railties 5.1.7 → 5.2.0.beta1

data/lib/rails/application/default_middleware_stack.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Rails
   class Application
     class DefaultMiddlewareStack
@@ -10,7 +12,7 @@ module Rails
       end
 
       def build_stack
-        ActionDispatch::MiddlewareStack.new.tap do |middleware|
+        ActionDispatch::MiddlewareStack.new do |middleware|
           if config.force_ssl
             middleware.use ::ActionDispatch::SSL, config.ssl_options
           end
@@ -61,6 +63,10 @@ module Rails
             middleware.use ::ActionDispatch::Flash
           end
 
+          unless config.api_only
+            middleware.use ::ActionDispatch::ContentSecurityPolicy::Middleware
+          end
+
           middleware.use ::Rack::Head
           middleware.use ::Rack::ConditionalGet
           middleware.use ::Rack::ETag, "no-cache"

data/lib/rails/application/finisher.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Rails
   class Application
     module Finisher
@@ -125,7 +127,7 @@ module Rails
       initializer :set_routes_reloader_hook do |app|
         reloader = routes_reloader
         reloader.eager_load = app.config.eager_load
-        reloader.execute
+        reloader.execute_if_updated
         reloaders << reloader
         app.reloader.to_run do
           # We configure #execute rather than #execute_if_updated because if

data/lib/rails/application/routes_reloader.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "active_support/core_ext/module/delegation"
 
 module Rails
@@ -5,7 +7,7 @@ module Rails
     class RoutesReloader
       attr_reader :route_sets, :paths
       attr_accessor :eager_load
-      delegate :execute_if_updated, :execute, :updated?, to: :updater
+      delegate :updated?, to: :updater
 
       def initialize
         @paths      = []
@@ -17,15 +19,31 @@ module Rails
         clear!
         load_paths
         finalize!
-        route_sets.each(&:eager_load!) if eager_load
       ensure
         revert
       end
 
+      def execute
+        ret = updater.execute
+        route_sets.each(&:eager_load!) if eager_load
+        ret
+      end
+
+      def execute_if_updated
+        if updated = updater.execute_if_updated
+          route_sets.each(&:eager_load!) if eager_load
+        end
+        updated
+      end
+
     private
 
       def updater
-        @updater ||= ActiveSupport::FileUpdateChecker.new(paths) { reload! }
+        @updater ||= begin
+          updater = ActiveSupport::FileUpdateChecker.new(paths) { reload! }
+          updater.execute
+          updater
+        end
       end
 
       def clear!

data/lib/rails/application_controller.rb

@@ -1,5 +1,7 @@
+# frozen_string_literal: true
+
 class Rails::ApplicationController < ActionController::Base # :nodoc:
-  self.view_paths = File.expand_path("../templates", __FILE__)
+  self.view_paths = File.expand_path("templates", __dir__)
   layout "application"
 
   private

data/lib/rails/backtrace_cleaner.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "active_support/backtrace_cleaner"
 
 module Rails
@@ -16,7 +18,7 @@ module Rails
       add_filter { |line| line.sub(DOT_SLASH, SLASH) } # for tests
 
       add_gem_filters
-      add_silencer { |line| line !~ APP_DIRS_PATTERN }
+      add_silencer { |line| !APP_DIRS_PATTERN.match?(line) }
     end
 
     private

data/lib/rails/cli.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "rails/app_loader"
 
 # If we are inside a Rails application this method performs an exec and thus

data/lib/rails/code_statistics.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "rails/code_statistics_calculator"
 require "active_support/core_ext/enumerable"
 

data/lib/rails/code_statistics_calculator.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class CodeStatisticsCalculator #:nodoc:
   attr_reader :lines, :code_lines, :classes, :methods
 

data/lib/rails/command.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "active_support"
 require "active_support/dependencies/autoload"
 require "active_support/core_ext/enumerable"
@@ -23,7 +25,7 @@ module Rails
       end
 
       def environment # :nodoc:
-        ENV["RAILS_ENV"] || ENV["RACK_ENV"] || "development"
+        ENV["RAILS_ENV"].presence || ENV["RACK_ENV"].presence || "development"
       end
 
       # Receives a namespace, arguments and the behavior to invoke the command.

data/lib/rails/command/actions.rb

@@ -1,11 +1,13 @@
+# frozen_string_literal: true
+
 module Rails
   module Command
     module Actions
-      # Change to the application's path if there is no config.ru file in current directory.
-      # This allows us to run `rails server` from other directories, but still get
-      # the main config.ru and properly set the tmp directory.
+      # Change to the application's path if there is no <tt>config.ru</tt> file in current directory.
+      # This allows us to run <tt>rails server</tt> from other directories, but still get
+      # the main <tt>config.ru</tt> and properly set the <tt>tmp</tt> directory.
       def set_application_directory!
-        Dir.chdir(File.expand_path("../../", APP_PATH)) unless File.exist?(File.expand_path("config.ru"))
+        Dir.chdir(File.expand_path("../..", APP_PATH)) unless File.exist?(File.expand_path("config.ru"))
       end
 
       def require_application_and_environment!

data/lib/rails/command/base.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "thor"
 require "erb"
 
@@ -73,7 +75,7 @@ module Rails
 
         # Use Rails' default banner.
         def banner(*)
-          "#{executable} #{arguments.map(&:usage).join(' ')} [options]".squish!
+          "#{executable} #{arguments.map(&:usage).join(' ')} [options]".squish
         end
 
         # Sets the base_name taking into account the current class namespace.
@@ -110,8 +112,8 @@ module Rails
         # Default file root to place extra files a command might need, placed
         # one folder above the command file.
         #
-        # For a `Rails::Command::TestCommand` placed in `rails/command/test_command.rb`
-        # would return `rails/test`.
+        # For a Rails::Command::TestCommand placed in <tt>rails/command/test_command.rb</tt>
+        # would return <tt>rails/test</tt>.
         def default_command_root
           path = File.expand_path(File.join("../commands", command_root_namespace), __dir__)
           path if File.exist?(path)

data/lib/rails/command/behavior.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "active_support"
 
 module Rails

data/lib/rails/command/environment_argument.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "active_support"
 
 module Rails
@@ -7,13 +9,24 @@ module Rails
 
       included do
         argument :environment, optional: true, banner: "environment"
+
+        class_option :environment, aliases: "-e", type: :string,
+          desc: "Specifies the environment to run this console under (test/development/production)."
       end
 
       private
         def extract_environment_option_from_argument
           if environment
             self.options = options.merge(environment: acceptable_environment(environment))
-          elsif !options[:environment]
+
+            ActiveSupport::Deprecation.warn "Passing the environment's name as a " \
+                                            "regular argument is deprecated and "  \
+                                            "will be removed in the next Rails "   \
+                                            "version. Please, use the -e option "  \
+                                            "instead."
+          elsif options[:environment]
+            self.options = options.merge(environment: acceptable_environment(options[:environment]))
+          else
             self.options = options.merge(environment: Rails::Command.environment)
           end
         end

data/lib/rails/command/helpers/editor.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+require "active_support/encrypted_file"
+
+module Rails
+  module Command
+    module Helpers
+      module Editor
+        private
+          def ensure_editor_available(command:)
+            if ENV["EDITOR"].to_s.empty?
+              say "No $EDITOR to open file in. Assign one like this:"
+              say ""
+              say %(EDITOR="mate --wait" #{command})
+              say ""
+              say "For editors that fork and exit immediately, it's important to pass a wait flag,"
+              say "otherwise the credentials will be saved immediately with no chance to edit."
+
+              false
+            else
+              true
+            end
+          end
+
+          def catch_editing_exceptions
+            yield
+          rescue Interrupt
+            say "Aborted changing file: nothing saved."
+          rescue ActiveSupport::EncryptedFile::MissingKeyError => error
+            say error.message
+          end
+      end
+    end
+  end
+end

data/lib/rails/commands.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "rails/command"
 
 aliases = {

data/lib/rails/commands/application/application_command.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "rails/generators"
 require "rails/generators/rails/app/app_generator"
 

data/lib/rails/commands/console/console_command.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "irb"
 require "irb/completion"
 
@@ -70,9 +72,6 @@ module Rails
       class_option :sandbox, aliases: "-s", type: :boolean, default: false,
         desc: "Rollback database modifications on exit."
 
-      class_option :environment, aliases: "-e", type: :string,
-        desc: "Specifies the environment to run this console under (test/development/production)."
-
       def initialize(args = [], local_options = {}, config = {})
         console_options = []
 

data/lib/rails/commands/credentials/USAGE

@@ -0,0 +1,40 @@
+=== Storing Encrypted Credentials in Source Control
+
+The Rails `credentials` commands provide access to encrypted credentials,
+so you can safely store access tokens, database passwords, and the like
+safely inside the app without relying on a mess of ENVs.
+
+This also allows for atomic deploys: no need to coordinate key changes
+to get everything working as the keys are shipped with the code.
+
+=== Setup
+
+Applications after Rails 5.2 automatically have a basic credentials file generated
+that just contains the secret_key_base used by MessageVerifiers/MessageEncryptors, like the ones
+signing and encrypting cookies.
+
+For applications created prior to Rails 5.2, we'll automatically generate a new
+credentials file in `config/credentials.yml.enc` the first time you run `bin/rails credentials:edit`.
+If you didn't have a master key saved in `config/master.key`, that'll be created too.
+
+Don't lose this master key! Put it in a password manager your team can access.
+Should you lose it no one, including you, will be able to access any encrypted
+credentials.
+
+Don't commit the key! Add `config/master.key` to your source control's
+ignore file. If you use Git, Rails handles this for you.
+
+Rails also looks for the master key in `ENV["RAILS_MASTER_KEY"]`, if that's easier to manage.
+
+You could prepend that to your server's start command like this:
+
+   RAILS_MASTER_KEY="very-secret-and-secure" server.start
+
+=== Editing Credentials
+
+This will open a temporary file in `$EDITOR` with the decrypted contents to edit
+the encrypted credentials.
+
+When the temporary file is next saved the contents are encrypted and written to
+`config/credentials.yml.enc` while the file itself is destroyed to prevent credentials
+from leaking.

data/lib/rails/commands/credentials/credentials_command.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+require "active_support"
+require "rails/command/helpers/editor"
+
+module Rails
+  module Command
+    class CredentialsCommand < Rails::Command::Base # :nodoc:
+      include Helpers::Editor
+
+      no_commands do
+        def help
+          say "Usage:\n  #{self.class.banner}"
+          say ""
+          say self.class.desc
+        end
+      end
+
+      def edit
+        require_application_and_environment!
+
+        ensure_editor_available(command: "bin/rails credentials:edit") || (return)
+        ensure_master_key_has_been_added
+        ensure_credentials_have_been_added
+
+        catch_editing_exceptions do
+          change_credentials_in_system_editor
+        end
+
+        say "New credentials encrypted and saved."
+      end
+
+      def show
+        require_application_and_environment!
+
+        say Rails.application.credentials.read.presence ||
+          "No credentials have been added yet. Use bin/rails credentials:edit to change that."
+      end
+
+      private
+        def ensure_master_key_has_been_added
+          master_key_generator.add_master_key_file
+          master_key_generator.ignore_master_key_file
+        end
+
+        def ensure_credentials_have_been_added
+          credentials_generator.add_credentials_file_silently
+        end
+
+        def change_credentials_in_system_editor
+          Rails.application.credentials.change do |tmp_path|
+            system("#{ENV["EDITOR"]} #{tmp_path}")
+          end
+        end
+
+
+        def master_key_generator
+          require "rails/generators"
+          require "rails/generators/rails/master_key/master_key_generator"
+
+          Rails::Generators::MasterKeyGenerator.new
+        end
+
+        def credentials_generator
+          require "rails/generators"
+          require "rails/generators/rails/credentials/credentials_generator"
+
+          Rails::Generators::CredentialsGenerator.new
+        end
+    end
+  end
+end

data/lib/rails/commands/dbconsole/dbconsole_command.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "rails/command/environment_argument"
 
 module Rails
@@ -58,7 +60,7 @@ module Rails
         logon = ""
 
         if config["username"]
-          logon = config["username"]
+          logon = config["username"].dup
           logon << "/#{config['password']}" if config["password"] && @options["include_password"]
           logon << "@#{config['database']}" if config["database"]
         end
@@ -73,7 +75,7 @@ module Rails
         args += ["-P", "#{config['password']}"] if config["password"]
 
         if config["host"]
-          host_arg = "#{config['host']}"
+          host_arg = "#{config['host']}".dup
           host_arg << ":#{config['port']}" if config["port"]
           args += ["-S", host_arg]
         end
@@ -87,10 +89,15 @@ module Rails
 
     def config
       @config ||= begin
-        if configurations[environment].blank?
+        # We need to check whether the user passed the connection the
+        # first time around to show a consistent error message to people
+        # relying on 2-level database configuration.
+        if @options["connection"] && configurations[connection].blank?
+          raise ActiveRecord::AdapterNotSpecified, "'#{connection}' connection is not configured. Available configuration: #{configurations.inspect}"
+        elsif configurations[environment].blank? && configurations[connection].blank?
           raise ActiveRecord::AdapterNotSpecified, "'#{environment}' database is not configured. Available configuration: #{configurations.inspect}"
         else
-          configurations[environment]
+          configurations[environment].presence || configurations[connection]
         end
       end
     end
@@ -99,6 +106,10 @@ module Rails
       Rails.respond_to?(:env) ? Rails.env : Rails::Command.environment
     end
 
+    def connection
+      @options.fetch(:connection, "primary")
+    end
+
     private
       def configurations # :doc:
         require APP_PATH
@@ -140,10 +151,10 @@ module Rails
       class_option :mode, enum: %w( html list line column ), type: :string,
         desc: "Automatically put the sqlite3 database in the specified mode (html, list, line, column)."
 
-      class_option :header, type: :string
+      class_option :header, type: :boolean
 
-      class_option :environment, aliases: "-e", type: :string,
-        desc: "Specifies the environment to run this console under (test/development/production)."
+      class_option :connection, aliases: "-c", type: :string,
+        desc: "Specifies the connection to use."
 
       def perform
         extract_environment_option_from_argument