railties 6.1.7.2 → 7.0.6

data/RDOC_MAIN.rdoc

@@ -15,21 +15,21 @@ application into three layers: Model, View, and Controller, each with a specific
 The <em><b>Model layer</b></em> represents the domain model (such as Account, Product,
 Person, Post, etc.) and encapsulates the business logic specific to
 your application. In \Rails, database-backed model classes are derived from
-<tt>ActiveRecord::Base</tt>. {Active Record}[link:files/activerecord/README_rdoc.html] allows you to present the data from
+<tt>ActiveRecord::Base</tt>. {Active Record}[link:/files/activerecord/README_rdoc.html] allows you to present the data from
 database rows as objects and embellish these data objects with business logic
 methods. Although most \Rails models are backed by a database, models can also be ordinary
 Ruby classes, or Ruby classes that implement a set of interfaces as provided by
-the {Active Model}[link:files/activemodel/README_rdoc.html] module.
+the {Active Model}[link:/files/activemodel/README_rdoc.html] module.
 
 == Controller layer
 
 The <em><b>Controller layer</b></em> is responsible for handling incoming HTTP requests and
-providing a suitable response. Usually this means returning \HTML, but \Rails controllers
+providing a suitable response. Usually, this means returning \HTML, but \Rails controllers
 can also generate XML, JSON, PDFs, mobile-specific views, and more. Controllers load and
-manipulate models, and render view templates in order to generate the appropriate HTTP response.
+manipulate models and render view templates in order to generate the appropriate HTTP response.
 In \Rails, incoming requests are routed by Action Dispatch to an appropriate controller, and
 controller classes are derived from <tt>ActionController::Base</tt>. Action Dispatch and Action Controller
-are bundled together in {Action Pack}[link:files/actionpack/README_rdoc.html].
+are bundled together in {Action Pack}[link:/files/actionpack/README_rdoc.html].
 
 == View layer
 
@@ -37,19 +37,19 @@ The <em><b>View layer</b></em> is composed of "templates" that are responsible f
 appropriate representations of your application's resources. Templates can
 come in a variety of formats, but most view templates are \HTML with embedded
 Ruby code (ERB files). Views are typically rendered to generate a controller response,
-or to generate the body of an email. In \Rails, View generation is handled by {Action View}[link:files/actionview/README_rdoc.html].
+or to generate the body of an email. In \Rails, View generation is handled by {Action View}[link:/files/actionview/README_rdoc.html].
 
 == Frameworks and libraries
 
-{Active Record}[link:files/activerecord/README_rdoc.html], {Active Model}[link:files/activemodel/README_rdoc.html],
-{Action Pack}[link:files/actionpack/README_rdoc.html], and {Action View}[link:files/actionview/README_rdoc.html] can each be used independently outside \Rails.
-In addition to that, \Rails also comes with {Action Mailer}[link:files/actionmailer/README_rdoc.html], a library
-to generate and send emails; {Action Mailbox}[link:files/actionmailbox/README_md.html], a library to receive emails within a Rails application;
-{Active Job}[link:files/activejob/README_md.html], a framework for declaring jobs and making them run on a variety of queueing
-backends; {Action Cable}[link:files/actioncable/README_md.html], a framework to
-integrate WebSockets with a \Rails application; {Active Storage}[link:files/activestorage/README_md.html],
-a library to attach cloud and local files to \Rails applications; {Action Text}[link:files/actiontext/README_md.html], a library to handle rich text content;
-and {Active Support}[link:files/activesupport/README_rdoc.html], a collection
+{Active Record}[link:/files/activerecord/README_rdoc.html], {Active Model}[link:/files/activemodel/README_rdoc.html],
+{Action Pack}[link:/files/actionpack/README_rdoc.html], and {Action View}[link:/files/actionview/README_rdoc.html] can each be used independently outside \Rails.
+In addition to that, \Rails also comes with {Action Mailer}[link:/files/actionmailer/README_rdoc.html], a library
+to generate and send emails; {Action Mailbox}[link:/files/actionmailbox/README_md.html], a library to receive emails within a Rails application;
+{Active Job}[link:/files/activejob/README_md.html], a framework for declaring jobs and making them run on a variety of queueing
+backends; {Action Cable}[link:/files/actioncable/README_md.html], a framework to
+integrate WebSockets with a \Rails application; {Active Storage}[link:/files/activestorage/README_md.html],
+a library to attach cloud and local files to \Rails applications; {Action Text}[link:/files/actiontext/README_md.html], a library to handle rich text content;
+and {Active Support}[link:/files/activesupport/README_rdoc.html], a collection
 of utility classes and standard library extensions that are useful for \Rails,
 and may also be used independently outside \Rails.
 
@@ -72,7 +72,7 @@ and may also be used independently outside \Rails.
 
    Run with <tt>--help</tt> or <tt>-h</tt> for options.
 
-4. Go to <tt>http://localhost:3000</tt> and you'll see: "Yay! You’re on \Rails!"
+4. Go to <tt>http://localhost:3000</tt>, and you'll see: "Yay! You’re on \Rails!"
 
 5. Follow the guidelines to start developing your application. You may find the following resources handy:
 

data/README.rdoc

@@ -8,14 +8,13 @@ Railties is responsible for gluing all frameworks together. Overall, it:
 
 * and provides the Rails generators core.
 
-
 == Download
 
 The latest version of Railties can be installed with RubyGems:
 
 * gem install railties
 
-Source code can be downloaded as part of the Rails project on GitHub
+Source code can be downloaded as part of the \Rails project on GitHub
 
 * https://github.com/rails/rails/tree/main/railties
 

data/lib/minitest/rails_plugin.rb

@@ -49,7 +49,7 @@ module Minitest
   end
 
   # Owes great inspiration to test runner trailblazers like RSpec,
-  # minitest-reporters, maxitest and others.
+  # minitest-reporters, maxitest, and others.
   def self.plugin_rails_init(options)
     unless options[:full_backtrace] || ENV["BACKTRACE"]
       # Plugin can run without Rails loaded, check before filtering.

data/lib/rails/all.rb

@@ -15,7 +15,6 @@ require "rails"
   action_mailbox/engine
   action_text/engine
   rails/test_unit/railtie
-  sprockets/railtie
 ).each do |railtie|
   begin
     require railtie

data/lib/rails/app_updater.rb

@@ -13,7 +13,7 @@ module Rails
       def app_generator
         @app_generator ||= begin
           gen = Rails::Generators::AppGenerator.new ["rails"], generator_options, destination_root: Rails.root
-          File.exist?(Rails.root.join("config", "application.rb")) ? gen.send(:app_const) : gen.send(:valid_const?)
+          gen.send(:valid_const?) unless File.exist?(Rails.root.join("config", "application.rb"))
           gen
         end
       end
@@ -21,15 +21,18 @@ module Rails
       private
         def generator_options
           options = { api: !!Rails.application.config.api_only, update: true }
-          options[:skip_javascript] = !File.exist?(Rails.root.join("bin", "yarn"))
+          options[:skip_active_job]     = !defined?(ActiveJob::Railtie)
           options[:skip_active_record]  = !defined?(ActiveRecord::Railtie)
-          options[:skip_active_storage] = !defined?(ActiveStorage::Engine) || !defined?(ActiveRecord::Railtie)
+          options[:skip_active_storage] = !defined?(ActiveStorage::Engine)
           options[:skip_action_mailer]  = !defined?(ActionMailer::Railtie)
+          options[:skip_action_mailbox] = !defined?(ActionMailbox::Engine)
+          options[:skip_action_text]    = !defined?(ActionText::Engine)
           options[:skip_action_cable]   = !defined?(ActionCable::Engine)
-          options[:skip_sprockets]      = !defined?(Sprockets::Railtie)
-          options[:skip_puma]           = !defined?(Puma)
+          options[:skip_test]           = !defined?(Rails::TestUnitRailtie)
+          options[:skip_system_test]    = Rails.application.config.generators.system_tests.nil?
+          options[:skip_asset_pipeline] = !defined?(Sprockets::Railtie) && !defined?(Propshaft::Railtie)
           options[:skip_bootsnap]       = !defined?(Bootsnap)
-          options[:skip_spring]         = !defined?(Spring)
+          options[:updating]            = true
           options
         end
     end

data/lib/rails/application/bootstrap.rb

@@ -14,6 +14,7 @@ module Rails
       initializer :load_environment_hook, group: :all do end
 
       initializer :load_active_support, group: :all do
+        ENV["RAILS_DISABLE_DEPRECATED_TO_S_CONVERSION"] = "true" if config.active_support.disable_to_s_conversion
         require "active_support/all" unless config.active_support.bare
       end
 
@@ -44,17 +45,23 @@ module Rails
           logger.level = ActiveSupport::Logger::WARN
           logger.warn(
             "Rails Error: Unable to access log file. Please ensure that #{path} exists and is writable " \
-            "(ie, make it writable for user and group: chmod 0664 #{path}). " \
+            "(i.e. make it writable for user and group: chmod 0664 #{path}). " \
             "The log level has been raised to WARN and the output directed to STDERR until the problem is fixed."
           )
           logger
         end
-
         Rails.logger.level = ActiveSupport::Logger.const_get(config.log_level.to_s.upcase)
+
+        unless config.consider_all_requests_local
+          Rails.error.logger = Rails.logger
+        end
       end
 
       # Initialize cache early in the stack so railties can make use of it.
       initializer :initialize_cache, group: :all do
+        cache_format_version = config.active_support.delete(:cache_format_version)
+        ActiveSupport.cache_format_version = cache_format_version if cache_format_version
+
         unless Rails.cache
           Rails.cache = ActiveSupport::Cache.lookup_store(*config.cache_store)
 
@@ -64,9 +71,21 @@ module Rails
         end
       end
 
-      # Sets the dependency loading mechanism.
-      initializer :initialize_dependency_mechanism, group: :all do
-        ActiveSupport::Dependencies.mechanism = config.cache_classes ? :require : :load
+      # We setup the once autoloader this early so that engines and applications
+      # are able to autoload from these paths during initialization.
+      initializer :setup_once_autoloader, after: :set_eager_load_paths, before: :bootstrap_hook do
+        autoloader = Rails.autoloaders.once
+
+        ActiveSupport::Dependencies.autoload_once_paths.freeze
+        ActiveSupport::Dependencies.autoload_once_paths.uniq.each do |path|
+          # Zeitwerk only accepts existing directories in `push_dir`.
+          next unless File.directory?(path)
+
+          autoloader.push_dir(path)
+          autoloader.do_not_eager_load(path) unless ActiveSupport::Dependencies.eager_load?(path)
+        end
+
+        autoloader.setup
       end
 
       initializer :bootstrap_hook, group: :all do |app|

data/lib/rails/application/configuration.rb

@@ -2,7 +2,6 @@
 
 require "ipaddr"
 require "active_support/core_ext/kernel/reporting"
-require "active_support/core_ext/symbol/starts_ends_with"
 require "active_support/file_update_checker"
 require "active_support/configuration_file"
 require "rails/engine/configuration"
@@ -22,9 +21,9 @@ module Rails
                     :read_encrypted_secrets, :log_level, :content_security_policy_report_only,
                     :content_security_policy_nonce_generator, :content_security_policy_nonce_directives,
                     :require_master_key, :credentials, :disable_sandbox, :add_autoload_paths_to_load_path,
-                    :rake_eager_load
+                    :rake_eager_load, :server_timing
 
-      attr_reader :encoding, :api_only, :loaded_config_version, :autoloader
+      attr_reader :encoding, :api_only, :loaded_config_version
 
       def initialize(*)
         super
@@ -35,7 +34,8 @@ module Rails
         @filter_redirect                         = []
         @helpers_paths                           = []
         if Rails.env.development?
-          @hosts = ActionDispatch::HostAuthorization::ALLOWED_HOSTS_IN_DEVELOPMENT.dup
+          @hosts = ActionDispatch::HostAuthorization::ALLOWED_HOSTS_IN_DEVELOPMENT +
+            ENV["RAILS_DEVELOPMENT_HOSTS"].to_s.split(",").map(&:strip)
         else
           @hosts = []
         end
@@ -74,20 +74,24 @@ module Rails
         @credentials                             = ActiveSupport::OrderedOptions.new
         @credentials.content_path                = default_credentials_content_path
         @credentials.key_path                    = default_credentials_key_path
-        @autoloader                              = :classic
         @disable_sandbox                         = false
         @add_autoload_paths_to_load_path         = true
         @permissions_policy                      = nil
         @rake_eager_load                         = false
+        @server_timing                           = false
       end
 
-      # Loads default configurations. See {the result of the method for each version}[https://guides.rubyonrails.org/configuring.html#results-of-config-load-defaults].
+      # Loads default configuration values for a target version. This includes
+      # defaults for versions prior to the target version. See the
+      # {configuration guide}[https://guides.rubyonrails.org/configuring.html]
+      # for the default values associated with a particular version.
       def load_defaults(target_version)
         case target_version.to_s
         when "5.0"
           if respond_to?(:action_controller)
             action_controller.per_form_csrf_tokens = true
             action_controller.forgery_protection_origin_check = true
+            action_controller.urlsafe_csrf_tokens = false
           end
 
           ActiveSupport.to_time_preserves_timezone = true
@@ -120,7 +124,7 @@ module Rails
 
           if respond_to?(:active_support)
             active_support.use_authenticated_message_encryption = true
-            active_support.hash_digest_class = ::Digest::SHA1
+            active_support.hash_digest_class = OpenSSL::Digest::SHA1
           end
 
           if respond_to?(:action_controller)
@@ -133,8 +137,6 @@ module Rails
         when "6.0"
           load_defaults "5.2"
 
-          self.autoloader = :zeitwerk if RUBY_ENGINE == "ruby"
-
           if respond_to?(:action_view)
             action_view.default_enforce_utf8 = false
           end
@@ -160,20 +162,13 @@ module Rails
         when "6.1"
           load_defaults "6.0"
 
-          self.autoloader = :zeitwerk if %w[ruby truffleruby].include?(RUBY_ENGINE)
-
           if respond_to?(:active_record)
             active_record.has_many_inversing = true
             active_record.legacy_connection_handling = false
           end
 
-          if respond_to?(:active_storage)
-            active_storage.track_variants = true
-          end
-
           if respond_to?(:active_job)
             active_job.retry_jitter = 0.15
-            active_job.skip_after_callbacks_if_terminated = true
           end
 
           if respond_to?(:action_dispatch)
@@ -182,7 +177,7 @@ module Rails
           end
 
           if respond_to?(:action_controller)
-            action_controller.urlsafe_csrf_tokens = true
+            action_controller.delete(:urlsafe_csrf_tokens)
           end
 
           if respond_to?(:action_view)
@@ -191,6 +186,8 @@ module Rails
           end
 
           if respond_to?(:active_storage)
+            active_storage.track_variants = true
+
             active_storage.queues.analysis = nil
             active_storage.queues.purge = nil
           end
@@ -205,6 +202,62 @@ module Rails
           end
 
           ActiveSupport.utc_to_local_returns_utc_offset_times = true
+        when "7.0"
+          load_defaults "6.1"
+
+          if respond_to?(:action_dispatch)
+            action_dispatch.default_headers = {
+              "X-Frame-Options" => "SAMEORIGIN",
+              "X-XSS-Protection" => "0",
+              "X-Content-Type-Options" => "nosniff",
+              "X-Download-Options" => "noopen",
+              "X-Permitted-Cross-Domain-Policies" => "none",
+              "Referrer-Policy" => "strict-origin-when-cross-origin"
+            }
+            action_dispatch.return_only_request_media_type_on_content_type = false
+            action_dispatch.cookies_serializer = :json
+          end
+
+          if respond_to?(:action_view)
+            action_view.button_to_generates_button_tag = true
+            action_view.apply_stylesheet_media_default = false
+          end
+
+          if respond_to?(:active_support)
+            active_support.hash_digest_class = OpenSSL::Digest::SHA256
+            active_support.key_generator_hash_digest_class = OpenSSL::Digest::SHA256
+            active_support.remove_deprecated_time_with_zone_name = true
+            active_support.cache_format_version = 7.0
+            active_support.use_rfc4122_namespaced_uuids = true
+            active_support.executor_around_test_case = true
+            active_support.isolation_level = :thread
+            active_support.disable_to_s_conversion = true
+          end
+
+          if respond_to?(:action_mailer)
+            action_mailer.smtp_timeout = 5
+          end
+
+          if respond_to?(:active_storage)
+            active_storage.video_preview_arguments =
+              "-vf 'select=eq(n\\,0)+eq(key\\,1)+gt(scene\\,0.015),loop=loop=-1:size=2,trim=start_frame=1'" \
+              " -frames:v 1 -f image2"
+
+            active_storage.variant_processor = :vips
+            active_storage.multiple_file_field_include_hidden = true
+          end
+
+          if respond_to?(:active_record)
+            active_record.verify_foreign_keys_for_fixtures = true
+            active_record.partial_inserts = false
+            active_record.automatic_scope_inversing = true
+          end
+
+          if respond_to?(:action_controller)
+            action_controller.raise_on_open_redirects = true
+
+            action_controller.wrap_parameters_by_default = true
+          end
         else
           raise "Unknown version #{target_version.to_s.inspect}"
         end
@@ -281,8 +334,14 @@ module Rails
         config = if yaml&.exist?
           loaded_yaml = ActiveSupport::ConfigurationFile.parse(yaml)
           if (shared = loaded_yaml.delete("shared"))
-            loaded_yaml.each do |_k, values|
-              values.reverse_merge!(shared)
+            loaded_yaml.each do |env, config|
+              if config.is_a?(Hash) && config.values.all?(Hash)
+                config.map do |name, sub_config|
+                  sub_config.reverse_merge!(shared)
+                end
+              else
+                config.reverse_merge!(shared)
+              end
             end
           end
           Hash.new(shared).merge(loaded_yaml)
@@ -308,6 +367,20 @@ module Rails
         generators.colorize_logging = val
       end
 
+      # Specifies what class to use to store the session. Possible values
+      # are +:cookie_store+, +:mem_cache_store+, a custom store, or
+      # +:disabled+. +:disabled+ tells Rails not to deal with sessions.
+      #
+      # Additional options will be set as +session_options+:
+      #
+      #   config.session_store :cookie_store, key: "_your_app_session"
+      #   config.session_options # => {key: "_your_app_session"}
+      #
+      # If a custom store is specified as a symbol, it will be resolved to
+      # the +ActionDispatch::Session+ namespace:
+      #
+      #   # use ActionDispatch::Session::MyCustomStore as the session store
+      #   config.session_store :my_custom_store
       def session_store(new_session_store = nil, **options)
         if new_session_store
           if new_session_store == :active_record_store
@@ -335,7 +408,7 @@ module Rails
         end
       end
 
-      def session_store? #:nodoc:
+      def session_store? # :nodoc:
         @session_store
       end
 
@@ -343,6 +416,7 @@ module Rails
         Rails::SourceAnnotationExtractor::Annotation
       end
 
+      # Configures the ActionDispatch::ContentSecurityPolicy.
       def content_security_policy(&block)
         if block_given?
           @content_security_policy = ActionDispatch::ContentSecurityPolicy.new(&block)
@@ -351,6 +425,7 @@ module Rails
         end
       end
 
+      # Configures the ActionDispatch::PermissionsPolicy.
       def permissions_policy(&block)
         if block_given?
           @permissions_policy = ActionDispatch::PermissionsPolicy.new(&block)
@@ -359,18 +434,6 @@ module Rails
         end
       end
 
-      def autoloader=(autoloader)
-        case autoloader
-        when :classic
-          @autoloader = autoloader
-        when :zeitwerk
-          require "zeitwerk"
-          @autoloader = autoloader
-        else
-          raise ArgumentError, "config.autoloader may be :classic or :zeitwerk, got #{autoloader.inspect} instead"
-        end
-      end
-
       def default_log_file
         path = paths["log"].first
         unless File.exist? File.dirname path
@@ -383,7 +446,7 @@ module Rails
         f
       end
 
-      class Custom #:nodoc:
+      class Custom # :nodoc:
         def initialize
           @configurations = Hash.new
         end

data/lib/rails/application/default_middleware_stack.rb

@@ -13,7 +13,7 @@ module Rails
 
       def build_stack
         ActionDispatch::MiddlewareStack.new do |middleware|
-          middleware.use ::ActionDispatch::HostAuthorization, config.hosts, config.action_dispatch.hosts_response_app, **config.host_authorization
+          middleware.use ::ActionDispatch::HostAuthorization, config.hosts, **config.host_authorization
 
           if config.force_ssl
             middleware.use ::ActionDispatch::SSL, **config.ssl_options,
@@ -42,6 +42,7 @@ module Rails
 
           middleware.use ::ActionDispatch::Executor, app.executor
 
+          middleware.use ::ActionDispatch::ServerTiming if config.server_timing
           middleware.use ::Rack::Runtime
           middleware.use ::Rack::MethodOverride unless config.api_only
           middleware.use ::ActionDispatch::RequestId, header: config.action_dispatch.request_id_header
@@ -50,7 +51,10 @@ module Rails
           middleware.use ::Rails::Rack::Logger, config.log_tags
           middleware.use ::ActionDispatch::ShowExceptions, show_exceptions_app
           middleware.use ::ActionDispatch::DebugExceptions, app, config.debug_exception_response_format
-          middleware.use ::ActionDispatch::ActionableExceptions
+
+          if config.consider_all_requests_local
+            middleware.use ::ActionDispatch::ActionableExceptions
+          end
 
           unless config.cache_classes
             middleware.use ::ActionDispatch::Reloader, app.reloader
@@ -64,10 +68,10 @@ module Rails
               config.session_options[:secure] = true
             end
             middleware.use config.session_store, config.session_options
-            middleware.use ::ActionDispatch::Flash
           end
 
           unless config.api_only
+            middleware.use ::ActionDispatch::Flash
             middleware.use ::ActionDispatch::ContentSecurityPolicy::Middleware
             middleware.use ::ActionDispatch::PermissionsPolicy::Middleware
           end
@@ -77,6 +81,21 @@ module Rails
           middleware.use ::Rack::ETag, "no-cache"
 
           middleware.use ::Rack::TempfileReaper unless config.api_only
+
+          if config.respond_to?(:active_record)
+            if selector_options = config.active_record.database_selector
+              resolver = config.active_record.database_resolver
+              context = config.active_record.database_resolver_context
+
+              middleware.use ::ActiveRecord::Middleware::DatabaseSelector, resolver, context, selector_options
+            end
+
+            if shard_resolver = config.active_record.shard_resolver
+              options = config.active_record.shard_selector || {}
+
+              middleware.use ::ActiveRecord::Middleware::ShardSelector, shard_resolver, options
+            end
+          end
         end
       end