roda 3.107.0 → 3.109.0

data/lib/roda/plugins/render_locals.rb

@@ -32,14 +32,20 @@ class Roda
       end
 
       def self.configure(app, opts=OPTS)
-        app.opts[:render_locals] = (app.opts[:render_locals] || {}).merge(opts[:render]||{}).freeze
-        app.opts[:layout_locals] = (app.opts[:layout_locals] || {}).merge(opts[:layout]||{}).freeze
+        app.opts[:render_locals] = (app.render_locals || {}).merge(opts[:render]||{}).freeze
+        app.opts[:layout_locals] = (app.layout_locals || {}).merge(opts[:layout]||{}).freeze
         if opts.has_key?(:merge)
           app.opts[:merge_locals] = opts[:merge]
-          app.opts[:layout_locals] = app.opts[:render_locals].merge(app.opts[:layout_locals]).freeze
+          app.opts[:layout_locals] = app.render_locals.merge(app.layout_locals).freeze
         end
       end
 
+      module ClassMethods
+        RodaPlugins.opt_attr_reader(self, :render_locals)
+        RodaPlugins.opt_attr_reader(self, :layout_locals)
+        RodaPlugins.opt_attr_reader(self, :merge_locals, name: :merge_locals?)
+      end
+
       module InstanceMethods
         private
 
@@ -56,11 +62,11 @@ class Roda
         end
 
         def render_locals
-          opts[:render_locals]
+          self.class.render_locals
         end
 
         def layout_locals
-          opts[:layout_locals]
+          self.class.layout_locals
         end
 
         # If this isn't the layout template, then use the plugin's render locals as the default locals.
@@ -79,7 +85,7 @@ class Roda
         # If using a layout, then use the plugin's layout locals as the default locals.
         def view_layout_opts(opts)
           if layout_opts = super
-            merge_locals = layout_opts.has_key?(:merge_locals) ? layout_opts[:merge_locals] : self.opts[:merge_locals] 
+            merge_locals = layout_opts.fetch(:merge_locals){self.class.merge_locals?}
 
             locals = {}
             locals.merge!(layout_locals)

data/lib/roda/plugins/request_aref.rb

@@ -20,7 +20,7 @@ class Roda
       def self.configure(app, setting)
         case setting
         when :allow, :raise, :warn
-          app::RodaRequest.class_eval do
+          app::RodaRequest.class_exec do
             alias_method(:[],  :"request_aref_#{setting}")
             alias_method(:[]=, :"request_aset_#{setting}")
             public :[], :[]=

data/lib/roda/plugins/response_content_type.rb

@@ -50,12 +50,16 @@ class Roda
           else
             mime_types.dup
           end
-          app.opts[:repsonse_content_types] = mime_types.freeze
+          app.opts[:response_content_types] = mime_types.freeze
         else
-          app.opts[:repsonse_content_types] ||= {}
+          app.opts[:response_content_types] ||= {}
         end
       end
 
+      module ClassMethods
+        RodaPlugins.opt_attr_reader(self, :response_content_types)
+      end
+
       module ResponseMethods
         # Return the content-type of the response. Will be nil if it has
         # not yet been explicitly set.
@@ -68,7 +72,7 @@ class Roda
         # type with the given file extension. If the symbol is not
         # a recognized mime type, raises KeyError.
         def content_type=(mime_type)
-          mime_type = roda_class.opts[:repsonse_content_types].fetch(mime_type) if mime_type.is_a?(Symbol)
+          mime_type = roda_class.response_content_types.fetch(mime_type) if mime_type.is_a?(Symbol)
           @headers[RodaResponseHeaders::CONTENT_TYPE] = mime_type
         end
       end

data/lib/roda/plugins/route_csrf.rb

@@ -57,13 +57,18 @@ class Roda
     # :csrf_failure :: The action to taken if a request fails the CSRF check (default: :raise).  Options:
     #                  :raise :: raise a Roda::RodaPlugins::RouteCsrf::InvalidToken exception
     #                  :empty_403 :: return a blank 403 page (rack_csrf's default behavior)
-    #                  :clear_session :: Clear the current session
+    #                  :clear_session :: Clear the current session  (deprecated)
     #                  Proc :: Treated as a routing block, called with request object
     # :check_header :: Whether the HTTP header should be checked for the token value (default: false).
     #                  If true, checks the HTTP header after checking for the form input parameter.
     #                  If :only, only checks the HTTP header and doesn't check the form input parameter.
     # :check_request_methods :: Which request methods require CSRF protection
     #                           (default: <tt>['POST', 'DELETE', 'PATCH', 'PUT']</tt>)
+    # :exempt_request_methods :: If given, specifies which request methods do not require CSRF protection.
+    #                            It is recommended to set this so an allow list approach is used, as
+    #                            :check_request_methods is the equivalent of a deny list
+    #                            (recommended: <tt>['GET', 'HEAD', 'OPTIONS', 'QUERY']</tt>, which
+    #                            will be the default in Roda 4)
     # :upgrade_from_rack_csrf_key :: If provided, the session key that should be checked for the
     #                                rack_csrf raw token.  If the session key is present, the value
     #                                will be checked against the submitted token, and if it matches,
@@ -155,6 +160,19 @@ class Roda
     #
     # By including random data in the HMAC for all tokens, different tokens are generated
     # each time, mitigating compression ratio attacks such as BREACH.
+    #
+    # == REQUEST_METHOD modifications
+    #
+    # It's possible to use Rack middleware that modify REQUEST_METHOD in the env hash,
+    # such that it does not reflect that actual request method. One example of this is
+    # Rack::MethodOverride. Using such middleware is generally bad from a security perspective,
+    # but if you want to do so anyway, you need to override the request method that the
+    # route_csrf plugin will use so it reflects the actual request method. If you are using
+    # Rack::MethodOverride, you can use:
+    #
+    #   def csrf_request_method
+    #     env['rack.methodoverride.original_method'] || super
+    #   end
     module RouteCsrf
       # Default CSRF option values
       DEFAULTS = {
@@ -165,6 +183,7 @@ class Roda
         :require_request_specific_tokens => true,
         :csrf_failure => :raise,
         :check_header => false,
+        # RODA4: Remove and set :exempt_request_methods by default
         :check_request_methods => %w'POST DELETE PATCH PUT'.freeze.each(&:freeze)
       }.freeze
 
@@ -177,7 +196,7 @@ class Roda
       end
 
       def self.configure(app, opts=OPTS, &block)
-        options = app.opts[:route_csrf] = (app.opts[:route_csrf] || DEFAULTS).merge(opts)
+        options = app.opts[:route_csrf] = (app.route_csrf_opts || DEFAULTS).merge(opts)
         if block || opts[:csrf_failure].is_a?(Proc)
           if block && opts[:csrf_failure]
             raise RodaError, "Cannot specify both route_csrf plugin block and :csrf_failure option"
@@ -186,10 +205,17 @@ class Roda
           options[:csrf_failure] = :csrf_failure_method
           app.define_roda_method(:_roda_route_csrf_failure, 1, &app.send(:convert_route_block, block))
         end
+        if opts[:csrf_failure] == :clear_session
+          RodaPlugins.warn "Passing :clear_session as the :csrf_failure option to the route_csrf plugin is deprecated"
+        end
         options[:env_header] = "HTTP_#{options[:header].to_s.tr('-', '_').upcase}".freeze
         options.freeze
       end
 
+      module ClassMethods
+        RodaPlugins.opt_attr_reader(self, :route_csrf, name: :route_csrf_opts)
+      end
+
       module InstanceMethods
         # Check that the submitted CSRF token is valid, if the request requires a CSRF token.
         # If the CSRF token is valid or the request does not require a CSRF token, return nil.
@@ -212,6 +238,7 @@ class Roda
               headers[RodaResponseHeaders::CONTENT_LENGTH] ='0'
               throw :halt, @_response.finish_with_body([])
             when :clear_session
+              RodaPlugins.warn "Passing :clear_session as the :csrf_failure option to check_csrf! is deprecated"
               session.clear
             when :csrf_failure_method
               @_request.on{_roda_route_csrf_failure(@_request)}
@@ -297,13 +324,22 @@ class Roda
 
         private
 
+        # The request method to use to determine whether to perform a CSRF check.
+        # defaults to REQUEST_METHOD in the environment, can be overridden if
+        # that isn't the actual request method.
+        def csrf_request_method
+          @_request.env['REQUEST_METHOD']
+        end
+
         # Returns error message string if the CSRF token is not valid.
         # Returns nil if the CSRF token is valid.
         def csrf_invalid_message(opts)
           opts = opts.empty? ? csrf_options : csrf_options.merge(opts)
-          method = request.request_method
+          method = csrf_request_method
 
-          unless opts[:check_request_methods].include?(method)
+          if exempt = opts[:exempt_request_methods]
+            return if exempt.include?(method)
+          elsif !opts[:check_request_methods].include?(method)
             return
           end
 
@@ -326,6 +362,7 @@ class Roda
           end
 
           if (rack_csrf_key = opts[:upgrade_from_rack_csrf_key]) && (rack_csrf_value = session[rack_csrf_key]) && csrf_compare(rack_csrf_value, encoded_token)
+            # RODA4: Remove :upgrade_from_rack_csrf_key support
             return
           end
 
@@ -360,7 +397,7 @@ class Roda
         
         # Helper for getting the plugin options.
         def csrf_options
-          opts[:route_csrf]
+          self.class.route_csrf_opts
         end
 
         # Perform a constant-time comparison of the two strings, returning true if they match and false otherwise.

data/lib/roda/plugins/run_append_slash.rb

@@ -22,20 +22,28 @@ class Roda
     #   # GET /a/ => App gets "/" as PATH_INFO
     module RunAppendSlash
       # Set plugin specific options.  Options:
-      # :use_redirects :: Whether to issue 302 redirects when appending the
-      #                   trailing slash.
+      # :use_redirects :: Whether to issue a redirect to the path with the slash
+      #                   appended, instead of calling the app directly with the
+      #                   trailing slash. Note that if the current path starts
+      #                   with +//+, it will call the app directly instead of
+      #                   redirecting.
       def self.configure(app, opts=OPTS)
         app.opts[:run_append_slash_redirect] = !!opts[:use_redirects]
       end
 
+      module ClassMethods
+        RodaPlugins.opt_attr_reader(self, :run_append_slash_redirect, name: :run_append_slash_redirect?)
+      end
+
       module RequestMethods
         # Calls the given rack app. If the path matches the root of the app but
         # does not contain a trailing slash, a trailing slash is appended to the
         # path internally, or a redirect is issued when configured with
-        # <tt>use_redirects: true</tt>.
+        # <tt>use_redirects: true</tt>. If the path starts with +//+,
+        # the redirect approach will not be used.
         def run(*)
           if @remaining_path.empty?
-            if scope.opts[:run_append_slash_redirect]
+            if roda_class.run_append_slash_redirect? && !(path = self.path).start_with?('//')
               redirect("#{path}/")
             else
               @remaining_path += '/'

data/lib/roda/plugins/sec_fetch_site_csrf.rb

@@ -54,7 +54,7 @@ class Roda
     #                  :raise :: raise a Roda::RodaPlugins::SecFetchSiteCsrf::CsrfFailure
     #                            exception
     #                  :empty_403 :: return a blank 403 page
-    #                  :clear_session :: clear the current session
+    #                  :clear_session :: clear the current session (deprecated)
     #
     # The plugin also supports a block, in which case failures will call the block
     # as a routing block (the block should accept the request object).
@@ -69,7 +69,7 @@ class Roda
       class CsrfFailure < RodaError; end
 
       def self.configure(app, opts=OPTS, &block)
-        options = app.opts[:sec_fetch_site_csrf] = (app.opts[:sec_fetch_site_csrf] || DEFAULTS).merge(opts)
+        options = app.opts[:sec_fetch_site_csrf] = (app.sec_fetch_site_csrf_opts || DEFAULTS).merge(opts)
 
         allowed_values = options[:allowed_values] = ["same-origin"]
         allowed_values << "same-site" if opts[:allow_same_site]
@@ -83,8 +83,10 @@ class Roda
         end
 
         case options[:csrf_failure]
-        when :raise, :empty_403, :clear_session, :method
+        when :raise, :empty_403, :method
           # nothing
+        when :clear_session
+          RodaPlugins.warn "Passing :clear_session as the :csrf_failure option to the sec_fetch_site_csrf plugin is deprecated"
         else
           raise RodaError, "Unsupported :csrf_failure plugin option: #{options[:csrf_failure].inspect}"
         end
@@ -92,6 +94,10 @@ class Roda
         options.freeze
       end
 
+      module ClassMethods
+        RodaPlugins.opt_attr_reader(self, :sec_fetch_site_csrf, name: :sec_fetch_site_csrf_opts)
+      end
+
       module InstanceMethods
         # Check that the Sec-Fetch-Site header is valid, if the request requires it.
         # If the header is valid or the request does not require the header, return nil.
@@ -99,7 +105,7 @@ class Roda
         # if a block is not given, use the plugin :csrf_failure option to determine how to
         # handle it.
         def check_sec_fetch_site!(&block)
-          plugin_opts = self.class.opts[:sec_fetch_site_csrf]
+          plugin_opts = self.class.sec_fetch_site_csrf_opts
           return unless plugin_opts[:check_request_methods].include?(request.request_method)
 
           sec_fetch_site = env["HTTP_SEC_FETCH_SITE"]
@@ -118,6 +124,7 @@ class Roda
             headers[RodaResponseHeaders::CONTENT_LENGTH] ='0'
             throw :halt, @_response.finish_with_body([])
           when :clear_session
+            # RODA4: Remove
             session.clear
           else # when :method
             @_request.on{_roda_sec_fetch_site_csrf_failure(@_request)}

data/lib/roda/plugins/sessions.rb

@@ -5,12 +5,11 @@ require 'openssl'
 begin
   OpenSSL::Cipher.new("aes-256-ctr")
 rescue OpenSSL::Cipher::CipherError
-  # :nocov:
+  # simplecov:disable
   raise LoadError, "Roda sessions plugin requires the aes-256-ctr cipher"
-  # :nocov:
+  # simplecov:enable
 end
 
-require 'json'
 require 'securerandom'
 require 'zlib'
 require 'rack/utils'
@@ -175,15 +174,16 @@ class Roda
 
       def self.load_dependencies(app, opts=OPTS)
         app.plugin :_base64
+        app.plugin :_json
       end
 
       # Configure the plugin, see Sessions for details on options.
       def self.configure(app, opts=OPTS)
-        opts = (app.opts[:sessions] || DEFAULT_OPTIONS).merge(opts)
+        opts = (app.sessions_opts || DEFAULT_OPTIONS).merge(opts)
         co = opts[:cookie_options] = DEFAULT_COOKIE_OPTIONS.merge(opts[:cookie_options] || OPTS).freeze
         opts[:remove_cookie_options] = co.merge(:max_age=>'0', :expires=>Time.at(0))
-        opts[:parser] ||= app.opts[:json_parser] || JSON.method(:parse)
-        opts[:serializer] ||= app.opts[:json_serializer] || :to_json.to_proc
+        opts[:parser] ||= app.json_parser
+        opts[:serializer] ||= app.json_serializer
 
         opts[:per_cookie_cipher_secret] = true unless opts.has_key?(:per_cookie_cipher_secret)
         opts[:session_version_num] = opts[:per_cookie_cipher_secret] ? 1 : 0
@@ -216,6 +216,10 @@ class Roda
         app.opts[:sessions_convert_symbols] = true unless app.opts.has_key?(:sessions_convert_symbols)
       end
 
+      module ClassMethods
+        RodaPlugins.opt_attr_reader(self, :sessions, name: :sessions_opts)
+      end
+
       module InstanceMethods
         # Clear data from the session, and update the request environment
         # so that the session cookie will use a new creation timestamp
@@ -233,7 +237,7 @@ class Roda
         # update the rack response headers to set the session cookie in
         # the response.
         def _roda_after_50__sessions(res)
-          if res && (session = env[self.class.opts[:sessions][:env_key]])
+          if res && (session = env[self.class.sessions_opts[:env_key]])
             @_request.persist_session(res[1], session)
           end
         end
@@ -247,7 +251,7 @@ class Roda
         # this method stores the session in 'rack.session' in the request environment,
         # but that does not happen until this method is called.
         def session
-          @env[roda_class.opts[:sessions][:env_key]] ||= _load_session
+          @env[roda_class.sessions_opts[:env_key]] ||= _load_session
         end
 
         # The time the session was originally created. nil if there is no active session.
@@ -266,7 +270,7 @@ class Roda
         # Rack::Session::Cookie, mark the related cookie for expiration so it isn't
         # sent in the future.
         def persist_session(headers, session)
-          opts = roda_class.opts[:sessions]
+          opts = roda_class.sessions_opts
 
           if session.empty?
             if env[SESSION_SERIALIZED]
@@ -317,7 +321,7 @@ class Roda
         # Load the session by looking for the appropriate cookie, or falling
         # back to the rack session cookie if configured.
         def _load_session
-          opts = roda_class.opts[:sessions]
+          opts = roda_class.sessions_opts
           cs = cookies
 
           if data = cs[opts[:key]]
@@ -340,7 +344,7 @@ class Roda
         # serialized session using the default Rack::Session::Cookie
         # hmac and coder.
         def _deserialize_rack_session(data)
-          opts = roda_class.opts[:sessions]
+          opts = roda_class.sessions_opts
           data, digest = data.split("--", 2)
           unless digest
             return _session_serialization_error("Not decoding Rack::Session::Cookie session: invalid format")
@@ -374,7 +378,7 @@ class Roda
 
         # Interpret given cookie data as a Rack::Session::Cookie
         def _deserialize_session(data)
-          opts = roda_class.opts[:sessions]
+          opts = roda_class.sessions_opts
 
           begin
             data = Base64_.urlsafe_decode64(data)
@@ -466,7 +470,7 @@ class Roda
         end
 
         def _serialize_session(session)
-          opts = roda_class.opts[:sessions]
+          opts = roda_class.sessions_opts
           env = @env
           now = Time.now.to_i
           json_data = opts[:serializer].call(session).force_encoding('BINARY')

data/lib/roda/plugins/shape_friendly.rb

@@ -74,6 +74,8 @@ class Roda
       end
 
       module ClassMethods
+        RodaPlugins.opt_attr_reader(self, :shape_friendly_scope_instance_variables)
+
         # Automatically refresh the instance variables used if the plugin
         # sets instance variables.
         def plugin(plugin, *args, &block)
@@ -90,9 +92,9 @@ class Roda
           end
           nil
         end
-        # :nocov:
+        # simplecov:disable
         ruby2_keywords(:plugin) if respond_to?(:ruby2_keywords, true)
-        # :nocov:
+        # simplecov:enable
 
         private
 
@@ -107,7 +109,7 @@ class Roda
             ivs.concat(mod.const_get(const)) if mod.const_defined?(const)
           end
 
-          if const == :SCOPE_INSTANCE_VARIABLES && (scope_ivs = opts[:shape_friendly_scope_instance_variables])
+          if const == :SCOPE_INSTANCE_VARIABLES && (scope_ivs = shape_friendly_scope_instance_variables)
             ivs.concat(scope_ivs)
           end
 
@@ -132,9 +134,9 @@ class Roda
         end
       end
 
-      # :nocov:
+      # simplecov:disable
       if RUBY_VERSION >= '4.0'
-      # :nocov:
+      # simplecov:enable
         module InstanceMethods
           private
 

data/lib/roda/plugins/sinatra_helpers.rb

@@ -256,6 +256,11 @@ class Roda
         end
       end
 
+      module ClassMethods
+        RodaPlugins.opt_attr_reader(self, :absolute_redirects, name: :absolute_redirects?)
+        RodaPlugins.opt_attr_reader(self, :prefixed_redirects, name: :prefixed_redirects?)
+      end
+
       module RequestMethods
         # Alias for referrer
         def back
@@ -285,9 +290,8 @@ class Roda
         # If the absolute_redirects or :prefixed_redirects roda class options has been set, respect those
         # and update the path.
         def redirect(path=(no_add_script_name = true; default_redirect_path), status=default_redirect_status)
-          opts = roda_class.opts
-          absolute_redirects = opts[:absolute_redirects]
-          prefixed_redirects = no_add_script_name ? false : opts[:prefixed_redirects]
+          absolute_redirects = roda_class.absolute_redirects?
+          prefixed_redirects = no_add_script_name ? false : roda_class.prefixed_redirects?
           path = uri(path, absolute_redirects, prefixed_redirects) if absolute_redirects || prefixed_redirects
           super(path, status)
         end

data/lib/roda/plugins/static.rb

@@ -21,6 +21,9 @@ class Roda
     # uses a separate option for it.
     #
     # Users of this plugin may want to consider using the public plugin instead.
+    # As this only loads a middleware, it does not integrate with other Roda
+    # security features, such as the content_security_policy and host_authorization
+    # plugins.
     # 
     # Examples:
     #

data/lib/roda/plugins/status_handler.rb

@@ -37,6 +37,8 @@ class Roda
       end
 
       module ClassMethods
+        RodaPlugins.opt_attr_reader(self, :status_handler, name: :status_handlers)
+
         # Install the given block as a status handler for the given HTTP response code.
         def status_handler(code, opts=OPTS, &block)
           # For backwards compatibility, pass request argument if block accepts argument
@@ -54,7 +56,7 @@ class Roda
           end
 
           meth = define_roda_method(:"_roda_status_handler__#{code}", arity, &block)
-          self.opts[:status_handler][code] = define_roda_method(:"_roda_status_handler_#{code}", 1) do |result|
+          status_handlers[code] = define_roda_method(:"_roda_status_handler_#{code}", 1) do |result|
             res = @_response
             res.status = result[0]
             handle_headers.call(res.headers)
@@ -64,7 +66,7 @@ class Roda
 
         # Freeze the hash of status handlers so that there can be no thread safety issues at runtime.
         def freeze
-          opts[:status_handler].freeze
+          status_handlers.freeze
           super
         end
       end
@@ -74,7 +76,7 @@ class Roda
 
         # If routing returns a response we have a handler for, call that handler.
         def _roda_after_20__status_handler(result)
-          if result && (meth = opts[:status_handler][result[0]]) && (v = result[2]).is_a?(Array) && v.empty?
+          if result && (meth = self.class.status_handlers[result[0]]) && (v = result[2]).is_a?(Array) && v.empty?
             send(meth, result)
           end
         end

data/lib/roda/plugins/strip_path_prefix.rb

@@ -21,9 +21,11 @@ class Roda
       end
 
       module ClassMethods
+        RodaPlugins.opt_attr_reader(self, :strip_path_prefix, name: :strip_path_prefix_regexp)
+
         # Strip the path prefix from the gien path if it starts with the prefix.
-        def expand_path(path, root=opts[:root])
-          super.sub(opts[:strip_path_prefix], '')
+        def expand_path(path, root=app_root)
+          super.sub(strip_path_prefix_regexp, '')
         end
       end
     end

data/lib/roda/plugins/symbol_matchers.rb

@@ -121,6 +121,8 @@ class Roda
       end
 
       module ClassMethods
+        RodaPlugins.opt_attr_reader(self, :symbol_matchers)
+
         # Set the matcher and block to use for the given class.
         # The matcher can be a regexp, registered symbol matcher, or registered class
         # matcher (if using the class_matchers plugin).
@@ -141,7 +143,7 @@ class Roda
 
         # Freeze the class_matchers hash when freezing the app.
         def freeze
-          opts[:symbol_matchers].freeze
+          symbol_matchers.freeze
           super
         end
       end

data/lib/roda/plugins/symbol_views.rb

@@ -28,7 +28,7 @@ class Roda
       end
 
       def self.configure(app)
-        app.opts[:custom_block_results][Symbol] = :view
+        app.custom_block_results[Symbol] = :view
       end
     end
 

data/lib/roda/plugins/timestamp_public.rb

@@ -46,7 +46,11 @@ class Roda
       #
       # The options given are also passed to the public plugin.
       def self.configure(app, opts=OPTS)
-        app.opts[:timestamp_public_prefix] = (opts[:prefix] || app.opts[:timestamp_public_prefix] || "static").dup.freeze
+        app.opts[:timestamp_public_prefix] = (opts[:prefix] || app.timestamp_public_prefix || "static").dup.freeze
+      end
+
+      module ClassMethods
+        RodaPlugins.opt_attr_reader(self, :timestamp_public_prefix)
       end
 
       module InstanceMethods
@@ -54,8 +58,8 @@ class Roda
         # This does not check the file is inside the directory for performance reasons,
         # so this should not be called with untrusted input.
         def timestamp_path(file)
-          mtime = File.mtime(File.join(opts[:public_root], file))
-          "/#{opts[:timestamp_public_prefix]}/#{sprintf("%i%06i", mtime.to_i, mtime.usec)}/#{file}"
+          mtime = File.mtime(File.join(self.class.public_root, file))
+          "/#{self.class.timestamp_public_prefix}/#{sprintf("%i%06i", mtime.to_i, mtime.usec)}/#{file}"
         end
       end
 
@@ -65,7 +69,7 @@ class Roda
         # a integer segment for the timestamp, and this is a GET request.
         def timestamp_public
           if is_get?
-            on roda_class.opts[:timestamp_public_prefix], Integer do |_|
+            on roda_class.timestamp_public_prefix, Integer do |_|
               public
             end
           end

data/lib/roda/plugins/type_routing.rb

@@ -110,7 +110,7 @@ class Roda
       }.freeze
 
       def self.configure(app, opts = {})
-        config = (app.opts[:type_routing] || CONFIGURATION).dup
+        config = (app.type_routing_opts || CONFIGURATION).dup
         [:use_extension, :use_header, :default_type].each do |key|
           config[key] = opts[key] if opts.has_key?(key)
         end
@@ -149,12 +149,16 @@ class Roda
         app.opts[:type_routing] = config.freeze
       end
 
+      module ClassMethods
+        RodaPlugins.opt_attr_reader(self, :type_routing, name: :type_routing_opts)
+      end
+
       module RequestMethods
         # Yields if the given +type+ matches the requested data type and halts
         # the request afterwards, returning the result of the block.
         def on_type(type, &block)
           return unless type == requested_type
-          response[RodaResponseHeaders::CONTENT_TYPE] ||= @scope.opts[:type_routing][:types][type]
+          response[RodaResponseHeaders::CONTENT_TYPE] ||= roda_class.type_routing_opts[:types][type]
           always(&block)
         end
 
@@ -162,7 +166,7 @@ class Roda
         def requested_type
           return @requested_type if @requested_type
 
-          opts = @scope.opts[:type_routing]
+          opts = roda_class.type_routing_opts
           @requested_type = accept_response_type if opts[:use_header]
           @requested_type ||= opts[:default_type]
         end
@@ -182,7 +186,7 @@ class Roda
         # Removes a trailing file extension from the path, and sets
         # the requested type if so.
         def _remaining_path(env)
-          opts = scope.opts[:type_routing]
+          opts = roda_class.type_routing_opts
           path = super
 
           if opts[:use_extension]
@@ -197,12 +201,12 @@ class Roda
 
         # The response type indicated by the Accept request header.
         def accept_response_type
-          mimes = @scope.opts[:type_routing][:mimes]
+          mimes = roda_class.type_routing_opts[:mimes]
+          response[RodaResponseHeaders::VARY] = (vary = response[RodaResponseHeaders::VARY]) ? "#{vary}, Accept" : 'Accept'
 
           @env['HTTP_ACCEPT'].to_s.split(/\s*,\s*/).map do |part|
             mime, _= part.split(/\s*;\s*/, 2)
             if sym = mimes[mime]
-              response[RodaResponseHeaders::VARY] = (vary = response[RodaResponseHeaders::VARY]) ? "#{vary}, Accept" : 'Accept'
               return sym
             end
           end