permittable 0.10.0 → 0.11.1

data/lib/permittable/railtie.rb

@@ -23,12 +23,99 @@ module Permittable
       # this array in place and ActionDispatch reads the same object per
       # request, so a name registered when a controller loads is seen by the
       # next request. It is the array, not a snapshot, that has to be fed.
+      #
+      # ActiveRecord is a second sink: see FilterAttributesFeed, which also
+      # explains why it is fed here and installed by the initializer below.
+      feed = filter_attributes_feed
       ::Permittable.on_sensitive_parameter do |name|
         filters = app.config.filter_parameters
         filters << name unless filters.include?(name)
+        feed.add(name)
       end
     end
 
+    # AFTER ActiveRecord's own hook, not before: both run when ActiveRecord::Base
+    # loads, in the order they were registered, and that one does
+    # `filter_attributes += config.filter_parameters`. Running first, the feed
+    # would add each name and that copy would add it again as a String (it holds
+    # Strings whenever precompile_filter_parameters is off, as on Rails 6.1).
+    initializer "permittable.filter_attributes",
+                after: "active_record.set_filter_attributes" do
+      feed = filter_attributes_feed
+      ::ActiveSupport.on_load(:active_record) { feed.attach(self) }
+    end
+
+    # The second sink for sensitive names: ActiveRecord::Base.filter_attributes.
+    #
+    # It is a snapshot that never sees a name registered after it loaded. Its
+    # `filter_attributes` is copied from config.filter_parameters exactly once,
+    # when ActiveRecord::Base loads, and in a real app that is BEFORE any
+    # controller registers anything: the first controller's own `model: Person`
+    # loads it. So the copy holds only the proc the initializer appended, which
+    # cannot redact an Integer in the SQL bind log (`[["pin_code", 4321]]`, where
+    # #inspect, handed an already-inspected String, was fine). Each name is
+    # therefore also fed to the model base class directly. The setter drops the
+    # memoized inspection filter, and only names that are missing are added, so
+    # the list holds one entry per name however often a reloaded controller
+    # registers it.
+    #
+    # An app that ASSIGNS `filter_attributes = [...]` (an initializer, or a
+    # to_prepare block, which runs on every reload) rather than appending to it
+    # discards everything fed in so far, and a name that was registered only once
+    # would never come back. So every registration restores EVERY name registered
+    # so far that is missing, not just its own: the next contract to load, or the
+    # next reload re-declaring one, heals the list. (A to_prepare of the gem's own
+    # would not help: railtie blocks run before the app's, so the app's
+    # assignment would still come last.)
+    #
+    # The read-modify-write is done under a lock, as two threads loading
+    # contracts at once would otherwise each write back a list that lacks the
+    # other's name. Nothing inside the lock calls back into the sink or loads
+    # ActiveRecord, so it cannot deadlock.
+    #
+    # ActiveRecord is hooked ONCE for the process, in #attach, rather than once
+    # per name: on_load runs the block at once when ActiveRecord is already
+    # loaded, waits for it otherwise, and never fires in an app without it, where
+    # a hook per registration would queue forever across every code reload.
+    class FilterAttributesFeed
+      def initialize
+        @names = {}
+        @base = nil
+        @lock = Mutex.new
+      end
+
+      # Called with ActiveRecord::Base once it has loaded.
+      def attach(base)
+        @lock.synchronize do
+          @base = base
+          restore
+        end
+      end
+
+      def add(name)
+        @lock.synchronize do
+          @names[name] = true
+          restore if @base
+        end
+      end
+
+      private
+
+      # The caller holds the lock.
+      def restore
+        missing = @names.keys - @base.filter_attributes
+        @base.filter_attributes += missing unless missing.empty?
+      end
+    end
+
+    # Shared by the two initializers, which Rails runs as instance_exec on this
+    # one object. Memoized rather than built in the first, so the second does not
+    # depend on the order Rails settles on for initializers that name no target.
+    def filter_attributes_feed
+      @filter_attributes_feed ||= FilterAttributesFeed.new
+    end
+    private :filter_attributes_feed
+
     rake_tasks do
       load File.expand_path("tasks/openapi.rake", __dir__)
       load File.expand_path("tasks/generate.rake", __dir__)

data/lib/permittable/rspec.rb

@@ -96,7 +96,10 @@ module Permittable
       end
 
       def matching(regexp)
-        @expected[:format] = regexp
+        # `format: "email"` names a preset exactly as `format: :email` does
+        # (see resolve_format!), so the matcher reads a String the same way;
+        # as a Symbol it also reports the preset the same way in a failure.
+        @expected[:format] = regexp.is_a?(String) ? regexp.to_sym : regexp
         self
       end
 
@@ -364,8 +367,9 @@ module Permittable
         "expected the field to be #{expected}, but it is #{actual}" unless actual == expected
       end
 
-      # `matching(:email)` asserts the preset by name, `matching(/re/)` the
-      # Regexp itself.
+      # `matching(:email)` (or `matching("email")`, normalized to a Symbol by
+      # `matching`) asserts the preset by name, `matching(/re/)` the Regexp
+      # itself.
       def format_mismatch(field, expected)
         return option_mismatch(field, :format, expected) unless expected.is_a?(Symbol)
         return if field[:format_name] == expected
@@ -374,7 +378,21 @@ module Permittable
       end
 
       def default_mismatch(field, expected)
-        option_mismatch(field, :default, expected) unless field.key?(:default) && field[:default] == cast_default(field, expected)
+        option_mismatch(field, :default, expected) unless field.key?(:default) && same_default?(field, expected)
+      end
+
+      # A :json default is stored as authored, but the action reads it as
+      # a HashWithIndifferentAccess, String-keyed all the way down. The
+      # declaration's spelling, `with_default(theme: "dark")`, and the
+      # action's, `with_default("theme" => "dark")`, name the same default,
+      # so both sides are read that way before comparing.
+      def same_default?(field, expected)
+        declared = field[:default]
+        if field[:kind] == :json && declared.is_a?(Hash) && expected.is_a?(Hash)
+          ActiveSupport::HashWithIndifferentAccess.new(declared) == ActiveSupport::HashWithIndifferentAccess.new(expected)
+        else
+          declared == cast_default(field, expected)
+        end
       end
 
       # A contract stores its `default:` as the field reads it — cast,
@@ -483,8 +501,11 @@ module Permittable
         end
       end
 
+      # An anonymous controller class has no name, and a Contract instance
+      # never does, so the fallback names the kind of subject it is.
       def subject_name
-        (@subject.respond_to?(:name) && @subject.name) || "the controller"
+        (@subject.respond_to?(:name) && @subject.name) ||
+          (@subject.is_a?(Permittable::Contract) ? "the contract" : "the controller")
       end
 
       def path_label
@@ -616,15 +637,33 @@ module Permittable
           attr_accessor :params
         end
         mirror_contract_unknown_check(host) if @subject.is_a?(Permittable::Contract)
+        action = @action || rule[:actions].first || "call"
+        label_instrumentation(host, action)
         host.permittable_contracts = [rule.merge(mode: :enforce).freeze]
         instance = host.new
         instance.params = @params
-        action = @action || rule[:actions].first || "call"
         violations = instance.permittable_violations(action)
         result = violations.empty? ? instance.permitted_params(action) : nil
         [violations, result]
       end
 
+      # A rejection instruments invalid_parameters.permittable exactly as a
+      # request would. The host is anonymous, so without this the payload
+      # carried controller: nil, action: nil — a subscriber following the
+      # README's shape (`payload[:controller].tr("/", ".")`) raised out of
+      # the matcher. Label it the way the subject itself would: a
+      # controller by its path (or name, or "the contract" when anonymous —
+      # an anonymous controller's controller_path is nil), a Contract as
+      # Contract#call does.
+      def label_instrumentation(host, action)
+        label = if @subject.is_a?(Permittable::Contract) then "Permittable::Contract"
+                elsif @subject.respond_to?(:controller_path) then @subject.controller_path || subject_name
+                else subject_name
+                end
+        host.define_method(:permittable_controller_name) { label }
+        host.define_method(:permittable_action_name) { action }
+      end
+
       # Mirrors Permittable::Contract's own host override verbatim (see
       # lib/permittable/contract.rb): standalone input has no router and no
       # request, so nothing is exempt from unknown: checking, top level or
@@ -666,8 +705,11 @@ module Permittable
         violations.map { |v| v[:code] ? "#{v[:param]} (#{v[:code]})" : v[:param] }.join(", ")
       end
 
+      # An anonymous controller class has no name, and a Contract instance
+      # never does, so the fallback names the kind of subject it is.
       def subject_name
-        (@subject.respond_to?(:name) && @subject.name) || "the contract"
+        (@subject.respond_to?(:name) && @subject.name) ||
+          (@subject.is_a?(Permittable::Contract) ? "the contract" : "the controller")
       end
 
       def action_label

data/lib/permittable/tasks/generate.rake

@@ -3,7 +3,9 @@
 # params.expect calls in its source. Drafts go to stdout (paste-ready); the
 # summary goes to stderr.
 #
-#   bin/rails permittable:generate                      # every uncovered controller
+#   bin/rails permittable:generate                      # every uncovered controller not
+#                                                       # left out by Permittable.audit_ignore,
+#                                                       # for the actions it defines
 #   bin/rails "permittable:generate[UsersController]"   # one controller, even if covered
 namespace :permittable do
   desc "Draft Permittable contracts from models and existing permit calls"
@@ -15,23 +17,26 @@ namespace :permittable do
     bases << ActionController::API if defined?(ActionController::API)
     controllers = bases.flat_map(&:descendants).uniq.select(&:name)
 
+    # { controller => actions to leave out of its draft }. A named controller
+    # is drafted even if covered or ignored; the sweep skips both, and leaves
+    # out what Permittable.audit_ignore names. Either leaves out an action the
+    # controller does not define (see Generator.targets and named_target).
     if task_args[:controller]
       controllers = controllers.select { |c| c.name == task_args[:controller] }
       abort "Permittable: no controller named #{task_args[:controller]} was found" if controllers.empty?
+      targets = controllers.to_h { |c| [c, Permittable::Generator.named_target(c)] }
     else
-      controllers = controllers.reject do |c|
-        c.respond_to?(:permittable_contracts) && c.permittable_contracts.any?
-      end
+      targets = Permittable::Generator.targets(controllers)
     end
 
-    drafted = controllers.sort_by(&:name).count do |controller|
+    drafted = targets.sort_by { |controller, _| controller.name }.count do |controller, except|
       path = begin
         Object.const_source_location(controller.name)&.first
       rescue StandardError
         nil
       end
       source = path && File.exist?(path) ? File.read(path) : nil
-      snippet = Permittable::Generator.for_controller(controller, source: source)
+      snippet = Permittable::Generator.for_controller(controller, source: source, except: except)
       next false unless snippet
 
       puts ["# ====", controller.name, path && "(#{path})", "===="].compact.join(" ")

data/lib/permittable/version.rb

@@ -1,3 +1,3 @@
 module Permittable
-  VERSION = "0.10.0".freeze
+  VERSION = "0.11.1".freeze
 end