rest-easy 1.4.0 → 1.4.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 567f6e8a9344027299c80aeebc330318bedf9ea0a030493b378ed3bfa9c3047d
-  data.tar.gz: 8d9015ee4dd9eeda16ed953cec2804c7a8ba723cd346dc0e1da481c4c3a9683a
+  metadata.gz: a192d482f07dc654cae8267e3166742ee45d90c4bf960f54f632f94ca11c20a6
+  data.tar.gz: 74b41469d03fb34c19616774f9ccb97dfd3191f937dfcf2e96560986333ccf12
 SHA512:
-  metadata.gz: 6e10536c6514eaca3e02acec7e303dbf085b4cef96e9fceb1d48260571087d56589aec201e3996153f6bb3dfafd235a20dda099ac634c300492d18c831ebb50d
-  data.tar.gz: c92c35d0ab63b770d2abf29e24ca8b4f7ff3a59945594e55d30bbf0ec7843f39f0f734ed2ca01aa648b94df57e4e8302d50182c3934b71343f3acfb4d9124271
+  metadata.gz: b493ff7a6f39fa303665e6e09174b2f664d35960e18864dbb39e3d2cf95fe3ea13543f4384fc3a4c4656d8ada2b029f486ccf99ac6e2d9dda983c74e05717f6b
+  data.tar.gz: fdec9a5343a0bf002fe43b1532849ec7a28520ee95392e4beddcd0e11af1b3fd2ec0c9c2c11eceeafb65ea8dd640281fe521f1613022bc43f60615ca0afc1095

data/CHANGELOG.md

@@ -2,6 +2,78 @@
 
 ## [Unreleased]
 
+## [1.4.2] - 2026-09-23
+
+### Fixed
+
+- **`update` no longer discards state it should carry forward.** It rebuilt
+  the instance's metadata and its change set from scratch instead of
+  inheriting them, which broke three things at once:
+
+  - An instance that had never been saved came back marked as persisted, so
+    `save` took the update branch: a PUT to the collection path with no id in
+    it, for a record the API has never seen, instead of a POST that creates
+    one. Building a record and adjusting it before the first save is the
+    ordinary way to use an immutable resource, and it could not produce a
+    correct create request.
+  - Chained updates kept only the last call's fields. After
+    `a.update(x: 1).update(y: 2)`, `__changes__` reported just `y` while `x`
+    read back as `1` on the instance, so a partial payload built from the
+    change set left out a field the object claimed to carry, and nothing
+    raised.
+  - Metadata set by a `before_parse` hook lives on the instance, not the
+    class, and was dropped. A consumer flagging parsed instances — to mark
+    the thin records a collection endpoint returns, say — lost the flag as
+    soon as anything called `update`.
+
+  `update` now inherits the receiver's metadata and merges its change set.
+  The metadata is copied rather than shared, so mutating an updated copy's
+  metadata still cannot reach the original's.
+
+## [1.4.1] - 2026-08-18
+
+### Fixed
+
+- **`Meta` no longer claims to implement methods it has no value for.**
+  `Meta#respond_to_missing?` returned `true` for every name, so any caller
+  that asks an object what it can do before calling it got a false yes, then
+  received the `nil` that `method_missing` returns for an unknown key as
+  though it were a real answer. Ruby does this constantly and implicitly —
+  coercion probes when a value is splatted or interpolated, serialisation
+  hooks, and any library that duck-types with `respond_to?` — so the failure
+  surfaced far from `Meta` and looked unrelated to it. Marshalling was the
+  sharpest case: `dump` silently wrote an empty payload and `load` then
+  raised `NoMethodError` from inside `method_missing`, which broke every
+  consumer caching resources in a store that marshals its entries.
+
+  Bare getters are now claimed only for keys the instance actually holds.
+  Setters and predicates are still claimed unconditionally, since writing is
+  how a key comes into existence and an unset predicate is meaningfully
+  `false`; no core Ruby probe uses those two shapes. Library-level
+  duck-typing can, though — ActiveSupport's `acts_like?(:date)` asks for
+  `acts_like_date?`, and `Meta` still answers yes — so the guarantee is
+  narrower than "nothing probes for `=` or `?`", and closing it properly is
+  tracked in #7. Operators are no longer claimed either: the check is
+  anchored to identifier-shaped names, so `<=` is not mistaken for a setter
+  (`method_missing` still is — #6).
+  `Resource::MetaCollector` had the identical defect and is fixed the same
+  way.
+
+  **Upgrading with a warm cache:** entries written by an earlier version are
+  not recoverable. A payload dumped before this fix carries `nil` where the
+  meta state should be, and loading it now raises `TypeError: instance of
+  RestEasy::Meta needs to have method 'marshal_load'` — legible, but still
+  an error. Consumers on a cache that survives deploys (`:file_store`,
+  Redis, Memcached) must flush it or bump the cache key namespace when
+  upgrading. A process-local `:memory_store` clears itself on restart and
+  needs nothing.
+
+  `method_missing` is unchanged: a bare getter for a key that was never set
+  still returns `nil` rather than raising, as the "gem author extensions"
+  example in `docs/model-architecture.md` depends on. `respond_to?`
+  therefore under-reports for those keys; reconciling the two halves
+  requires declaring meta keys up front and is tracked in #7.
+
 ## [1.4.0] - 2026-06-26
 
 ### Fixed
@@ -123,7 +195,9 @@
 
 Initial release.
 
-[Unreleased]: https://github.com/accodeing/rest-easy/compare/v1.4.0...HEAD
+[Unreleased]: https://github.com/accodeing/rest-easy/compare/v1.4.2...HEAD
+[1.4.2]: https://github.com/accodeing/rest-easy/compare/v1.4.1...v1.4.2
+[1.4.1]: https://github.com/accodeing/rest-easy/compare/v1.4.0...v1.4.1
 [1.4.0]: https://github.com/accodeing/rest-easy/compare/v1.3.1...v1.4.0
 [1.3.1]: https://github.com/accodeing/rest-easy/compare/v1.3.0...v1.3.1
 [1.3.0]: https://github.com/accodeing/rest-easy/compare/v1.2.0...v1.3.0

data/lib/rest_easy/meta.rb

@@ -6,6 +6,11 @@ module RestEasy
       @data = { new: new_record, saved: saved, **defaults }
     end
 
+    def initialize_copy(source)
+      super
+      @data = @data.dup
+    end
+
     def new?
       @data[:new]
     end
@@ -25,8 +30,46 @@ module RestEasy
       end
     end
 
-    def respond_to_missing?(_name, _include_private = false)
-      true
+    # Accessor shapes `method_missing` synthesises. Anchored, so operators
+    # stay out: `<=` ends with `=`, and claiming it would let `meta <= 5`
+    # read as a setter. `method_missing` itself is still unanchored and
+    # writes `@data[:<]` for that call — see issue #6.
+    #
+    # POSIX classes rather than `[a-zA-Z_]\w*`, because Ruby identifiers are
+    # not ASCII-only: `meta.företag = x` is a valid setter that
+    # `method_missing` stores, so `respond_to?` has to claim it too.
+    ACCESSOR_PATTERN = /\A[[:alpha:]_][[:word:]]*[=?]\z/
+    private_constant :ACCESSOR_PATTERN
+
+    # `method_missing` answers to any name, but this must not, because callers
+    # routinely ask an object what it can do before calling it — Ruby's own
+    # coercion probes (`to_hash` on double-splat, `to_ary`, `to_str`),
+    # serialisation hooks (`marshal_dump`, `init_with`), and any library that
+    # duck-types with `respond_to?`. Claiming those hands the caller the `nil`
+    # that `method_missing` returns for an unknown key as though it were an
+    # answer.
+    #
+    # Bare getters are therefore claimed only for keys actually held. Setters
+    # and predicates are claimed unconditionally: writing is how a key comes
+    # into existence, and an unset predicate is meaningfully `false`. No core
+    # Ruby probe uses those two shapes — though library-level duck-typing can,
+    # and ActiveSupport's `acts_like?(:date)` asking for `acts_like_date?` is
+    # a known false positive. Closing it properly means declaring meta keys
+    # up front, which is a breaking change — see issue #7.
+    #
+    # `@data` is guarded because `respond_to?` must never raise, and Ruby
+    # allocates an instance before initialising it: Psych's `revive` probes
+    # `init_with` on a bare allocation, and so does `Marshal.load` on a
+    # payload written before this fix.
+    #
+    # This under-claims a bare getter for a key that was never set, which
+    # `method_missing` still answers with `nil`. Reconciling the two halves
+    # means declaring meta keys up front, and that is a 2.0 — see issue #7.
+    def respond_to_missing?(name, include_private = false)
+      return true if ACCESSOR_PATTERN.match?(name.to_s)
+      return super unless @data
+
+      @data.key?(name.to_sym) || super
     end
   end
 end

data/lib/rest_easy/resource.rb

@@ -119,8 +119,22 @@ module RestEasy
         end
       end
 
-      def respond_to_missing?(_name, _include_private = false)
-        true
+      # Anchored so operators stay out — see Meta::ACCESSOR_PATTERN and
+      # issue #6. Only the setter shape here; unlike Meta, `method_missing`
+      # above has no predicate form.
+      SETTER_PATTERN = /\A[[:alpha:]_][[:word:]]*=\z/
+      private_constant :SETTER_PATTERN
+
+      # Same reasoning as Meta#respond_to_missing? — a blanket `true` makes
+      # this claim Ruby's implicit protocol methods and hand them the `nil`
+      # from `method_missing`. `@data` is guarded for the same reason too:
+      # `respond_to?` must never raise, and Psych and Marshal both probe a
+      # bare allocation before it is initialised.
+      def respond_to_missing?(name, include_private = false)
+        return true if SETTER_PATTERN.match?(name.to_s)
+        return super unless @data
+
+        @data.key?(name.to_sym) || super
       end
     end
 
@@ -584,7 +598,7 @@ module RestEasy
 
       new_model = @model_attributes.merge(coerced)
       new_instance = self.class.allocate
-      new_instance.send(:init_from_update, new_model, @api_data, coerced)
+      new_instance.send(:init_from_update, new_model, @api_data, __changes__.merge(coerced), @meta)
       new_instance
     end
 
@@ -787,11 +801,14 @@ module RestEasy
       end
     end
 
-    def init_from_update(new_model_attrs, original_api_data, changes)
+    def init_from_update(new_model_attrs, original_api_data, changes, meta)
       @api_data = original_api_data
       @model_attributes = new_model_attrs
       @changes = changes
-      @meta = Meta.new(new_record: false, saved: true, **self.class.metadata)
+      # Carried from the receiver, not rebuilt: an instance that was never
+      # saved stays new, so `save` still POSTs it, and metadata a parse hook
+      # set (which lives on the instance, not the class) survives the update.
+      @meta = meta.dup
     end
   end
 end

data/lib/rest_easy/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RestEasy
-  VERSION = "1.4.0"
+  VERSION = "1.4.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rest-easy
 version: !ruby/object:Gem::Version
-  version: 1.4.0
+  version: 1.4.2
 platform: ruby
 authors:
 - Jonas Schubert Erlandsson
@@ -10,7 +10,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-06-26 00:00:00.000000000 Z
+date: 2026-09-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dry-types