respondo 2.1.1 → 2.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fbe7751852587a50eb66e9d18128db0f0b98295f6e309ea1db812d2c6802827e
-  data.tar.gz: d59797929ccbf67f507eba232a36c04f5642318b1f3992aa0251f3949b4ed284
+  metadata.gz: eac53474dd61508e20d695e46cc364e3bf9ebdb0b89a6e1b4ae93eda15ebc7b7
+  data.tar.gz: 8f1035182c1795269fe3266473bdf4b67bcfa56fcdaf10d6593c5e56739a955c
 SHA512:
-  metadata.gz: d3d210ee9413164b2d0b80b4c84e8f238ffac624145704dbabfb4a09242d655460e18ecd0591cd010a43a5a9c37d1b0a1ad6086ac0ab8f0a7e36536f0d6b16c3
-  data.tar.gz: 8683372f8e107d696b62d6f5e69e9f693638ce3dc50f21775d54820781c987fae14e924bce00c126b83747ce8ef14857652582a7a1e0d1c881c1536c7c4bbfe5
+  metadata.gz: b9540985dd09e11ee39c87cccccc13b9056f07cb762a8b6523a5e1a1666cdb4e0e8ca1ab6dfd9305706c5d48386c73bd5dfbabc070b05c7a1d92d08877fd5ba4
+  data.tar.gz: 53bdf553e918de4f9b4e0a3df8fc3fb894fcbe0efaae7a2daeaa97990a18974b8b80d18b094d2fa2f8f10c7098fae0c01067394c3b6be6fb45766e5f68dd04b3

data/CHANGELOG.md

@@ -1,5 +1,123 @@
 # Changelog
 
+## [2.1.3] — Docs & Dependency Updates
+
+### Changed
+- README updated (add a one-line summary of what you changed)
+- Development dependencies updated to patched versions, fixing CVEs in
+  `concurrent-ruby`, `erb` and `rails-html-sanitizer`. These are test-only
+  dependencies, so there is no change to the gem's runtime behavior.
+
+## [2.1.2] — Code Quality & Test Coverage
+
+### Fixed
+
+#### `controller_helpers.rb` — `render_success` and `render_error` made private
+Previously `render_success` and `render_error` were public methods, meaning any
+controller could call them directly — bypassing the semantic named helpers
+(`render_ok`, `render_created`, `render_forbidden`, etc.) and undermining the
+gem's design intent.
+
+**Before (public — bypassable):**
+```ruby
+# Any controller could do this, skipping semantic intent entirely
+render_success(data: @user, status: :created)
+render_error(message: "bad", status: :not_found)
+```
+
+**After (private — enforced through named helpers only):**
+```ruby
+# Correct usage — callers must use the named helpers
+render_created(data: @user)
+render_not_found(message: "User not found")
+```
+
+**Why:** The named helpers encode the correct HTTP status code, default
+message, and meta code for each scenario. Allowing direct calls to
+`render_success` / `render_error` lets callers set arbitrary status/code
+combinations that break the consistency guarantee.
+
+**Migration:** Replace any direct `render_success` / `render_error` calls in
+your controllers with the appropriate named helper. All named helpers remain
+public and their signatures are unchanged.
+
+---
+
+#### `response_builder.rb` — replaced `defined?(Time.current)` with `Time.respond_to?(:current)`
+The original guard used Ruby's `defined?` keyword to check for Rails'
+`Time.current`. However, `defined?(Time.current)` always returns `"method"`
+as long as the `Time` constant exists — making the `else` branch permanently
+unreachable even in non-Rails environments.
+
+**Before (broken guard — else branch unreachable):**
+```ruby
+def current_timestamp
+  if defined?(Time.current)   # always truthy — else never runs
+    Time.current.iso8601
+  else
+    Time.now.utc.iso8601      # dead code
+  end
+end
+```
+
+**After (correct guard — both branches reachable):**
+```ruby
+def current_timestamp
+  if Time.respond_to?(:current)   # false outside Rails
+    Time.current.iso8601
+  else
+    Time.now.utc.iso8601           # correctly used in plain Ruby
+  end
+end
+```
+
+**Why:** `respond_to?` correctly returns `false` in plain Ruby environments
+where ActiveSupport is not loaded, allowing the `Time.now.utc` fallback to
+actually execute. Behaviour in Rails is identical since `Time.respond_to?(:current)`
+returns `true` when ActiveSupport is present.
+
+---
+
+#### `install_generator.rb` — blank `api_version` no longer writes empty key to initializer
+Previously, if a user entered a blank api_version at the prompt, the generator
+would write `api_version: ""` into the initializer's `default_meta` block —
+a meaningless empty string that would be sent in every API response.
+
+**Before (wrote empty key):**
+```ruby
+meta = { "api_version" => @cfg[:api_version] }.merge(@cfg[:default_meta])
+# If api_version is "" → writes: api_version: ""
+```
+
+**After (omits blank api_version):**
+```ruby
+meta = @cfg[:default_meta].dup
+meta["api_version"] = @cfg[:api_version] unless @cfg[:api_version].to_s.empty?
+# If api_version is "" → key is cleanly omitted
+# If no extra meta either → writes: config.default_meta = {}
+```
+
+**Why:** An empty `api_version` key adds noise to every response's meta block
+with no value. The generator now omits it cleanly, and the previously
+unreachable `config.default_meta = {}` branch is now correctly written when
+both `api_version` is blank and no extra meta fields were added.
+
+---
+
+### Changed
+
+#### Test coverage improved from 97.92% → 100%
+All previously uncovered branches are now exercised:
+
+| File | Branch previously missed | Fix |
+|------|--------------------------|-----|
+| `controller_helpers.rb` | `extract_errors` — `ActiveModel::Errors`, `Array`, `String`, and unknown-type paths | Added `send(:extract_errors, ...)` specs |
+| `response_builder.rb` | `else` branch of `current_timestamp` (non-Rails fallback) | Fixed guard + added branch specs |
+| `install_generator.rb` | `if meta.empty?` branch in `build_content` | Fixed generator logic + added spec |
+| `serializer.rb` | `serialize_record` — `elsif respond_to?(:to_h)` and `else` (bare record) | Added `serialize_record` branch specs |
+
+---
+
 ## [2.1.1] — Bug Fix
 
 ### Fixed