railties 6.1.0 → 7.0.0

data/lib/rails/application/bootstrap.rb

@@ -14,6 +14,7 @@ module Rails
       initializer :load_environment_hook, group: :all do end
 
       initializer :load_active_support, group: :all do
+        ENV["RAILS_DISABLE_DEPRECATED_TO_S_CONVERSION"] = "true" if config.active_support.disable_to_s_conversion
         require "active_support/all" unless config.active_support.bare
       end
 
@@ -44,13 +45,16 @@ module Rails
           logger.level = ActiveSupport::Logger::WARN
           logger.warn(
             "Rails Error: Unable to access log file. Please ensure that #{path} exists and is writable " \
-            "(ie, make it writable for user and group: chmod 0664 #{path}). " \
+            "(i.e. make it writable for user and group: chmod 0664 #{path}). " \
             "The log level has been raised to WARN and the output directed to STDERR until the problem is fixed."
           )
           logger
         end
-
         Rails.logger.level = ActiveSupport::Logger.const_get(config.log_level.to_s.upcase)
+
+        unless config.consider_all_requests_local
+          Rails.error.logger = Rails.logger
+        end
       end
 
       # Initialize cache early in the stack so railties can make use of it.
@@ -64,9 +68,21 @@ module Rails
         end
       end
 
-      # Sets the dependency loading mechanism.
-      initializer :initialize_dependency_mechanism, group: :all do
-        ActiveSupport::Dependencies.mechanism = config.cache_classes ? :require : :load
+      # We setup the once autoloader this early so that engines and applications
+      # are able to autoload from these paths during initialization.
+      initializer :setup_once_autoloader, after: :set_eager_load_paths, before: :bootstrap_hook do
+        autoloader = Rails.autoloaders.once
+
+        ActiveSupport::Dependencies.autoload_once_paths.freeze
+        ActiveSupport::Dependencies.autoload_once_paths.uniq.each do |path|
+          # Zeitwerk only accepts existing directories in `push_dir`.
+          next unless File.directory?(path)
+
+          autoloader.push_dir(path)
+          autoloader.do_not_eager_load(path) unless ActiveSupport::Dependencies.eager_load?(path)
+        end
+
+        autoloader.setup
       end
 
       initializer :bootstrap_hook, group: :all do |app|

data/lib/rails/application/configuration.rb

@@ -2,7 +2,6 @@
 
 require "ipaddr"
 require "active_support/core_ext/kernel/reporting"
-require "active_support/core_ext/symbol/starts_ends_with"
 require "active_support/file_update_checker"
 require "active_support/configuration_file"
 require "rails/engine/configuration"
@@ -22,9 +21,9 @@ module Rails
                     :read_encrypted_secrets, :log_level, :content_security_policy_report_only,
                     :content_security_policy_nonce_generator, :content_security_policy_nonce_directives,
                     :require_master_key, :credentials, :disable_sandbox, :add_autoload_paths_to_load_path,
-                    :rake_eager_load
+                    :rake_eager_load, :server_timing
 
-      attr_reader :encoding, :api_only, :loaded_config_version, :autoloader
+      attr_reader :encoding, :api_only, :loaded_config_version
 
       def initialize(*)
         super
@@ -34,7 +33,12 @@ module Rails
         @filter_parameters                       = []
         @filter_redirect                         = []
         @helpers_paths                           = []
-        @hosts                                   = Array(([".localhost", IPAddr.new("0.0.0.0/0"), IPAddr.new("::/0")] if Rails.env.development?))
+        if Rails.env.development?
+          @hosts = ActionDispatch::HostAuthorization::ALLOWED_HOSTS_IN_DEVELOPMENT +
+            ENV["RAILS_DEVELOPMENT_HOSTS"].to_s.split(",").map(&:strip)
+        else
+          @hosts = []
+        end
         @host_authorization                      = {}
         @public_file_server                      = ActiveSupport::OrderedOptions.new
         @public_file_server.enabled              = true
@@ -70,11 +74,11 @@ module Rails
         @credentials                             = ActiveSupport::OrderedOptions.new
         @credentials.content_path                = default_credentials_content_path
         @credentials.key_path                    = default_credentials_key_path
-        @autoloader                              = :classic
         @disable_sandbox                         = false
         @add_autoload_paths_to_load_path         = true
         @permissions_policy                      = nil
         @rake_eager_load                         = false
+        @server_timing                           = false
       end
 
       # Loads default configurations. See {the result of the method for each version}[https://guides.rubyonrails.org/configuring.html#results-of-config-load-defaults].
@@ -84,6 +88,7 @@ module Rails
           if respond_to?(:action_controller)
             action_controller.per_form_csrf_tokens = true
             action_controller.forgery_protection_origin_check = true
+            action_controller.urlsafe_csrf_tokens = false
           end
 
           ActiveSupport.to_time_preserves_timezone = true
@@ -116,7 +121,7 @@ module Rails
 
           if respond_to?(:active_support)
             active_support.use_authenticated_message_encryption = true
-            active_support.hash_digest_class = ::Digest::SHA1
+            active_support.hash_digest_class = OpenSSL::Digest::SHA1
           end
 
           if respond_to?(:action_controller)
@@ -129,8 +134,6 @@ module Rails
         when "6.0"
           load_defaults "5.2"
 
-          self.autoloader = :zeitwerk if RUBY_ENGINE == "ruby"
-
           if respond_to?(:action_view)
             action_view.default_enforce_utf8 = false
           end
@@ -156,20 +159,13 @@ module Rails
         when "6.1"
           load_defaults "6.0"
 
-          self.autoloader = :zeitwerk if %w[ruby truffleruby].include?(RUBY_ENGINE)
-
           if respond_to?(:active_record)
             active_record.has_many_inversing = true
             active_record.legacy_connection_handling = false
           end
 
-          if respond_to?(:active_storage)
-            active_storage.track_variants = true
-          end
-
           if respond_to?(:active_job)
             active_job.retry_jitter = 0.15
-            active_job.skip_after_callbacks_if_terminated = true
           end
 
           if respond_to?(:action_dispatch)
@@ -178,14 +174,17 @@ module Rails
           end
 
           if respond_to?(:action_controller)
-            action_controller.urlsafe_csrf_tokens = true
+            action_controller.delete(:urlsafe_csrf_tokens)
           end
 
           if respond_to?(:action_view)
             action_view.form_with_generates_remote_forms = false
+            action_view.preload_links_header = true
           end
 
           if respond_to?(:active_storage)
+            active_storage.track_variants = true
+
             active_storage.queues.analysis = nil
             active_storage.queues.purge = nil
           end
@@ -200,6 +199,62 @@ module Rails
           end
 
           ActiveSupport.utc_to_local_returns_utc_offset_times = true
+        when "7.0"
+          load_defaults "6.1"
+
+          if respond_to?(:action_dispatch)
+            action_dispatch.default_headers = {
+              "X-Frame-Options" => "SAMEORIGIN",
+              "X-XSS-Protection" => "0",
+              "X-Content-Type-Options" => "nosniff",
+              "X-Download-Options" => "noopen",
+              "X-Permitted-Cross-Domain-Policies" => "none",
+              "Referrer-Policy" => "strict-origin-when-cross-origin"
+            }
+            action_dispatch.return_only_request_media_type_on_content_type = false
+            action_dispatch.cookies_serializer = :json
+          end
+
+          if respond_to?(:action_view)
+            action_view.button_to_generates_button_tag = true
+            action_view.apply_stylesheet_media_default = false
+          end
+
+          if respond_to?(:active_support)
+            active_support.hash_digest_class = OpenSSL::Digest::SHA256
+            active_support.key_generator_hash_digest_class = OpenSSL::Digest::SHA256
+            active_support.remove_deprecated_time_with_zone_name = true
+            active_support.cache_format_version = 7.0
+            active_support.use_rfc4122_namespaced_uuids = true
+            active_support.executor_around_test_case = true
+            active_support.isolation_level = :thread
+            active_support.disable_to_s_conversion = true
+          end
+
+          if respond_to?(:action_mailer)
+            action_mailer.smtp_timeout = 5
+          end
+
+          if respond_to?(:active_storage)
+            active_storage.video_preview_arguments =
+              "-vf 'select=eq(n\\,0)+eq(key\\,1)+gt(scene\\,0.015),loop=loop=-1:size=2,trim=start_frame=1'" \
+              " -frames:v 1 -f image2"
+
+            active_storage.variant_processor = :vips
+            active_storage.multiple_file_field_include_hidden = true
+          end
+
+          if respond_to?(:active_record)
+            active_record.verify_foreign_keys_for_fixtures = true
+            active_record.partial_inserts = false
+            active_record.automatic_scope_inversing = true
+          end
+
+          if respond_to?(:action_controller)
+            action_controller.raise_on_open_redirects = true
+
+            action_controller.wrap_parameters_by_default = true
+          end
         else
           raise "Unknown version #{target_version.to_s.inspect}"
         end
@@ -255,10 +310,13 @@ module Rails
         if path = paths["config/database"].existent.first
           require "rails/application/dummy_erb_compiler"
 
-          yaml = Pathname.new(path)
-          erb = DummyERB.new(yaml.read)
+          yaml = DummyERB.new(Pathname.new(path).read).result
 
-          YAML.load(erb.result) || {}
+          if YAML.respond_to?(:unsafe_load)
+            YAML.unsafe_load(yaml) || {}
+          else
+            YAML.load(yaml) || {}
+          end
         else
           {}
         end
@@ -327,7 +385,7 @@ module Rails
         end
       end
 
-      def session_store? #:nodoc:
+      def session_store? # :nodoc:
         @session_store
       end
 
@@ -351,18 +409,6 @@ module Rails
         end
       end
 
-      def autoloader=(autoloader)
-        case autoloader
-        when :classic
-          @autoloader = autoloader
-        when :zeitwerk
-          require "zeitwerk"
-          @autoloader = autoloader
-        else
-          raise ArgumentError, "config.autoloader may be :classic or :zeitwerk, got #{autoloader.inspect} instead"
-        end
-      end
-
       def default_log_file
         path = paths["log"].first
         unless File.exist? File.dirname path
@@ -375,7 +421,7 @@ module Rails
         f
       end
 
-      class Custom #:nodoc:
+      class Custom # :nodoc:
         def initialize
           @configurations = Hash.new
         end

data/lib/rails/application/default_middleware_stack.rb

@@ -13,7 +13,7 @@ module Rails
 
       def build_stack
         ActionDispatch::MiddlewareStack.new do |middleware|
-          middleware.use ::ActionDispatch::HostAuthorization, config.hosts, config.action_dispatch.hosts_response_app, **config.host_authorization
+          middleware.use ::ActionDispatch::HostAuthorization, config.hosts, **config.host_authorization
 
           if config.force_ssl
             middleware.use ::ActionDispatch::SSL, **config.ssl_options,
@@ -42,6 +42,7 @@ module Rails
 
           middleware.use ::ActionDispatch::Executor, app.executor
 
+          middleware.use ::ActionDispatch::ServerTiming if config.server_timing
           middleware.use ::Rack::Runtime
           middleware.use ::Rack::MethodOverride unless config.api_only
           middleware.use ::ActionDispatch::RequestId, header: config.action_dispatch.request_id_header
@@ -50,7 +51,10 @@ module Rails
           middleware.use ::Rails::Rack::Logger, config.log_tags
           middleware.use ::ActionDispatch::ShowExceptions, show_exceptions_app
           middleware.use ::ActionDispatch::DebugExceptions, app, config.debug_exception_response_format
-          middleware.use ::ActionDispatch::ActionableExceptions
+
+          if config.consider_all_requests_local
+            middleware.use ::ActionDispatch::ActionableExceptions
+          end
 
           unless config.cache_classes
             middleware.use ::ActionDispatch::Reloader, app.reloader
@@ -64,10 +68,10 @@ module Rails
               config.session_options[:secure] = true
             end
             middleware.use config.session_store, config.session_options
-            middleware.use ::ActionDispatch::Flash
           end
 
           unless config.api_only
+            middleware.use ::ActionDispatch::Flash
             middleware.use ::ActionDispatch::ContentSecurityPolicy::Middleware
             middleware.use ::ActionDispatch::PermissionsPolicy::Middleware
           end

data/lib/rails/application/finisher.rb

@@ -1,7 +1,10 @@
 # frozen_string_literal: true
 
+require "zeitwerk"
 require "active_support/core_ext/string/inflections"
 require "active_support/core_ext/array/conversions"
+require "active_support/descendants_tracker"
+require "active_support/dependencies"
 
 module Rails
   class Application
@@ -12,88 +15,34 @@ module Rails
         config.generators.templates.unshift(*paths["lib/templates"].existent)
       end
 
-      initializer :ensure_autoload_once_paths_as_subset do
-        extra = ActiveSupport::Dependencies.autoload_once_paths -
-                ActiveSupport::Dependencies.autoload_paths
+      initializer :setup_main_autoloader do
+        autoloader = Rails.autoloaders.main
 
-        unless extra.empty?
-          abort <<-end_error
-            autoload_once_paths must be a subset of the autoload_paths.
-            Extra items in autoload_once_paths: #{extra * ','}
-          end_error
-        end
-      end
+        ActiveSupport::Dependencies.autoload_paths.freeze
+        ActiveSupport::Dependencies.autoload_paths.uniq.each do |path|
+          # Zeitwerk only accepts existing directories in `push_dir`.
+          next unless File.directory?(path)
 
-      # This will become an error if/when we remove classic mode. The plan is
-      # autoloaders won't be configured up to this point in the finisher, so
-      # constants just won't be found, raising regular NameError exceptions.
-      initializer :warn_if_autoloaded, before: :let_zeitwerk_take_over do
-        next if config.cache_classes
-        next if ActiveSupport::Dependencies.autoloaded_constants.empty?
-
-        autoloaded    = ActiveSupport::Dependencies.autoloaded_constants
-        constants     = "constant".pluralize(autoloaded.size)
-        enum          = autoloaded.to_sentence
-        have          = autoloaded.size == 1 ? "has" : "have"
-        these         = autoloaded.size == 1 ? "This" : "These"
-        example       = autoloaded.first
-        example_klass = example.constantize.class
-
-        if config.autoloader == :zeitwerk
-          ActiveSupport::DescendantsTracker.clear
-          ActiveSupport::Dependencies.clear
-
-          unload_message = "#{these} autoloaded #{constants} #{have} been unloaded."
-        else
-          unload_message = "`config.autoloader` is set to `#{config.autoloader}`. #{these} autoloaded #{constants} would have been unloaded if `config.autoloader` had been set to `:zeitwerk`."
+          autoloader.push_dir(path)
+          autoloader.do_not_eager_load(path) unless ActiveSupport::Dependencies.eager_load?(path)
         end
 
-        ActiveSupport::Deprecation.warn(<<~WARNING)
-          Initialization autoloaded the #{constants} #{enum}.
-
-          Being able to do this is deprecated. Autoloading during initialization is going
-          to be an error condition in future versions of Rails.
-
-          Reloading does not reboot the application, and therefore code executed during
-          initialization does not run again. So, if you reload #{example}, for example,
-          the expected changes won't be reflected in that stale #{example_klass} object.
-
-          #{unload_message}
-
-          In order to autoload safely at boot time, please wrap your code in a reloader
-          callback this way:
+        unless config.cache_classes
+          autoloader.enable_reloading
+          ActiveSupport::Dependencies.autoloader = autoloader
 
-              Rails.application.reloader.to_prepare do
-                # Autoload classes and modules needed at boot time here.
-              end
-
-          That block runs when the application boots, and every time there is a reload.
-          For historical reasons, it may run twice, so it has to be idempotent.
-
-          Check the "Autoloading and Reloading Constants" guide to learn more about how
-          Rails autoloads and reloads.
-        WARNING
-      end
-
-      initializer :let_zeitwerk_take_over do
-        if config.autoloader == :zeitwerk
-          require "active_support/dependencies/zeitwerk_integration"
-          ActiveSupport::Dependencies::ZeitwerkIntegration.take_over(enable_reloading: !config.cache_classes)
-        end
-      end
-
-      initializer :add_builtin_route do |app|
-        if Rails.env.development?
-          app.routes.prepend do
-            get "/rails/info/properties" => "rails/info#properties", internal: true
-            get "/rails/info/routes"     => "rails/info#routes", internal: true
-            get "/rails/info"            => "rails/info#index", internal: true
+          autoloader.on_load do |_cpath, value, _abspath|
+            if value.is_a?(Class) && value.singleton_class < ActiveSupport::DescendantsTracker
+              ActiveSupport::Dependencies._autoloaded_tracked_classes << value
+            end
           end
 
-          app.routes.append do
-            get "/"                      => "rails/welcome#index", internal: true
+          autoloader.on_unload do |_cpath, value, _abspath|
+            value.before_remove_const if value.respond_to?(:before_remove_const)
           end
         end
+
+        autoloader.setup
       end
 
       # Setup default session store if not already set in config/application.rb
@@ -127,10 +76,7 @@ module Rails
       initializer :eager_load! do
         if config.eager_load
           ActiveSupport.run_load_hooks(:before_eager_load, self)
-          # Checks defined?(Zeitwerk) instead of zeitwerk_enabled? because we
-          # want to eager load any dependency managed by Zeitwerk regardless of
-          # the autoloading mode of the application.
-          Zeitwerk::Loader.eager_load_all if defined?(Zeitwerk)
+          Zeitwerk::Loader.eager_load_all
           config.eager_load_namespaces.each(&:eager_load!)
         end
       end
@@ -187,6 +133,22 @@ module Rails
         end
       end
 
+      initializer :add_internal_routes do |app|
+        if Rails.env.development?
+          app.routes.prepend do
+            get "/rails/info/properties" => "rails/info#properties", internal: true
+            get "/rails/info/routes"     => "rails/info#routes",     internal: true
+            get "/rails/info"            => "rails/info#index",      internal: true
+          end
+
+          routes_reloader.run_after_load_paths = -> do
+            app.routes.append do
+              get "/" => "rails/welcome#index", internal: true
+            end
+          end
+        end
+      end
+
       # Set routes reload after the finisher hook to ensure routes added in
       # the hook are taken into account.
       initializer :set_routes_reloader_hook do |app|
@@ -213,7 +175,8 @@ module Rails
       # added in the hook are taken into account.
       initializer :set_clear_dependencies_hook, group: :all do |app|
         callback = lambda do
-          ActiveSupport::DescendantsTracker.clear
+          # Order matters.
+          ActiveSupport::DescendantsTracker.clear(ActiveSupport::Dependencies._autoloaded_tracked_classes)
           ActiveSupport::Dependencies.clear
         end
 
@@ -229,6 +192,7 @@ module Rails
 
         if config.cache_classes
           # No reloader
+          ActiveSupport::DescendantsTracker.disable_clear!
         elsif config.reload_classes_only_on_change
           reloader = config.file_watcher.new(*watchable_args, &callback)
           reloaders << reloader
@@ -251,13 +215,6 @@ module Rails
           end
         end
       end
-
-      # Disable dependency loading during request cycle
-      initializer :disable_dependency_loading do
-        if config.eager_load && config.cache_classes && !config.enable_dependency_loading
-          ActiveSupport::Dependencies.unhook!
-        end
-      end
     end
   end
 end

data/lib/rails/application/routes_reloader.rb

@@ -5,8 +5,11 @@ require "active_support/core_ext/module/delegation"
 module Rails
   class Application
     class RoutesReloader
+      include ActiveSupport::Callbacks
+
       attr_reader :route_sets, :paths, :external_routes
       attr_accessor :eager_load
+      attr_writer :run_after_load_paths # :nodoc:
       delegate :execute_if_updated, :execute, :updated?, to: :updater
 
       def initialize
@@ -45,6 +48,11 @@ module Rails
 
       def load_paths
         paths.each { |path| load(path) }
+        run_after_load_paths.call
+      end
+
+      def run_after_load_paths
+        @run_after_load_paths ||= -> { }
       end
 
       def finalize!