permittable 0.5.0 → 0.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 59d816740d54375ea14045959a2afb70dffee709e21350b914d69fcc115655c4
-  data.tar.gz: 233c21f86657a7643c5a8de70b83001e8f66b5e0ad3d1ae71e25a79b22883753
+  metadata.gz: d9b826995301bd0dc72ab69a6560ddfe58e13ae67323a252a9a506c21f61420d
+  data.tar.gz: 5e354c9e104237d9116591df08d4c1a58962f98d543d0f5ff6de983b96f3bc51
 SHA512:
-  metadata.gz: 249dfeaf789c471b84589e5e49ee70148774fb03a5eaa3906a479088f7da68bc6d3f8a9b8d513e19c9f1fba18a62be1a6d9a68d1390b96c22c906e1ae208f002
-  data.tar.gz: a17c6c12cf879384624cd4f1eb654a05fc9cb5e641d821ee99461d459156744eb372bd51ced705588c6af7a5f2f713ee8285fb9f1c38a7eb42f2aaf6667a5867
+  metadata.gz: c9cf62a2210a42cad9190f25ce259250c268dabf72bb966bae4110d2c627f27ce7a050a64f92c9e1729c9eb088d48077384b901481475a5cae077d1d802684ab
+  data.tar.gz: a6db0156d761c972ef0c9f6b41ef96e3fee3f0f48158ce01344b8a6ea39f9a8504dd2df015bcf3c379841420a66e857a42a2d0ff07d2d94902b49d89fec6b570

data/CHANGELOG.md

@@ -1,5 +1,14 @@
 <!-- CHANGELOG.md -->
 
+## 0.5.1 (2026-09-02)
+<!-- title: nested input outside Rails -->
+
+Patch release. Checking how a contract handles a request with several top-level envelopes (`{ user: { ... }, address_attributes: { ... } }`) surfaced one crash and one unhelpful error; both are fixed below, and no behaviour of existing contracts changes.
+
+### Fixed
+- **Nested hash input crashed outside Rails.** `lib/permittable.rb` required `HashWithIndifferentAccess` but not the Hash core extension it needs to convert nested plain Hashes, so a standalone `Permittable::Contract` (or any host that loads only `permittable`) raised `NoMethodError: undefined method 'nested_under_indifferent_access'` on payloads like `{ user: { ... }, address_attributes: { ... } }`. Rails apps and the spec suite loaded the extension indirectly, which is why it went unnoticed; a spec now exercises a nested contract in a bare subprocess.
+- **`root:` rejects anything but one key at class load.** `root: [:user, :address_attributes]` used to leak `NoMethodError: undefined method 'to_sym' for Array`; it now raises a descriptive `ArgumentError` pointing at the recipe for several top-level envelopes — a rootless contract with one nested block per key. Specs pin that recipe, and pin that a rooted contract never sees the root's siblings (even under `unknown: :error`), matching `require(:user).permit`.
+
 ## 0.5.0 (2026-09-02)
 <!-- title: the adoption on-ramp -->
 

data/lib/permittable/version.rb

@@ -1,3 +1,3 @@
 module Permittable
-  VERSION = "0.5.0".freeze
+  VERSION = "0.5.1".freeze
 end

data/lib/permittable.rb

@@ -2,6 +2,7 @@ require "active_support"
 require "active_support/concern"
 require "active_support/notifications"
 require "active_support/hash_with_indifferent_access"
+require "active_support/core_ext/hash/indifferent_access" # nested plain Hashes inside HWIA.new
 require "active_support/core_ext/class/attribute"
 require "active_support/core_ext/string/inflections"
 require "active_support/core_ext/string/filters"
@@ -611,6 +612,10 @@ module Permittable
     #
     #   root:    key to unwrap first (`require(:user)` equivalent); false
     #            (default) reads top-level params. Missing root renders 400.
+    #            Exactly one key: a rooted contract never sees the root's
+    #            siblings (like `require(:user).permit`), so to accept
+    #            several top-level envelopes stay rootless and declare one
+    #            nested block per key.
     #   model:   a model class (or `true` to infer from controller_name)
     #            enabling the schema-drift check on every non-virtual scalar
     #            field.
@@ -627,6 +632,11 @@ module Permittable
     def permit_params(*actions, root: false, model: nil, unknown: :ignore, enforce: false, mode: nil, desc: nil, &block)
       raise ArgumentError, "#{LABEL}: permit_params requires a block declaring the contract fields" unless block
 
+      unless root.nil? || root == false || root.is_a?(Symbol) || root.is_a?(String)
+        raise ArgumentError, "#{LABEL}: :root must be one key (Symbol or String) or false, got #{root.inspect} — " \
+                             "to accept several top-level keys, declare a rootless contract with one nested block per key"
+      end
+
       unknown = unknown.to_sym
       raise ArgumentError, "#{LABEL}: :unknown must be one of #{UNKNOWN_MODES.join(', ')}" unless UNKNOWN_MODES.include?(unknown)
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: permittable
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.5.1
 platform: ruby
 authors:
 - Ethan Nguyen