padrino-core 0.17.0 → 0.18.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 44a11b5c0a503449fdce5f86ea6ceff3c6fe7f33e7d28223983b8507c1975aca
-  data.tar.gz: b3dcecde6843769f9b74336e1b94d1ecbd5cd2d2ae607d5982c2380be1452085
+  metadata.gz: 60c8ed53139a3e9558b1e665205eeb798960a6049ac0788e3454f8f6f4280de0
+  data.tar.gz: '08dc99355571157c9113a0083c8acacd9970c7f64e407008265fdc177e590572'
 SHA512:
-  metadata.gz: dbad97028d154c692aa99e3f9d7b68301c69da4843e905cbafbd59bd2b24026186efe0eaadcdb0df0bc2aff14d803952d507efa5153988d5ede8b29a7d2de60e
-  data.tar.gz: f9dca7338b15c2276b2546afc826f9e4c39eb2ef8f226dc90fa2666d4ce3b3a2814230aea1f23f4e99985ae45f76bd8c5068e4c5918f8c7aa5fb5b11522aa3d5
+  metadata.gz: 50d10641e73dd6b858b2a6490cdc77372055ace5232683d7727e44b45a85267d8bd56fa2c5ce49852c51e5c017169a7449ecb0d297b6b5d67a6896b8f7396b93
+  data.tar.gz: 79af9aed08ab7c2189d162b75772e9d40f37ca45189abf26d18c9c42f0ca62d149d30756c77088fdaa119683192c76c94b8e9acf07b6b2abb8d0f72cd214155e

data/lib/padrino-core/application/application_setup.rb

@@ -60,7 +60,10 @@ module Padrino
         set :views,         proc { File.join(root, 'views') }
 
         set :uri_root,      '/'
-        set :public_folder, proc { Padrino.root('public', uri_root) }
+        set :public_folder, proc {
+          app_public = Padrino.root('public', uri_root)
+          File.exist?(app_public) ? app_public : Padrino.root('public')
+        }
         set :images_path,   proc { File.join(public_folder, 'images') }
         set :base_url,      'http://localhost'
       end
@@ -111,10 +114,24 @@ module Padrino
         builder.use Rack::Head
         register Padrino::Flash
         setup_protection builder
+        setup_host_authorization builder if host_authorization_set?
         setup_csrf_protection builder
         setup_application!
       end
 
+      ##
+      # Sinatra 4.1+ checks the Host header against its host_authorization
+      # setting. Its default permits only local hosts in development, so
+      # Padrino applies the setting only when it is set to a Hash on the app,
+      # a Padrino application it inherits from or in Padrino.configure_apps,
+      # and apps that don't set it keep answering any host.
+      #
+      def host_authorization_set?
+        respond_to?(:setup_host_authorization, true) &&
+          method(:host_authorization).owner != Sinatra::Base.singleton_class &&
+          host_authorization.is_a?(Hash)
+      end
+
       ##
       # We need to add almost __sinatra__ images.
       #

data/lib/padrino-core/application/routing.rb

@@ -381,6 +381,20 @@ module Padrino
         end
       end
 
+      ##
+      # The project's shared public/ for an app mounted under a sub-path whose
+      # public folder is the default public/<uri_root>. Static files and asset
+      # stamps fall back to it for files public/<uri_root> doesn't have. Nil for
+      # standalone Sinatra apps that only register Padrino::Routing.
+      #
+      # @api private
+      def shared_public_folder
+        return unless respond_to?(:uri_root) && Padrino.respond_to?(:root)
+        return if uri_root.nil? || uri_root == '/' || !public_folder
+
+        Padrino.root('public') if File.expand_path(public_folder) == Padrino.root('public', uri_root)
+      end
+
       ##
       # Processes the existing path and prepends the 'parent' parameters onto the route
       # Used for calculating path in route method.
@@ -857,17 +871,20 @@ module Padrino
 
       ##
       # This is mostly just a helper so request.path_info isn't changed when
-      # serving files from the public directory.
+      # serving files from the public directory. An app mounted under a sub-path
+      # falls back to the shared public/ for files missing from public/<uri_root>.
       #
       def static_file?(path_info)
         return unless (public_dir = settings.public_folder)
-        public_dir = File.expand_path(public_dir)
-        path = "#{public_dir}#{unescape(path_info)}"
-        return unless Rack::Utils.valid_path?(path)
-        path = File.expand_path(path)
-        return unless path.start_with?("#{public_dir}/")
-        return unless File.file?(path)
-        path
+        # Decode the path the way Sinatra's static! and the router do: %XX only, so '+' stays a plus.
+        file = Rack::Utils.unescape_path(path_info.b).force_encoding(Encoding::UTF_8)
+        [File.expand_path(public_dir), settings.shared_public_folder].compact.each do |dir|
+          path = "#{dir}#{file}"
+          next unless Rack::Utils.valid_path?(path)
+          path = File.expand_path(path)
+          return path if path.start_with?("#{dir}/") && File.file?(path)
+        end
+        nil
       end
 
       #

data/lib/padrino-core/application.rb

@@ -119,15 +119,22 @@ module Padrino
       end
 
       ##
-      # Returns default list of path globs to load as dependencies.
-      # Appends custom dependency patterns to the be loaded for your Application.
+      # Returns the files to load as dependencies of your Application: those matching
+      # the default globs below, under the application's root. The list is built again
+      # on each call, so appending to it has no effect; to load more files, override
+      # the method and add them to +super+. Add file paths (expand globs with Dir.glob)
+      # under Padrino.root: the reloader watches these files and reloads the application
+      # when one changes.
       #
-      # @return [Array]
-      #   list of path globs to load as dependencies
+      # @return [Array<String>]
+      #   paths of the files to load as dependencies
       #
       # @example
-      #   MyApp.dependencies << "#{Padrino.root}/uploaders/**/*.rb"
-      #   MyApp.dependencies << Padrino.root('other_app', 'controllers.rb')
+      #   class MyApp < Padrino::Application
+      #     def self.dependencies
+      #       super + Dir.glob(Padrino.root('uploaders', '**', '*.rb'))
+      #     end
+      #   end
       #
       def dependencies
         [

data/lib/padrino-core/cli/binstub.rb

@@ -21,7 +21,8 @@ module Padrino
     if File.file?(binstub)
       exec Gem.ruby, binstub, *ARGV
     else
-      puts 'Please run `bundle install && bundle binstubs --all` from your project root to generate bundle-specific executables'
+      # exit! skips the flush of buffered output, so write to the unbuffered stderr. Not warn: -W0 silences it.
+      $stderr.puts 'Please run `bundle install && bundle binstubs --all` from your project root to generate bundle-specific executables'
       exit!
     end
   end

data/lib/padrino-core/module.rb

@@ -34,8 +34,9 @@ module Padrino
     end
 
     ##
-    # Returns the list of path globs to load as dependencies.
-    # Appends custom dependency patterns to the be loaded for Padrino.
+    # Returns the path globs of the module's files to load as dependencies. The list
+    # is built again on each call, so appending to it has no effect; to load more
+    # files, override the method and add globs to +super+.
     #
     # @return [Array<String>]
     #   The dependency paths.
@@ -44,9 +45,11 @@ module Padrino
     #   module MyModule
     #     extend Padrino::Module
     #     gem! 'my_gem'
-    #   end
     #
-    #   Module.dependency_paths << "#{MyModule.root}/uploaders/*.rb"
+    #     def self.dependency_paths
+    #       super + ["#{root}/uploaders/*.rb"]
+    #     end
+    #   end
     #
     def dependency_paths
       [

data/lib/padrino-core/path_router/compiler.rb

@@ -70,6 +70,8 @@ module Padrino
       # Returns a instance of PathRouter::Route if path is matched with current regexp
       #
       def match?(offset, path)
+        return unless path
+
         @routes[offset..].find do |route|
           route.regexp === path || (path.end_with?('/') && route.regexp === path[0..-2])
         end
@@ -88,10 +90,14 @@ module Padrino
       end
 
       ##
-      # Decode env["PATH_INFO"]
+      # Decode env["PATH_INFO"]. Returns nil when the path doesn't decode to valid text
+      # (a malformed or non-UTF-8 escape such as "/%ff"), so it matches no route.
       #
       def decode_pattern(pattern)
-        decode_uri(encode_default_external(pattern))
+        decoded = decode_uri(encode_default_external(pattern))
+        decoded if decoded.valid_encoding?
+      rescue ArgumentError, EncodingError
+        nil
       end
 
       ##

data/lib/padrino-core/reloader/storage.rb

@@ -20,6 +20,7 @@ module Padrino
 
       def prepare(name)
         file = remove(name)
+        reset_concerns(name)
         @old_entries ||= {}
         @old_entries[name] = {
           constants: object_classes,
@@ -57,6 +58,24 @@ module Padrino
         @files ||= {}
       end
 
+      ##
+      # Resets the ActiveSupport::Concern modules first defined in the file. Unlike classes
+      # they are kept on reload, so that classes including them keep working and namespaces
+      # keep their constants, but their state is reset so the file can define them again.
+      #
+      def reset_concerns(file)
+        return unless defined?(::ActiveSupport::Concern)
+
+        ObjectSpace.each_object(::Module) do |mod|
+          # Module#=== doesn't call mod, which can be a DeprecatedConstantProxy that warns on any call.
+          next unless ::ActiveSupport::Concern === mod && mod.name
+          next unless Object.const_source_location(mod.name)&.first == file
+          Reloader.reset_concern(mod) if Object.const_get(mod.name).equal?(mod)
+        rescue NameError
+          next
+        end
+      end
+
       ##
       # Returns all the classes in the object space.
       #

data/lib/padrino-core/reloader.rb

@@ -153,6 +153,18 @@ module Padrino
       # no const to remove
     end
 
+    ##
+    # Clears the included and prepended blocks of an ActiveSupport::Concern, so that its file
+    # can define them again. Its dependencies are reset by +extend ActiveSupport::Concern+.
+    #
+    def reset_concern(concern)
+      return if constant_excluded?(concern)
+      %i[@_included_block @_prepended_block].each do |ivar|
+        concern.remove_instance_variable(ivar) if concern.instance_variable_defined?(ivar)
+      end
+      logger.devel "Reset concern #{concern}"
+    end
+
     ##
     # Remove a feature from $LOADED_FEATURES so it can be required again.
     #

data/lib/padrino-core/server.rb

@@ -55,6 +55,8 @@ module Padrino
       %i[INT TERM].each { |sig| trap(sig) { exit } }
       super do |server|
         server.threaded = true if server.respond_to?(:threaded=)
+        # WEBrick: stop on TERM the way Rackup stops it on INT, instead of raising SystemExit in its accept loop.
+        trap(:TERM) { server.shutdown } if server.respond_to?(:shutdown)
       end
     ensure
       puts '<= Padrino leaves the gun, takes the cannoli' unless options[:daemonize]

data/lib/padrino-core/version.rb

@@ -6,7 +6,7 @@
 #
 module Padrino
   # The version constant for the current version of Padrino.
-  VERSION = '0.17.0' unless defined?(Padrino::VERSION)
+  VERSION = '0.18.0' unless defined?(Padrino::VERSION)
 
   #
   # The current Padrino version.

data/test/fixtures/apps/concerned/models/catalog_item.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+require_relative 'mixins/sortable'
+
+class CatalogItem
+  include Sortable
+end

data/test/fixtures/apps/concerned/models/filtered_item.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+class FilteredItem
+  include Filterable
+end

data/test/fixtures/apps/concerned/models/mixins/filterable.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Filterable
+  extend ActiveSupport::Concern
+
+  included do
+    define_method(:filter) { 'v1' }
+  end
+
+  def label
+    'l1'
+  end
+end

data/test/fixtures/apps/concerned/models/mixins/sortable.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Sortable
+  extend ActiveSupport::Concern
+
+  included do
+    define_method(:sort_key) { 's1' }
+  end
+
+  def sort_label
+    's1'
+  end
+end

data/test/fixtures/apps/helpers/class_methods_helpers.rb

@@ -1,5 +1,5 @@
 begin
-  require '/tmp/padrino_class_demo'
+  require 'padrino_class_demo'
 rescue LoadError
   # do nothing
 end

data/test/fixtures/apps/helpers/instance_methods_helpers.rb

@@ -1,5 +1,5 @@
 begin
-  require '/tmp/padrino_instance_demo'
+  require 'padrino_instance_demo'
 rescue LoadError
   # do nothing
 end

data/test/test_binstub.rb

@@ -1,4 +1,5 @@
 require_relative 'helper'
+require 'open3'
 require 'tmpdir'
 require 'padrino-core/cli/binstub'
 
@@ -7,15 +8,40 @@ describe 'Padrino.replace_with_binstub' do
     Dir.mktmpdir do |dir|
       File.write(File.join(dir, 'Gemfile'), '')
       File.write(File.join(dir, '.components'), '')
-      out, = capture_io do
+      _, err = capture_io do
         Bundler.stub(:definition, -> { raise Bundler::GemfileNotFound }) do
           Padrino.stub(:exit!, nil) do
             Dir.chdir(dir) { Padrino.replace_with_binstub('padrino') }
           end
         end
       end
-      assert_match(/bundle install && bundle binstubs --all/, out)
-      refute_match(/--binstubs/, out)
+      assert_match(/bundle install && bundle binstubs --all/, err)
+      refute_match(/--binstubs/, err)
     end
   end
+
+  # Runs the executable outside any bundle in a project without bin/, with its output piped.
+  def run_without_binstubs(bin, env = {})
+    Dir.mktmpdir do |dir|
+      File.write(File.join(dir, 'Gemfile'), '')
+      File.write(File.join(dir, '.components'), '')
+      run = -> { Open3.capture3(env, RbConfig.ruby, '-I', File.expand_path('../lib', __dir__), bin, 'version', chdir: dir) }
+      defined?(Bundler) ? Bundler.with_unbundled_env(&run) : run.call
+    end
+  end
+
+  %w[padrino-core/bin/padrino padrino-gen/bin/padrino-gen].each do |executable|
+    it "should show the binstubs hint and exit 1 when the output of #{executable} is piped" do
+      out, err, status = run_without_binstubs(File.expand_path("../../#{executable}", __dir__))
+      assert_equal 1, status.exitstatus
+      assert_includes err, 'bundle install && bundle binstubs --all'
+      refute_includes out, 'bundle binstubs'
+    end
+  end
+
+  it 'should show the binstubs hint with warnings turned off' do
+    _, err, status = run_without_binstubs(File.expand_path('../../padrino-core/bin/padrino', __dir__), 'RUBYOPT' => '-W0')
+    assert_equal 1, status.exitstatus
+    assert_includes err, 'bundle install && bundle binstubs --all'
+  end
 end

data/test/test_host_authorization.rb

@@ -0,0 +1,117 @@
+require_relative 'helper'
+
+describe 'Host authorization' do
+  before do
+    skip 'needs Sinatra 4.1+' unless Sinatra::Base.respond_to?(:host_authorization)
+    Padrino.clear!
+  end
+
+  def status_for(rack_app, host, path = '/')
+    Rack::MockRequest.new(rack_app).get(path, 'HTTP_HOST' => host).status
+  end
+
+  describe 'when the app sets host_authorization' do
+    it 'should answer permitted hosts and refuse others' do
+      mock_app do
+        set :host_authorization, permitted_hosts: ['good.example']
+        get('/') { 'ok' }
+      end
+      assert_equal 200, status_for(@app, 'good.example')
+      assert_equal 403, status_for(@app, 'evil.example')
+    end
+
+    it 'should apply it in development' do
+      mock_app do
+        set :environment, :development
+        disable :reload
+        set :host_authorization, permitted_hosts: ['good.example']
+        get('/') { 'ok' }
+      end
+      assert_equal 200, status_for(@app, 'good.example')
+      assert_equal 403, status_for(@app, 'evil.example')
+    end
+
+    it 'should apply a setting inherited from a parent app class' do
+      parent = Sinatra.new(Padrino::Application) do
+        set :host_authorization, permitted_hosts: ['good.example']
+      end
+      mock_app(parent) { get('/') { 'ok' } }
+      assert_equal 200, status_for(@app, 'good.example')
+      assert_equal 403, status_for(@app, 'evil.example')
+    end
+
+    it 'should apply a setting from Padrino.configure_apps' do
+      Padrino.configure_apps { set :host_authorization, permitted_hosts: ['good.example'] }
+      mock_app { get('/') { 'ok' } }
+      assert_equal 200, status_for(@app, 'good.example')
+      assert_equal 403, status_for(@app, 'evil.example')
+    ensure
+      Padrino.clear!
+    end
+  end
+
+  describe 'when the app does not set host_authorization' do
+    %i[development production test].each do |env|
+      it "should answer any host in #{env}" do
+        mock_app do
+          set :environment, env
+          disable :reload
+          get('/') { 'ok' }
+        end
+        assert_equal 200, status_for(@app, 'myapp.example')
+        assert_equal 200, status_for(@app, 'localhost')
+      end
+    end
+
+    it 'should treat a setting that is not a Hash as unset' do
+      mock_app do
+        disable :host_authorization
+        get('/') { 'ok' }
+      end
+      assert_equal 200, status_for(@app, 'myapp.example')
+    end
+  end
+
+  describe 'for mounted apps' do
+    before do
+      Object.send(:remove_const, :HostAuthApp) if defined?(::HostAuthApp)
+      ::HostAuthApp = Class.new(Padrino::Application) do
+        set :host_authorization, permitted_hosts: ['good.example']
+        get('/') { 'ok' }
+      end
+    end
+
+    after do
+      Object.send(:remove_const, :HostAuthApp)
+      Padrino.clear!
+    end
+
+    it 'should apply it to an app mounted at the root' do
+      Padrino.mount('HostAuthApp', app_file: __FILE__).to('/')
+      assert_equal 200, status_for(Padrino.application, 'good.example')
+      assert_equal 403, status_for(Padrino.application, 'evil.example')
+    end
+
+    it 'should apply it to an app mounted under a sub-path' do
+      Padrino.mount('HostAuthApp', app_file: __FILE__).to('/sub')
+      assert_equal 200, status_for(Padrino.application, 'good.example', '/sub')
+      assert_equal 403, status_for(Padrino.application, 'evil.example', '/sub')
+    end
+
+    it 'should apply it to an app mounted for a host pattern' do
+      Padrino.mount('HostAuthApp', app_file: __FILE__).host(/\.example\z/)
+      assert_equal 200, status_for(Padrino.application, 'good.example')
+      assert_equal 403, status_for(Padrino.application, 'evil.example')
+    end
+
+    it 'should leave a sibling app without the setting open to any host' do
+      ::HostAuthOpenApp = Class.new(Padrino::Application) { get('/') { 'open' } }
+      Padrino.mount('HostAuthApp', app_file: __FILE__).to('/locked')
+      Padrino.mount('HostAuthOpenApp', app_file: __FILE__).to('/')
+      assert_equal 403, status_for(Padrino.application, 'evil.example', '/locked')
+      assert_equal 200, status_for(Padrino.application, 'evil.example', '/')
+    ensure
+      Object.send(:remove_const, :HostAuthOpenApp) if defined?(::HostAuthOpenApp)
+    end
+  end
+end

data/test/test_mounter.rb

@@ -254,6 +254,93 @@ describe 'Mounter' do
       assert_equal File.read(__FILE__), res.body
     end
 
+    describe 'serving static assets under a sub-path' do
+      def with_public_files(*files, &block)
+        Dir.mktmpdir do |root|
+          files.each do |file|
+            path = File.join(root, 'public', file)
+            FileUtils.mkdir_p(File.dirname(path))
+            File.write(path, file)
+          end
+          Padrino.stub(:root, proc { |*args| File.expand_path(File.join(root, *args)) }, &block)
+        end
+      end
+
+      it 'should serve assets from the project public folder' do
+        class ::StaticSubApp < Padrino::Application; end
+        with_public_files('stylesheets/site.css') do
+          Padrino.mount('static_sub_app').to('/myapp')
+          res = Rack::MockRequest.new(Padrino.application).get('/myapp/stylesheets/site.css')
+          assert res.ok?
+          assert_equal 'stylesheets/site.css', res.body
+        end
+      end
+
+      it 'should serve assets from a public folder named after the uri root' do
+        class ::StaticOwnApp < Padrino::Application; end
+        with_public_files('stylesheets/site.css', 'myapp/stylesheets/site.css') do
+          Padrino.mount('static_own_app').to('/myapp')
+          res = Rack::MockRequest.new(Padrino.application).get('/myapp/stylesheets/site.css')
+          assert res.ok?
+          assert_equal 'myapp/stylesheets/site.css', res.body
+        end
+      end
+
+      it 'should fall back to the project public folder for files missing from the uri root folder' do
+        class ::StaticPartialApp < Padrino::Application; end
+        with_public_files('stylesheets/site.css', 'myapp/.keep') do
+          Padrino.mount('static_partial_app').to('/myapp')
+          res = Rack::MockRequest.new(Padrino.application).get('/myapp/stylesheets/site.css')
+          assert res.ok?
+          assert_equal 'stylesheets/site.css', res.body
+        end
+      end
+
+      it 'should keep serving shared assets when the application is built again' do
+        class ::StaticRebuiltApp < Padrino::Application; end
+        with_public_files('stylesheets/site.css') do
+          Padrino.mount('static_rebuilt_app').to('/myapp')
+          3.times do
+            res = Rack::MockRequest.new(Padrino.application).get('/myapp/stylesheets/site.css')
+            assert res.ok?
+            assert_equal 'stylesheets/site.css', res.body
+          end
+        end
+      end
+
+      it 'should serve assets and routes when the app has a helper named like an internal method' do
+        class ::StaticHelperApp < Padrino::Application
+          helpers(Module.new { define_method(:public_file) { |name| "/files/#{name}" } })
+          get('/page') { public_file('a') }
+        end
+        with_public_files('stylesheets/site.css') do
+          Padrino.mount('static_helper_app').to('/myapp')
+          assert_equal 'stylesheets/site.css', Rack::MockRequest.new(Padrino.application).get('/myapp/stylesheets/site.css').body
+          assert_equal '/files/a', Rack::MockRequest.new(Padrino.application).get('/myapp/page').body
+        end
+      end
+
+      it 'should not fall back from a custom public folder' do
+        class ::StaticCustomApp < Padrino::Application; end
+        with_public_files('stylesheets/site.css', 'custom/.keep') do
+          StaticCustomApp.set :public_folder, Padrino.root('public', 'custom')
+          Padrino.mount('static_custom_app').to('/myapp')
+          res = Rack::MockRequest.new(Padrino.application).get('/myapp/stylesheets/site.css')
+          assert_equal 404, res.status
+        end
+      end
+
+      it 'should serve assets for an app mounted at the root' do
+        class ::StaticRootApp < Padrino::Application; end
+        with_public_files('stylesheets/site.css') do
+          Padrino.mount('static_root_app').to('/')
+          res = Rack::MockRequest.new(Padrino.application).get('/stylesheets/site.css')
+          assert res.ok?
+          assert_equal 'stylesheets/site.css', res.body
+        end
+      end
+    end
+
     it 'should load apps from gems' do
       spec_file = Padrino.root('fixtures', 'app_gem', 'app_gem.gemspec')
       spec = Gem::Specification.load(spec_file)

data/test/test_reloader_storage.rb

@@ -30,15 +30,14 @@ describe 'Padrino::Reloader::Storage' do
     end
 
     it 'should return list of new classes' do
-      skip
       class OSTest; end
       module OSTestModule; class B; end; end
 
       new_classes = Padrino::Reloader::Storage.send(:new_classes, @snapshot)
 
-      assert_equal new_classes.size, 3
-      assert_equal new_classes.include?(OSTest), true
-      assert_equal new_classes.include?(OSTestModule::B), true
+      assert_includes new_classes, OSTest
+      assert_includes new_classes, OSTestModule::B
+      refute_includes new_classes, Padrino::Logger
     end
 
     it 'should return a Set object' do

data/test/test_reloader_system.rb

@@ -70,9 +70,10 @@ describe 'SystemReloader' do
           end
         end
       DOC
-      tmp_file = '/tmp/padrino_class_demo.rb'
+      gem_dir = Dir.mktmpdir
+      File.write(File.join(gem_dir, 'padrino_class_demo.rb'), new_class)
+      $LOAD_PATH.unshift(gem_dir)
       begin
-        File.open(tmp_file, 'w') { |f| f.write(new_class) }
         Padrino.clear!
         require File.expand_path("#{__dir__}/fixtures/apps/system_class_methods_demo.rb")
         @app = SystemClassMethodsDemo
@@ -85,7 +86,8 @@ describe 'SystemReloader' do
         assert defined?(SingletonClassTest), 'SingletonClassTest undefined'
         assert_includes SingletonClassTest.singleton_methods, :external_test
       ensure
-        FileUtils.rm tmp_file
+        $LOAD_PATH.delete(gem_dir)
+        FileUtils.rm_rf(gem_dir)
       end
     end
 
@@ -96,9 +98,10 @@ describe 'SystemReloader' do
           end
         end
       DOC
-      tmp_file = '/tmp/padrino_instance_demo.rb'
+      gem_dir = Dir.mktmpdir
+      File.write(File.join(gem_dir, 'padrino_instance_demo.rb'), new_class)
+      $LOAD_PATH.unshift(gem_dir)
       begin
-        File.open(tmp_file, 'w') { |f| f.write(new_class) }
         Padrino.clear!
         require File.expand_path("#{__dir__}/fixtures/apps/system_instance_methods_demo.rb")
         @app = SystemInstanceMethodsDemo
@@ -111,7 +114,8 @@ describe 'SystemReloader' do
         assert defined?(InstanceTest), 'InstanceTest undefined'
         assert_includes InstanceTest.new.methods, :instance_test
       ensure
-        FileUtils.rm tmp_file
+        $LOAD_PATH.delete(gem_dir)
+        FileUtils.rm_rf(gem_dir)
       end
     end
 
@@ -187,5 +191,94 @@ describe 'SystemReloader' do
       Padrino.reload!
       assert_equal original_value, BadModule.instance_variable_get(:@happy_global_variable)
     end
+
+    it 'should redefine an ActiveSupport::Concern whose included block moved' do
+      begin
+        require 'active_support/concern'
+      rescue LoadError
+        skip 'ActiveSupport is not available'
+      end
+      concern_file = "#{__dir__}/fixtures/apps/concerned/models/mixins/filterable.rb"
+      includer_file = "#{__dir__}/fixtures/apps/concerned/models/filtered_item.rb"
+      original = File.read(concern_file)
+      Padrino.clear!
+      require File.expand_path("#{__dir__}/fixtures/apps/concerned/app.rb")
+      @app = SystemConcernedClassDemo
+      Padrino.mount(SystemConcernedClassDemo).to('/')
+      get '/'
+      assert_equal 'v1', FilteredItem.new.filter
+      Filterable.instance_variable_set(:@config, :kept)
+
+      # A second edit checks that the concern stays tracked after its first reload.
+      [2, 3].each do |version|
+        File.write(concern_file, original.sub('  included do', "#{"  # moved\n" * version}  included do")
+                                         .sub("'v1'", "'v#{version}'").sub("'l1'", "'l#{version}'"))
+        FileUtils.touch(concern_file, mtime: Time.now + version)
+        Padrino.reload!
+        assert_equal "l#{version}", FilteredItem.new.label
+        FileUtils.touch(includer_file, mtime: Time.now + version)
+        Padrino.reload!
+        assert_equal "v#{version}", FilteredItem.new.filter
+      end
+      assert_equal :kept, Filterable.instance_variable_get(:@config)
+    ensure
+      File.write(concern_file, original) if original
+    end
+
+    it 'should redefine an ActiveSupport::Concern that another file requires, also after Padrino.clear!' do
+      begin
+        require 'active_support/concern'
+      rescue LoadError
+        skip 'ActiveSupport is not available'
+      end
+      concern_file = "#{__dir__}/fixtures/apps/concerned/models/mixins/sortable.rb"
+      includer_file = "#{__dir__}/fixtures/apps/concerned/models/catalog_item.rb"
+      original = File.read(concern_file)
+      # Sortable stays defined after Padrino.clear!, so the second load finds it already defined.
+      2.times do
+        Padrino.clear!
+        require File.expand_path("#{__dir__}/fixtures/apps/concerned/app.rb")
+        @app = SystemConcernedClassDemo
+        Padrino.mount(SystemConcernedClassDemo).to('/')
+        get '/'
+      end
+      assert_equal 's1', CatalogItem.new.sort_key
+
+      [2, 3].each do |version|
+        File.write(concern_file, original.sub('  included do', "#{"  # moved\n" * version}  included do").gsub("'s1'", "'s#{version}'"))
+        FileUtils.touch(concern_file, mtime: Time.now + version)
+        Padrino.reload!
+        assert_equal "s#{version}", CatalogItem.new.sort_label
+        FileUtils.touch(includer_file, mtime: Time.now + version)
+        Padrino.reload!
+        assert_equal "s#{version}", CatalogItem.new.sort_key
+      end
+    ensure
+      if original
+        File.write(concern_file, original)
+        # The next Padrino.clear! keeps Sortable, and CatalogItem then requires the restored file without a reset.
+        Padrino::Reloader.reset_concern(Sortable) if defined?(Sortable)
+      end
+    end
+
+    it 'should not call methods on deprecated constant proxies while looking for concerns' do
+      begin
+        require 'active_support'
+        require 'active_support/deprecation'
+      rescue LoadError
+        skip 'ActiveSupport is not available'
+      end
+      # A proxy is a Module that warns, or raises with this behavior, on any method call,
+      # so the test only keeps a reference to it and never calls it.
+      deprecator = ActiveSupport::Deprecation.new
+      deprecator.behavior = :raise
+      _proxy = ActiveSupport::Deprecation::DeprecatedConstantProxy.new('ReloaderDeprecatedMonitor', '::Monitor', deprecator)
+      Padrino.clear!
+      require File.expand_path("#{__dir__}/fixtures/apps/concerned/app.rb")
+      @app = SystemConcernedClassDemo
+      Padrino.mount(SystemConcernedClassDemo).to('/')
+      get '/'
+      assert_equal 'l1', FilteredItem.new.label
+    end
   end
 end

data/test/test_routing.rb

@@ -89,6 +89,52 @@ describe 'Routing' do
     end
   end
 
+  it 'should keep a plus sign in static file paths' do
+    Dir.mktmpdir do |tmp|
+      dir = "#{tmp}/\u00fcber"
+      FileUtils.mkdir_p(["#{dir}/public", "#{dir}/public_bak"])
+      File.write("#{dir}/public/a+b.txt", 'plus')
+      File.write("#{dir}/public/c d.txt", 'space')
+      File.write("#{dir}/public/caf\u00e9.txt", 'cafe')
+      File.write("#{dir}/public_bak/secret.txt", 'secret')
+      mock_app do
+        set :public_folder, "#{dir}/public"
+        get('/*') { 'not found' }
+      end
+      get '/a+b.txt'
+      assert_equal 'plus', body
+      get '/a%2Bb.txt'
+      assert_equal 'plus', body
+      get '/c%20d.txt'
+      assert_equal 'space', body
+      get '/c+d.txt'
+      assert_equal 'not found', body
+      get '/caf%C3%A9.txt'
+      assert_equal 'cafe', body
+      get '/%2e%2e/public_bak/secret.txt'
+      assert_equal 'not found', body
+      get '/a+b.txt%00.png'
+      assert_equal 'not found', body
+    end
+  end
+
+  it 'should keep a plus sign in static file paths of an app mounted under a sub-path' do
+    Dir.mktmpdir do |dir|
+      FileUtils.mkdir_p("#{dir}/public")
+      File.write("#{dir}/public/a+b.txt", 'plus')
+      File.write("#{dir}/public/c d.txt", 'space')
+      mock_app do
+        set :public_folder, "#{dir}/public"
+        get('/*') { 'not found' }
+      end
+      mounted = Rack::Builder.app(@app) { |inner| map('/blog') { run inner } }
+      request = Rack::MockRequest.new(mounted)
+      assert_equal 'plus', request.get('/blog/a+b.txt').body
+      assert_equal 'not found', request.get('/blog/c+d.txt').body
+      assert_equal 'space', request.get('/blog/c%20d.txt').body
+    end
+  end
+
   it 'should ignore trailing delimiters for basic route' do
     mock_app do
       get('/foo') { 'okey' }
@@ -253,6 +299,30 @@ describe 'Routing' do
     assert_equal 'cpp', body
   end
 
+  it 'should not find a route for a path that does not decode to valid UTF-8' do
+    mock_app do
+      get('/') { 'root' }
+      get("/caf\u00e9") { 'cafe' }
+      get(:show, map: '/items/:id') { params[:id] }
+    end
+    { '' => Padrino::Router.new(path: '/', to: @app), '/blog' => Padrino::Router.new(path: '/blog', to: @app) }.each do |prefix, app|
+      # Set PATH_INFO directly: Rack::MockRequest refuses to parse a malformed escape such as '%zz'.
+      request = lambda do |path|
+        env = Rack::MockRequest.env_for('/')
+        env['PATH_INFO'] = "#{prefix}#{path}"
+        status, _headers, body = app.call(env)
+        [status, body.to_enum.to_a.join]
+      end
+      ['/%ff.txt', '/a%80', '/items/%ff', '/items/%c0%ae%c0%ae', '/a%zz', '/items/%'].each do |path|
+        assert_equal 404, request.call(path)[0], "#{prefix}#{path}"
+      end
+      assert_equal [200, 'root'], request.call('/')
+      assert_equal [200, 'cafe'], request.call('/caf%C3%A9')
+      assert_equal [200, "caf\u00e9"], request.call('/items/caf%C3%A9')
+      assert_equal [200, 'a+b'], request.call('/items/a+b')
+    end
+  end
+
   it 'should keep path params UTF-8 regardless of default_external' do
     mock_app { get(:show, map: '/items/:id') { params[:id] == 'щ' ? 'ok' : "bad #{params[:id].encoding}" } }
     old_verbose = $VERBOSE
@@ -1174,6 +1244,17 @@ describe 'Routing' do
     assert_equal 'show 3 1 2', body
   end
 
+  it 'should name the parent param after a parent that ends in s' do
+    mock_app do
+      controller :comments, parent: :status do
+        get(:index) { "index #{params[:status_id]}" }
+      end
+    end
+    get '/status/1/comments'
+    assert_equal 'index 1', body
+    assert_equal '/status/1/comments', @app.url(:comments, :index, status_id: 1)
+  end
+
   it 'should respect parent precedence: controllers parents go before route parents' do
     mock_app do
       controllers :project do
@@ -2501,4 +2582,21 @@ describe 'Routing' do
     get '/'
     assert_equal 200, status
   end
+
+  it 'functions in a standalone app that has a public folder' do
+    Dir.mktmpdir do |root|
+      FileUtils.mkdir_p(File.join(root, 'public'))
+      File.write(File.join(root, 'public', 'a.txt'), 'static')
+      mock_app(Sinatra::Application) do
+        set :root, root
+        register Padrino::Routing
+        get(:index) { 'Standalone' }
+      end
+      get '/'
+      assert_equal 200, status
+      assert_equal 'Standalone', body
+      get '/a.txt'
+      assert_equal 'static', body
+    end
+  end
 end

data/test/test_server.rb

@@ -1,4 +1,6 @@
 require_relative 'helper'
+require 'open3'
+require 'timeout'
 
 describe 'Padrino::Server' do
   describe 'detect_rack_handler' do
@@ -29,4 +31,60 @@ describe 'Padrino::Server' do
       end
     end
   end
+
+  describe 'signals' do
+    # Starts Padrino::Server in a child process on a fake handler that, like WEBrick, yields its
+    # server and then loops until the server is shut down, sends the child TERM and returns its output.
+    def start_and_term(server_methods)
+      script = <<~RUBY
+        require 'padrino-core'
+        class FakeServer
+          #{server_methods}
+          def start
+            puts 'READY'
+            $stdout.flush
+            sleep 0.05 until @stopped
+            puts 'STOPPED'
+          end
+        end
+        module FakeHandler
+          def self.run(_app, **_options)
+            server = FakeServer.new
+            yield server
+            server.start
+          end
+        end
+        Rackup::Handler.register('fake', FakeHandler)
+        Padrino::Server.start(->(_env) { [200, {}, []] }, server: 'fake', Port: 0)
+      RUBY
+      lib = File.expand_path('../lib', __dir__)
+      Open3.popen2e({ 'RACK_ENV' => 'test' }, RbConfig.ruby, '-I', lib, '-e', script) do |_stdin, out, wait|
+        output = +''
+        Timeout.timeout(60) do
+          output << out.gets.to_s until output.include?('READY') || out.eof?
+          Process.kill('TERM', wait.pid)
+          output << out.read
+          [output, wait.value]
+        end
+      rescue Timeout::Error
+        Process.kill('KILL', wait.pid)
+        raise
+      end
+    end
+
+    it 'should shut the server down on TERM when it supports shutdown' do
+      output, status = start_and_term("def shutdown\n  puts 'SHUTDOWN'\n  @stopped = true\nend")
+      assert status.success?, output
+      assert_includes output, 'SHUTDOWN'
+      assert_includes output, 'STOPPED'
+      refute_includes output, 'SystemExit'
+    end
+
+    it 'should exit on TERM when the server does not support shutdown' do
+      output, status = start_and_term('')
+      assert status.success?, output
+      refute_includes output, 'STOPPED'
+      assert_includes output, 'leaves the gun'
+    end
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: padrino-core
 version: !ruby/object:Gem::Version
-  version: 0.17.0
+  version: 0.18.0
 platform: ruby
 authors:
 - Padrino Team
@@ -11,7 +11,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-14 00:00:00.000000000 Z
+date: 2026-10-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ostruct
@@ -33,14 +33,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.17.0
+        version: 0.18.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.17.0
+        version: 0.18.0
 - !ruby/object:Gem::Dependency
   name: rackup
   requirement: !ruby/object:Gem::Requirement
@@ -145,7 +145,11 @@ files:
 - test/fixtures/app_gem/lib/app_gem/version.rb
 - test/fixtures/apps/complex.rb
 - test/fixtures/apps/concerned/app.rb
+- test/fixtures/apps/concerned/models/catalog_item.rb
+- test/fixtures/apps/concerned/models/filtered_item.rb
 - test/fixtures/apps/concerned/models/mixins/badmodule.rb
+- test/fixtures/apps/concerned/models/mixins/filterable.rb
+- test/fixtures/apps/concerned/models/mixins/sortable.rb
 - test/fixtures/apps/custom_dependencies/custom_dependencies.rb
 - test/fixtures/apps/custom_dependencies/my_dependencies/my_dependency.rb
 - test/fixtures/apps/demo_app.rb
@@ -226,6 +230,7 @@ files:
 - test/test_dependencies.rb
 - test/test_filters.rb
 - test/test_flash.rb
+- test/test_host_authorization.rb
 - test/test_launcher.rb
 - test/test_locale.rb
 - test/test_logger.rb
@@ -261,111 +266,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 1.3.6
 requirements: []
-rubygems_version: 3.5.23
+rubygems_version: 3.5.22
 signing_key:
 specification_version: 4
 summary: The required Padrino core gem
-test_files:
-- test/fixtures/app_gem/Gemfile
-- test/fixtures/app_gem/app/app.rb
-- test/fixtures/app_gem/app_gem.gemspec
-- test/fixtures/app_gem/lib/app_gem.rb
-- test/fixtures/app_gem/lib/app_gem/version.rb
-- test/fixtures/apps/complex.rb
-- test/fixtures/apps/concerned/app.rb
-- test/fixtures/apps/concerned/models/mixins/badmodule.rb
-- test/fixtures/apps/custom_dependencies/custom_dependencies.rb
-- test/fixtures/apps/custom_dependencies/my_dependencies/my_dependency.rb
-- test/fixtures/apps/demo_app.rb
-- test/fixtures/apps/demo_demo.rb
-- test/fixtures/apps/demo_project/api/app.rb
-- test/fixtures/apps/demo_project/api/lib/api_lib.rb
-- test/fixtures/apps/demo_project/app.rb
-- test/fixtures/apps/external_apps/fake_lib.rb
-- test/fixtures/apps/external_apps/fake_root.rb
-- test/fixtures/apps/external_constants/app.rb
-- test/fixtures/apps/external_constants/helpers/external_constants_helpers.rb
-- test/fixtures/apps/helpers/class_methods_helpers.rb
-- test/fixtures/apps/helpers/instance_methods_helpers.rb
-- test/fixtures/apps/helpers/system_helpers.rb
-- test/fixtures/apps/kiq.rb
-- test/fixtures/apps/lib/myklass.rb
-- test/fixtures/apps/lib/myklass/mysubklass.rb
-- test/fixtures/apps/models/child.rb
-- test/fixtures/apps/models/parent.rb
-- test/fixtures/apps/mountable_apps/rack_apps.rb
-- test/fixtures/apps/mountable_apps/static.html
-- test/fixtures/apps/precompiled_app.rb
-- test/fixtures/apps/simple.rb
-- test/fixtures/apps/static.rb
-- test/fixtures/apps/stealthy/app.rb
-- test/fixtures/apps/stealthy/helpers/stealthy_class_helpers.rb
-- test/fixtures/apps/system.rb
-- test/fixtures/apps/system_class_methods_demo.rb
-- test/fixtures/apps/system_instance_methods_demo.rb
-- test/fixtures/dependencies/a.rb
-- test/fixtures/dependencies/autoload/a.rb
-- test/fixtures/dependencies/autoload/b.rb
-- test/fixtures/dependencies/autoload/lazy.rb
-- test/fixtures/dependencies/b.rb
-- test/fixtures/dependencies/c.rb
-- test/fixtures/dependencies/circular/e.rb
-- test/fixtures/dependencies/circular/f.rb
-- test/fixtures/dependencies/circular/g.rb
-- test/fixtures/dependencies/d.rb
-- test/fixtures/dependencies/gc/t.rb
-- test/fixtures/dependencies/gc/u.rb
-- test/fixtures/dependencies/gc/v.rb
-- test/fixtures/dependencies/gc/w.rb
-- test/fixtures/dependencies/gc/x.rb
-- test/fixtures/dependencies/gc/y.rb
-- test/fixtures/dependencies/linear/h.rb
-- test/fixtures/dependencies/linear/i.rb
-- test/fixtures/dependencies/nested/j.rb
-- test/fixtures/dependencies/nested/k.rb
-- test/fixtures/dependencies/nested/l.rb
-- test/fixtures/dependencies/nested/m.rb
-- test/fixtures/dependencies/nested/n.rb
-- test/fixtures/dependencies/nested/ooo.rb
-- test/fixtures/dependencies/nested/ppp.rb
-- test/fixtures/dependencies/nested/qqq.rb
-- test/fixtures/dependencies/nested/rrr.rb
-- test/fixtures/dependencies/nested/sss.rb
-- test/fixtures/dependencies/parent/admin.rb
-- test/fixtures/dependencies/parent/trackable.rb
-- test/fixtures/dependencies/parent/user.rb
-- test/fixtures/dependencies/partial/a.rb
-- test/fixtures/dependencies/partial/b.rb
-- test/fixtures/dependencies/reload/forced.rb
-- test/fixtures/dependencies/reload/untracked.rb
-- test/fixtures/dependencies/reload/untracked_forced.rb
-- test/fixtures/dependencies/untracked/a.rb
-- test/fixtures/dependencies/untracked/b.rb
-- test/fixtures/reloadable_apps/external/app/app.rb
-- test/fixtures/reloadable_apps/external/app/controllers/base.rb
-- test/fixtures/reloadable_apps/main/app.rb
-- test/helper.rb
-- test/test_application.rb
-- test/test_binstub.rb
-- test/test_cli.rb
-- test/test_configuration.rb
-- test/test_core.rb
-- test/test_csrf_protection.rb
-- test/test_dependencies.rb
-- test/test_filters.rb
-- test/test_flash.rb
-- test/test_launcher.rb
-- test/test_locale.rb
-- test/test_logger.rb
-- test/test_mounter.rb
-- test/test_params_protection.rb
-- test/test_rake_tasks.rb
-- test/test_reloader_complex.rb
-- test/test_reloader_external.rb
-- test/test_reloader_simple.rb
-- test/test_reloader_storage.rb
-- test/test_reloader_system.rb
-- test/test_restful_routing.rb
-- test/test_router.rb
-- test/test_routing.rb
-- test/test_server.rb
+test_files: []