rackr 0.0.65 → 0.0.68

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5d146e39fc587acb31017ef9e5b093aba6a8cecadf8fe8beb038ab7804425015
-  data.tar.gz: '04787fa986d2d6f4033114d5bf6a134bd6451e2e7cb0c957ef063ddf7fbb9cf3'
+  metadata.gz: f73af417da9875005db2b3ee4f61d9c8a646721d97791b1737ec5e3868145cee
+  data.tar.gz: 984c3a38fa157758f04414c4d963ee901771c535e5dd1e3047a403c649c13a3a
 SHA512:
-  metadata.gz: 57661323fb8e596afd2833f24145716090db3bd1024bf465ae2388f48c5a2c9cbff4384331368d69337a08f7fd977b5f33dcb275421324748eb783f33d6a877e
-  data.tar.gz: b524b6414b3218cca05f134f81ce03583fac97d38eb4e754c27a754b50fd0d2eaa969b4728304ce6aafe08a45c370ffde59a68d21d76f72634cc43fc74925b9b
+  metadata.gz: 1f5c8dfaa7a2329474ac15f27a8ba4330f2b53df85b0ddf141e053dfa0b5efb14c6af7bee05c3f8fc70fae968563c33a2b08a7f693db4a3e7e769e9b51a17561
+  data.tar.gz: 2455b933241dcbae25f6c4ad60ffbd3aab03a1121d16a57b681318461a5e08e9b3c70d54102a2a1869b7f20d041d9383c4f73e1988d7e4137afde586d7cf328d

data/lib/rackr/action.rb

@@ -3,95 +3,279 @@
 require 'erubi'
 require 'oj'
 require 'rack'
+require_relative 'action/callbacks'
 
 class Rackr
+  # This module provides the action functions available inside the routes context or
+  # specific action class that included the Rackr::Action.
   module Action
-    @@default_headers_for = lambda { |content_type, headers, content|
+    MIME_TYPES = {
+      text: 'text/plain',
+      html: 'text/html',
+      json: 'application/json',
+      manifest: 'text/cache-manifest',
+      atom: 'application/atom+xml',
+      avi: 'video/x-msvideo',
+      bmp: 'image/bmp',
+      bz: 'application/x-bzip',
+      bz2: 'application/x-bzip2',
+      chm: 'application/vnd.ms-htmlhelp',
+      css: 'text/css',
+      csv: 'text/csv',
+      flv: 'video/x-flv',
+      gif: 'image/gif',
+      gz: 'application/x-gzip',
+      h264: 'video/h264',
+      ico: 'image/vnd.microsoft.icon',
+      ics: 'text/calendar',
+      jpg: 'image/jpeg',
+      js: 'application/javascript',
+      mp4: 'video/mp4',
+      mov: 'video/quicktime',
+      mp3: 'audio/mpeg',
+      mp4a: 'audio/mp4',
+      mpg: 'video/mpeg',
+      oga: 'audio/ogg',
+      ogg: 'application/ogg',
+      ogv: 'video/ogg',
+      pdf: 'application/pdf',
+      pgp: 'application/pgp-encrypted',
+      png: 'image/png',
+      psd: 'image/vnd.adobe.photoshop',
+      rss: 'application/rss+xml',
+      rtf: 'application/rtf',
+      sh: 'application/x-sh',
+      svg: 'image/svg+xml',
+      swf: 'application/x-shockwave-flash',
+      tar: 'application/x-tar',
+      torrent: 'application/x-bittorrent',
+      tsv: 'text/tab-separated-values',
+      uri: 'text/uri-list',
+      vcs: 'text/x-vcalendar',
+      wav: 'audio/x-wav',
+      webm: 'video/webm',
+      wmv: 'video/x-ms-wmv',
+      woff: 'application/font-woff',
+      woff2: 'application/font-woff2',
+      wsdl: 'application/wsdl+xml',
+      xhtml: 'application/xhtml+xml',
+      xml: 'application/xml',
+      xslt: 'application/xslt+xml',
+      yml: 'text/yaml',
+      zip: 'application/zip'
+    }.freeze
+
+    DEFAULT_CSP_HEADERS = {
+      base_uri: "'self'",
+      child_src: "'self'",
+      connect_src: "'self'",
+      default_src: "'none'",
+      font_src: "'self'",
+      form_action: "'self'",
+      frame_ancestors: "'self'",
+      frame_src: "'self'",
+      img_src: "'self' https: data:",
+      media_src: "'self'",
+      object_src: "'none'",
+      script_src: "'self'",
+      style_src: "'self' 'unsafe-inline' https:"
+    }.freeze
+
+    # These are constant (not methods) for better performance
+
+    DEFAULT_HEADERS = (proc do |content_type, headers, content|
       {
         'content-type' => content_type,
         'content-length' => content.bytesize.to_s
       }.merge(headers)
-    }
-
-    @@render = {
-      html: lambda do |val, status: 200, headers: {}, html: nil|
-        [
-          status,
-          @@default_headers_for.call('text/html; charset=utf-8', headers, val),
-          [val]
-        ]
+    end).freeze
+
+    RENDER = {
+      json: proc do |content, status, headers, charset|
+        content = Oj.dump(content, mode: :compat) unless content.is_a?(String)
+        [status || 200, DEFAULT_HEADERS.call("application/json; charset=#{charset}", headers, content), [content]]
+      end,
+      html: proc do |content, status, headers, charset, content_security_policy|
+        headers['content-security-policy'] = content_security_policy
+        [status || 200, DEFAULT_HEADERS.call("text/html; charset=#{charset}", headers, content), [content]]
+      end,
+      res: proc do |content, status, _headers, charset|
+        content.status = status if status
+        if charset
+          content.content_type =
+            (content.content_type || 'charset=utf-8').sub(/charset=\S+/, "charset=#{charset}")
+        end
+        content.headers['content-length'] ||= content.body.join.bytesize.to_s
+        content.finish
       end,
-      text: lambda do |val, status: 200, headers: {}, text: nil|
-        [
-          status,
-          @@default_headers_for.call('text/plain', headers, val),
-          [val]
-        ]
+      response: proc do |content, status, _headers, charset|
+        content.status = status if status
+        if charset
+          content.content_type =
+            (content.content_type || 'charset=utf-8').sub(/charset=\S+/, "charset=#{charset}")
+        end
+        content.headers['content-length'] ||= content.body.join.bytesize.to_s
+        content.finish
+      end
+    }.freeze
+
+    BUILD_RESPONSE = {
+      json: proc do |content, status, headers, charset|
+        content = Oj.dump(content, mode: :compat) unless content.is_a?(String)
+        Rack::Response.new(content, status,
+                           DEFAULT_HEADERS.call("application/json; charset=#{charset}", headers, content))
       end,
-      json: lambda do |val, status: 200, headers: {}, json: nil|
-        val = Oj.dump(val, mode: :compat) unless val.is_a?(String)
-        [
-          status,
-          @@default_headers_for.call('application/json', headers, val),
-          [val]
-        ]
+      html: proc do |content, status, headers, charset, content_security_policy|
+        headers['content-security-policy'] = content_security_policy
+        Rack::Response.new(content, status, DEFAULT_HEADERS.call("text/html; charset=#{charset}", headers, content))
       end,
-      res: lambda do |val, status: nil, headers: nil, res: nil|
-        val.status = status if status
-        headers.each { |h, v| val.set_header(h, v) } if headers
-        val.finish
+      head: proc do |status, _empty, headers|
+        Rack::Response.new(nil, status, headers)
       end,
-      response: lambda do |val, status: nil, headers: nil, response: nil|
-        val.status = status if status
-        headers.each { |h, v| val.set_header(h, v) } if headers
-        val.finish
+      redirect_to: proc do |content, _status, headers|
+        Rack::Response.new(
+          nil,
+          302,
+          { 'location' => content }.merge(headers)
+        )
       end
     }.freeze
 
     def self.included(base)
       base.class_eval do
-        attr_reader :routes, :config, :deps, :db if self != Rackr
+        if self != Rackr
+          attr_reader :routes, :config, :deps, :db, :log, :cache
+
+          include Callbacks unless included_modules.include?(Rackr::Callback)
+        end
+
+        include HtmlSlice if Object.const_defined?('HtmlSlice')
+        include Stimulux if Object.const_defined?('Stimulux')
 
         def initialize(routes: nil, config: nil)
           @routes = routes
           @config = config
-          @deps = config[:deps]
-          @db = config.dig(:deps, :db)
+          @deps = config&.dig(:deps)
+          @db = config&.dig(:deps, :db)
+          @log = config&.dig(:deps, :log)
+          @cache = config&.dig(:deps, :cache)
+        end
+
+        def url_for(method, name)
+          "#{config&.dig(:host)}#{path_for(method, name)}"
+        end
+
+        def path_for(method, name)
+          routes.send(method)&.dig(name)
         end
 
-        def render(**opts)
+        def render(content = nil, **opts)
+          if content
+            return RENDER[:html].call(
+              content.to_s,
+              opts[:status],
+              opts[:headers] || {},
+              opts[:charset] || 'utf-8',
+              content_security_policy
+            )
+          end
+
           type = opts.keys.first
           content = opts[type]
 
-          @@render[type]&.call(content, **opts) || _render_view(content, **opts)
+          if (renderer = RENDER[type])
+            return renderer.call(
+              content,
+              opts[:status],
+              opts[:headers] || {},
+              opts[:charset] || 'utf-8',
+              content_security_policy
+            )
+          end
+
+          if (mime = MIME_TYPES[type])
+            return [
+              opts[:status] || 200,
+              DEFAULT_HEADERS.call(
+                "#{mime}; charset=#{opts[:charset] || 'utf-8'}",
+                opts[:headers] || {},
+                content
+              ),
+              [content]
+            ]
+          end
+
+          _render_view(
+            content,
+            status: opts[:status] || 200,
+            headers: opts[:headers] || {},
+            layout_path: opts[:layout_path] || 'layout',
+            view: opts[:view],
+            response_instance: opts[:response_instance] || false,
+            charset: opts[:charset] || 'utf-8'
+          )
         end
 
-        def view_response(
-          paths,
-          status: 200,
-          headers: {},
-          layout_path: 'layout'
-        )
+        def build_response(content = nil, **opts)
+          if content
+            return BUILD_RESPONSE[:html].call(
+              content.to_s,
+              opts[:status] || 200,
+              opts[:headers] || {},
+              opts[:charset] || 'utf-8',
+              content_security_policy
+            )
+          end
+
+          type = opts.keys.first
+          content = opts[type]
+
+          if (builder = BUILD_RESPONSE[type])
+            return builder.call(
+              content,
+              opts[:status] || 200,
+              opts[:headers] || {},
+              opts[:charset] || 'utf-8',
+              content_security_policy
+            )
+          end
+
+          if (mime = MIME_TYPES[type])
+            return Rack::Response.new(
+              content,
+              opts[:status] || 200,
+              DEFAULT_HEADERS.call(
+                "#{mime}; charset=#{opts[:charset] || 'utf-8'}",
+                opts[:headers] || {},
+                content
+              )
+            )
+          end
+
           _render_view(
-            paths,
-            status: status,
-            headers: headers,
-            layout_path: layout_path,
-            response_instance: true
+            content,
+            status: opts[:status] || 200,
+            headers: opts[:headers] || {},
+            layout_path: opts[:layout_path] || 'layout',
+            view: opts[:view],
+            response_instance: true,
+            charset: opts[:charset] || 'utf-8'
           )
         end
 
         def _render_view(
           paths,
-          status: 200,
-          headers: {},
-          layout_path: 'layout',
-          response_instance: false,
-          view: nil
+          status:,
+          headers:,
+          layout_path:,
+          response_instance:,
+          view:,
+          charset:
         )
           base_path = config.dig(:views, :path) || 'views'
+          headers['content-security-policy'] ||= content_security_policy
 
-          file_or_nil = lambda do |path|
+          file_or_nil = proc do |path|
             ::File.read(path)
           rescue Errno::ENOENT
             nil
@@ -118,56 +302,31 @@ class Rackr
             return Rack::Response.new(
               parsed_erb,
               status,
-              @@default_headers_for.call('text/html; charset=utf-8', headers, parsed_erb)
+              DEFAULT_HEADERS.call("text/html; charset=#{charset}", headers, parsed_erb)
             )
           end
 
-          [status, @@default_headers_for.call('text/html; charset=utf-8', headers, parsed_erb), [parsed_erb]]
-        end
-
-        def not_found!
-          raise Rackr::NotFound
-        end
-
-        def load_json(val)
-          return Oj.load(val.body.read) if val.is_a?(Rack::Request)
-
-          Oj.load(val)
-        end
-
-        def html_response(content = '', status: 200, headers: {})
-          Rack::Response.new(content, status, @@default_headers_for.call('text/html; charset=utf-8', headers, content))
+          [status, DEFAULT_HEADERS.call("text/html; charset=#{charset}", headers, parsed_erb), [parsed_erb]]
         end
 
-        def json_response(content = {}, status: 200, headers: {})
-          content = Oj.dump(content, mode: :compat) unless content.is_a?(String)
-          Rack::Response.new(content, status, @@default_headers_for.call('application/json', headers, content))
+        def d(content)
+          raise Rackr::Dump, content
         end
 
-        def text_response(content, status: 200, headers: {})
-          Rack::Response.new(content, status, @@default_headers_for.call('text/plain', headers, content))
+        def not_found!
+          raise Rackr::NotFound
         end
 
+        # rubocop:disable Security/Eval
         def load_erb(content, binding_context: nil)
           eval(Erubi::Engine.new(content).src, binding_context)
         end
+        # rubocop:enable Security/Eval
 
         def head(status, headers: {})
           [status, headers, []]
         end
 
-        def head_response(status, headers: {})
-          Rack::Response.new(nil, status, headers)
-        end
-
-        def redirect_response(url, headers: {})
-          Rack::Response.new(
-            nil,
-            302,
-            { 'location' => url }.merge(headers)
-          )
-        end
-
         def redirect_to(url, headers: {})
           [302, { 'location' => url }.merge(headers), []]
         end
@@ -175,7 +334,17 @@ class Rackr
         def response(body = nil, status = 200, headers = {})
           Rack::Response.new(body, status, headers)
         end
+
+        def content_security_policy
+          @content_security_policy ||=
+            DEFAULT_CSP_HEADERS
+            .merge(config&.dig(:csp_headers) || {})
+            .map { |k, v| "#{k.to_s.tr('_', '-')} #{v}" }
+            .join('; ')
+        end
       end
     end
   end
+  # rubocop:enable Metrics/PerceivedComplexity
+  # rubocop:enable Metrics/MethodLength
 end

data/lib/rackr/callback.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 class Rackr
+  # A callback is just a Rackr::Action with the assign method
   module Callback
     def self.included(base)
       base.class_eval do

data/lib/rackr/router/build_request.rb

@@ -2,6 +2,7 @@
 
 class Rackr
   class Router
+    # This class is responsible for initialize the Rack::Request object and give it the path params
     class BuildRequest
       def initialize(env, spplited_request_path)
         @env = env

data/lib/rackr/router/dev_html/dump.rb

@@ -0,0 +1,105 @@
+# frozen_string_literal: true
+
+require 'rack/utils'
+
+class Rackr
+  class Router
+    module DevHtml
+      # Pretty print the content of the dump
+      class PrettyPrint
+        def self.call(content, level = 0)
+          content = content.inspect if content.instance_of?(String)
+          content = 'nil' if content.instance_of?(nil)
+          content = 'false' if content.instance_of?(false)
+
+          return "<pre>#{Rack::Utils.escape_html(content)}</pre>" if level >= 2
+
+          case content
+          when String, Symbol, Numeric, TrueClass, FalseClass, NilClass
+            "<pre>#{Rack::Utils.escape_html(content)}</pre>"
+          when Array
+            pretty_print_array(content, level)
+          when Hash
+            pretty_print_hash(content, level)
+          else
+            pretty_print_object(content, level)
+          end
+        end
+
+        def self.pretty_print_array(array, level)
+          list_items = array.map do |item|
+            "<li>#{call(item, level + 1)}</li>"
+          end.join
+
+          "<ul>#{list_items}</ul>"
+        end
+
+        def self.pretty_print_hash(hash, level)
+          list_items = hash.map do |key, value|
+            "<li><strong>#{key.inspect} =></strong> #{call(value, level + 1)}</li>"
+          end.join
+
+          "<ul>#{list_items}</ul>"
+        end
+
+        def self.pretty_print_object(content, level)
+          instance_vars = content.instance_variables.map do |var|
+            value = content.instance_variable_get(var)
+            "<li><strong>#{var}:</strong> #{call(value, level + 1)}</li>"
+          end.join
+
+          "<h3>#{content.class}</h3><ul>#{instance_vars}</ul>"
+        end
+      end
+
+      # This is the action that is called when a dump is raised
+      class Dump
+        include Rackr::Action
+
+        def call(env)
+          res = response(<<-HTML
+            <!DOCTYPE html>
+            <html>
+            <head>
+              <title>Application dump</title>
+              <style>
+                body {
+                  padding: 0px;
+                  margin: 0px;
+                  font:small sans-serif;
+                  background-color: #2b2b2b;
+                  color: white;
+                }
+                h2 {
+                  margin: 0px;
+                  padding: 0.2em;
+                  background-color: #353535;
+                }
+                li {
+                  padding: 0px;
+                }
+                div {
+                  margin: 1em;
+                }
+              </style>
+            </head>
+            <body>
+              <h2>#{env['dump'].content.class}</h2>
+              <div>
+                <h3>Methods</h3>
+                #{env['dump'].content.methods}
+                <h3>Content</h3>
+                #{PrettyPrint.call(env['dump'].content)}
+              </div>
+            </body>
+            </html>
+          HTML
+                        )
+          res.status = 200
+          res.headers['content-type'] = 'text/html'
+          render res:
+        end
+      end
+    end
+  end
+end

data/lib/rackr/router/{errors/dev_html.rb → dev_html/errors.rb}

@@ -2,12 +2,13 @@
 
 class Rackr
   class Router
-    module Errors
-      class DevHtml
+    module DevHtml
+      # This is the action that is called when an error is raised
+      class Errors
         include Rackr::Action
 
         def call(env)
-          render(html: <<-HTML
+          res = build_response(html: <<-HTML
             <!DOCTYPE html>
             <html>
             <head>
@@ -20,9 +21,9 @@ class Rackr
                 body>div { border-bottom:1px solid #ddd; }
                 h1 { font-weight:normal; }
                 h2 { margin-bottom:.8em; }
-                h2 span { font-size:80%; color:#666; font-weight:normal; }
+                h2 span { font-size:80%; color:#555; font-weight:normal; }
                 #summary { background: #ffc; }
-                #summary h2 { font-weight: normal; color: #666; }
+                #summary h2 { font-weight: normal; color: #555; }
                 #backtrace { background: #eee; }
                 pre {
                   background: #ddd;
@@ -45,12 +46,14 @@ class Rackr
             </body>
             </html>
           HTML
-                )
+                              )
+          res.status = 500
+          render res:
         end
 
         def backtrace(env)
           first, *tail = env['error'].backtrace
-          traceback = String.new('<h2>Traceback <span>(innermost first)</span></h2>')
+          traceback = +'<h2>Traceback <span>(innermost first)</span></h2>'
           traceback << "<p class=\"first-p\">#{first}</p><br/>"
 
           line_number = extract_line_number(first)
@@ -58,7 +61,7 @@ class Rackr
           file_path = (match ? match[1] : nil)
           unless file_path.nil?
             lines = File.readlines(file_path).map.with_index { |line, i| "#{i + 1}: #{line}" }
-            traceback << "<pre>#{slice_around_index(lines, line_number).join('')}</pre>"
+            traceback << "<pre>#{slice_around_index(lines, line_number).join}</pre>"
           end
 
           traceback << "<p>#{tail.join('<br>')}</p>"

data/lib/rackr/router/endpoint.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+class Rackr
+  class Router
+    # A endpoint in Rackr is all objects that respond do .call, or .new.call
+    module Endpoint
+      def self.call(endpoint, content, routes = nil, config = nil, error = nil)
+        instance =
+          if endpoint.respond_to?(:call)
+            endpoint
+          elsif endpoint < Rackr::Action || endpoint < Rackr::Callback
+            endpoint.new(routes:, config:)
+          else
+            endpoint.new
+          end
+
+        return instance.call(content, error) if error
+
+        instance.call(content)
+      end
+    end
+  end
+end

data/lib/rackr/router/errors.rb

@@ -2,6 +2,7 @@
 
 class Rackr
   class Router
+    # Errors for the router
     module Errors
       class Error < StandardError; end
       class InvalidNamedRouteError < Error; end
@@ -10,8 +11,15 @@ class Rackr
       class InvalidCallbackError < Error; end
       class InvalidPathError < Error; end
       class InvalidBranchNameError < Error; end
+      class InvalidRackResponseError < StandardError; end
 
       class << self
+        def check_rack_response(response, where)
+          return if response.is_a?(Array)
+
+          raise(InvalidRackResponseError, "Invalid Rack response in #{where}, received: #{response}")
+        end
+
         def check_scope_name(path)
           return if path.is_a?(String) || path.is_a?(Symbol) || path.nil?
 
@@ -39,7 +47,7 @@ class Rackr
 
         def check_callbacks(callbacks, path)
           check = lambda { |callback|
-            unless callback.nil? || callback.respond_to?(:call) || (callback.respond_to?(:new) && callback.instance_methods.include?(:call))
+            unless callback.nil? || callback.respond_to?(:call) || (callback.respond_to?(:new) && callback.method_defined?(:call))
               raise(InvalidCallbackError,
                     "Callbacks must respond to a `call` method or be a class with a `call` instance method, got: '#{callback.inspect}' for '#{path}'")
             end
@@ -49,9 +57,7 @@ class Rackr
         end
 
         def check_endpoint(endpoint, path)
-          if endpoint.respond_to?(:call) || (endpoint.respond_to?(:new) && endpoint.instance_methods.include?(:call))
-            return
-          end
+          return if endpoint.respond_to?(:call) || (endpoint.respond_to?(:new) && endpoint.method_defined?(:call))
 
           raise(InvalidEndpointError,
                 "Endpoints must respond to a `call` method or be a class with a `call` instance method, got: '#{endpoint.inspect}' for '#{path}'")