permittable 0.3.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: aa679480fdac311694469096c7537926586e987ce2e7a724099611ec91dd3d2b
-  data.tar.gz: fa1785c674f0cbf388ce9f74b87f22344adef95cd5a5bfa6c81490fb8958a124
+  metadata.gz: e6009aed769f45203bb8053f4310d4ac986ec941815704e613f63bddf819bf92
+  data.tar.gz: 721cead2003e010c773e4bab9de20830d85f40182a049b8e4db6fa82d1f377d7
 SHA512:
-  metadata.gz: 66e7a85dad6e8029dbc8827b1a55ac14a297e3dc006315ffc66efc0e2f7dd6179ee6247e33f5de93a06d7fe08c3ff1205e30bf6dde6b16d93bfd381bdd3da813
-  data.tar.gz: fc0e4a920d62a687c960b808301841327bde86c85a2cf90c36c65e0ac61f133844e0733cd6ad3075298a8680d5a1360e9319495c4e60a9382449047bf6d76c0e
+  metadata.gz: 5ff703088a1c1389cc49150521380c56f937d4ba0f99de0137e7390a91fa66a16bdad09092f0c65964b94e332bee170b17bdc6d7e9d03c11a7b2020f95953c78
+  data.tar.gz: 64b5097368d5df03d8dfacb4c9eb79cf6ecb08e2c0b933a80281201139e496f143f0336d886d4a4d33a15dfc0f2c7642f10ee5641e625874a80526717386d869

data/CHANGELOG.md

@@ -1,5 +1,18 @@
 <!-- CHANGELOG.md -->
 
+## 0.4.0 (2026-08-24)
+<!-- title: monitor mode -->
+
+The rollout switch. Adopting contracts on a live API — or tightening an existing one — used to mean flipping unknown clients from "accepted" to "422" in a single deploy. A contract can now run in **monitor mode**: the full pipeline executes (unwrap, cast, validate, defaults), but a violation is **reported instead of rejected** and the request proceeds exactly as it did before the contract existed. Deploy monitoring, dashboard the would-be rejections, then enforce controller by controller — every 422 you finally return is one you already counted.
+
+### Added
+- **`mode: :monitor` on `permit_params`, and an app-wide `Permittable.mode` default** (`:enforce` unless set; a rule's own `mode:` always wins, in both directions). On a violating request in monitor mode nothing raises and nothing renders: the `invalid_parameters.permittable` event fires with `mode: :monitor`, the logger warns with the offending paths, and `permitted_params` returns the **raw pass-through** — exactly what the client sent, no casts, no defaults, no transforms (a missing `root:` passes an empty hash; a rootless contract drops only the router's bookkeeping keys). Monitor rules validate **eagerly in the `before_action` regardless of `enforce:`**, so telemetry never depends on the action calling `permitted_params` — legacy actions still reading `params` directly are exactly the ones being monitored.
+- **`permittable_violations(action = nil)`** — the recorded violation details for the (memoized) validation of `action`, `[]` when the request was clean. The monitor-mode observable; under enforce it swallows its own trigger's raise, making "would this request fail?" a one-liner in tests.
+- **`mode:` key on the `invalid_parameters.permittable` payload** (`:enforce` / `:monitor`), so one subscriber can dashboard enforced rejections and monitored would-be rejections side by side. Additive — existing subscribers are unaffected.
+- **`x-permittable-mode: "monitor"`** on exported OpenAPI operations whose rule declares monitor mode — the docs must not promise a 422 the server doesn't yet send. Only the per-rule declaration is exported; the app-wide `Permittable.mode` is runtime configuration, not contract data.
+
+Contracts that don't opt in are byte-for-byte unaffected: the default mode is `:enforce` and the enforce path behaves exactly as before.
+
 ## 0.3.0 (2026-08-24)
 <!-- title: OpenAPI export -->
 

data/README.md

@@ -54,7 +54,7 @@ A violating request never reaches your action:
 - [Violations and error responses](#violations-and-error-responses) · [Custom error messages](#custom-error-messages-message) · [Unknown parameters](#unknown-parameters)
 - [Output reshaping](#output-reshaping-transform-and-finalize) · [The schema-drift guard](#the-schema-drift-guard)
 - [Sensitive parameters](#sensitive-parameters-and-log-redaction) · [Instrumentation](#instrumentation)
-- [Exporting OpenAPI](#exporting-openapi-docs-that-cannot-drift)
+- [Monitor mode](#monitor-mode-roll-out-without-rejecting) · [Exporting OpenAPI](#exporting-openapi-docs-that-cannot-drift)
 - [API reference](#api-reference) · [Errors caught at class load](#errors-caught-at-class-load) · [Compatibility](#compatibility)
 
 ---
@@ -72,6 +72,7 @@ A violating request never reaches your action:
 | Reshapes output | ❌ | ❌ | ✅ |
 | Checked against your schema at boot | ❌ | ❌ | ✅ |
 | Exports OpenAPI / JSON Schema | ❌ | ❌ | ✅ |
+| Report-only rollout mode | ❌ | ❌ | ✅ |
 
 The design rests on one idea: **a contract is data, not code.** It is declared once at the class level, frozen, inheritable, and introspectable. Everything else here follows from that — the drift guard can read it at boot, `finalize` can run on a bare object with no controller state, and the whole contract can be printed or tested without a request.
 
@@ -108,10 +109,12 @@ params
 
 Validation is **lazy by default**: it runs on the first `permitted_params` call, so an action that never reads params never pays for it. Pass `enforce: true` to run it in a `before_action` instead, rejecting bad requests before the action body executes. Results are **memoized per action**.
 
+In [monitor mode](#monitor-mode-roll-out-without-rejecting) the same flow runs, but a violation is reported instead of raised and the request proceeds with the raw params passed through.
+
 ## Declaring a contract
 
 ```ruby
-permit_params(*actions, root: false, model: nil, unknown: :ignore, enforce: false, desc: nil, &contract)
+permit_params(*actions, root: false, model: nil, unknown: :ignore, enforce: false, mode: nil, desc: nil, &contract)
 ```
 
 | Option | Default | Meaning |
@@ -121,6 +124,7 @@ permit_params(*actions, root: false, model: nil, unknown: :ignore, enforce: fals
 | `model:` | `nil` | Model class, or `true` to infer from `controller_name`, enabling the [drift guard](#the-schema-drift-guard) |
 | `unknown:` | `:ignore` | `:ignore` / `:log` / `:error` — how to treat undeclared keys |
 | `enforce:` | `false` | `false` validates lazily on first use; `true` validates in a `before_action` |
+| `mode:` | `nil` | `nil` follows `Permittable.mode`; `:monitor` reports violations instead of rejecting — see [monitor mode](#monitor-mode-roll-out-without-rejecting) |
 | `desc:` | `nil` | Documentation only — becomes the operation description in [exported OpenAPI](#exporting-openapi-docs-that-cannot-drift) |
 
 `permit_params` is **repeatable**, and **the last matching rule wins**. Contracts behave like configuration: a base controller declares a catch-all, and a subclass overrides it for specific actions.
@@ -383,6 +387,47 @@ ActiveSupport::Notifications.subscribe("invalid_parameters.permittable") do |*,
 end
 ```
 
+## Monitor mode (roll out without rejecting)
+
+Adopting contracts on a live API — or tightening one field on an existing contract — has a chicken-and-egg problem: you cannot know what the 422s would break until you enforce them, and you dare not enforce them until you know. Old mobile app versions, third-party integrations, and forgotten cron jobs all send what they send. `mode: :monitor` resolves it: the full pipeline runs (unwrap, cast, validate, defaults), but a violation is **reported instead of rejected** and the request proceeds exactly as it did before the contract existed.
+
+```ruby
+class OrdersController < ApplicationController
+  permit_params :create, root: :order, mode: :monitor do
+    required :sku,      :string
+    optional :quantity, :integer, in: 1..99
+  end
+
+  # The action doesn't have to change while monitoring — it can keep reading
+  # params the old way; the contract validates in the before_action.
+end
+```
+
+Or flip the whole app at once and pin controllers to their final mode one at a time — a rule's own `mode:` always beats the global, in both directions:
+
+```ruby
+# config/initializers/permittable.rb
+Permittable.mode = ENV.fetch("PERMITTABLE_MODE", "enforce").to_sym
+```
+
+On a violating request in monitor mode:
+
+- **Nothing raises and nothing renders** — the action runs.
+- The [`invalid_parameters.permittable` event](#instrumentation) fires with `mode: :monitor` in the payload (enforced violations carry `mode: :enforce`), and the logger warns with the offending paths. Point your existing subscriber at a dashboard and you have a per-controller rollout report.
+- `permitted_params` returns the **raw pass-through**: exactly what the client sent, untouched — no casts, no defaults, no transforms. A missing `root:` passes an empty hash (the envelope you asked for isn't there); a rootless contract drops only Rails' routing keys.
+- `permittable_violations` returns the recorded details (`[]` when the request was clean), if the action wants to branch on or tag the traffic.
+
+Monitor-mode rules validate **eagerly in the `before_action`, regardless of `enforce:`** — telemetry must not depend on the action calling `permitted_params`, since legacy actions still reading `params` directly are exactly the ones worth monitoring. (On a plain-Ruby host without `before_action`, validation stays lazy.)
+
+The rollout recipe:
+
+1. Write contracts for a legacy controller. The action code stays as-is.
+2. Deploy with `PERMITTABLE_MODE=monitor`. Behaviour is unchanged; telemetry starts.
+3. Watch the dashboard. Every entry is a real client that would have been rejected — fix the contract, or wait for that traffic to drain.
+4. Flip to enforce, controller by controller. Every 422 you now return is one you already counted.
+
+[Exported OpenAPI](#exporting-openapi-docs-that-cannot-drift) marks operations whose rule declares `mode: :monitor` with `x-permittable-mode: "monitor"` — the docs shouldn't promise a 422 the server doesn't yet send. Only the per-rule declaration is exported: the global `Permittable.mode` is runtime configuration, not contract data.
+
 ## Exporting OpenAPI (docs that cannot drift)
 
 Because a contract is data, it has a third reader beyond the validator and the drift guard: an exporter that emits **OpenAPI 3.1** (whose request bodies are plain JSON Schema). The schema is generated from the same frozen data the server enforces, so — like the drift guard, pointed outward — the docs cannot lie:
@@ -422,7 +467,7 @@ How contracts map:
 
 Every operation references shared components for the [error envelope](#violations-and-error-responses): a `422` response always, plus a `400` when the contract declares a `root:`. So consumers get typed *errors*, not just typed inputs.
 
-**What is honestly unrepresentable stays visible instead of guessed.** A `format:` regexp using a Ruby-only construct (or flags) is exported as `x-permittable-pattern` rather than a mistranslated `pattern`; `validate:`/`transform:` are flagged `x-permittable-custom-validation`/`x-permittable-transformed`; actions covered only by a catch-all rule on a plain-Ruby host appear under `"*"` with `x-permittable-catch-all`; operations with no matching route land in `x-permittable-controllers` instead of being dropped. The schema documents the canonical JSON encoding — the runtime additionally accepts string-encoded scalars (`"42"`, `"true"`) for form/query payloads.
+**What is honestly unrepresentable stays visible instead of guessed.** A `format:` regexp using a Ruby-only construct (or flags) is exported as `x-permittable-pattern` rather than a mistranslated `pattern`; `validate:`/`transform:` are flagged `x-permittable-custom-validation`/`x-permittable-transformed`; actions covered only by a catch-all rule on a plain-Ruby host appear under `"*"` with `x-permittable-catch-all`; operations whose rule runs in [monitor mode](#monitor-mode-roll-out-without-rejecting) carry `x-permittable-mode: "monitor"`; operations with no matching route land in `x-permittable-controllers` instead of being dropped. The schema documents the canonical JSON encoding — the runtime additionally accepts string-encoded scalars (`"42"`, `"true"`) for form/query payloads.
 
 Output is deterministic (fixed key order, declaration-order properties), so the generated file can be committed and reviewed as a diff — a contract change shows up in the same PR as its documentation change.
 
@@ -432,8 +477,9 @@ Output is deterministic (fixed key order, declaration-order properties), so the
 
 | Method | Purpose |
 |---|---|
-| `permitted_params(action = action_name)` | The cast, validated, defaulted `HashWithIndifferentAccess`. Memoized per action. Raises `InvalidParameters` on violation, or `ArgumentError` when no contract covers the action |
-| `enforce_params_contract` | The `before_action` entry point. Only validates rules declared `enforce: true`. Public, so hosts can `skip_before_action` it |
+| `permitted_params(action = action_name)` | The cast, validated, defaulted `HashWithIndifferentAccess`. Memoized per action. Raises `InvalidParameters` on violation (in [monitor mode](#monitor-mode-roll-out-without-rejecting), returns the raw pass-through instead), or `ArgumentError` when no contract covers the action |
+| `permittable_violations(action = action_name)` | The violation details recorded by validating `action` — `[]` when clean. Triggers the same memoized validation; under enforce it swallows the raise, making "would this request fail?" a one-liner |
+| `enforce_params_contract` | The `before_action` entry point. Validates rules declared `enforce: true` and all [monitor-mode](#monitor-mode-roll-out-without-rejecting) rules. Public, so hosts can `skip_before_action` it |
 | `render_invalid_parameters(error)` | The `rescue_from` target. Renders via the host's `render_error` when defined, the inline envelope otherwise |
 
 ### Class methods
@@ -450,6 +496,7 @@ Output is deterministic (fixed key order, declaration-order properties), so the
 |---|---|
 | `Permittable.filter_parameter_registry` | The live registry of `sensitive:` field names |
 | `Permittable.filter_parameter_registry=` | Swap in your own duck-typed registry |
+| `Permittable.mode` / `Permittable.mode=` | App-wide default (`:enforce`) for rules that don't declare their own `mode:` |
 | `Permittable::InvalidParameters` | Raised on violation; carries `#details` and `#status` |
 | `Permittable::JsonSchema` | Contract data → JSON Schema fragments (`.rule`, `.object`, `.field`) |
 | `Permittable::OpenAPI` | OpenAPI 3.1 assembly (`.document`, `.operations_for`, `.request_body_for`, `.components`) |
@@ -471,6 +518,7 @@ A bad contract is a programmer error, so it fails when the class loads — never
 - An empty contract, or a nested block declaring no sub-fields
 - `finalize` declared twice, without a block, or inside a nested block
 - `permit_params` without a block, or an invalid `unknown:` mode
+- An invalid `mode:` (and `Permittable.mode =` rejects invalid values at assignment)
 - A `model:` that isn't an ActiveRecord class, or `model: true` that can't be inferred
 
 ## Compatibility
@@ -488,7 +536,7 @@ Using [concerns_on_rails](https://github.com/VSN2015/concerns_on_rails)? `Concer
 
 ```sh
 bundle install
-bundle exec rspec      # 112 examples
+bundle exec rspec      # 125 examples
 bundle exec rubocop
 ```
 

data/lib/permittable/open_api.rb

@@ -135,6 +135,10 @@ module Permittable
       operation["description"] = rule[:desc] if rule[:desc]
       operation["requestBody"] = rule_request_body(rule)
       operation["responses"] = responses_for(rule)
+      # The docs must not promise a 422 the server doesn't yet send. Only
+      # the rule's own declaration is contract data — the app-wide
+      # Permittable.mode is runtime configuration the export can't see.
+      operation["x-permittable-mode"] = "monitor" if rule[:mode] == :monitor
       operation["x-permittable-catch-all"] = true if action == "*"
       operation
     end

data/lib/permittable/version.rb

@@ -1,3 +1,3 @@
 module Permittable
-  VERSION = "0.3.0".freeze
+  VERSION = "0.4.0".freeze
 end

data/lib/permittable.rb

@@ -63,6 +63,21 @@ require "permittable/filter_parameter_registry"
 # action that never reads params never pays. `enforce: true` installs the
 # check as a before_action instead (reject before the action body runs).
 #
+# MONITOR MODE — the rollout switch. `mode: :monitor` on a rule (or
+# `Permittable.mode = :monitor` app-wide; a rule's own mode: wins) runs the
+# full pipeline but REPORTS violations instead of rejecting: the same
+# "invalid_parameters.permittable" event fires (payload mode: :monitor),
+# the logger warns, and permitted_params returns the raw params passed
+# through untouched — no casts, no defaults, no transforms — so behaviour
+# is identical to the pre-contract app (a missing root: passes an empty
+# hash; a rootless contract drops only the router's bookkeeping keys).
+# Monitor rules validate eagerly in the before_action regardless of
+# enforce:, because telemetry must not depend on the action calling
+# permitted_params — legacy actions still reading `params` directly are
+# exactly the ones being monitored — and monitoring can never halt the
+# request. `permittable_violations` reads the recorded details ([] when
+# the request was clean).
+#
 # Coercion is deliberately STRICT — ActiveModel::Type is not used, because its
 # casts are lenient by design ("abc".to_i == 0, Boolean.cast("abc") == true)
 # and silently corrupting untrusted input is exactly what a contract must not
@@ -119,6 +134,7 @@ module Permittable
   LABEL = "Permittable".freeze
   SCALAR_TYPES = %i[string integer float decimal boolean date datetime].freeze
   UNKNOWN_MODES = %i[ignore log error].freeze
+  MODES = %i[enforce monitor].freeze
   # Rails merges routing bookkeeping into params; a top-level (root: false)
   # unknown-keys check must not flag them.
   ROUTING_KEYS = %w[controller action format].freeze
@@ -144,6 +160,26 @@ module Permittable
     end
 
     attr_writer :filter_parameter_registry
+
+    # App-wide default for rules that don't declare their own mode:.
+    # :enforce (the default) rejects violating requests; :monitor reports
+    # them — same instrumentation event with payload mode: :monitor, plus a
+    # logger.warn — and lets the request proceed with the raw params passed
+    # through. This is the rollout switch for brownfield adoption: set it
+    # from an initializer (Permittable.mode =
+    # ENV.fetch("PERMITTABLE_MODE", "enforce").to_sym) and flip controllers
+    # to their final mode one at a time, since a rule's own mode: always
+    # wins over this default.
+    def mode
+      @mode || :enforce
+    end
+
+    def mode=(value)
+      value = value.to_sym
+      raise ArgumentError, "#{LABEL}: mode must be one of #{MODES.join(', ')}" unless MODES.include?(value)
+
+      @mode = value
+    end
   end
 
   # Raised when the request violates the matching contract. `details` is an
@@ -564,14 +600,23 @@ module Permittable
     #            undeclared keys, at every nesting level.
     #   enforce: false (default) validates lazily on the first
     #            permitted_params call; true validates in a before_action.
+    #   mode:    nil (default) follows Permittable.mode; :enforce rejects
+    #            violating requests; :monitor reports them and passes the
+    #            raw params through (see MONITOR MODE in the module
+    #            comment).
     #   desc:    documentation only — carried on the rule for exporters
     #            (Permittable::OpenAPI); the runtime never reads it.
-    def permit_params(*actions, root: false, model: nil, unknown: :ignore, enforce: false, desc: nil, &block)
+    def permit_params(*actions, root: false, model: nil, unknown: :ignore, enforce: false, mode: nil, desc: nil, &block)
       raise ArgumentError, "#{LABEL}: permit_params requires a block declaring the contract fields" unless block
 
       unknown = unknown.to_sym
       raise ArgumentError, "#{LABEL}: :unknown must be one of #{UNKNOWN_MODES.join(', ')}" unless UNKNOWN_MODES.include?(unknown)
 
+      mode = mode&.to_sym
+      if mode && !MODES.include?(mode)
+        raise ArgumentError, "#{LABEL}: :mode must be one of #{MODES.join(', ')}, or nil to follow Permittable.mode"
+      end
+
       builder = ContractBuilder.new
       fields = builder.build(&block)
       raise ArgumentError, "#{LABEL}: a contract must declare at least one field" if fields.empty?
@@ -581,7 +626,7 @@ module Permittable
       register_sensitive_params(fields)
 
       rule = { actions: actions.flatten.map(&:to_s).freeze, root: root && root.to_sym,
-               model: model_class, unknown: unknown, enforce: !!enforce, fields: fields,
+               model: model_class, unknown: unknown, enforce: !!enforce, mode: mode, fields: fields,
                finalize: builder.finalizer, desc: desc }.freeze
       self.permittable_contracts = permittable_contracts + [rule]
     end
@@ -657,21 +702,44 @@ module Permittable
     rule = self.class.permit_rule_for(action)
     raise ArgumentError, "#{LABEL}: no params contract declared covering ##{action}" unless rule
 
-    @permittable_validated[action] = validate_params_contract!(rule)
+    @permittable_validated[action] = validate_params_contract!(rule, action)
   end
 
   # before_action entry point (public so hosts can `skip_before_action
-  # :enforce_params_contract`). Only rules that opted in with
-  # `enforce: true` validate here.
+  # :enforce_params_contract`). Two kinds of rule validate here: those that
+  # opted in with `enforce: true`, and monitor-mode rules — monitoring must
+  # not depend on the action calling permitted_params (legacy actions still
+  # reading `params` directly are exactly the ones being monitored), and it
+  # can never halt the request because monitor mode never raises.
   def enforce_params_contract
     action = permittable_action_name
     return nil unless action
 
     rule = self.class.permit_rule_for(action)
-    permitted_params(action) if rule && rule[:enforce]
+    permitted_params(action) if rule && (rule[:enforce] || permittable_mode(rule) == :monitor)
     nil
   end
 
+  # The violation details recorded by validating `action` (default: the
+  # current action) — [] when the request satisfied the contract. Triggers
+  # the same memoized validation as permitted_params, so under monitor mode
+  # this is the request-level observable ("what would have been
+  # rejected?"); under enforce mode it swallows the raise and hands back
+  # the details, which makes "would this request fail?" a one-liner in
+  # tests.
+  def permittable_violations(action = nil)
+    action = (action || permittable_action_name).to_s
+    @permittable_violations ||= {}
+    unless @permittable_violations.key?(action)
+      begin
+        permitted_params(action)
+      rescue InvalidParameters
+        # validation recorded the details before raising
+      end
+    end
+    @permittable_violations.fetch(action)
+  end
+
   # rescue_from target — renders through the shared envelope (the host's
   # render_error when present, the identical inline shape otherwise).
   def render_invalid_parameters(error)
@@ -683,7 +751,7 @@ module Permittable
 
   private
 
-  def validate_params_contract!(rule)
+  def validate_params_contract!(rule, action)
     violations = []
     source = permittable_root_hash(rule, violations)
     result = ActiveSupport::HashWithIndifferentAccess.new
@@ -693,19 +761,53 @@ module Permittable
     end
     # finalize only sees a hash every field vouched for — never garbage.
     result = permittable_run_finalize(rule[:finalize], result, violations) if violations.empty? && rule[:finalize]
+    violations.each(&:freeze)
+    (@permittable_violations ||= {})[action] = violations.freeze
     return result if violations.empty?
+    return permittable_monitor_pass_through(rule, source, violations) if permittable_mode(rule) == :monitor
 
     raise_invalid_parameters!(violations, status: source ? :unprocessable_entity : :bad_request)
   end
 
+  # A rule's own mode: wins; otherwise the app-wide Permittable.mode.
+  def permittable_mode(rule)
+    rule[:mode] || Permittable.mode
+  end
+
+  # Monitor mode's violation path: emit the same instrumentation event the
+  # enforce path does (payload mode: :monitor) plus a warn line, then hand
+  # back exactly what the client sent — no casts, no defaults, no
+  # transforms — so behaviour is identical to the pre-contract app. A
+  # missing root: passes an empty hash through (the envelope you asked for
+  # isn't there); a rootless contract drops only the router's bookkeeping
+  # keys, mirroring their exemption from the unknown-keys check.
+  def permittable_monitor_pass_through(rule, source, violations)
+    permittable_instrument_violations(violations, mode: :monitor)
+    if respond_to?(:logger) && logger
+      logger.warn("#{LABEL}: [monitor] ##{permittable_action_name} would have been rejected: " \
+                  "#{permittable_violation_summary(violations)}")
+    end
+    return ActiveSupport::HashWithIndifferentAccess.new unless source
+
+    passed = ActiveSupport::HashWithIndifferentAccess.new(source)
+    rule[:root] ? passed : passed.except(*ROUTING_KEYS)
+  end
+
   def raise_invalid_parameters!(violations, status:)
-    violations.each(&:freeze)
+    permittable_instrument_violations(violations, mode: :enforce)
+    raise InvalidParameters.new("Invalid parameters: #{permittable_violation_summary(violations)}",
+                                details: violations, status: status)
+  end
+
+  def permittable_instrument_violations(violations, mode:)
     ActiveSupport::Notifications.instrument(
       "invalid_parameters.permittable",
-      controller: permittable_controller_name, action: permittable_action_name, details: violations
+      controller: permittable_controller_name, action: permittable_action_name, details: violations, mode: mode
     )
-    summary = violations.map { |v| v[:message] ? "#{v[:param]} #{v[:message]}" : "#{v[:param]} (#{v[:code]})" }.join(", ")
-    raise InvalidParameters.new("Invalid parameters: #{summary}", details: violations, status: status)
+  end
+
+  def permittable_violation_summary(violations)
+    violations.map { |v| v[:message] ? "#{v[:param]} #{v[:message]}" : "#{v[:param]} (#{v[:code]})" }.join(", ")
   end
 
   # One violation detail entry. A field's `message:` (String, or Hash keyed

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: permittable
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.0
 platform: ruby
 authors:
 - Ethan Nguyen