permittable 0.13.0 → 0.14.0

data/lib/permittable.rb

@@ -218,7 +218,11 @@ module Permittable
   extend ActiveSupport::Concern
 
   LABEL = "Permittable".freeze
-  SCALAR_TYPES = %i[string integer float decimal boolean date datetime].freeze
+  SCALAR_TYPES = %i[string integer float decimal boolean date datetime file].freeze
+  # An upload, as multipart params carry it. It is a scalar in strong params'
+  # sense (an upload object is permitted), but it is never cast, and a
+  # request's String can never be one.
+  FILE_TYPE = :file
   # Not a scalar: an opaque hash whose shape is deliberately undeclared, for
   # the json/jsonb column a contract has to be able to carry.
   JSON_TYPE = :json
@@ -640,15 +644,14 @@ module Permittable
 
   included do
     class_attribute :permittable_contracts, instance_accessor: false, default: []
-
-    rescue_from InvalidParameters, with: :render_invalid_parameters if respond_to?(:rescue_from)
-    # Registered here, at the include, and not at the first `permit_params`:
-    # the README documents `skip_before_action :enforce_params_contract`, and
-    # Rails raises when it is asked to skip a callback that is not defined
-    # yet. The cost is the order: this check runs before any callback
-    # declared after the include (see the README's "Per-request locales"),
-    # so a locale switch that must cover it is a `prepend_around_action`.
-    before_action :enforce_params_contract if respond_to?(:before_action)
+    # Whether the gem itself ever registered its rescue_from / before_action
+    # for this class (a subclass inherits the answer). Asking the callback
+    # chain instead would bring back a check the app took out with
+    # `skip_before_action :enforce_params_contract`.
+    class_attribute :permittable_rescue_registered, :permittable_callback_registered,
+                    instance_accessor: false, default: false
+
+    permittable_register_hooks
   end
 
   # Strict params-shaped coercion, shared by request-time validation and
@@ -746,6 +749,7 @@ module Permittable
     end
 
     def cast(type, value)
+      return cast_file(value) if type == FILE_TYPE
       return [:error, "invalid_type"] unless scalar_shaped?(value)
       return public_send("cast_#{type}", value) unless value.is_a?(String)
       # Bytes that are not valid in the String's OWN encoding are not text in
@@ -819,6 +823,17 @@ module Permittable
       value.dup.force_encoding(Encoding::UTF_8).scrub
     end
 
+    # Exactly the upload objects ActionController::Parameters permits as
+    # scalars (its PERMITTED_SCALAR_TYPES): what Rails' multipart parser
+    # builds, and what rack-test sends. Each constant is looked up at call
+    # time, so the gem loads and a standalone Contract works without
+    # ActionDispatch or rack-test. The object is handed back as it came.
+    def cast_file(value)
+      upload = (defined?(ActionDispatch::Http::UploadedFile) && value.is_a?(ActionDispatch::Http::UploadedFile)) ||
+               (defined?(Rack::Test::UploadedFile) && value.is_a?(Rack::Test::UploadedFile))
+      upload ? [:ok, value] : [:error, "invalid_type"]
+    end
+
     # Arrays, hashes, and nested ActionController::Parameters
     # (`?age[]=1`, `?age[x]=1`) can never satisfy a scalar type.
     def scalar_shaped?(value)
@@ -1018,8 +1033,17 @@ module Permittable
         date ? [:ok, date] : [:error, "invalid_type"]
       when Date then [:ok, value]
       when String
+        # A bare ISO date ("2026-09-05", the common case) carries no zone, T
+        # or offset, so it skips every check for one.
+        plain = PLAIN_ISO_DATE.match?(value)
+        return cast_date_instant(value) if !plain && (ISO_DATE_AT_OFFSET.match?(value) || ISO_DATE_T.match?(value))
+
         found = Date._parse(value)
         return [:error, "invalid_type"] unless complete_date?(found)
+        return cast_date_instant(value, found) if names_an_instant?(found)
+        # No time found, but an offset may have been dropped ("5/9/2026
+        # -0500"), which :datetime refuses too.
+        return [:error, "invalid_type"] if !plain && offset_misread?(value, found)
 
         # Built from the components rather than re-running Date.parse, which
         # would parse the same string a second time — and Date.parse is the
@@ -1038,6 +1062,32 @@ module Permittable
       found.key?(:year) && found.key?(:mon) && found.key?(:mday)
     end
 
+    # A time of day or a zone, as opposed to a bare calendar date.
+    def names_an_instant?(found)
+      %i[hour min sec sec_fraction zone offset].any? { |part| found.key?(part) }
+    end
+
+    # A String that carries a time or a zone is the instant it names, read
+    # exactly as :datetime reads it (a zoneless one as UTC, an impossible
+    # time or an offset Ruby cannot honour refused) and then as a Time is
+    # read: a date only at midnight UTC. Keeping just the calendar day
+    # accepted "T25:00:00Z" and "+24:00", and turned "T23:30:00-05:00",
+    # which is the next day in UTC, into the day before.
+    #
+    # The Date is built from the components, like a date-only String's,
+    # because Time#to_date reads the proleptic Gregorian day in the Julian
+    # calendar before 1582 ("1500-01-01T00:00:00Z" became 1499-12-23).
+    #
+    # `found` is the String's Date._parse, when the caller has it and has
+    # ruled out the ISO forms cast_datetime reads without one; :datetime's
+    # reading of it is then the same, with one parse fewer.
+    def cast_date_instant(value, found = nil)
+      status, instant = found ? cast_parsed_datetime(value, found) : cast_datetime(value)
+      return [:error, "invalid_type"] unless status == :ok && instant == instant.beginning_of_day
+
+      [:ok, Date.new(instant.year, instant.month, instant.day)]
+    end
+
     # The date a Time or DateTime IS, or nil: its UTC date when it is
     # exactly midnight UTC. That is the instant ActiveSupport compares a
     # Date as, and the one :datetime reads a Date as, so the two types map
@@ -1046,9 +1096,31 @@ module Permittable
     # with a time of day always got. Shared by cast_date and
     # instant_as_date, so a value and an in: member cannot be read
     # differently; and always a plain Date, never the DateTime it came as.
+    #
+    # Built from the UTC components, as a String is (cast_date), not with
+    # Time#to_date: that keeps the instant's day NUMBER and labels it in the
+    # Julian calendar before the 1582 reform, so Time.utc(1500, 1, 1) came
+    # out as 1499-12-23 while "1500-01-01" was 1500-01-01.
+    #
+    # A day the 1582 reform skipped (1582-10-05..14) is no Date, as the String
+    # "1582-10-10" is none, so it is nil here and every caller gives its usual
+    # error. :datetime is proleptic Gregorian and does accept those days; the
+    # two differ there by design, :date being the String path's calendar.
+    #
+    # A DateTime is read by its own civil day, not through #to_time: stdlib's
+    # converts by day number, so outside Rails (ActiveSupport converts by
+    # component) a DateTime before 1582 landed 9 days late.
     def date_of_instant(instant)
-      utc = instant.to_time.getutc
-      utc.to_date if utc == utc.beginning_of_day
+      if instant.is_a?(DateTime)
+        utc = instant.new_offset(0)
+        return unless utc.hour.zero? && utc.minute.zero? && utc.second.zero? && utc.sec_fraction.zero?
+      else
+        utc = instant.to_time.getutc
+        return unless utc == utc.beginning_of_day
+      end
+      return unless Date.valid_date?(utc.year, utc.month, utc.day)
+
+      Date.new(utc.year, utc.month, utc.day)
     end
 
     # A zoneless String parses as UTC regardless of the host timezone
@@ -1080,16 +1152,28 @@ module Permittable
         # converts by day number, so "1500-01-01" became 1500-01-10 — unless
         # the host had loaded ActiveSupport's DateTime#to_time, which
         # converts by component. Gregorian, both agree.
-        found = Date._parse(value)
-        return [:error, "invalid_type"] unless complete_date?(found) && honoured_zone?(found)
+        if (iso = ISO_DATE_AT_OFFSET.match(value)) then return midnight_at_offset(*iso.captures)
+        elsif ISO_DATE_T.match?(value) then return [:error, "invalid_type"]
+        end
 
-        [:ok, DateTime.parse(value, true, Date::GREGORIAN).to_time.utc]
+        cast_parsed_datetime(value, Date._parse(value))
       else [:error, "invalid_type"]
       end
     rescue ArgumentError, RangeError
       [:error, "invalid_type"]
     end
 
+    # cast_datetime's reading of a String once Date._parse has `found` its
+    # parts, shared with cast_date_instant so a :date need not parse twice.
+    def cast_parsed_datetime(value, found)
+      return [:error, "invalid_type"] unless complete_date?(found) && honoured_zone?(found)
+      return [:error, "invalid_type"] if offset_misread?(value, found)
+
+      [:ok, DateTime.parse(value, true, Date::GREGORIAN).to_time.utc]
+    rescue ArgumentError, RangeError
+      [:error, "invalid_type"]
+    end
+
     # A zone the parser could not turn into an offset — an offset of a day
     # or more ("+24:00", "-99:00", "+99") or an abbreviation it does not
     # know ("XYZ") — is reported as a zone with no offset, or with one
@@ -1103,6 +1187,74 @@ module Permittable
       !offset.nil? && offset.abs < 86_400
     end
 
+    # An ISO date followed by an offset or Z and no time of day
+    # ("2026-09-05-05:00", "2026-09-05 +05:00", "20260905Z"): XSD xs:date and
+    # Java's ISO_DATE, for midnight at that offset. Date._parse does not read
+    # it so — it takes "-05:00" for the TIME 05:00 and drops the sign, or
+    # drops "-0500" altogether — so the instant is built from the captures.
+    # Only the whole String counts, so a plain "2026-09-05" (which ends in
+    # "-05") never matches, and costs nothing more than the match.
+    ISO_DATE_AT_OFFSET = /\A\s*(\d{4})(-?)(\d{2})\2(\d{2})\s*(Z|z|[+-]\d{2}(?::?\d{2})?)\s*\z/
+
+    # An ISO date followed by a "T" and no time ("2026-09-05T",
+    # "20260905T-0500"). Ruby reads a lone letter as a military zone, T as
+    # -07:00, or drops it with whatever follows, so it is refused rather
+    # than read as some instant the client did not write.
+    ISO_DATE_T = /\A\s*\d{4}(-?)\d{2}\1\d{2}[Tt](?!\s*\d)/
+
+    # An ISO date and nothing else, which none of the above can match.
+    PLAIN_ISO_DATE = /\A\s*\d{4}-?\d{2}-?\d{2}\s*\z/
+
+    # A signed number at the end of a String, and whether a space sets it
+    # apart from what comes before ("5/9/2026 -0500" but not "2026-09-05").
+    SIGNED_TAIL = /(\s)?[+-]\d+(?::\d+)*\s*\z/
+    private_constant :ISO_DATE_AT_OFFSET, :ISO_DATE_T, :PLAIN_ISO_DATE, :SIGNED_TAIL
+
+    # The captures of ISO_DATE_AT_OFFSET as the instant they name, held to
+    # the rule any other offset is (honoured_zone?): "+24:00" and "-99:00"
+    # are refused, and so are minutes past 59 ("+05:99"), which the parser
+    # reports with no offset. Date.new checks the day ("2026-02-30Z"), which
+    # Time.utc would roll over into March.
+    def midnight_at_offset(year, _dash, mon, mday, zone)
+      year, mon, mday = [year, mon, mday].map { |part| Integer(part, 10) }
+      offset = zone_offset(zone)
+      return [:error, "invalid_type"] unless honoured_zone?(zone: zone, offset: offset)
+
+      Date.new(year, mon, mday, Date::GREGORIAN)
+      [:ok, Time.utc(year, mon, mday) - offset]
+    end
+
+    # "Z", "+05", "-0530" or "+05:30" in seconds east of UTC, or nil when
+    # the minutes are not minutes.
+    def zone_offset(zone)
+      return 0 if zone.casecmp?("z")
+
+      hours = Integer(zone[1, 2], 10)
+      minutes = Integer(zone[3..].delete(":").rjust(1, "0"), 10)
+      return if minutes > 59
+
+      (zone.start_with?("-") ? -1 : 1) * ((hours * 3600) + (minutes * 60))
+    end
+
+    # Whether a date's trailing offset was taken for its time of day
+    # ("Sep 5 2026 -05:00" reports 05:00, "2026-09-05 UTC-05:00" too) or
+    # dropped without a trace ("5/9/2026 -0500", "2026-09-05 +5"), outside
+    # the ISO form midnight_at_offset reads. The tail is the culprit when the
+    # parser found no zone and the String without it names the same date and
+    # no time. Only a String that ends in a signed number and either got an
+    # hour or has a space before the number is parsed again, so a plain
+    # "2026-09-05" is not.
+    def offset_misread?(value, found)
+      return false if found.key?(:zone)
+
+      tail = SIGNED_TAIL.match(value) or return false
+      return false unless tail[1] || found.key?(:hour)
+
+      rest = Date._parse(tail.pre_match)
+      complete_date?(rest) && !rest.key?(:hour) &&
+        rest.values_at(:year, :mon, :mday) == found.values_at(:year, :mon, :mday)
+    end
+
     # Presets only make sense on String input; a non-String value (JSON
     # numbers, booleans) skips normalization and goes straight to the cast.
     #
@@ -1241,11 +1393,34 @@ module Permittable
       return instant_as_date(member) if type == :date && (member.is_a?(Time) || member.is_a?(DateTime))
 
       status, value = cast(type, member)
-      return [status, value] unless status == :ok && type == :datetime && !member.is_a?(String) && !whole_nanoseconds?(value)
+      return [status, value] unless status == :ok && finer_than_nanosecond?(type, member, value)
 
       [:error, "finer than a nanosecond, so it never equals a request; round it, e.g. with .round(9)"]
     end
 
+    # Whether `raw`, authored as a Time-like `in:` member of a :datetime
+    # field and cast to `cast_value`, holds more than the nine digits the
+    # export prints. A String `in:` member is exempt: it is cast exactly as a
+    # request sending it is, and published as written (see
+    # published_in_member), so whatever precision it spells is reachable.
+    def finer_than_nanosecond?(type, raw, cast_value)
+      type == :datetime && !raw.is_a?(String) && !whole_nanoseconds?(cast_value)
+    end
+
+    # An authored `default:` or `example:` is held to the same rule as an
+    # `in:` member: the exported schema prints it to nine digits, so a value
+    # finer than that was published as a different instant than the action
+    # got for an omitted field, and a client sending the published default
+    # was not sending the default. Unlike an `in:` member, a String is NOT
+    # exempt here: a default or example is stored as the cast Time and
+    # exported from that, never as written, so "...00.1234567891Z" printed
+    # as .123456789Z. `outcome` is the cast's [status, value].
+    def refuse_finer_than_nanosecond(type, outcome)
+      return outcome unless outcome.first == :ok && type == :datetime && !whole_nanoseconds?(outcome.last)
+
+      [:error, "finer than a nanosecond, so the export publishes a different instant; round it, e.g. with .round(9)"]
+    end
+
     # A request's fraction of a second is a finite decimal, and the export
     # prints a member to at most nine digits, so a member that is not a whole
     # number of nanoseconds — Time.at(1.1) holds 1.10000000000000008881...,
@@ -1267,7 +1442,7 @@ module Permittable
     # class-load error a reason where a request gets `invalid_type`.
     def instant_as_date(member)
       date = date_of_instant(member)
-      date ? [:ok, date] : [:error, "not midnight UTC, so it never equals a date"]
+      date ? [:ok, date] : [:error, "not midnight UTC of an existing day, so it never equals a date"]
     end
 
     # What an exported enum lists for one member: the cast value, re-encoded
@@ -1297,6 +1472,7 @@ module Permittable
   class ContractBuilder
     SCALAR_OPTS = %i[in format length default normalize validate virtual sensitive transform message desc example
                      nullable].freeze
+    FILE_REFUSED_OPTS = %i[in format length default normalize example].freeze
     NESTED_OPTS = %i[virtual sensitive message desc nullable].freeze
     JSON_OPTS   = %i[length max_depth default validate virtual sensitive transform message desc example
                      nullable].freeze
@@ -1348,6 +1524,7 @@ module Permittable
       name = field_name!(name)
       assert_opts!(name, opts, ARRAY_OPTS)
       required = opts.delete(:required) ? true : false
+      refuse_file_opts!(name, opts.keys & %i[default example], FILE_TYPE) if opts[:of]&.to_sym == FILE_TYPE
 
       field = { name: name, kind: :array, required: required, **opts }
       if field[:required] && field.key?(:default)
@@ -1553,6 +1730,7 @@ module Permittable
 
     def validate_scalar_opts!(field)
       name = field[:name]
+      refuse_file_opts!(name, field.keys & FILE_REFUSED_OPTS, FILE_TYPE) if field[:type] == FILE_TYPE
       if field[:required] && field.key?(:default)
         raise ArgumentError, "#{LABEL}: field :#{name} is required and cannot have a :default (default implies optional)"
       end
@@ -1728,6 +1906,17 @@ module Permittable
 
     # format / length / normalize reason about characters; on any other
     # type they would silently apply to a cast non-String and mislead.
+    # An upload is passed through as it came, so what shapes a String or
+    # picks a value to stand in for one has nothing to act on. `validate:`
+    # is where a size or content-type check belongs.
+    def refuse_file_opts!(name, opts, type)
+      opt = opts.first
+      return unless opt
+
+      raise ArgumentError, "#{LABEL}: :#{opt} is not supported on :#{type} fields (field :#{name} is :#{type}); " \
+                           "use validate: for a size or content-type check"
+    end
+
     def validate_string_only_opts!(field)
       return if field[:type] == :string
 
@@ -1885,7 +2074,17 @@ module Permittable
       # proc cannot rewrite the host's own literal.
       authored = field[opt].is_a?(String) ? field[opt].dup : field[opt]
       value = Coercion.apply_normalize(field[:normalize], authored)
-      status, result = Coercion.check_scalar(live_in?(field) ? field.except(:in) : field, value)
+      # The walker's absence rule: on a nullable field a value that reads as
+      # absent ("" or one normalizing to "") is the explicit nil a request
+      # sending it gets, with nothing to cast or check — as an array's
+      # nullable sub-field already reads it (see AuthoredValues).
+      status, result = if field[:nullable] && Coercion.absent_value?(value)
+                         [:ok, nil]
+                       else
+                         Coercion.refuse_finer_than_nanosecond(
+                           field[:type], Coercion.check_scalar(live_in?(field) ? field.except(:in) : field, value)
+                         )
+                       end
       raise ArgumentError, "#{LABEL}: :#{opt} for field :#{field[:name]} violates its own contract (#{result})" unless status == :ok
 
       field[opt] = freeze_authored(opt == :default && field[:transform] ? field[opt] : result)
@@ -2106,6 +2305,8 @@ module Permittable
       rule = { actions: actions.flatten.map(&:to_s).freeze, root: root && root.to_sym,
                model: model_class, unknown: unknown, enforce: !!enforce, mode: mode, fields: fields,
                finalize: builder.finalizer, desc: desc&.deep_dup&.freeze }.freeze
+      permittable_register_hooks
+      permittable_ensure_runnable!(rule)
       self.permittable_contracts = permittable_contracts + [rule]
     end
 
@@ -2119,6 +2320,69 @@ module Permittable
 
     private
 
+    # Registers the rescue_from handler and the before_action the gem relies
+    # on, each once per class, as soon as the class can take them. They used
+    # to be registered at the include alone, so a bare ActionController::Metal
+    # controller that included Permittable BEFORE AbstractController::Callbacks
+    # and ActionController::Rescue never got them: an `enforce: true` rule let
+    # bad requests through, and a violation escaped as a 500. Called at the
+    # include and again at every permit_params, which is where such a class
+    # has by now been given its modules. The callback is still registered
+    # ahead of any declared after this point (see the README's "Per-request
+    # locales").
+    def permittable_register_hooks
+      if !permittable_rescue_registered && respond_to?(:rescue_from)
+        rescue_from InvalidParameters, with: :render_invalid_parameters
+        self.permittable_rescue_registered = true
+      end
+      return if permittable_callback_registered || !respond_to?(:before_action)
+
+      # Registered at the include, and not at the first `permit_params`, when
+      # the host has callbacks by then: the README documents
+      # `skip_before_action :enforce_params_contract`, and Rails raises when it
+      # is asked to skip a callback that is not defined yet. The cost is the
+      # order: this check runs before any callback declared after the include,
+      # so a locale switch that must cover it is a `prepend_around_action`.
+      before_action :enforce_params_contract
+      self.permittable_callback_registered = true
+    end
+
+    # A bare ActionController::Metal controller has neither callbacks nor
+    # rescue_from until the app includes them, and a rule that needs one of
+    # them would otherwise load and then not run: raise at class load, naming
+    # the module. Other hosts (a plain class, a duck) are left as they are.
+    def permittable_ensure_runnable!(rule)
+      return unless defined?(::ActionController::Metal) && self < ::ActionController::Metal
+
+      monitored = rule[:mode] == :monitor
+      missing = []
+      missing << "AbstractController::Callbacks" if (rule[:enforce] || monitored) && !respond_to?(:before_action)
+      missing << "ActionController::Rescue" if rule[:enforce] && !monitored && !respond_to?(:rescue_from)
+      if missing.empty?
+        return unless rule[:enforce] && !monitored && permittable_rescue_inside_callbacks?
+
+        raise ArgumentError,
+              "#{LABEL}: permit_params on #{name || inspect}, an ActionController::Metal controller, cannot rescue " \
+              "this enforce: true rule: include ActionController::Rescue after AbstractController::Callbacks, " \
+              "as ActionController::Base does. Included before it, Rescue wraps only the action, so the " \
+              "before_action's InvalidParameters escapes as a 500"
+      end
+
+      raise ArgumentError,
+            "#{LABEL}: permit_params on #{name || inspect}, an ActionController::Metal controller, cannot run " \
+            "this #{monitored ? 'monitor-mode' : 'enforce: true'} rule: include #{missing.join(' and ')} " \
+            "before permit_params (ActionController::Rescue after AbstractController::Callbacks, as ActionController::Base does)"
+    end
+
+    # A module included later sits earlier in the ancestors and so runs
+    # outside the others' process_action: Rescue is only around the
+    # callbacks when it was included after them.
+    def permittable_rescue_inside_callbacks?
+      rescue_at = ancestors.index(::ActionController::Rescue)
+      callbacks_at = ancestors.index(::AbstractController::Callbacks)
+      !rescue_at.nil? && !callbacks_at.nil? && rescue_at > callbacks_at
+    end
+
     def resolve_permit_model(model)
       case model
       when nil, false then nil
@@ -2146,8 +2410,12 @@ module Permittable
     # The drift guard. Nested/array fields are implicitly virtual — only
     # scalar fields, and the opaque `:json` field standing in for a
     # json/jsonb column, map one-to-one onto columns.
+    #
+    # A :file field is an upload, which maps to an attachment (ActiveStorage's
+    # has_one_attached, Shrine) rather than a column, so it is never demanded
+    # a column, as if it were virtual: true.
     def guard_contract_columns!(model_class, fields)
-      checked = fields.select { |f| %i[scalar json].include?(f[:kind]) && !f[:virtual] }
+      checked = fields.select { |f| %i[scalar json].include?(f[:kind]) && !f[:virtual] && f[:type] != FILE_TYPE }
       return if checked.empty?
 
       types = checked.to_h { |f| [f[:name], f[:type]] }
@@ -2758,7 +3026,7 @@ module Permittable
     case field[:kind]
     when :scalar
       # Already normalized by permittable_normalized, before the absence rule.
-      permittable_check_whole(field, Coercion.check_scalar(field, value), full, result, violations: violations)
+      permittable_check_whole(field, permittable_check_scalar(field, value), full, result, violations: violations)
     when :json
       permittable_check_whole(field, permittable_check_json(field, value), full, result, violations: violations)
     when :nested
@@ -2883,7 +3151,18 @@ module Permittable
     field[:transform] ? field[:transform].call(value) : value
   end
 
-  # A second seam, for the same reader: the array-level `validate:` to run.
+  # More seams, for the same reader: how a scalar field's value, and an
+  # array element, are cast. A request's are cast as they come; an authored
+  # default: or example: is also held to the nine digits the export prints.
+  def permittable_check_scalar(field, value)
+    Coercion.check_scalar(field, value)
+  end
+
+  def permittable_cast_element(field, element)
+    Coercion.cast(field[:of], element)
+  end
+
+  # A third seam, for the same reader: the array-level `validate:` to run.
   def permittable_array_validator(field)
     field[:validate]
   end
@@ -2898,7 +3177,7 @@ module Permittable
                                     path: path, unknown: unknown, top_level: false, violations: violations)
     end
 
-    status, out = Coercion.cast(field[:of], permittable_own(element))
+    status, out = permittable_cast_element(field, permittable_own(element))
     return out if status == :ok
 
     violations << permittable_violation(field, path, out)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: permittable
 version: !ruby/object:Gem::Version
-  version: 0.13.0
+  version: 0.14.0
 platform: ruby
 authors:
 - Ethan Nguyen
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-24 00:00:00.000000000 Z
+date: 2026-11-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport