+      name = name.to_s
+      raise ConfigurationError, "Invalid resource path: #{name}" unless name.match?(/\A[a-zA-Z0-9_-]+\z/)
+
+      singular ||= Routes.singularize(name)
+      collection_path = @prefix + [name]
+      member_path = (shallow ? @scope_prefix + [name] : collection_path) + [param.to_sym]
+      child_path = member_path[0...-1] + [(parent_key || "#{singular}_id").to_sym]
+      resource = ResourceRoutes.new(namespace: namespace, legacy: legacy, endpoints: @endpoints,
+                                    prefix: child_path, scope_prefix: @scope_prefix)
+      resource.collection_path, resource.member_path = collection_path, member_path
+      resource.resource_name, resource.label = name, Routes.camelize(singular)
+      only.each do |action|
+        verb, member = ACTIONS.fetch(action.to_sym) { raise ConfigurationError, "Unknown action: #{action}" }
+        pair = actions[action.to_sym]
+        resource.add(verb, member ? member_path : collection_path, action,
+                     controller: pair&.fetch(0), handler: pair&.fetch(1))
+        if action.to_sym == :update
+          resource.add('PUT', member_path, action, controller: pair&.fetch(0), handler: pair&.fetch(1))
+        end
+        if legacy && action.to_sym == :update
+          resource.add('POST', member_path, action, controller: pair&.fetch(0), handler: pair&.fetch(1))
+        elsif legacy && action.to_sym == :delete
+          resource.add('POST', member_path + ['delete'], action, controller: pair&.fetch(0), handler: pair&.fetch(1))
+        end
+      end
+      resource.instance_eval(&block) if block
+    end
+  end
+
+  class ResourceRoutes < Routes
+    attr_accessor :collection_path, :member_path, :resource_name, :label
+
+    def member(action, via:, controller: nil, handler: nil)
+      add(via, member_path + [action.to_s], action, controller: controller, handler: handler)
+    end
+
+    def collection(action, via:, controller: nil, handler: nil)
+      add(via, collection_path + [action.to_s], action, controller: controller, handler: handler)
+    end
+
+    def add(verb, path, action, controller:, handler:)
+      prefix = "#{Routes.camelize(resource_name)}#{Routes.camelize(action)}"
+      controller ||= @namespace.const_get("#{prefix}Controller", false)
+      handler ||= @namespace.const_get("#{prefix}Handler", false)
+      unless controller <= Controller && controller.method_defined?(:route_block)
+        raise ConfigurationError, "#{controller} must define a controller route block"
+      end
+      unless handler <= Handler && handler.method_defined?(:handler_block)
+        raise ConfigurationError, "#{handler} must define a handler block"
+      end
+      names = path.grep(Symbol)
+      raise ConfigurationError, "Duplicate path parameters in #{path.inspect}; set parent_key" unless names.uniq == names
+
+      path = path.map { |part| part.is_a?(String) ? part.dup.freeze : part }.freeze
+      @endpoints << {verb: verb.to_s.upcase.freeze, path: path, action: action.to_sym,
+                     controller: controller, handler: handler, label: label.freeze, params: names.freeze}.freeze
+    rescue NameError => error
+      raise ConfigurationError, "Missing action for #{resource_name}.#{action}: #{error.message}"
+    end
+  end
+
+  # A compiled trie. Literal branches take precedence over parameter captures.
+  # Matching still uses Roda, including its exact-path and halt semantics.
+  class Router
+    Node = Struct.new(:literals, :dynamic, :methods, keyword_init: true)
+    attr_reader :endpoints
+
+    def initialize(endpoints)
+      @endpoints = endpoints.freeze
+      @root = new_node
+      endpoints.each do |endpoint|
+        node = endpoint[:path].inject(@root) do |branch, segment|
+          segment.is_a?(Symbol) ? (branch.dynamic ||= new_node) : (branch.literals[segment] ||= new_node)
+        end
+        verb = endpoint[:verb]
+        raise ConfigurationError, "Duplicate route: #{verb} /#{endpoint[:path].join('/')}" if node.methods.key?(verb)
+
+        node.methods[verb] = endpoint
+      end
+      freeze_node(@root)
+      freeze
+    end
+
+    def call(request, application)
+      walk(@root, request, application, [])
+    end
+
+    private
+
+    def new_node = Node.new(literals: {}, methods: {})
+
+    def freeze_node(node)
+      node.literals.each_value { |child| freeze_node(child) }
+      freeze_node(node.dynamic) if node.dynamic
+      node.literals.freeze
+      node.methods.freeze
+      node.freeze
+    end
+
+    def walk(node, request, application, captures)
+      request.is do
+        request.halt(404, {error: 'Not Found'}) if node.methods.empty?
+
+        verb = request.head? ? 'GET' : request.request_method
+        endpoint = node.methods[verb]
+        unless endpoint
+          allowed = node.methods.keys
+          allowed += ['HEAD'] if allowed.include?('GET')
+          request.response['allow'] = allowed.sort.join(', ')
+          request.halt(405, {error: 'Method not allowed'})
+        end
+        request.env['mk.path_params'] = endpoint[:params].zip(captures).to_h.freeze
+        request.params # Validate the body before controller side effects.
+        application.dispatch(endpoint, request)
+      end
+
+      request.on String do |segment|
+        if (child = node.literals[segment])
+          walk(child, request, application, captures)
+        elsif node.dynamic
+          walk(node.dynamic, request, application, captures + [segment.freeze])
+        else
+          request.halt(404, {error: 'Not Found'})
+        end
+      end
+      request.halt(404, {error: 'Not Found'})
+    end
+  end
+end