omg-actionpack 8.0.0.alpha1

data/lib/action_controller.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+# :markup: markdown
+
+require "abstract_controller"
+require "action_dispatch"
+require "action_controller/deprecator"
+require "action_controller/metal/strong_parameters"
+require "action_controller/metal/exceptions"
+
+# # Action Controller
+#
+# Action Controller is a module of Action Pack.
+#
+# Action Controller provides a base controller class that can be subclassed to
+# implement filters and actions to handle requests. The result of an action is
+# typically content generated from views.
+module ActionController
+  extend ActiveSupport::Autoload
+
+  autoload :API
+  autoload :Base
+  autoload :Metal
+  autoload :Renderer
+  autoload :FormBuilder
+
+  eager_autoload do
+    autoload :Caching
+  end
+
+  autoload_under "metal" do
+    autoload :AllowBrowser
+    autoload :ConditionalGet
+    autoload :ContentSecurityPolicy
+    autoload :Cookies
+    autoload :DataStreaming
+    autoload :DefaultHeaders
+    autoload :EtagWithTemplateDigest
+    autoload :EtagWithFlash
+    autoload :PermissionsPolicy
+    autoload :Flash
+    autoload :Head
+    autoload :Helpers
+    autoload :HttpAuthentication
+    autoload :BasicImplicitRender
+    autoload :ImplicitRender
+    autoload :Instrumentation
+    autoload :Live
+    autoload :Logging
+    autoload :MimeResponds
+    autoload :ParamsWrapper
+    autoload :RateLimiting
+    autoload :Redirecting
+    autoload :Renderers
+    autoload :Rendering
+    autoload :RequestForgeryProtection
+    autoload :Rescue
+    autoload :Streaming
+    autoload :StrongParameters
+    autoload :ParameterEncoding
+    autoload :Testing
+    autoload :UrlFor
+  end
+
+  autoload_under "api" do
+    autoload :ApiRendering
+  end
+
+  autoload_at "action_controller/test_case" do
+    autoload :TestCase
+    autoload :TestRequest
+    autoload :TemplateAssertions
+  end
+end
+
+# Common Active Support usage in Action Controller
+require "active_support/core_ext/module/attribute_accessors"
+require "active_support/core_ext/module/attr_internal"
+require "active_support/core_ext/name_error"
+require "active_support/inflector"

data/lib/action_dispatch/constants.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+# :markup: markdown
+
+require "rack/version"
+
+module ActionDispatch
+  module Constants
+    # Response Header keys for Rack 2.x and 3.x
+    if Gem::Version.new(Rack::RELEASE) < Gem::Version.new("3")
+      VARY = "Vary"
+      CONTENT_ENCODING = "Content-Encoding"
+      CONTENT_SECURITY_POLICY = "Content-Security-Policy"
+      CONTENT_SECURITY_POLICY_REPORT_ONLY = "Content-Security-Policy-Report-Only"
+      LOCATION = "Location"
+      FEATURE_POLICY = "Feature-Policy"
+      X_REQUEST_ID = "X-Request-Id"
+      X_CASCADE = "X-Cascade"
+      SERVER_TIMING = "Server-Timing"
+      STRICT_TRANSPORT_SECURITY = "Strict-Transport-Security"
+    else
+      VARY = "vary"
+      CONTENT_ENCODING = "content-encoding"
+      CONTENT_SECURITY_POLICY = "content-security-policy"
+      CONTENT_SECURITY_POLICY_REPORT_ONLY = "content-security-policy-report-only"
+      LOCATION = "location"
+      FEATURE_POLICY = "feature-policy"
+      X_REQUEST_ID = "x-request-id"
+      X_CASCADE = "x-cascade"
+      SERVER_TIMING = "server-timing"
+      STRICT_TRANSPORT_SECURITY = "strict-transport-security"
+    end
+  end
+end

data/lib/action_dispatch/deprecator.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+# :markup: markdown
+
+module ActionDispatch
+  def self.deprecator # :nodoc:
+    @deprecator ||= ActiveSupport::Deprecation.new
+  end
+end

data/lib/action_dispatch/http/cache.rb

@@ -0,0 +1,249 @@
+# frozen_string_literal: true
+
+# :markup: markdown
+
+module ActionDispatch
+  module Http
+    module Cache
+      module Request
+        HTTP_IF_MODIFIED_SINCE = "HTTP_IF_MODIFIED_SINCE"
+        HTTP_IF_NONE_MATCH     = "HTTP_IF_NONE_MATCH"
+
+        mattr_accessor :strict_freshness, default: false
+
+        def if_modified_since
+          if since = get_header(HTTP_IF_MODIFIED_SINCE)
+            Time.rfc2822(since) rescue nil
+          end
+        end
+
+        def if_none_match
+          get_header HTTP_IF_NONE_MATCH
+        end
+
+        def if_none_match_etags
+          if_none_match ? if_none_match.split(",").each(&:strip!) : []
+        end
+
+        def not_modified?(modified_at)
+          if_modified_since && modified_at && if_modified_since >= modified_at
+        end
+
+        def etag_matches?(etag)
+          if etag
+            validators = if_none_match_etags
+            validators.include?(etag) || validators.include?("*")
+          end
+        end
+
+        # Check response freshness (`Last-Modified` and `ETag`) against request
+        # `If-Modified-Since` and `If-None-Match` conditions.
+        # If both headers are supplied, based on configuration, either `ETag` is preferred over `Last-Modified`
+        # or both are considered equally. You can adjust the preference with
+        # `config.action_dispatch.strict_freshness`.
+        # Reference: http://tools.ietf.org/html/rfc7232#section-6
+        def fresh?(response)
+          if Request.strict_freshness
+            if if_none_match
+              etag_matches?(response.etag)
+            elsif if_modified_since
+              not_modified?(response.last_modified)
+            else
+              false
+            end
+          else
+            last_modified = if_modified_since
+            etag          = if_none_match
+
+            return false unless last_modified || etag
+
+            success = true
+            success &&= not_modified?(response.last_modified) if last_modified
+            success &&= etag_matches?(response.etag) if etag
+            success
+          end
+        end
+      end
+
+      module Response
+        attr_reader :cache_control
+
+        def last_modified
+          if last = get_header(LAST_MODIFIED)
+            Time.httpdate(last)
+          end
+        end
+
+        def last_modified?
+          has_header? LAST_MODIFIED
+        end
+
+        def last_modified=(utc_time)
+          set_header LAST_MODIFIED, utc_time.httpdate
+        end
+
+        def date
+          if date_header = get_header(DATE)
+            Time.httpdate(date_header)
+          end
+        end
+
+        def date?
+          has_header? DATE
+        end
+
+        def date=(utc_time)
+          set_header DATE, utc_time.httpdate
+        end
+
+        # This method sets a weak ETag validator on the response so browsers and proxies
+        # may cache the response, keyed on the ETag. On subsequent requests, the
+        # `If-None-Match` header is set to the cached ETag. If it matches the current
+        # ETag, we can return a `304 Not Modified` response with no body, letting the
+        # browser or proxy know that their cache is current. Big savings in request time
+        # and network bandwidth.
+        #
+        # Weak ETags are considered to be semantically equivalent but not byte-for-byte
+        # identical. This is perfect for browser caching of HTML pages where we don't
+        # care about exact equality, just what the user is viewing.
+        #
+        # Strong ETags are considered byte-for-byte identical. They allow a browser or
+        # proxy cache to support `Range` requests, useful for paging through a PDF file
+        # or scrubbing through a video. Some CDNs only support strong ETags and will
+        # ignore weak ETags entirely.
+        #
+        # Weak ETags are what we almost always need, so they're the default. Check out
+        # #strong_etag= to provide a strong ETag validator.
+        def etag=(weak_validators)
+          self.weak_etag = weak_validators
+        end
+
+        def weak_etag=(weak_validators)
+          set_header "ETag", generate_weak_etag(weak_validators)
+        end
+
+        def strong_etag=(strong_validators)
+          set_header "ETag", generate_strong_etag(strong_validators)
+        end
+
+        def etag?; etag; end
+
+        # True if an ETag is set, and it's a weak validator (preceded with `W/`).
+        def weak_etag?
+          etag? && etag.start_with?('W/"')
+        end
+
+        # True if an ETag is set, and it isn't a weak validator (not preceded with
+        # `W/`).
+        def strong_etag?
+          etag? && !weak_etag?
+        end
+
+      private
+        DATE          = "Date"
+        LAST_MODIFIED = "Last-Modified"
+        SPECIAL_KEYS  = Set.new(%w[extras no-store no-cache max-age public private must-revalidate])
+
+        def generate_weak_etag(validators)
+          "W/#{generate_strong_etag(validators)}"
+        end
+
+        def generate_strong_etag(validators)
+          %("#{ActiveSupport::Digest.hexdigest(ActiveSupport::Cache.expand_cache_key(validators))}")
+        end
+
+        def cache_control_segments
+          if cache_control = _cache_control
+            cache_control.delete(" ").split(",")
+          end
+        end
+
+        def cache_control_headers
+          cache_control = {}
+
+          cache_control_segments&.each do |segment|
+            directive, argument = segment.split("=", 2)
+
+            if SPECIAL_KEYS.include? directive
+              directive.tr!("-", "_")
+              cache_control[directive.to_sym] = argument || true
+            else
+              cache_control[:extras] ||= []
+              cache_control[:extras] << segment
+            end
+          end
+
+          cache_control
+        end
+
+        def prepare_cache_control!
+          @cache_control = cache_control_headers
+        end
+
+        DEFAULT_CACHE_CONTROL = "max-age=0, private, must-revalidate"
+        NO_STORE              = "no-store"
+        NO_CACHE              = "no-cache"
+        PUBLIC                = "public"
+        PRIVATE               = "private"
+        MUST_REVALIDATE       = "must-revalidate"
+        IMMUTABLE             = "immutable"
+
+        def handle_conditional_get!
+          # Normally default cache control setting is handled by ETag middleware. But, if
+          # an etag is already set, the middleware defaults to `no-cache` unless a default
+          # `Cache-Control` value is previously set. So, set a default one here.
+          if (etag? || last_modified?) && !self._cache_control
+            self._cache_control = DEFAULT_CACHE_CONTROL
+          end
+        end
+
+        def merge_and_normalize_cache_control!(cache_control)
+          control = cache_control_headers
+
+          return if control.empty? && cache_control.empty?  # Let middleware handle default behavior
+
+          if cache_control.any?
+            # Any caching directive coming from a controller overrides no-cache/no-store in
+            # the default Cache-Control header.
+            control.delete(:no_cache)
+            control.delete(:no_store)
+
+            if extras = control.delete(:extras)
+              cache_control[:extras] ||= []
+              cache_control[:extras] += extras
+              cache_control[:extras].uniq!
+            end
+
+            control.merge! cache_control
+          end
+
+          options = []
+
+          if control[:no_store]
+            options << PRIVATE if control[:private]
+            options << NO_STORE
+          elsif control[:no_cache]
+            options << PUBLIC if control[:public]
+            options << NO_CACHE
+            options.concat(control[:extras]) if control[:extras]
+          else
+            extras = control[:extras]
+            max_age = control[:max_age]
+            stale_while_revalidate = control[:stale_while_revalidate]
+            stale_if_error = control[:stale_if_error]
+
+            options << "max-age=#{max_age.to_i}" if max_age
+            options << (control[:public] ? PUBLIC : PRIVATE)
+            options << MUST_REVALIDATE if control[:must_revalidate]
+            options << "stale-while-revalidate=#{stale_while_revalidate.to_i}" if stale_while_revalidate
+            options << "stale-if-error=#{stale_if_error.to_i}" if stale_if_error
+            options << IMMUTABLE if control[:immutable]
+            options.concat(extras) if extras
+          end
+
+          self._cache_control = options.join(", ")
+        end
+      end
+    end
+  end
+end

data/lib/action_dispatch/http/content_disposition.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+# :markup: markdown
+
+module ActionDispatch
+  module Http
+    class ContentDisposition # :nodoc:
+      def self.format(disposition:, filename:)
+        new(disposition: disposition, filename: filename).to_s
+      end
+
+      attr_reader :disposition, :filename
+
+      def initialize(disposition:, filename:)
+        @disposition = disposition
+        @filename = filename
+      end
+
+      TRADITIONAL_ESCAPED_CHAR = /[^ A-Za-z0-9!\#$+.^_`|~-]/
+
+      def ascii_filename
+        'filename="' + percent_escape(I18n.transliterate(filename), TRADITIONAL_ESCAPED_CHAR) + '"'
+      end
+
+      RFC_5987_ESCAPED_CHAR = /[^A-Za-z0-9!\#$&+.^_`|~-]/
+
+      def utf8_filename
+        "filename*=UTF-8''" + percent_escape(filename, RFC_5987_ESCAPED_CHAR)
+      end
+
+      def to_s
+        if filename
+          "#{disposition}; #{ascii_filename}; #{utf8_filename}"
+        else
+          "#{disposition}"
+        end
+      end
+
+      private
+        def percent_escape(string, pattern)
+          string.gsub(pattern) do |char|
+            char.bytes.map { |byte| "%%%02X" % byte }.join
+          end
+        end
+    end
+  end
+end