railties 7.0.8.7 → 7.1.5.1

data/lib/rails/application.rb

@@ -4,7 +4,8 @@ require "yaml"
 require "active_support/core_ext/hash/keys"
 require "active_support/core_ext/object/blank"
 require "active_support/key_generator"
-require "active_support/message_verifier"
+require "active_support/message_verifiers"
+require "active_support/deprecation"
 require "active_support/encrypted_configuration"
 require "active_support/hash_with_indifferent_access"
 require "active_support/configuration_file"
@@ -26,7 +27,7 @@ module Rails
   #
   # Besides providing the same configuration as Rails::Engine and Rails::Railtie,
   # the application object has several specific configurations, for example
-  # +cache_classes+, +consider_all_requests_local+, +filter_parameters+,
+  # +enable_reloading+, +consider_all_requests_local+, +filter_parameters+,
   # +logger+, and so forth.
   #
   # Check Rails::Application::Configuration to see them all.
@@ -70,6 +71,8 @@ module Rails
       def inherited(base)
         super
         Rails.app_class = base
+        # lib has to be added to $LOAD_PATH unconditionally, even if it's in the
+        # autoload paths and config.add_autoload_paths_to_load_path is false.
         add_lib_to_load_path!(find_root(base.called_from))
         ActiveSupport.run_load_hooks(:before_configuration, base)
       end
@@ -111,7 +114,9 @@ module Rails
       @app_env_config    = nil
       @ordered_railties  = nil
       @railties          = nil
-      @message_verifiers = {}
+      @key_generators    = {}
+      @message_verifiers = nil
+      @deprecators       = nil
       @ran_load_hooks    = false
 
       @executor          = Class.new(ActiveSupport::Executor)
@@ -149,15 +154,53 @@ module Rails
       routes_reloader.reload!
     end
 
-    # Returns the application's KeyGenerator
-    def key_generator
+    # Returns a key generator (ActiveSupport::CachingKeyGenerator) for a
+    # specified +secret_key_base+. The return value is memoized, so additional
+    # calls with the same +secret_key_base+ will return the same key generator
+    # instance.
+    def key_generator(secret_key_base = self.secret_key_base)
       # number of iterations selected based on consultation with the google security
       # team. Details at https://github.com/rails/rails/pull/6952#issuecomment-7661220
-      @caching_key_generator ||= ActiveSupport::CachingKeyGenerator.new(
+      @key_generators[secret_key_base] ||= ActiveSupport::CachingKeyGenerator.new(
         ActiveSupport::KeyGenerator.new(secret_key_base, iterations: 1000)
       )
     end
 
+    # Returns a message verifier factory (ActiveSupport::MessageVerifiers). This
+    # factory can be used as a central point to configure and create message
+    # verifiers (ActiveSupport::MessageVerifier) for your application.
+    #
+    # By default, message verifiers created by this factory will generate
+    # messages using the default ActiveSupport::MessageVerifier options. You can
+    # override these options with a combination of
+    # ActiveSupport::MessageVerifiers#clear_rotations and
+    # ActiveSupport::MessageVerifiers#rotate. However, this must be done prior
+    # to building any message verifier instances. For example, in a
+    # +before_initialize+ block:
+    #
+    #   # Use `url_safe: true` when generating messages
+    #   config.before_initialize do |app|
+    #     app.message_verifiers.clear_rotations
+    #     app.message_verifiers.rotate(url_safe: true)
+    #   end
+    #
+    # Message verifiers created by this factory will always use a secret derived
+    # from #secret_key_base when generating messages. +clear_rotations+ will not
+    # affect this behavior. However, older +secret_key_base+ values can be
+    # rotated for verifying messages:
+    #
+    #   # Fall back to old `secret_key_base` when verifying messages
+    #   config.before_initialize do |app|
+    #     app.message_verifiers.rotate(secret_key_base: "old secret_key_base")
+    #   end
+    #
+    def message_verifiers
+      @message_verifiers ||=
+        ActiveSupport::MessageVerifiers.new do |salt, secret_key_base: self.secret_key_base|
+          key_generator(secret_key_base).generate_key(salt)
+        end.rotate_defaults
+    end
+
     # Returns a message verifier object.
     #
     # This verifier can be used to generate and verify signed messages in the application.
@@ -177,15 +220,21 @@ module Rails
     #
     # See the ActiveSupport::MessageVerifier documentation for more information.
     def message_verifier(verifier_name)
-      @message_verifiers[verifier_name] ||= begin
-        secret = key_generator.generate_key(verifier_name.to_s)
-        ActiveSupport::MessageVerifier.new(secret)
+      message_verifiers[verifier_name]
+    end
+
+    # A managed collection of deprecators (ActiveSupport::Deprecation::Deprecators).
+    # The collection's configuration methods affect all deprecators in the
+    # collection. Additionally, the collection's +silence+ method silences all
+    # deprecators in the collection for the duration of a given block.
+    def deprecators
+      @deprecators ||= ActiveSupport::Deprecation::Deprecators.new.tap do |deprecators|
+        deprecators[:railties] = Rails.deprecator
       end
     end
 
-    # Convenience for loading config/foo.yml for the current Rails env.
-    #
-    # Examples:
+    # Convenience for loading config/foo.yml for the current \Rails env.
+    # Example:
     #
     #     # config/exception_notification.yml:
     #     production:
@@ -196,13 +245,15 @@ module Rails
     #       url: http://localhost:3001
     #       namespace: my_app_development
     #
+    # <code></code>
+    #
     #     # config/environments/production.rb
     #     Rails.application.configure do
     #       config.middleware.use ExceptionNotifier, config_for(:exception_notification)
     #     end
     #
-    #     # You can also store configurations in a shared section which will be
-    #     # merged with the environment configuration
+    # You can also store configurations in a shared section which will be merged
+    # with the environment configuration
     #
     #     # config/example.yml
     #     shared:
@@ -215,6 +266,8 @@ module Rails
     #         bar:
     #           qux: 2
     #
+    # <code></code>
+    #
     #     # development environment
     #     Rails.application.config_for(:example)[:foo][:bar]
     #     # => { baz: 1, qux: 2 }
@@ -245,16 +298,17 @@ module Rails
       end
     end
 
-    # Stores some of the Rails initial environment parameters which
+    # Stores some of the \Rails initial environment parameters which
     # will be used by middlewares and engines to configure themselves.
     def env_config
       @app_env_config ||= super.merge(
-          "action_dispatch.parameter_filter" => config.filter_parameters,
+          "action_dispatch.parameter_filter" => filter_parameters,
           "action_dispatch.redirect_filter" => config.filter_redirect,
           "action_dispatch.secret_key_base" => secret_key_base,
           "action_dispatch.show_exceptions" => config.action_dispatch.show_exceptions,
           "action_dispatch.show_detailed_exceptions" => config.consider_all_requests_local,
           "action_dispatch.log_rescued_responses" => config.action_dispatch.log_rescued_responses,
+          "action_dispatch.debug_exception_log_level" => ActiveSupport::Logger.const_get(config.action_dispatch.debug_exception_log_level.to_s.upcase),
           "action_dispatch.logger" => Rails.logger,
           "action_dispatch.backtrace_cleaner" => Rails.backtrace_cleaner,
           "action_dispatch.key_generator" => key_generator,
@@ -337,7 +391,7 @@ module Rails
     # Rails application, you will need to add lib to $LOAD_PATH on your own in case
     # you need to load files in lib/ during the application configuration as well.
     def self.add_lib_to_load_path!(root) # :nodoc:
-      path = File.join root, "lib"
+      path = File.join(root, "lib")
       if File.exist?(path) && !$LOAD_PATH.include?(path)
         $LOAD_PATH.unshift(path)
       end
@@ -387,6 +441,9 @@ module Rails
     attr_writer :config
 
     def secrets
+      Rails.deprecator.warn(<<~MSG.squish)
+        `Rails.application.secrets` is deprecated in favor of `Rails.application.credentials` and will be removed in Rails 7.2.
+      MSG
       @secrets ||= begin
         secrets = ActiveSupport::OrderedOptions.new
         files = config.paths["config/secrets"].existent
@@ -407,19 +464,42 @@ module Rails
     # including the ones that sign and encrypt cookies.
     #
     # In development and test, this is randomly generated and stored in a
-    # temporary file in <tt>tmp/development_secret.txt</tt>.
+    # temporary file in <tt>tmp/local_secret.txt</tt>.
+    #
+    # You can also set <tt>ENV["SECRET_KEY_BASE_DUMMY"]</tt> to trigger the use of a randomly generated
+    # secret_key_base that's stored in a temporary file. This is useful when precompiling assets for
+    # production as part of a build step that otherwise does not need access to the production secrets.
+    #
+    # Dockerfile example: <tt>RUN SECRET_KEY_BASE_DUMMY=1 bundle exec rails assets:precompile</tt>.
     #
     # In all other environments, we look for it first in <tt>ENV["SECRET_KEY_BASE"]</tt>,
     # then +credentials.secret_key_base+, and finally +secrets.secret_key_base+. For most applications,
     # the correct place to store it is in the encrypted credentials file.
     def secret_key_base
-      if Rails.env.development? || Rails.env.test?
-        secrets.secret_key_base ||= generate_development_secret
-      else
-        validate_secret_key_base(
-          ENV["SECRET_KEY_BASE"] || credentials.secret_key_base || secrets.secret_key_base
-        )
-      end
+      config.secret_key_base ||=
+        if ENV["SECRET_KEY_BASE_DUMMY"]
+          generate_local_secret
+        else
+          validate_secret_key_base(
+            ENV["SECRET_KEY_BASE"] || credentials.secret_key_base || begin
+              secret_skb = secrets_secret_key_base
+
+              if secret_skb && secret_skb.equal?(config.secret_key_base)
+                config.secret_key_base
+              elsif secret_skb
+                Rails.deprecator.warn(<<~MSG.squish)
+                  Your `secret_key_base` is configured in `Rails.application.secrets`,
+                  which is deprecated in favor of `Rails.application.credentials` and
+                  will be removed in Rails 7.2.
+                MSG
+
+                secret_skb
+              elsif Rails.env.local?
+                generate_local_secret
+              end
+            end
+          )
+        end
     end
 
     # Returns an ActiveSupport::EncryptedConfiguration instance for the
@@ -488,6 +568,11 @@ module Rails
       ordered_railties.flatten - [self]
     end
 
+    def load_generators(app = self) # :nodoc:
+      app.ensure_generator_templates_added
+      super
+    end
+
     # Eager loads the application code.
     def eager_load!
       Rails.autoloaders.each(&:eager_load)
@@ -577,21 +662,35 @@ module Rails
       end
     end
 
-    private
-      def generate_development_secret
-        if secrets.secret_key_base.nil?
-          key_file = Rails.root.join("tmp/development_secret.txt")
+    def ensure_generator_templates_added
+      configured_paths = config.generators.templates
+      configured_paths.unshift(*(paths["lib/templates"].existent - configured_paths))
+    end
 
-          if !File.exist?(key_file)
+    private
+      def generate_local_secret
+        if config.secret_key_base.nil?
+          key_file = Rails.root.join("tmp/local_secret.txt")
+
+          if File.exist?(key_file)
+            config.secret_key_base = File.binread(key_file)
+          elsif secrets_secret_key_base
+            config.secret_key_base = secrets_secret_key_base
+          else
             random_key = SecureRandom.hex(64)
             FileUtils.mkdir_p(key_file.dirname)
             File.binwrite(key_file, random_key)
+            config.secret_key_base = File.binread(key_file)
           end
-
-          secrets.secret_key_base = File.binread(key_file)
         end
 
-        secrets.secret_key_base
+        config.secret_key_base
+      end
+
+      def secrets_secret_key_base
+        Rails.deprecator.silence do
+          secrets.secret_key_base
+        end
       end
 
       def build_request(env)
@@ -608,5 +707,14 @@ module Rails
       def coerce_same_site_protection(protection)
         protection.respond_to?(:call) ? protection : proc { protection }
       end
+
+      def filter_parameters
+        if config.precompile_filter_parameters
+          config.filter_parameters.replace(
+            ActiveSupport::ParameterFilter.precompile_filters(config.filter_parameters)
+          )
+        end
+        config.filter_parameters
+      end
   end
 end

data/lib/rails/backtrace_cleaner.rb

@@ -4,15 +4,17 @@ require "active_support/backtrace_cleaner"
 require "active_support/core_ext/string/access"
 
 module Rails
-  class BacktraceCleaner < ActiveSupport::BacktraceCleaner
+  class BacktraceCleaner < ActiveSupport::BacktraceCleaner # :nodoc:
     APP_DIRS_PATTERN = /\A(?:\.\/)?(?:app|config|lib|test|\(\w*\))/
     RENDER_TEMPLATE_PATTERN = /:in `.*_\w+_{2,3}\d+_\d+'/
 
     def initialize
       super
-      @root = "#{Rails.root}/"
       add_filter do |line|
-        line.start_with?(@root) ? line.from(@root.size) : line
+        # We may be called before Rails.root is assigned.
+        # When that happens we fallback to not truncating.
+        @root ||= Rails.root && "#{Rails.root}/"
+        @root && line.start_with?(@root) ? line.from(@root.size) : line
       end
       add_filter do |line|
         if RENDER_TEMPLATE_PATTERN.match?(line)

data/lib/rails/cli.rb

@@ -10,8 +10,11 @@ require "rails/ruby_version_check"
 Signal.trap("INT") { puts; exit(1) }
 
 require "rails/command"
-
-if ARGV.first == "plugin"
+case ARGV.first
+when Rails::Command::HELP_MAPPINGS, "help", nil
+  ARGV.shift
+  Rails::Command.invoke :gem_help, ARGV
+when "plugin"
   ARGV.shift
   Rails::Command.invoke :plugin, ARGV
 else

data/lib/rails/command/actions.rb

@@ -10,23 +10,21 @@ module Rails
         Dir.chdir(File.expand_path("../..", APP_PATH)) unless File.exist?(File.expand_path("config.ru"))
       end
 
-      def require_application_and_environment!
-        require_application!
-        require_environment!
-      end
-
       def require_application!
         require ENGINE_PATH if defined?(ENGINE_PATH)
+        require APP_PATH if defined?(APP_PATH)
+      end
 
-        if defined?(APP_PATH)
-          require APP_PATH
-        end
+      def boot_application!
+        require_application!
+        Rails.application.require_environment! if defined?(APP_PATH)
       end
 
-      def require_environment!
-        if defined?(APP_PATH)
-          Rails.application.require_environment!
-        end
+      def load_environment_config!
+        require_application!
+        # Only run initializers that are in the :all group, which includes the
+        # :load_environment_config initializer.
+        Rails.application.initialize!(:_) if defined?(APP_PATH)
       end
 
       if defined?(ENGINE_PATH)

data/lib/rails/command/base.rb

@@ -3,7 +3,8 @@
 require "thor"
 require "erb"
 
-require "active_support/core_ext/string/filters"
+require "active_support/core_ext/class/attribute"
+require "active_support/core_ext/module/delegation"
 require "active_support/core_ext/string/inflections"
 
 require "rails/command/actions"
@@ -14,32 +15,16 @@ module Rails
       class Error < Thor::Error # :nodoc:
       end
 
-      class CorrectableError < Error # :nodoc:
-        attr_reader :key, :options
-
-        def initialize(message, key, options)
-          @key     = key
-          @options = options
-          super(message)
-        end
-
-        if defined?(DidYouMean::SpellChecker) && defined?(DidYouMean::Correctable)
-          include DidYouMean::Correctable
-
-          def corrections
-            @corrections ||= DidYouMean::SpellChecker.new(dictionary: options).correct(key)
-          end
-        end
-      end
-
       include Actions
 
+      class_attribute :bin, instance_accessor: false, default: "bin/rails"
+
       class << self
         def exit_on_failure? # :nodoc:
           false
         end
 
-        # Returns true when the app is a Rails engine.
+        # Returns true when the app is a \Rails engine.
         def engine?
           defined?(ENGINE_ROOT)
         end
@@ -50,7 +35,7 @@ module Rails
           if usage
             super
           else
-            @desc ||= ERB.new(File.read(usage_path), trim_mode: "-").result(binding) if usage_path
+            class_usage
           end
         end
 
@@ -81,23 +66,38 @@ module Rails
 
         def perform(command, args, config) # :nodoc:
           if Rails::Command::HELP_MAPPINGS.include?(args.first)
-            command, args = "help", []
+            command, args = "help", [command]
+            args.clear if instance_method(:help).arity.zero?
           end
 
           dispatch(command, args.dup, nil, config)
         end
 
         def printing_commands
-          namespaced_commands
+          commands.filter_map do |name, command|
+            [namespaced_name(name), command.description] unless command.hidden?
+          end
         end
 
-        def executable
-          "rails #{command_name}"
+        def executable(command_name = self.command_name)
+          "#{bin} #{namespaced_name(command_name)}"
         end
 
-        # Use Rails' default banner.
-        def banner(*)
-          "#{executable} #{arguments.map(&:usage).join(' ')} [options]".squish
+        def banner(command = nil, *)
+          if command
+            # Similar to Thor's banner, but show the namespace (minus the
+            # "rails:" prefix), and show the command's declared bin instead of
+            # the command runner.
+            command.formatted_usage(self).gsub(/^#{namespace}:(\w+)/) { executable($1) }
+          else
+            executable
+          end
+        end
+
+        # Override Thor's class-level help to also show the USAGE.
+        def help(shell, *) # :nodoc:
+          super
+          shell.say class_usage if class_usage
         end
 
         # Sets the base_name taking into account the current class namespace.
@@ -119,12 +119,16 @@ module Rails
           end
         end
 
+        def class_usage # :nodoc:
+          if usage_path
+            @class_usage ||= ERB.new(File.read(usage_path), trim_mode: "-").result(binding)
+          end
+        end
+
         # Path to lookup a USAGE description in a file.
         def usage_path
-          if default_command_root
-            path = File.join(default_command_root, "USAGE")
-            path if File.exist?(path)
-          end
+          @usage_path = resolve_path("USAGE") unless defined?(@usage_path)
+          @usage_path
         end
 
         # Default file root to place extra files a command might need, placed
@@ -133,8 +137,8 @@ module Rails
         # For a Rails::Command::TestCommand placed in <tt>rails/command/test_command.rb</tt>
         # would return <tt>rails/test</tt>.
         def default_command_root
-          path = File.expand_path(relative_command_path, __dir__)
-          path if File.exist?(path)
+          @default_command_root = resolve_path(".") unless defined?(@default_command_root)
+          @default_command_root
         end
 
         private
@@ -145,37 +149,35 @@ module Rails
             else
               # Prevent exception about command without usage.
               # Some commands define their documentation differently.
-              @usage ||= ""
+              @usage ||= meth
               @desc  ||= ""
 
               super
             end
           end
 
-          def command_root_namespace
-            (namespace.split(":") - %w(rails)).join(":")
-          end
-
-          def relative_command_path
-            File.join("../commands", *command_root_namespace.split(":"))
+          def namespaced_name(name)
+            *prefix, basename = namespace.delete_prefix("rails:").split(":")
+            prefix.concat([basename, name.to_s].uniq).join(":")
           end
 
-          def namespaced_commands
-            commands.keys.map do |key|
-              if command_root_namespace.match?(/(\A|:)#{key}\z/)
-                command_root_namespace
-              else
-                "#{command_root_namespace}:#{key}"
-              end
-            end
+          def resolve_path(path)
+            path = File.join("../commands", *namespace.delete_prefix("rails:").split(":"), path)
+            path = File.expand_path(path, __dir__)
+            path if File.exist?(path)
           end
       end
 
-      def help
-        if command_name = self.class.command_name
-          self.class.command_help(shell, command_name)
-        else
+      no_commands do
+        delegate :executable, to: :class
+        attr_reader :current_subcommand
+
+        def invoke_command(command, *) # :nodoc:
+          @current_subcommand ||= nil
+          original_subcommand, @current_subcommand = @current_subcommand, command.name
           super
+        ensure
+          @current_subcommand = original_subcommand
         end
       end
     end

data/lib/rails/command/environment_argument.rb

@@ -9,31 +9,47 @@ module Rails
       extend ActiveSupport::Concern
 
       included do
-        no_commands do
-          class_attribute :environment_desc, default: "Specifies the environment to run this #{self.command_name} under (test/development/production)."
+        class_option :environment, aliases: "-e", type: :string,
+          desc: "The environment to run `#{self.command_name}` in (e.g. test / development / production)."
+      end
+
+      def initialize(...)
+        super
+
+        @environment_specified = options[:environment].present?
+
+        if !@environment_specified
+          self.options = options.merge(environment: Rails::Command.environment)
+        elsif !available_environments.include?(options[:environment])
+          self.options = options.merge(environment: expand_environment_name(options[:environment]))
         end
-        class_option :environment, aliases: "-e", type: :string, desc: environment_desc
       end
 
       private
-        def extract_environment_option_from_argument(default_environment: Rails::Command.environment)
-          if options[:environment]
-            self.options = options.merge(environment: acceptable_environment(options[:environment]))
-          else
-            self.options = options.merge(environment: default_environment)
-          end
+        def require_application!
+          ENV["RAILS_ENV"] = environment
+          super
+        end
+
+        def environment
+          @environment ||= options[:environment]
+        end
+
+        def environment=(environment)
+          @environment = environment
         end
 
-        def acceptable_environment(env = nil)
-          if available_environments.include? env
-            env
-          else
-            %w( production development test ).detect { |e| /^#{env}/.match?(e) } || env
-          end
+        def environment_specified?
+          @environment_specified
         end
 
         def available_environments
-          Dir["config/environments/*.rb"].map { |fname| File.basename(fname, ".*") }
+          @available_environments ||=
+            Dir["config/environments/*.rb"].map { |filename| File.basename(filename, ".*") }
+        end
+
+        def expand_environment_name(name)
+          %w[production development test].find { |full_name| full_name.start_with?(name) } || name
         end
     end
   end

data/lib/rails/command/helpers/editor.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "shellwords"
 require "active_support/encrypted_file"
 
 module Rails
@@ -7,27 +8,31 @@ module Rails
     module Helpers
       module Editor
         private
-          def ensure_editor_available(command:)
-            if ENV["EDITOR"].to_s.empty?
-              say "No $EDITOR to open file in. Assign one like this:"
+          def editor
+            ENV["VISUAL"].to_s.empty? ? ENV["EDITOR"] : ENV["VISUAL"]
+          end
+
+          def display_hint_if_system_editor_not_specified
+            if editor.to_s.empty?
+              say "No $VISUAL or $EDITOR to open file in. Assign one like this:"
               say ""
-              say %(EDITOR="mate --wait" #{command})
+              say %(VISUAL="mate --wait" #{executable(current_subcommand)})
               say ""
-              say "For editors that fork and exit immediately, it's important to pass a wait flag,"
-              say "otherwise the credentials will be saved immediately with no chance to edit."
+              say "For editors that fork and exit immediately, it's important to pass a wait flag;"
+              say "otherwise, the file will be saved immediately with no chance to edit."
 
-              false
-            else
               true
             end
           end
 
-          def catch_editing_exceptions
-            yield
+          def system_editor(file_path)
+            system(*Shellwords.split(editor), file_path.to_s)
+          end
+
+          def using_system_editor
+            display_hint_if_system_editor_not_specified || yield
           rescue Interrupt
             say "Aborted changing file: nothing saved."
-          rescue ActiveSupport::EncryptedFile::MissingKeyError => error
-            say error.message
           end
       end
     end