otto 2.11.0 → 2.12.0

data/lib/otto/core/router.rb

@@ -105,22 +105,16 @@ class Otto
         # symlink-free root (issue #257). A missing root leaves @static_route
         # nil and the request falls through to normal routing (404), rather
         # than raising at construction.
-        @static_route    ||= build_static_route
-        path_info          = Rack::Utils.unescape(env['PATH_INFO'])
-        path_info          = '/' if path_info.to_s.empty?
-
-        begin
-          # Shared with Otto::CaddyTLS::LocalhostGuard so the guard and the
-          # router cannot normalize a path differently (which would be a guard
-          # bypass). See Otto::Utils.normalize_path.
-          path_info_clean = Otto::Utils.normalize_path(env['PATH_INFO'])
-        rescue ArgumentError => e
-          # Log the error but don't expose details
-          Otto.logger.error '[Otto.handle_request] Path encoding error'
-          Otto.logger.debug "[Otto.handle_request] Error details: #{e.message}" if Otto.debug
-          # Set a default value or use the original path_info
-          path_info_clean = path_info
-        end
+        @static_route ||= build_static_route
+
+        # The one path every dispatch stage matches. It comes from the public
+        # Otto::Utils.routing_path so that guards running before the router
+        # (Otto::CaddyTLS::LocalhostGuard, an application's own middleware)
+        # judge exactly this value rather than re-deriving it; a guard that
+        # normalized differently would be a bypass. It never raises: a
+        # malformed escape (%zz) is kept as written and routed like any other
+        # path.
+        path_info_clean = Otto::Utils.routing_path(env)
 
         http_verb      = env['REQUEST_METHOD'].upcase.to_sym
         literal_routes = routes_literal[http_verb] || {}
@@ -220,7 +214,9 @@ class Otto
         # Rack::Files unescapes PATH_INFO, so escape the canonical path to
         # survive the round trip (escape_path preserves '/').
         static_env['PATH_INFO'] = "/#{Rack::Utils.escape_path(static_file.relative)}"
-        files.call(static_env)
+        status, headers, body = files.call(static_env)
+        headers['referrer-policy'] ||= @security_config.referrer_policy
+        [status, headers, body]
       end
 
       # Rack::Files rooted at the root +static_file+ was validated against.
@@ -249,9 +245,9 @@ class Otto
       end
 
       # +dispatch_path+ is the normalized path from #handle_request (see the
-      # +dispatch_path+ comment there): +Otto::Utils.normalize_path+ output with
+      # +dispatch_path+ comment there): +Otto::Utils.routing_path+ output with
       # root's empty string mapped back to '/' so the anchored route regexes can
-      # match. It is deliberately NOT the raw +normalize_path+ value.
+      # match. It is deliberately NOT the raw +routing_path+ value.
       def match_dynamic_route(env, dispatch_path, http_verb, literal_routes)
         extra_params  = {}
         found_route   = nil
@@ -319,7 +315,7 @@ class Otto
       # @return [Array] a fresh Rack triple
       def not_found_response(env)
         fallback = @not_found
-        return Otto::Static.not_found if fallback.nil?
+        return Otto::Static.not_found(@security_config) if fallback.nil?
 
         resolve_fallback_response(:not_found, fallback, env)
       end

data/lib/otto/env_keys.rb

@@ -217,7 +217,8 @@ class Otto
     # Note: setting CLIENT_IP yourself is out of contract — it trips the
     #       middleware's idempotency guard, so the unmasked address is never
     #       captured and this capability degrades to a logged fail-closed
-    #       check that denies every range.
+    #       check that denies every range. Test harnesses build both keys
+    #       with Otto::Testing.env_for (require 'otto/testing').
     IP_MATCH = 'otto.ip_match'
 
     # Privacy-safe masked IP address

data/lib/otto/privacy/config.rb

@@ -50,10 +50,17 @@ class Otto
       # Note the axis this controls: what PERSISTS observably (env keys, logs,
       # fingerprints). Precise ephemeral matching against the unmasked IP does
       # not require :audit — see EnvKeys::IP_MATCH, available in every profile.
+      #
+      # This table is the only list of knobs a profile governs: #profile=
+      # assigns whatever keys a preset carries, through each knob's writer so
+      # any check or normalization the writer does still runs. Every profile
+      # names the same keys, so applying one yields the same state whatever
+      # preceded it, and each key names a Config attribute with a writer and
+      # a public reader.
       PROFILES = {
         anonymous: { disabled: false, mask_private_ips: true }.freeze,
            masked: { disabled: false, mask_private_ips: false }.freeze,
-            audit: { disabled: true }.freeze,
+            audit: { disabled: true, mask_private_ips: false }.freeze,
       }.freeze
 
       attr_accessor :octet_precision, :hash_rotation_period, :geo_enabled, :mask_private_ips,
@@ -396,23 +403,18 @@ class Otto
 
       # Apply a named privacy profile's presets to this config.
       #
-      # Sets only the knobs the profile names (see {PROFILES}); other settings
+      # Assigns every knob the preset names (see {PROFILES}), so the result
+      # never depends on the profile applied before it: :anonymous -> :audit
+      # -> enable! lands on :masked, exactly as
+      # Config.new(profile: :audit).enable! does. Other settings
       # (octet_precision, geo, correlation_secret, ...) are untouched.
       #
-      # Presets are applied, not reset: a knob a profile does not name keeps its
-      # previous value. Switching :anonymous -> :audit therefore leaves
-      # mask_private_ips true, because :audit names only `disabled`. That is
-      # inert rather than wrong — `disabled` short-circuits privacy_enabled?
-      # before mask_private_ips is ever read, and #profile below tests @disabled
-      # first, so the derived label stays accurate. Switching on to :masked
-      # re-sets both knobs explicitly. Only surprising if you read the raw ivars.
-      #
       # @param profile [Symbol, String] :anonymous, :masked, or :audit
       # @raise [ArgumentError] for an unknown profile name
       def profile=(profile)
-        presets = self.class.profile_presets(profile)
-        @disabled = presets[:disabled] if presets.key?(:disabled)
-        @mask_private_ips = presets[:mask_private_ips] if presets.key?(:mask_private_ips)
+        self.class.profile_presets(profile).each do |knob, value|
+          send(:"#{knob}=", value)
+        end
       end
 
       # The profile the current knob state corresponds to.
@@ -517,6 +519,10 @@ class Otto
 
       private
 
+      # Profile-governed, so #profile= can assign it through a writer like the
+      # other knobs. Public callers use #disable! and #enable!.
+      attr_writer :disabled
+
       # Normalize a database-path option to a non-empty String or nil. Shared by
       # the geo, ASN and anonymizer paths — the rule is identical for all three.
       #

data/lib/otto/response.rb

@@ -91,8 +91,11 @@ class Otto
       # Prevent MIME type sniffing
       headers['x-content-type-options'] = 'nosniff'
 
-      # Add referrer policy
-      headers['referrer-policy'] = 'strict-origin-when-cross-origin'
+      # Add the configured referrer policy without replacing an explicit
+      # response-level value.
+      configured_policy = request && request.env['otto.security_config']&.referrer_policy
+      policy = self['referrer-policy'] || configured_policy || Otto::Security::Config::DEFAULT_REFERRER_POLICY
+      headers['referrer-policy'] ||= policy
 
       # Add frame options
       headers['x-frame-options'] = 'DENY'

data/lib/otto/route.rb

@@ -187,7 +187,7 @@ class Otto
       # Add security headers
       if otto.respond_to?(:security_config) && otto.security_config
         otto.security_config.security_headers.each do |header, value|
-          res.headers[header] = value
+          res.headers[header] ||= value
         end
       end
 

data/lib/otto/route_handlers/base.rb

@@ -148,7 +148,7 @@ class Otto
         # Add security headers
         if otto_instance.respond_to?(:security_config) && otto_instance.security_config
           otto_instance.security_config.security_headers.each do |header, value|
-            res.headers[header] = value
+            res.headers[header] ||= value
           end
         end
 

data/lib/otto/route_handlers/logic_class.rb

@@ -10,14 +10,25 @@ class Otto
     #
     # Logic classes use a constrained signature: initialize(context, params, locale)
     # - context: The authentication strategy result (user info, session data)
-    # - params: Merged request parameters (URL params + body + extra_params)
+    # - params: Merged request parameters. Path captures win over form and
+    #   query parameters (Rack order between those two), and a JSON body sits
+    #   below all of them.
     # - locale: The locale string from env['otto.locale']
     #
+    # A Logic class may also declare a +route_params:+ keyword on initialize
+    # to receive the path captures on their own, separate from anything the
+    # caller sent in the query string or body:
+    #
+    #   def initialize(context, params, locale, route_params: {})
+    #
     # IMPORTANT: Logic classes do NOT receive the Rack request or env hash.
     # This is intentional - Logic classes work with clean, authenticated contexts.
     # For endpoints requiring direct request access (sessions, cookies, headers,
     # or logout flows), use controller handlers (Controller#action or Controller.action).
     class LogicClassHandler < BaseHandler
+      # Parameter types (from Method#parameters) that name a keyword argument
+      ROUTE_PARAMS_KEYWORD_TYPES = %i[key keyreq].freeze
+
       protected
 
       # Invoke Logic class with constrained signature
@@ -36,8 +47,13 @@ class Otto
         # Get locale
         locale = env['otto.locale'] || 'en'
 
-        # Instantiate Logic class
-        logic = target_class.new(strategy_result, logic_params, locale)
+        # Instantiate Logic class. Path captures travel separately so a Logic
+        # class can read the router's value by name, whatever the body sent.
+        logic = if accepts_route_params?
+                  target_class.new(strategy_result, logic_params, locale, route_params: route_params)
+                else
+                  target_class.new(strategy_result, logic_params, locale)
+                end
 
         # Execute standard Logic class lifecycle
         logic.raise_concerns if logic.respond_to?(:raise_concerns)
@@ -57,50 +73,86 @@ class Otto
         [result, context]
       end
 
+      # Path captures matched by the router, keyed by the route's placeholder
+      # names. Always present in +params+ as well (where they take precedence);
+      # this copy is for Logic classes that must not confuse a path value with
+      # one the caller put in the query string or body.
+      #
+      # @return [Hash] Indifferent hash of route captures; empty for literal routes
+      def route_params
+        Otto::Static.indifferent_params((@extra_params || {}).dup)
+      end
+
+      # Whether the Logic class constructor declares a +route_params:+ keyword
+      # (or accepts arbitrary keywords). Logic classes opt in by declaring it;
+      # the three-positional signature keeps working unchanged.
+      #
+      # @return [Boolean]
+      def accepts_route_params?
+        return @accepts_route_params if defined?(@accepts_route_params)
+
+        @accepts_route_params = target_class.instance_method(:initialize).parameters.any? do |type, name|
+          type == :keyrest || (ROUTE_PARAMS_KEYWORD_TYPES.include?(type) && name == :route_params)
+        end
+      end
+
       # Extract logic parameters including JSON body parsing
+      #
+      # Starts from req.params, which already carries Rack's own precedence
+      # (form body over query string) with the path captures merged on top by
+      # setup_request_response. A JSON body sits below all of those: a JSON
+      # key can never replace a path capture, a query parameter, or a form
+      # field. JSON bodies are only read for methods that carry a body (never
+      # GET or HEAD).
+      #
       # @param req [Rack::Request] Request object
       # @param env [Hash] Rack environment
       # @return [Hash] Parameters for Logic class
       def extract_logic_params(req, env)
-        # req.params already has extra_params merged and indifferent_params applied
-        # by setup_request_response in BaseHandler
         logic_params = req.params.dup
+        return logic_params unless json_body?(req)
 
-        # Handle JSON request bodies
-        if req.content_type&.include?('application/json') && req.body.size.positive?
-          logic_params = parse_json_body(req, env, logic_params)
-        end
+        json_params = parse_json_body(req, env)
+        return logic_params if json_params.empty?
+
+        Otto::Static.indifferent_params(json_params.merge(logic_params))
+      end
 
-        logic_params
+      # Whether the request carries a JSON body worth parsing
+      # @param req [Rack::Request] Request object
+      # @return [Boolean]
+      def json_body?(req)
+        return false if req.get? || req.head?
+        return false unless req.content_type&.include?('application/json')
+
+        req.body&.size&.positive? || false
       end
 
       # Parse JSON request body with error handling
       # @param req [Rack::Request] Request object
       # @param env [Hash] Rack environment
-      # @param logic_params [Hash] Current parameters
-      # @return [Hash] Parameters with JSON merged (or original if parsing fails)
-      def parse_json_body(req, env, logic_params)
-        begin
-          req.body.rewind
-          json_data = JSON.parse(req.body.read)
-          logic_params = logic_params.merge(json_data) if json_data.is_a?(Hash)
-        rescue JSON::ParserError => e
-          # Base context pattern: create once, reuse for correlation
-          log_context = Otto::LoggingHelpers.request_context(env)
-
-          Otto.structured_log(:error, 'JSON parsing error',
-            log_context.merge(
-              handler: handler_name,
-              error: e.message,
-              error_class: e.class.name,
-              duration: Otto::Utils.now_in_μs - @start_time
-            ))
-
-          Otto::LoggingHelpers.log_backtrace(e,
-            log_context.merge(handler: handler_name))
-        end
-
-        logic_params
+      # @return [Hash] Parsed JSON object, or an empty hash when the body is
+      #   not a JSON object or fails to parse
+      def parse_json_body(req, env)
+        req.body.rewind
+        json_data = JSON.parse(req.body.read)
+        json_data.is_a?(Hash) ? json_data : {}
+      rescue JSON::ParserError => e
+        # Base context pattern: create once, reuse for correlation
+        log_context = Otto::LoggingHelpers.request_context(env)
+
+        Otto.structured_log(:error, 'JSON parsing error',
+          log_context.merge(
+            handler: handler_name,
+            error: e.message,
+            error_class: e.class.name,
+            duration: Otto::Utils.now_in_μs - @start_time
+          ))
+
+        Otto::LoggingHelpers.log_backtrace(e,
+          log_context.merge(handler: handler_name))
+
+        {}
       end
 
       # Format handler name for Logic routes