pakyow-routing 1.0.0.rc1

data/lib/pakyow/routing/expansion.rb

@@ -0,0 +1,104 @@
+# frozen_string_literal: true
+
+require "forwardable"
+
+module Pakyow
+  module Routing
+    # Expands a route template.
+    #
+    # @api private
+    class Expansion
+      attr_reader :expander, :controller, :name
+
+      extend Forwardable
+      def_delegators :@expander, *%i(default template).concat(Controller::DEFINABLE_HTTP_METHODS)
+      def_delegators :@controller, :action
+
+      def initialize(template_name, controller, options, &template_block)
+        @controller = controller
+
+        # Create the controller that stores available routes, groups, and namespaces.
+        #
+        @expander = Controller.make(set_const: false)
+
+        # Evaluate the template to define available routes, groups, and namespaces.
+        #
+        instance_exec(**options, &template_block)
+
+        # Define helper methods for routes
+        #
+        local_expander = @expander
+        @expander.routes.each do |method, routes|
+          routes.each do |route|
+            unless @controller.singleton_class.instance_methods(false).include?(route.name)
+              @controller.define_singleton_method route.name do |*args, &block|
+                # Handle template parts named `new` by determining if we're calling `new` to expand
+                # part of a template, or if we're intending to create a new controller instance.
+                #
+                # If args are empty we can be sure that we're creating a route.
+                #
+                if args.any?
+                  super(*args)
+                else
+                  build_route(method, route.name, route.path || route.matcher, &block).tap do
+                    # Make sure the route was inserted in the same order as found in the template.
+                    #
+                    index_of_last_insert = local_expander.routes[method].index { |expander_route|
+                      expander_route.name == @routes[method].last.name
+                    }
+
+                    insert_before_this_index = @routes[method].select { |each_route|
+                      local_expander.routes[method].any? { |expander_route|
+                        each_route.name == expander_route.name
+                      }
+                    }.map { |each_route|
+                      local_expander.routes[method].index { |expander_route|
+                        expander_route.name == each_route.name
+                      }
+                    }.select { |index|
+                      index > index_of_last_insert
+                    }.first
+
+                    if insert_before_this_index
+                      @routes[method].insert(
+                        @routes[method].index { |each_route|
+                          each_route.name == local_expander.routes[method][insert_before_this_index].name
+                        }, @routes[method].delete_at(index_of_last_insert)
+                      )
+                    end
+                  end
+                end
+              end
+            end
+          end
+        end
+
+        # Define helper methods for groups and namespaces
+        #
+        @expander.children.each do |child|
+          unless @controller.singleton_class.instance_methods(false).include?(child.__object_name.name)
+            @controller.define_singleton_method child.__object_name.name do |&block|
+              if child.path.nil?
+                group(child.__object_name.name, &block)
+              else
+                namespace(child.__object_name.name, child.path || child.matcher, &block)
+              end
+            end
+          end
+        end
+
+        # Set the expansion on the controller.
+        #
+        @controller.expansions << template_name
+      end
+
+      def group(*args, **kwargs, &block)
+        @expander.send(:group, *args, set_const: false, **kwargs, &block)
+      end
+
+      def namespace(*args, **kwargs, &block)
+        @expander.send(:namespace, *args, set_const: false, **kwargs, &block)
+      end
+    end
+  end
+end

data/lib/pakyow/routing/extensions/resource.rb

@@ -0,0 +1,158 @@
+# frozen_string_literal: true
+
+require "pakyow/support/extension"
+
+module Pakyow
+  module Routing
+    module Extension
+      # An extension for defining RESTful Resources. For example:
+      #
+      #   resource :posts, "/posts" do
+      #     list do
+      #       # list the posts
+      #     end
+      #   end
+      #
+      # +Resource+ is available in all controllers by default.
+      #
+      # = Supported Actions
+      #
+      # These actions are supported:
+      #
+      # - +list+ -- +GET /+
+      # - +new+ -- +GET /new+
+      # - +create+ -- +POST /+
+      # - +edit+ -- +GET /:resource_id/edit+
+      # - +update+ -- +PATCH /:resource_id+
+      # - +replace+ -- +PUT /:resource_id+
+      # - +delete+ -- +DELETE /:resource_id+
+      # - +show+ -- +GET /:resource_id+
+      #
+      # = Nested Resources
+      #
+      # Resources can be nested. For example:
+      #
+      #   resource :posts, "/posts" do
+      #     resource :comments, "/comments" do
+      #       list do
+      #         # available at GET /posts/:post_id/comments
+      #       end
+      #     end
+      #   end
+      #
+      # = Collection Routes
+      #
+      # Routes can be defined for the collection. For example:
+      #
+      #   resource :posts, "/posts" do
+      #     collection do
+      #       get "/foo" do
+      #         # available at GET /posts/foo
+      #       end
+      #     end
+      #   end
+      #
+      # = Member Routes
+      #
+      # Routes can be defined as members. For example:
+      #
+      #   resource :posts, "/posts" do
+      #     member do
+      #       get "/foo" do
+      #         # available at GET /posts/:post_id/foo
+      #       end
+      #     end
+      #   end
+      #
+      module Resource
+        extend Support::Extension
+        restrict_extension Controller
+
+        DEFAULT_PARAM = :id
+
+        apply_extension do
+          template :resource do |param: DEFAULT_PARAM|
+            resource_id = ":#{param}"
+            nested_param = "#{Support.inflector.singularize(controller.__object_name.name)}_#{param}".to_sym
+            nested_resource_id = ":#{nested_param}"
+
+            action :update_request_path_for_show, only: [:show] do
+              connection.get(:__endpoint_path).gsub!(resource_id, "show")
+            end
+
+            controller.class_eval do
+              allow_params param
+
+              unless singleton_class.instance_methods(false).include?(:param)
+                define_singleton_method :param do
+                  param
+                end
+              end
+
+              unless singleton_class.instance_methods(false).include?(:nested_param)
+                define_singleton_method :nested_param do
+                  nested_param
+                end
+              end
+
+              unless instance_methods(false).include?(:update_request_path_for_show)
+                define_method :update_request_path_for_show do
+                  connection.get(:__endpoint_path).gsub!(resource_id, "show")
+                end
+              end
+
+              NestedResource.define(self, nested_resource_id, nested_param)
+            end
+
+            get :list, "/"
+            get :new,  "/new"
+            post :create, "/"
+            get :edit, "/#{resource_id}/edit"
+            patch :update, "/#{resource_id}"
+            put :replace, "/#{resource_id}"
+            delete :delete, "/#{resource_id}"
+            get :show, "/#{resource_id}"
+
+            group :collection
+            namespace :member, nested_resource_id
+          end
+        end
+
+        module NestedResource
+          # Nest resources as members of the current resource.
+          #
+          def self.define(controller, nested_resource_id, nested_param)
+            unless controller.singleton_class.instance_methods(false).include?(:namespace)
+              controller.define_singleton_method :namespace do |*args, &block|
+                super(*args, &block).tap do |namespace|
+                  namespace.allow_params nested_param
+                  namespace.action :update_request_path_for_parent do
+                    connection.get(:__endpoint_path).gsub!("/#{nested_resource_id}", "")
+                  end
+                end
+              end
+            end
+
+            unless controller.singleton_class.instance_methods(false).include?(:resource)
+              controller.define_singleton_method :resource do |name, matcher, param: DEFAULT_PARAM, &block|
+                if existing_resource = children.find { |child| child.expansions.include?(:resource) && child.__object_name.name == name }
+                  existing_resource.instance_exec(&block); existing_resource
+                else
+                  expand(:resource, name, File.join(nested_resource_id, matcher), param: param) do
+                    allow_params nested_param
+
+                    action :update_request_path_for_parent do
+                      connection.get(:__endpoint_path).gsub!("/#{nested_resource_id}", "")
+                    end
+
+                    class_eval(&block)
+                  end
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pakyow/routing/extensions.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+require "pakyow/routing/extensions/resource"

data/lib/pakyow/routing/framework.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+require "pakyow/framework"
+
+require "pakyow/routing/controller"
+require "pakyow/routing/extensions"
+require "pakyow/routing/helpers/exposures"
+
+require "pakyow/behavior/definition"
+
+require "pakyow/security/behavior/config"
+require "pakyow/security/behavior/disabling"
+require "pakyow/security/behavior/helpers"
+require "pakyow/security/behavior/insecure"
+require "pakyow/security/behavior/pipeline"
+
+module Pakyow
+  module Routing
+    class Framework < Pakyow::Framework(:routing)
+      def boot
+        object.class_eval do
+          include Pakyow::Behavior::Definition
+
+          isolate Controller do
+            include Extension::Resource
+          end
+
+          # Make controllers definable on the app.
+          #
+          stateful :controller, isolated(:Controller) do |args, _opts|
+            if self.ancestors.include?(Plugin)
+              # When using plugins, prefix controller paths with the mount path.
+              #
+              name, matcher = Controller.send(:parse_name_and_matcher_from_args, *args)
+              path = File.join(@mount_path, Controller.send(:path_from_matcher, matcher).to_s)
+              args.replace([name, path])
+            end
+          end
+
+          # Load controllers for the app.
+          #
+          aspect :controllers
+
+          # Load resources for the app.
+          #
+          aspect :resources
+
+          register_helper :active, Helpers::Exposures
+
+          # Include helpers into the controller class.
+          #
+          on "load" do
+            self.class.include_helpers :active, isolated(:Controller)
+          end
+
+          # Create the global controller instance.
+          #
+          after "initialize" do
+            @global_controller = isolated(:Controller).new(self)
+          end
+
+          # Expose the global controller for handling errors from other frameworks.
+          #
+          def controller_for_connection(connection)
+            @global_controller.dup.tap do |controller|
+              controller.instance_variable_set(:@connection, connection)
+            end
+          end
+
+          require "pakyow/support/message_verifier"
+          handle Support::MessageVerifier::TamperedMessage, as: :forbidden
+
+          include Security::Behavior::Config
+          include Security::Behavior::Disabling
+          include Security::Behavior::Helpers
+          include Security::Behavior::Insecure
+          include Security::Behavior::Pipeline
+        end
+      end
+    end
+  end
+end

data/lib/pakyow/routing/helpers/exposures.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module Pakyow
+  module Routing
+    module Helpers
+      module Exposures
+        # Expose a value by name.
+        #
+        def expose(name, default_value = default_omitted = true, &block)
+          value = if block_given?
+            yield
+          elsif default_omitted
+            __send__(name)
+          end
+
+          unless default_omitted
+            value ||= default_value
+          end
+
+          @connection.set(name, value)
+        end
+      end
+    end
+  end
+end

data/lib/pakyow/routing/route.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+require "pakyow/support/aargv"
+require "pakyow/support/core_refinements/string/normalization"
+
+module Pakyow
+  module Routing
+    # A {Controller} endpoint.
+    #
+    class Route
+      using Support::Refinements::String::Normalization
+
+      attr_reader :path, :method, :name, :block
+
+      # @api private
+      attr_accessor :pipeline
+
+      def initialize(path_or_matcher, name:, method:, &block)
+        @name, @method, @block = name, method, block
+
+        if path_or_matcher.is_a?(String)
+          @path    = path_or_matcher.to_s
+          @matcher = create_matcher_from_path(@path)
+        else
+          @path    = ""
+          @matcher = path_or_matcher
+        end
+      end
+
+      def match(path_to_match)
+        @matcher.match(path_to_match)
+      end
+
+      def call(context)
+        context.instance_exec(&@block) if @block
+      end
+
+      def build_path(path_to_self, **params)
+        working_path = String.normalize_path(File.join(path_to_self.to_s, @path))
+
+        params.each do |key, value|
+          working_path.sub!(":#{key}", value.to_s)
+        end
+
+        working_path.sub!("/#", "#")
+        working_path
+      end
+
+      private
+
+      def create_matcher_from_path(path)
+        converted_path = String.normalize_path(path.split("/").map { |segment|
+          if segment.include?(":")
+            "(?<#{segment[(segment.index(":") + 1)..-1]}>(\\w|[-~:@!$\\'\\(\\)\\*\\+,;])+)"
+          else
+            segment
+          end
+        }.join("/"))
+
+        Regexp.new("^#{converted_path}$")
+      end
+
+      class EndpointBuilder
+        attr_reader :params
+
+        def initialize(route:, path:)
+          @route, @path = route, path
+          @params = String.normalize_path(File.join(@path.to_s, @route.path)).split("/").select { |segment|
+            segment.start_with?(":")
+          }.map { |segment|
+            segment[1..-1].to_sym
+          }
+        end
+
+        def call(**params)
+          @route.build_path(@path, params)
+        end
+
+        def source_location
+          @route.block&.source_location || []
+        end
+      end
+    end
+  end
+end

data/lib/pakyow/routing.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+require "pakyow"
+require "pakyow/support"
+
+require "pakyow/validations"
+
+require "pakyow/routing/framework"
+
+require "pakyow/routing/actions/respond_missing"

data/lib/pakyow/security/base.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require "pakyow/support/hookable"
+
+require "pakyow/security/errors"
+
+module Pakyow
+  module Security
+    class Base
+      include Support::Hookable
+      events :reject
+
+      SAFE_HTTP_METHODS = %i(get head options trace).freeze
+
+      def initialize(config)
+        @config = config
+      end
+
+      def call(connection)
+        unless safe?(connection) || allowed?(connection)
+          reject(connection)
+        end
+
+        connection
+      end
+
+      def reject(connection)
+        performing :reject do
+          connection.logger.warn "Request rejected by #{self.class}; connection: #{connection.inspect}"
+
+          connection.status = 403
+          connection.body = StringIO.new("Forbidden")
+
+          raise InsecureRequest
+        end
+      end
+
+      def safe?(connection)
+        SAFE_HTTP_METHODS.include? connection.method
+      end
+
+      def allowed?(_)
+        false
+      end
+    end
+  end
+end

data/lib/pakyow/security/behavior/config.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+require "pakyow/support/extension"
+
+module Pakyow
+  module Security
+    module Behavior
+      module Config
+        extend Support::Extension
+
+        apply_extension do
+          configurable :security do
+            configurable :csrf do
+              setting :protection, {}
+              setting :origin_whitelist, []
+              setting :param, :authenticity_token
+            end
+          end
+
+          require "pakyow/security/csrf/verify_same_origin"
+          require "pakyow/security/csrf/verify_authenticity_token"
+
+          config.security.csrf.protection = {
+            origin: CSRF::VerifySameOrigin.new(
+              origin_whitelist: config.security.csrf.origin_whitelist
+            ),
+
+            authenticity: CSRF::VerifyAuthenticityToken.new({}),
+          }
+        end
+      end
+    end
+  end
+end

data/lib/pakyow/security/behavior/disabling.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require "pakyow/support/extension"
+
+module Pakyow
+  module Security
+    module Behavior
+      module Disabling
+        extend Support::Extension
+
+        apply_extension do
+          isolated :Controller do
+            def self.disable_protection(type, only: [], except: [])
+              if type.to_sym == :csrf
+                if only.any? || except.any?
+                  Pipelines::CSRF.__pipeline.actions.each do |action|
+                    if only.any?
+                      skip action.target, only: only
+                    end
+
+                    if except.any?
+                      action action.target, only: except
+                    end
+                  end
+                else
+                  exclude_pipeline Pipelines::CSRF
+                end
+              else
+                raise ArgumentError, "Unknown protection type `#{type}'"
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pakyow/security/behavior/helpers.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+require "pakyow/support/extension"
+
+require "pakyow/security/helpers/csrf"
+
+module Pakyow
+  module Security
+    module Behavior
+      module Helpers
+        extend Support::Extension
+
+        apply_extension do
+          register_helper :passive, Security::Helpers::CSRF
+        end
+      end
+    end
+  end
+end

data/lib/pakyow/security/behavior/insecure.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+require "pakyow/support/extension"
+
+require "pakyow/security/errors"
+
+module Pakyow
+  module Security
+    module Behavior
+      module Insecure
+        extend Support::Extension
+
+        apply_extension do
+          handle InsecureRequest, as: 403 do
+            trigger(403)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pakyow/security/behavior/pipeline.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+require "pakyow/support/extension"
+
+module Pakyow
+  module Security
+    module Behavior
+      module Pipeline
+        extend Support::Extension
+
+        apply_extension do
+          require "pakyow/security/pipelines/csrf"
+
+          isolated :Controller do
+            include_pipeline Pipelines::CSRF
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pakyow/security/csrf/verify_authenticity_token.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+require "pakyow/support/message_verifier"
+
+require "pakyow/security/base"
+
+module Pakyow
+  module Security
+    module CSRF
+      # Protects against Cross-Site Forgery Requests (CSRF).
+      # https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet
+      #
+      # Requires a valid token be passed as a request parameter. The token consists
+      # of a client id (unique to the request) and a digest generated from the
+      # client id and the server id stored in the session.
+      #
+      # @see Pakyow::Support::MessageVerifier
+      #
+      class VerifyAuthenticityToken < Base
+        def allowed?(connection)
+          connection.verifier.verify(connection.params[connection.app.config.security.csrf.param])
+        end
+      end
+    end
+  end
+end