railties 5.1.7 → 5.2.0.beta1

data/README.rdoc

@@ -23,7 +23,7 @@ Source code can be downloaded as part of the Rails project on GitHub
 
 Railties is released under the MIT license:
 
-* http://www.opensource.org/licenses/MIT
+* https://opensource.org/licenses/MIT
 
 == Support
 
@@ -38,4 +38,3 @@ Bug reports can be filed for the Ruby on Rails project here:
 Feature requests should be discussed on the rails-core mailing list here:
 
 * https://groups.google.com/forum/?fromgroups#!forum/rubyonrails-core
-

data/exe/rails

@@ -1,9 +1,10 @@
 #!/usr/bin/env ruby
+# frozen_string_literal: true
 
-git_path = File.expand_path("../../../.git", __FILE__)
+git_path = File.expand_path("../../.git", __dir__)
 
 if File.exist?(git_path)
-  railties_path = File.expand_path("../../lib", __FILE__)
+  railties_path = File.expand_path("../lib", __dir__)
   $:.unshift(railties_path)
 end
 require "rails/cli"

data/lib/minitest/rails_plugin.rb

@@ -1,5 +1,8 @@
+# frozen_string_literal: true
+
 require "active_support/core_ext/module/attribute_accessors"
 require "rails/test_unit/reporter"
+require "rails/test_unit/runner"
 
 module Minitest
   class SuppressedSummaryReporter < SummaryReporter
@@ -10,6 +13,8 @@ module Minitest
   end
 
   def self.plugin_rails_options(opts, options)
+    Rails::TestUnit::Runner.attach_before_load_options(opts)
+
     opts.on("-b", "--backtrace", "Show the complete backtrace") do
       options[:full_backtrace] = true
     end
@@ -38,21 +43,12 @@ module Minitest
       Minitest.backtrace_filter = ::Rails.backtrace_cleaner if ::Rails.respond_to?(:backtrace_cleaner)
     end
 
-    self.plugin_rails_replace_reporters(reporter, options)
-  end
-
-  def self.plugin_rails_replace_reporters(minitest_reporter, options)
-    return unless minitest_reporter.kind_of?(Minitest::CompositeReporter)
-
     # Replace progress reporter for colors.
-    if minitest_reporter.reporters.reject! { |reporter| reporter.kind_of?(SummaryReporter) } != nil
-      minitest_reporter << SuppressedSummaryReporter.new(options[:io], options)
-    end
-    if minitest_reporter.reporters.reject! { |reporter| reporter.kind_of?(ProgressReporter) } != nil
-      minitest_reporter << ::Rails::TestUnitReporter.new(options[:io], options)
-    end
+    reporter.reporters.delete_if { |reporter| reporter.kind_of?(SummaryReporter) || reporter.kind_of?(ProgressReporter) }
+    reporter << SuppressedSummaryReporter.new(options[:io], options)
+    reporter << ::Rails::TestUnitReporter.new(options[:io], options)
   end
 
   # Backwardscompatibility with Rails 5.0 generated plugin test scripts
-  mattr_reader(:run_via) { Hash.new }
+  mattr_reader :run_via, default: {}
 end

data/lib/rails.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "rails/ruby_version_check"
 
 require "pathname"
@@ -87,8 +89,8 @@ module Rails
     #   groups assets: [:development, :test]
     #
     #   # Returns
-    #   # => [:default, :development, :assets] for Rails.env == "development"
-    #   # => [:default, :production]           for Rails.env == "production"
+    #   # => [:default, "development", :assets] for Rails.env == "development"
+    #   # => [:default, "production"]           for Rails.env == "production"
     def groups(*groups)
       hash = groups.extract_options!
       env = Rails.env

data/lib/rails/all.rb

@@ -1,7 +1,10 @@
+# frozen_string_literal: true
+
 require "rails"
 
 %w(
   active_record/railtie
+  active_storage/engine
   action_controller/railtie
   action_view/railtie
   action_mailer/railtie

data/lib/rails/api/generator.rb

@@ -1,11 +1,16 @@
+# frozen_string_literal: true
+
 require "sdoc"
 
 class RDoc::Generator::API < RDoc::Generator::SDoc # :nodoc:
   RDoc::RDoc.add_generator self
 
   def generate_class_tree_level(classes, visited = {})
-    # Only process core extensions on the first visit.
+    # Only process core extensions on the first visit and remove
+    # Active Storage duplicated classes that are at the top level
+    # since they aren't nested under a definition of the `ActiveStorage` module.
     if visited.empty?
+      classes = classes.reject { |klass| active_storage?(klass) }
       core_exts, classes = classes.partition { |klass| core_extension?(klass) }
 
       super.unshift([ "Core extensions", "", "", build_core_ext_subtree(core_exts, visited) ])
@@ -25,4 +30,8 @@ class RDoc::Generator::API < RDoc::Generator::SDoc # :nodoc:
     def core_extension?(klass)
       klass.name != "ActiveSupport" && klass.in_files.any? { |file| file.absolute_name.include?("core_ext") }
     end
+
+    def active_storage?(klass)
+      klass.name != "ActiveStorage" && klass.in_files.all? { |file| file.absolute_name.include?("active_storage") }
+    end
 end

data/lib/rails/api/task.rb

@@ -1,5 +1,7 @@
+# frozen_string_literal: true
+
 require "rdoc/task"
-require_relative "generator"
+require "rails/api/generator"
 
 module Rails
   module API
@@ -64,6 +66,14 @@ module Rails
           )
         },
 
+        "activestorage" => {
+          include: %w(
+            README.md
+            app/**/active_storage/**/*.rb
+            lib/active_storage/**/*.rb
+          )
+        },
+
         "railties" => {
           include: %w(
             README.rdoc

data/lib/rails/app_loader.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "pathname"
 require "rails/version"
 
@@ -8,15 +10,26 @@ module Rails
     RUBY = Gem.ruby
     EXECUTABLES = ["bin/rails", "script/rails"]
     BUNDLER_WARNING = <<EOS
-Looks like your app's ./bin/rails is a stub that was generated by Bundler.
+Beginning in Rails 4, Rails ships with a `rails` binstub at ./bin/rails that
+should be used instead of the Bundler-generated `rails` binstub.
+
+If you are seeing this message, your binstub at ./bin/rails was generated by
+Bundler instead of Rails.
+
+You might need to regenerate your `rails` binstub locally and add it to source
+control:
+
+ rails app:update:bin           # Bear in mind this generates other binstubs
+                                # too that you may or may not want (like yarn)
 
-In Rails #{Rails::VERSION::MAJOR}, your app's bin/ directory contains executables that are versioned
-like any other source code, rather than stubs that are generated on demand.
+If you already have Rails binstubs in source control, you might be
+inadverently overwriting them during deployment by using bundle install
+with the --binstubs option.
 
-Here's how to upgrade:
+If your application was created prior to Rails 4, here's how to upgrade:
 
   bundle config --delete bin    # Turn off Bundler's stub generator
-  rails app:update:bin          # Use the new Rails 5 executables
+  rails app:update:bin          # Use the new Rails executables
   git add bin                   # Add bin/ to source control
 
 You may need to remove bin/ from your .gitignore as well.

data/lib/rails/app_updater.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+require "rails/generators"
+require "rails/generators/rails/app/app_generator"
+
+module Rails
+  class AppUpdater # :nodoc:
+    class << self
+      def invoke_from_app_generator(method)
+        app_generator.send(method)
+      end
+
+      def app_generator
+        @app_generator ||= begin
+          gen = Rails::Generators::AppGenerator.new ["rails"], generator_options, destination_root: Rails.root
+          File.exist?(Rails.root.join("config", "application.rb")) ? gen.send(:app_const) : gen.send(:valid_const?)
+          gen
+        end
+      end
+
+      private
+        def generator_options
+          options = { api: !!Rails.application.config.api_only, update: true }
+          options[:skip_active_record]  = !defined?(ActiveRecord::Railtie)
+          options[:skip_active_storage] = !defined?(ActiveStorage::Engine) || !defined?(ActiveRecord::Railtie)
+          options[:skip_action_mailer]  = !defined?(ActionMailer::Railtie)
+          options[:skip_action_cable]   = !defined?(ActionCable::Engine)
+          options[:skip_sprockets]      = !defined?(Sprockets::Railtie)
+          options[:skip_puma]           = !defined?(Puma)
+          options
+        end
+    end
+  end
+end

data/lib/rails/application.rb

@@ -1,8 +1,12 @@
+# frozen_string_literal: true
+
 require "yaml"
 require "active_support/core_ext/hash/keys"
 require "active_support/core_ext/object/blank"
 require "active_support/key_generator"
 require "active_support/message_verifier"
+require "active_support/encrypted_configuration"
+require "active_support/deprecation"
 require "rails/engine"
 require "rails/secrets"
 
@@ -169,12 +173,10 @@ module Rails
       # number of iterations selected based on consultation with the google security
       # team. Details at https://github.com/rails/rails/pull/6952#issuecomment-7661220
       @caching_key_generator ||=
-        if secrets.secret_key_base
-          unless secrets.secret_key_base.kind_of?(String)
-            raise ArgumentError, "`secret_key_base` for #{Rails.env} environment must be a type of String, change this value in `config/secrets.yml`"
-          end
-          key_generator = ActiveSupport::KeyGenerator.new(secrets.secret_key_base, iterations: 1000)
-          ActiveSupport::CachingKeyGenerator.new(key_generator)
+        if secret_key_base
+          ActiveSupport::CachingKeyGenerator.new(
+            ActiveSupport::KeyGenerator.new(secret_key_base, iterations: 1000)
+          )
         else
           ActiveSupport::LegacyKeyGenerator.new(secrets.secret_token)
         end
@@ -244,13 +246,11 @@ module Rails
     # will be used by middlewares and engines to configure themselves.
     def env_config
       @app_env_config ||= begin
-        validate_secret_key_config!
-
         super.merge(
           "action_dispatch.parameter_filter" => config.filter_parameters,
           "action_dispatch.redirect_filter" => config.filter_redirect,
           "action_dispatch.secret_token" => secrets.secret_token,
-          "action_dispatch.secret_key_base" => secrets.secret_key_base,
+          "action_dispatch.secret_key_base" => secret_key_base,
           "action_dispatch.show_exceptions" => config.action_dispatch.show_exceptions,
           "action_dispatch.show_detailed_exceptions" => config.consider_all_requests_local,
           "action_dispatch.logger" => Rails.logger,
@@ -260,8 +260,15 @@ module Rails
           "action_dispatch.signed_cookie_salt" => config.action_dispatch.signed_cookie_salt,
           "action_dispatch.encrypted_cookie_salt" => config.action_dispatch.encrypted_cookie_salt,
           "action_dispatch.encrypted_signed_cookie_salt" => config.action_dispatch.encrypted_signed_cookie_salt,
+          "action_dispatch.authenticated_encrypted_cookie_salt" => config.action_dispatch.authenticated_encrypted_cookie_salt,
+          "action_dispatch.use_authenticated_cookie_encryption" => config.action_dispatch.use_authenticated_cookie_encryption,
+          "action_dispatch.encrypted_cookie_cipher" => config.action_dispatch.encrypted_cookie_cipher,
+          "action_dispatch.signed_cookie_digest" => config.action_dispatch.signed_cookie_digest,
           "action_dispatch.cookies_serializer" => config.action_dispatch.cookies_serializer,
-          "action_dispatch.cookies_digest" => config.action_dispatch.cookies_digest
+          "action_dispatch.cookies_digest" => config.action_dispatch.cookies_digest,
+          "action_dispatch.cookies_rotations" => config.action_dispatch.cookies_rotations,
+          "action_dispatch.content_security_policy" => config.content_security_policy,
+          "action_dispatch.content_security_policy_report_only" => config.content_security_policy_report_only
         )
       end
     end
@@ -395,6 +402,12 @@ module Rails
         # Fallback to config.secret_token if secrets.secret_token isn't set
         secrets.secret_token ||= config.secret_token
 
+        if secrets.secret_token.present?
+          ActiveSupport::Deprecation.warn(
+            "`secrets.secret_token` is deprecated in favor of `secret_key_base` and will be removed in Rails 6.0."
+          )
+        end
+
         secrets
       end
     end
@@ -403,6 +416,66 @@ module Rails
       @secrets = secrets
     end
 
+    # The secret_key_base is used as the input secret to the application's key generator, which in turn
+    # is used to create all MessageVerifiers/MessageEncryptors, including the ones that sign and encrypt cookies.
+    #
+    # In test and development, this is simply derived as a MD5 hash of the application's name.
+    #
+    # In all other environments, we look for it first in ENV["SECRET_KEY_BASE"],
+    # then credentials.secret_key_base, and finally secrets.secret_key_base. For most applications,
+    # the correct place to store it is in the encrypted credentials file.
+    def secret_key_base
+      if Rails.env.test? || Rails.env.development?
+        Digest::MD5.hexdigest self.class.name
+      else
+        validate_secret_key_base(
+          ENV["SECRET_KEY_BASE"] || credentials.secret_key_base || secrets.secret_key_base
+        )
+      end
+    end
+
+    # Decrypts the credentials hash as kept in +config/credentials.yml.enc+. This file is encrypted with
+    # the Rails master key, which is either taken from <tt>ENV["RAILS_MASTER_KEY"]</tt> or from loading
+    # +config/master.key+.
+    def credentials
+      @credentials ||= encrypted("config/credentials.yml.enc")
+    end
+
+    # Shorthand to decrypt any encrypted configurations or files.
+    #
+    # For any file added with <tt>bin/rails encrypted:edit</tt> call +read+ to decrypt
+    # the file with the master key.
+    # The master key is either stored in +config/master.key+ or <tt>ENV["RAILS_MASTER_KEY"]</tt>.
+    #
+    #   Rails.application.encrypted("config/mystery_man.txt.enc").read
+    #   # => "We've met before, haven't we?"
+    #
+    # It's also possible to interpret encrypted YAML files with +config+.
+    #
+    #   Rails.application.encrypted("config/credentials.yml.enc").config
+    #   # => { next_guys_line: "I don't think so. Where was it you think we met?" }
+    #
+    # Any top-level configs are also accessible directly on the return value:
+    #
+    #   Rails.application.encrypted("config/credentials.yml.enc").next_guys_line
+    #   # => "I don't think so. Where was it you think we met?"
+    #
+    # The files or configs can also be encrypted with a custom key. To decrypt with
+    # a key in the +ENV+, use:
+    #
+    #   Rails.application.encrypted("config/special_tokens.yml.enc", env_key: "SPECIAL_TOKENS")
+    #
+    # Or to decrypt with a file, that should be version control ignored, relative to +Rails.root+:
+    #
+    #   Rails.application.encrypted("config/special_tokens.yml.enc", key_path: "config/special_tokens.key")
+    def encrypted(path, key_path: "config/master.key", env_key: "RAILS_MASTER_KEY")
+      ActiveSupport::EncryptedConfiguration.new(
+        config_path: Rails.root.join(path),
+        key_path: Rails.root.join(key_path),
+        env_key: env_key
+      )
+    end
+
     def to_app #:nodoc:
       self
     end
@@ -501,14 +574,13 @@ module Rails
       default_stack.build_stack
     end
 
-    def validate_secret_key_config! #:nodoc:
-      if secrets.secret_key_base.blank?
-        ActiveSupport::Deprecation.warn "You didn't set `secret_key_base`. " \
-          "Read the upgrade documentation to learn more about this new config option."
-
-        if secrets.secret_token.blank?
-          raise "Missing `secret_key_base` for '#{Rails.env}' environment, set this value in `config/secrets.yml`"
-        end
+    def validate_secret_key_base(secret_key_base)
+      if secret_key_base.is_a?(String) && secret_key_base.present?
+        secret_key_base
+      elsif secret_key_base
+        raise ArgumentError, "`secret_key_base` for #{Rails.env} environment must be a type of String`"
+      elsif secrets.secret_token.blank?
+        raise ArgumentError, "Missing `secret_key_base` for '#{Rails.env}' environment, set this string with `rails credentials:edit`"
       end
     end
 

data/lib/rails/application/bootstrap.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "fileutils"
 require "active_support/notifications"
 require "active_support/dependencies"

data/lib/rails/application/configuration.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "active_support/core_ext/kernel/reporting"
 require "active_support/file_update_checker"
 require "rails/engine/configuration"
@@ -14,44 +16,46 @@ module Rails
                     :ssl_options, :public_file_server,
                     :session_options, :time_zone, :reload_classes_only_on_change,
                     :beginning_of_week, :filter_redirect, :x, :enable_dependency_loading,
-                    :read_encrypted_secrets, :log_level
+                    :read_encrypted_secrets, :log_level, :content_security_policy_report_only
 
       attr_reader :encoding, :api_only
 
       def initialize(*)
         super
-        self.encoding                    = Encoding::UTF_8
-        @allow_concurrency               = nil
-        @consider_all_requests_local     = false
-        @filter_parameters               = []
-        @filter_redirect                 = []
-        @helpers_paths                   = []
-        @public_file_server              = ActiveSupport::OrderedOptions.new
-        @public_file_server.enabled      = true
-        @public_file_server.index_name   = "index"
-        @force_ssl                       = false
-        @ssl_options                     = {}
-        @session_store                   = nil
-        @time_zone                       = "UTC"
-        @beginning_of_week               = :monday
-        @log_level                       = :debug
-        @generators                      = app_generators
-        @cache_store                     = [ :file_store, "#{root}/tmp/cache/" ]
-        @railties_order                  = [:all]
-        @relative_url_root               = ENV["RAILS_RELATIVE_URL_ROOT"]
-        @reload_classes_only_on_change   = true
-        @file_watcher                    = ActiveSupport::FileUpdateChecker
-        @exceptions_app                  = nil
-        @autoflush_log                   = true
-        @log_formatter                   = ActiveSupport::Logger::SimpleFormatter.new
-        @eager_load                      = nil
-        @secret_token                    = nil
-        @secret_key_base                 = nil
-        @api_only                        = false
-        @debug_exception_response_format = nil
-        @x                               = Custom.new
-        @enable_dependency_loading       = false
-        @read_encrypted_secrets          = false
+        self.encoding                        = Encoding::UTF_8
+        @allow_concurrency                   = nil
+        @consider_all_requests_local         = false
+        @filter_parameters                   = []
+        @filter_redirect                     = []
+        @helpers_paths                       = []
+        @public_file_server                  = ActiveSupport::OrderedOptions.new
+        @public_file_server.enabled          = true
+        @public_file_server.index_name       = "index"
+        @force_ssl                           = false
+        @ssl_options                         = {}
+        @session_store                       = nil
+        @time_zone                           = "UTC"
+        @beginning_of_week                   = :monday
+        @log_level                           = :debug
+        @generators                          = app_generators
+        @cache_store                         = [ :file_store, "#{root}/tmp/cache/" ]
+        @railties_order                      = [:all]
+        @relative_url_root                   = ENV["RAILS_RELATIVE_URL_ROOT"]
+        @reload_classes_only_on_change       = true
+        @file_watcher                        = ActiveSupport::FileUpdateChecker
+        @exceptions_app                      = nil
+        @autoflush_log                       = true
+        @log_formatter                       = ActiveSupport::Logger::SimpleFormatter.new
+        @eager_load                          = nil
+        @secret_token                        = nil
+        @secret_key_base                     = nil
+        @api_only                            = false
+        @debug_exception_response_format     = nil
+        @x                                   = Custom.new
+        @enable_dependency_loading           = false
+        @read_encrypted_secrets              = false
+        @content_security_policy             = nil
+        @content_security_policy_report_only = false
       end
 
       def load_defaults(target_version)
@@ -69,7 +73,6 @@ module Rails
           end
 
           self.ssl_options = { hsts: { subdomains: true } }
-
         when "5.1"
           load_defaults "5.0"
 
@@ -77,6 +80,35 @@ module Rails
             assets.unknown_asset_fallback = false
           end
 
+          if respond_to?(:action_view)
+            action_view.form_with_generates_remote_forms = true
+          end
+        when "5.2"
+          load_defaults "5.1"
+
+          if respond_to?(:active_record)
+            active_record.cache_versioning = true
+            # Remove the temporary load hook from SQLite3Adapter when this is removed
+            ActiveSupport.on_load(:active_record_sqlite3adapter) do
+              ActiveRecord::ConnectionAdapters::SQLite3Adapter.represent_boolean_as_integer = true
+            end
+          end
+
+          if respond_to?(:action_dispatch)
+            action_dispatch.use_authenticated_cookie_encryption = true
+          end
+
+          if respond_to?(:active_support)
+            active_support.use_authenticated_message_encryption = true
+          end
+
+          if respond_to?(:action_controller)
+            action_controller.default_protect_from_forgery = true
+          end
+
+          if respond_to?(:action_view)
+            action_view.form_with_generates_ids = true
+          end
         else
           raise "Unknown version #{target_version.to_s.inspect}"
         end
@@ -122,7 +154,7 @@ module Rails
       end
 
       # Loads and returns the entire raw configuration of database from
-      # values stored in `config/database.yml`.
+      # values stored in <tt>config/database.yml</tt>.
       def database_configuration
         path = paths["config/database"].existent.first
         yaml = Pathname.new(path) if path
@@ -130,7 +162,14 @@ module Rails
         config = if yaml && yaml.exist?
           require "yaml"
           require "erb"
-          YAML.load(ERB.new(yaml.read).result) || {}
+          loaded_yaml = YAML.load(ERB.new(yaml.read).result) || {}
+          shared = loaded_yaml.delete("shared")
+          if shared
+            loaded_yaml.each do |_k, values|
+              values.reverse_merge!(shared)
+            end
+          end
+          Hash.new(shared).merge(loaded_yaml)
         elsif ENV["DATABASE_URL"]
           # Value from ENV['DATABASE_URL'] is set to default database connection
           # by Active Record.
@@ -192,6 +231,10 @@ module Rails
         SourceAnnotationExtractor::Annotation
       end
 
+      def content_security_policy(&block)
+        @content_security_policy ||= ActionDispatch::ContentSecurityPolicy.new(&block)
+      end
+
       class Custom #:nodoc:
         def initialize
           @configurations = Hash.new