rest-easy 1.4.0 → 1.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 567f6e8a9344027299c80aeebc330318bedf9ea0a030493b378ed3bfa9c3047d
-  data.tar.gz: 8d9015ee4dd9eeda16ed953cec2804c7a8ba723cd346dc0e1da481c4c3a9683a
+  metadata.gz: a30780e0b38e31f1c183d1ec0a91ea93658a78e67d2415aeb8aef279d03359b7
+  data.tar.gz: 2ed7aafbcaf5e0c6fd463992a65293d1f064c693611f64b9b3256e8e4b518fdf
 SHA512:
-  metadata.gz: 6e10536c6514eaca3e02acec7e303dbf085b4cef96e9fceb1d48260571087d56589aec201e3996153f6bb3dfafd235a20dda099ac634c300492d18c831ebb50d
-  data.tar.gz: c92c35d0ab63b770d2abf29e24ca8b4f7ff3a59945594e55d30bbf0ec7843f39f0f734ed2ca01aa648b94df57e4e8302d50182c3934b71343f3acfb4d9124271
+  metadata.gz: 3ac9ea37e26b652d5fe590075d7668f70e2cf8b7290b02d7e4dd1f227bf7a7e26ea9e5faa02ed1b84b5706262d90e774db52381ea0ce2d026da40d410ae38c11
+  data.tar.gz: 8f8773d0cbacc6366daade22ceee18ee76de91ee5eb5cd718c392e0abfe1ed3a911658a867dab1bcd1f21b077f2296e0cb5ffbb1aa5597f6fee7e77a7b40b84d

data/CHANGELOG.md

@@ -2,6 +2,50 @@
 
 ## [Unreleased]
 
+## [1.4.1] - 2026-08-18
+
+### Fixed
+
+- **`Meta` no longer claims to implement methods it has no value for.**
+  `Meta#respond_to_missing?` returned `true` for every name, so any caller
+  that asks an object what it can do before calling it got a false yes, then
+  received the `nil` that `method_missing` returns for an unknown key as
+  though it were a real answer. Ruby does this constantly and implicitly —
+  coercion probes when a value is splatted or interpolated, serialisation
+  hooks, and any library that duck-types with `respond_to?` — so the failure
+  surfaced far from `Meta` and looked unrelated to it. Marshalling was the
+  sharpest case: `dump` silently wrote an empty payload and `load` then
+  raised `NoMethodError` from inside `method_missing`, which broke every
+  consumer caching resources in a store that marshals its entries.
+
+  Bare getters are now claimed only for keys the instance actually holds.
+  Setters and predicates are still claimed unconditionally, since writing is
+  how a key comes into existence and an unset predicate is meaningfully
+  `false`; no core Ruby probe uses those two shapes. Library-level
+  duck-typing can, though — ActiveSupport's `acts_like?(:date)` asks for
+  `acts_like_date?`, and `Meta` still answers yes — so the guarantee is
+  narrower than "nothing probes for `=` or `?`", and closing it properly is
+  tracked in #7. Operators are no longer claimed either: the check is
+  anchored to identifier-shaped names, so `<=` is not mistaken for a setter
+  (`method_missing` still is — #6).
+  `Resource::MetaCollector` had the identical defect and is fixed the same
+  way.
+
+  **Upgrading with a warm cache:** entries written by an earlier version are
+  not recoverable. A payload dumped before this fix carries `nil` where the
+  meta state should be, and loading it now raises `TypeError: instance of
+  RestEasy::Meta needs to have method 'marshal_load'` — legible, but still
+  an error. Consumers on a cache that survives deploys (`:file_store`,
+  Redis, Memcached) must flush it or bump the cache key namespace when
+  upgrading. A process-local `:memory_store` clears itself on restart and
+  needs nothing.
+
+  `method_missing` is unchanged: a bare getter for a key that was never set
+  still returns `nil` rather than raising, as the "gem author extensions"
+  example in `docs/model-architecture.md` depends on. `respond_to?`
+  therefore under-reports for those keys; reconciling the two halves
+  requires declaring meta keys up front and is tracked in #7.
+
 ## [1.4.0] - 2026-06-26
 
 ### Fixed
@@ -123,7 +167,8 @@
 
 Initial release.
 
-[Unreleased]: https://github.com/accodeing/rest-easy/compare/v1.4.0...HEAD
+[Unreleased]: https://github.com/accodeing/rest-easy/compare/v1.4.1...HEAD
+[1.4.1]: https://github.com/accodeing/rest-easy/compare/v1.4.0...v1.4.1
 [1.4.0]: https://github.com/accodeing/rest-easy/compare/v1.3.1...v1.4.0
 [1.3.1]: https://github.com/accodeing/rest-easy/compare/v1.3.0...v1.3.1
 [1.3.0]: https://github.com/accodeing/rest-easy/compare/v1.2.0...v1.3.0

data/lib/rest_easy/meta.rb

@@ -25,8 +25,46 @@ module RestEasy
       end
     end
 
-    def respond_to_missing?(_name, _include_private = false)
-      true
+    # Accessor shapes `method_missing` synthesises. Anchored, so operators
+    # stay out: `<=` ends with `=`, and claiming it would let `meta <= 5`
+    # read as a setter. `method_missing` itself is still unanchored and
+    # writes `@data[:<]` for that call — see issue #6.
+    #
+    # POSIX classes rather than `[a-zA-Z_]\w*`, because Ruby identifiers are
+    # not ASCII-only: `meta.företag = x` is a valid setter that
+    # `method_missing` stores, so `respond_to?` has to claim it too.
+    ACCESSOR_PATTERN = /\A[[:alpha:]_][[:word:]]*[=?]\z/
+    private_constant :ACCESSOR_PATTERN
+
+    # `method_missing` answers to any name, but this must not, because callers
+    # routinely ask an object what it can do before calling it — Ruby's own
+    # coercion probes (`to_hash` on double-splat, `to_ary`, `to_str`),
+    # serialisation hooks (`marshal_dump`, `init_with`), and any library that
+    # duck-types with `respond_to?`. Claiming those hands the caller the `nil`
+    # that `method_missing` returns for an unknown key as though it were an
+    # answer.
+    #
+    # Bare getters are therefore claimed only for keys actually held. Setters
+    # and predicates are claimed unconditionally: writing is how a key comes
+    # into existence, and an unset predicate is meaningfully `false`. No core
+    # Ruby probe uses those two shapes — though library-level duck-typing can,
+    # and ActiveSupport's `acts_like?(:date)` asking for `acts_like_date?` is
+    # a known false positive. Closing it properly means declaring meta keys
+    # up front, which is a breaking change — see issue #7.
+    #
+    # `@data` is guarded because `respond_to?` must never raise, and Ruby
+    # allocates an instance before initialising it: Psych's `revive` probes
+    # `init_with` on a bare allocation, and so does `Marshal.load` on a
+    # payload written before this fix.
+    #
+    # This under-claims a bare getter for a key that was never set, which
+    # `method_missing` still answers with `nil`. Reconciling the two halves
+    # means declaring meta keys up front, and that is a 2.0 — see issue #7.
+    def respond_to_missing?(name, include_private = false)
+      return true if ACCESSOR_PATTERN.match?(name.to_s)
+      return super unless @data
+
+      @data.key?(name.to_sym) || super
     end
   end
 end

data/lib/rest_easy/resource.rb

@@ -119,8 +119,22 @@ module RestEasy
         end
       end
 
-      def respond_to_missing?(_name, _include_private = false)
-        true
+      # Anchored so operators stay out — see Meta::ACCESSOR_PATTERN and
+      # issue #6. Only the setter shape here; unlike Meta, `method_missing`
+      # above has no predicate form.
+      SETTER_PATTERN = /\A[[:alpha:]_][[:word:]]*=\z/
+      private_constant :SETTER_PATTERN
+
+      # Same reasoning as Meta#respond_to_missing? — a blanket `true` makes
+      # this claim Ruby's implicit protocol methods and hand them the `nil`
+      # from `method_missing`. `@data` is guarded for the same reason too:
+      # `respond_to?` must never raise, and Psych and Marshal both probe a
+      # bare allocation before it is initialised.
+      def respond_to_missing?(name, include_private = false)
+        return true if SETTER_PATTERN.match?(name.to_s)
+        return super unless @data
+
+        @data.key?(name.to_sym) || super
       end
     end
 

data/lib/rest_easy/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RestEasy
-  VERSION = "1.4.0"
+  VERSION = "1.4.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rest-easy
 version: !ruby/object:Gem::Version
-  version: 1.4.0
+  version: 1.4.1
 platform: ruby
 authors:
 - Jonas Schubert Erlandsson
@@ -10,7 +10,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-06-26 00:00:00.000000000 Z
+date: 2026-08-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dry-types