roda 3.83.0 → 3.85.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8f3ad50e6de6bdfa7e2019cbcbe4a07b920a23adb30645616340b8bc007951a1
-  data.tar.gz: b5bd2835bb0f5286fb92555c602949482c4730b3497de4506a841a6ab3e80718
+  metadata.gz: a862ed0414bf90081e744ed7c50ac19806f141ebeae8c699d5f96b9a4e718e10
+  data.tar.gz: b1fcd622255d24044ba7f26c2c3f35e5fc8ea7f30b2ba577bec5fe306ca75c76
 SHA512:
-  metadata.gz: 8e6937b542ae838a0b4e79171936fc3cd937faf127900b34265ff9e0923144bf5cf25879fe0103b43b51fb9c940e1dfc6c058f91eb02bab23177369e3b0424f7
-  data.tar.gz: d7515ac6becbb47900713e5349b52eb41e284391c5a75743b4e3adcb3609a8ad09a20b8e38e7d85ddb59c52681396a9ec2b1b82b3264752731837b873907835d
+  metadata.gz: '086d21f564d66b14fafabbb99c6d670559c12fed91105c1acb9e5e9147623bf15de0730d35f2b5bd098a6e26aba0d6a73497a914ee23d97d8cb58dbbf0f6dd5b'
+  data.tar.gz: 713dee3419ce7bf52742d7da6be4243c393b393aeb5762dcd0dc61a58d691e586226636b5df687e56e0dd280a89930a18b1e32f3c9b499516afc461cf92fcf4c

data/lib/roda/plugins/Integer_matcher_max.rb

@@ -23,27 +23,28 @@ class Roda
     module IntegerMatcherMax
       def self.configure(app, max=nil)
         if max
-          app::RodaRequest.class_eval do
-            define_method(:_match_class_max_Integer){max}
-            alias_method :_match_class_max_Integer, :_match_class_max_Integer
-            private :_match_class_max_Integer
+          app.class_eval do
+            meth = :_max_value_convert_class_Integer
+            define_method(meth){max}
+            alias_method meth, meth
+            private meth
           end
         end
       end
 
-      module RequestMethods
+      module InstanceMethods
         private
 
         # Do not have the Integer matcher max when over the maximum
         # configured Integer value.
-        def _match_class_convert_Integer(value)
+        def _convert_class_Integer(value)
           value = super
-          value if value <= _match_class_max_Integer
+          value if value <= _max_value_convert_class_Integer
         end
 
         # Use 2**63-1 as the default maximum value for the Integer
         # matcher.
-        def _match_class_max_Integer
+        def _max_value_convert_class_Integer
           9223372036854775807
         end
       end

data/lib/roda/plugins/_optimized_matching.rb

@@ -52,7 +52,7 @@ class Roda
                   end
                 end
               elsif matcher == Integer
-                if (matchdata = /\A\/(\d{1,100})(?=\/|\z)/.match(@remaining_path)) && (value = _match_class_convert_Integer(matchdata[1]))
+                if (matchdata = /\A\/(\d{1,100})(?=\/|\z)/.match(@remaining_path)) && (value = scope.send(:_convert_class_Integer, matchdata[1]))
                   @remaining_path = matchdata.post_match
                   always{yield(value)}
                 end
@@ -151,7 +151,7 @@ class Roda
                 always{yield rp[1, len]}
               end
             elsif matcher == Integer
-              if (matchdata = /\A\/(\d{1,100})\z/.match(@remaining_path)) && (value = _match_class_convert_Integer(matchdata[1]))
+              if (matchdata = /\A\/(\d{1,100})\z/.match(@remaining_path)) && (value = scope.send(:_convert_class_Integer, matchdata[1]))
                 @remaining_path = ''
                 always{yield(value)}
               end

data/lib/roda/plugins/_symbol_class_matchers.rb

@@ -0,0 +1,107 @@
+# frozen-string-literal: true
+
+#
+class Roda
+  module RodaPlugins
+    module SymbolClassMatchers_
+      module ClassMethods
+        private
+
+        # Backend of symbol_matcher and class_matcher.
+        def _symbol_class_matcher(expected_class, obj, matcher, block, &request_class_block)
+          unless obj.is_a?(expected_class)
+            raise RodaError, "Invalid type passed to class_matcher or symbol_matcher: #{matcher.inspect}"
+          end
+
+          if obj.is_a?(Symbol)
+            type = "symbol"
+            meth = :"match_symbol_#{obj}"
+          else
+            type = "class"
+            meth = :"_match_class_#{obj}"
+          end
+
+          case matcher
+          when Regexp
+            regexp = matcher
+            consume_regexp = self::RodaRequest.send(:consume_pattern, regexp)
+          when Symbol
+            unless opts[:symbol_matchers]
+              raise RodaError, "cannot provide Symbol matcher to class_matcher unless using symbol_matchers plugin: #{matcher.inspect}"
+            end
+
+            regexp, consume_regexp, matcher_block = opts[:symbol_matchers][matcher]
+
+            unless regexp
+              raise RodaError, "unregistered symbol matcher given to #{type}_matcher: #{matcher.inspect}"
+            end
+
+            block = _merge_matcher_blocks(type, obj, block, matcher_block)
+          when Class
+            unless opts[:class_matchers]
+              raise RodaError, "cannot provide Class matcher to symbol_matcher unless using class_matchers plugin: #{matcher.inspect}"
+            end
+
+            regexp, consume_regexp, matcher_block = opts[:class_matchers][matcher]
+            unless regexp
+              raise RodaError, "unregistered class matcher given to #{type}_matcher: #{matcher.inspect}"
+            end
+            block = _merge_matcher_blocks(type, obj, block, matcher_block)
+          else
+            raise RodaError, "unsupported matcher given to #{type}_matcher: #{matcher.inspect}"
+          end
+
+          if block.is_a?(Symbol)
+            convert_meth = block
+          elsif block
+            convert_meth = :"_convert_#{type}_#{obj}"
+            define_method(convert_meth, &block)
+            private convert_meth
+          end
+
+          array = opts[:"#{type}_matchers"][obj] = [regexp, consume_regexp, convert_meth].freeze
+
+          self::RodaRequest.class_eval do
+            class_exec(meth, array, &request_class_block)
+            private meth
+          end
+
+          nil
+        end
+
+        # If both block and matche_meth are given, 
+        # define a method for block, and then return a
+        # proc that calls matcher_meth first, and only calls
+        # the newly defined method with the return values of matcher_meth
+        # if matcher_method returns a truthy value.
+        # Otherwise, return matcher_meth or block.
+        def _merge_matcher_blocks(type, obj, block, matcher_meth)
+          if matcher_meth
+            if block
+              convert_meth = :"_convert_merge_#{type}_#{obj}"
+              define_method(convert_meth, &block)
+              private convert_meth
+
+              proc do |*a|
+                if captures = send(matcher_meth, *a)
+                  if captures.is_a?(Array)
+                    send(convert_meth, *captures)
+                  else
+                    send(convert_meth, captures)
+                  end
+                end
+              end
+            else
+              matcher_meth
+            end
+          else
+            block
+          end
+        end
+      end
+    end
+
+    register_plugin(:_symbol_class_matchers, SymbolClassMatchers_)
+  end
+end
+

data/lib/roda/plugins/capture_erb.rb

@@ -16,10 +16,11 @@ class Roda
     # to wrap template blocks with arbitrary output and then inject the
     # wrapped output into the template.
     #
-    # If the output buffer object responds to +capture+ (e.g. when
-    # +erubi/capture_block+ is being used as the template engine),
-    # this will call +capture+ on the output buffer object, instead
-    # of setting the output buffer object temporarily to a new object.
+    # If the output buffer object responds to +capture+ and is not
+    # an instance of String (e.g. when +erubi/capture_block+ is being
+    # used as the template engine), this will call +capture+ on the
+    # output buffer object, instead of setting the output buffer object
+    # temporarily to a new object.
     module CaptureERB
       def self.load_dependencies(app)
         app.plugin :render
@@ -34,7 +35,7 @@ class Roda
           outvar = render_opts[:template_opts][:outvar]
           buf_was = instance_variable_get(outvar)
 
-          if buf_was.respond_to?(:capture)
+          if buf_was.respond_to?(:capture) && !buf_was.instance_of?(String)
             buf_was.capture(&block)
           else
             begin

data/lib/roda/plugins/class_matchers.rb

@@ -12,11 +12,10 @@ class Roda
     #     # ...
     #   end
     #
-    # You can register a Date class matcher for that regexp (note that
-    # the block must return an array):
+    # You can register a Date class matcher for that regexp:
     #
     #   class_matcher(Date, /(\d\d\d\d)-(\d\d)-(\d\d)/) do |y, m, d|
-    #     [Date.new(y.to_i, m.to_i, d.to_i)]
+    #     Date.new(y.to_i, m.to_i, d.to_i)
     #   end
     #
     # And then use the Date class as a matcher, and it will yield a Date object:
@@ -26,7 +25,8 @@ class Roda
     #   end
     #
     # This is useful to DRY up code if you are using the same type of pattern and
-    # type conversion in multiple places in your application.
+    # type conversion in multiple places in your application. You can have the
+    # block return an array to yield multiple captures.
     #
     # If you have a segment match the passed regexp, but decide during block
     # processing that you do not want to treat it as a match, you can have the
@@ -37,22 +37,99 @@ class Roda
     #     y = y.to_i
     #     m = m.to_i
     #     d = d.to_i
-    #     [Date.new(y, m, d)] if Date.valid_date?(y, m, d)
+    #     Date.new(y, m, d) if Date.valid_date?(y, m, d)
     #   end
     #
+    # The second argument to class_matcher can be a class already registered
+    # as a class matcher. This can DRY up code that wants a conversion
+    # performed by an existing class matcher:
+    #
+    #   class_matcher Employee, Integer do |id|
+    #     Employee[id]
+    #   end
+    #
+    # With the above example, the Integer matcher performs the conversion to
+    # integer, so +id+ is yielded as an integer.  The block then looks up the
+    # employee with that id.  If there is no employee with that id, then
+    # the Employee matcher will not match.
+    #
+    # If using the symbol_matchers plugin, you can provide a recognized symbol
+    # matcher as the second argument to class_matcher, and it will work in
+    # a similar manner:
+    #
+    #   symbol_matcher(:employee_id, /E-(\d{6})/) do |employee_id|
+    #     employee_id.to_i
+    #   end
+    #   class_matcher Employee, :employee_id do |id|
+    #     Employee[id]
+    #   end
+    #
+    # Blocks passed to the class_matchers plugin are evaluated in route
+    # block context.
+    #
     # This plugin does not work with the params_capturing plugin, as it does not
     # offer the ability to associate block arguments with named keys.
     module ClassMatchers
+      def self.load_dependencies(app)
+        app.plugin :_symbol_class_matchers
+      end
+
+      def self.configure(app)
+        app.opts[:class_matchers] ||= {
+          Integer=>[/(\d{1,100})/, /\A\/(\d{1,100})(?=\/|\z)/, :_convert_class_Integer].freeze,
+          String=>[/([^\/]+)/, nil, nil].freeze
+        }
+      end
+
       module ClassMethods
-        # Set the regexp to use for the given class.  The block given will be
-        # called with all matched values from the regexp, and should return an
-        # array with the captures to yield to the match block.
-        def class_matcher(klass, re, &block)
-          meth = :"_match_class_#{klass}"
-          self::RodaRequest.class_eval do
-            consume_re = consume_pattern(re)
-            define_method(meth){consume(consume_re, &block)}
-            private meth
+        # Set the matcher and block to use for the given class.
+        # The matcher can be a regexp, registered class matcher, or registered symbol
+        # matcher (if using the symbol_matchers plugin).
+        #
+        # If providing a regexp, the block given will be called with all regexp captures.
+        # If providing a registered class or symbol, the block will be called with the
+        # captures returned by the block for the registered class or symbol, or the regexp
+        # captures if no block was registered with the class or symbol. In either case,
+        # if a block is given, it should return an array with the captures to yield to
+        # the match block.
+        def class_matcher(klass, matcher, &block)
+          _symbol_class_matcher(Class, klass, matcher, block) do |meth, (_, regexp, convert_meth)|
+            if regexp
+              define_method(meth){consume(regexp, convert_meth)}
+            else
+              define_method(meth){_consume_segment(convert_meth)}
+            end
+          end
+        end
+
+        # Freeze the class_matchers hash when freezing the app.
+        def freeze
+          opts[:class_matchers].freeze
+          super
+        end
+      end
+
+      module RequestMethods
+        # Use faster approach for segment matching.  This is used for
+        # matchers based on the String class matcher, and avoids the
+        # use of regular expressions for scanning.
+        def _consume_segment(convert_meth)
+          rp = @remaining_path
+          if _match_class_String
+            if convert_meth
+              if captures = scope.send(convert_meth, @captures.pop)
+                if captures.is_a?(Array)
+                  @captures.concat(captures)
+                else
+                  @captures << captures
+                end
+              else
+                @remaining_path = rp
+                nil
+              end
+            else
+              true
+            end
           end
         end
       end

data/lib/roda/plugins/hsts.rb

@@ -0,0 +1,35 @@
+# frozen-string-literal: true
+
+#
+class Roda
+  module RodaPlugins
+    # The hsts plugin allows for easily configuring an appropriate
+    # Strict-Transport-Security response header for the application:
+    #
+    #   plugin :hsts
+    #   # Strict-Transport-Security: max-age=63072000; includeSubDomains
+    #
+    #   plugin :hsts, preload: true
+    #   # Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
+    #
+    #   plugin :hsts, max_age: 31536000, subdomains: false
+    #   # Strict-Transport-Security: max-age=31536000
+    module Hsts
+      # Ensure default_headers plugin is loaded first
+      def self.load_dependencies(app, opts=OPTS)
+        app.plugin :default_headers
+      end
+
+      # Configure the Strict-Transport-Security header. Options:
+      # :max_age :: Set max-age in seconds (default is 63072000, two years)
+      # :preload :: Set preload, so the domain can be included in HSTS preload lists
+      # :subdomains :: Set to false to not set includeSubDomains. By default, 
+      #                includeSubDomains is set to enforce HTTPS for subdomains.
+      def self.configure(app, opts=OPTS)
+        app.plugin :default_headers, RodaResponseHeaders::STRICT_TRANSPORT_SECURITY => "max-age=#{opts[:max_age]||63072000}#{'; includeSubDomains' unless opts[:subdomains] == false}#{'; preload' if opts[:preload]}".freeze
+      end
+    end
+
+    register_plugin(:hsts, Hsts)
+  end
+end

data/lib/roda/plugins/placeholder_string_matchers.rb

@@ -21,6 +21,10 @@ class Roda
     #
     #   r.is "foo", String
     #   r.is "foo", :bar 
+    #
+    # If used with the symbol_matchers plugin, this plugin respects the regexps
+    # for the registered symbols, but it does not perform the conversions, the
+    # captures for the regexp are used directly as the captures for the match method.
     module PlaceholderStringMatchers
       def self.load_dependencies(app)
         app.plugin :_symbol_regexp_matchers

data/lib/roda/plugins/public.rb

@@ -42,12 +42,12 @@ class Roda
     #   end
     module Public
       SPLIT = Regexp.union(*[File::SEPARATOR, File::ALT_SEPARATOR].compact)
-      PARSER = URI::DEFAULT_PARSER
       RACK_FILES = defined?(Rack::Files) ? Rack::Files : Rack::File
       ENCODING_MAP = {:zstd=>'zstd', :brotli=>'br', :gzip=>'gzip'}.freeze
       ENCODING_EXTENSIONS = {'br'=>'.br', 'gzip'=>'.gz', 'zstd'=>'.zst'}.freeze
 
       # :nocov:
+      PARSER = defined?(::URI::RFC2396_PARSER) ? ::URI::RFC2396_PARSER : ::URI::DEFAULT_PARSER
       MATCH_METHOD = RUBY_VERSION >= '2.4' ? :match? : :match
       # :nocov:
 

data/lib/roda/plugins/render.rb

@@ -48,7 +48,7 @@ class Roda
     #
     # :allowed_paths :: Set the template paths to allow.  Attempts to render paths outside
     #                   of these paths will raise an error.  Defaults to the +:views+ directory.
-    # :cache :: nil/false to explicitly disable premanent template caching.  By default, permanent
+    # :cache :: nil/false to explicitly disable permanent template caching.  By default, permanent
     #           template caching is disabled by default if RACK_ENV is development.  When permanent
     #           template caching is disabled, for templates with paths in the file system, the
     #           modification time of the file will be checked on every render, and if it has changed,

data/lib/roda/plugins/symbol_matchers.rb

@@ -23,7 +23,7 @@ class Roda
     #
     # :d :: <tt>/(\d+)/</tt>, a decimal segment
     # :rest :: <tt>/(.*)/</tt>, all remaining characters, if any
-    # :w :: <tt>/(\w+)/</tt>, a alphanumeric segment
+    # :w :: <tt>/(\w+)/</tt>, an alphanumeric segment
     #
     # If the placeholder_string_matchers plugin is loaded, this feature also applies to
     # placeholders in strings, so the following:
@@ -39,11 +39,10 @@ class Roda
     # be loaded first.
     #
     # You can provide a block when calling +symbol_matcher+, and it will be called
-    # for all matches to allow for type conversion.  The block must return an
-    # array:
+    # for all matches to allow for type conversion:
     #
     #   symbol_matcher(:date, /(\d\d\d\d)-(\d\d)-(\d\d)/) do |y, m, d|
-    #     [Date.new(y.to_i, m.to_i, d.to_i)]
+    #     Date.new(y.to_i, m.to_i, d.to_i)
     #   end
     #
     #   route do |r|
@@ -61,29 +60,80 @@ class Roda
     #     y = y.to_i
     #     m = m.to_i
     #     d = d.to_i
-    #     [Date.new(y, m, d)] if Date.valid_date?(y, m, d)
+    #     Date.new(y, m, d) if Date.valid_date?(y, m, d)
     #   end
     #
-    # However, if providing a block to the symbol_matchers plugin, the symbol may 
-    # not work with the params_capturing plugin.
+    # You can have the block return an array to yield multiple captures.
+    #
+    # The second argument to symbol_matcher can be a symbol already registered
+    # as a symbol matcher. This can DRY up code that wants a conversion
+    # performed by an existing class matcher or to use the same regexp:
+    #
+    #   symbol_matcher :employee_id, :d do |id|
+    #     id.to_i
+    #   end
+    #   symbol_matcher :employee, :employee_id do |id|
+    #     Employee[id]
+    #   end
+    #
+    # With the above example, the :d matcher matches only decimal strings, but
+    # yields them as string.  The registered :employee_id matcher converts the
+    # decimal string to an integer.  The registered :employee matcher builds
+    # on that and uses the integer to lookup the related employee.  If there is
+    # no employee with that id, then the :employee matcher will not match.
+    #
+    # If using the class_matchers plugin, you can provide a recognized class
+    # matcher as the second argument to symbol_matcher, and it will work in
+    # a similar manner:
+    #
+    #   symbol_matcher :employee, Integer do |id|
+    #     Employee[id]
+    #   end
+    #
+    # Blocks passed to the symbol matchers plugin are evaluated in route
+    # block context.
+    #
+    # If providing a block to the symbol_matchers plugin, the symbol may 
+    # not work with the params_capturing plugin. Note that the use of
+    # symbol matchers inside strings when using the placeholder_string_matchers
+    # plugin only uses the regexp, it does not respect the conversion blocks
+    # registered with the symbols.
     module SymbolMatchers
       def self.load_dependencies(app)
         app.plugin :_symbol_regexp_matchers
+        app.plugin :_symbol_class_matchers
       end
 
       def self.configure(app)
+        app.opts[:symbol_matchers] ||= {}
         app.symbol_matcher(:d, /(\d+)/)
         app.symbol_matcher(:w, /(\w+)/)
         app.symbol_matcher(:rest, /(.*)/)
       end
 
       module ClassMethods
-        # Set the regexp to use for the given symbol, instead of the default.
-        def symbol_matcher(s, re, &block)
-          meth = :"match_symbol_#{s}"
-          array = [re, block].freeze
-          self::RodaRequest.send(:define_method, meth){array}
-          self::RodaRequest.send(:private, meth)
+        # Set the matcher and block to use for the given class.
+        # The matcher can be a regexp, registered symbol matcher, or registered class
+        # matcher (if using the class_matchers plugin).
+        #
+        # If providing a regexp, the block given will be called with all regexp captures.
+        # If providing a registered symbol or class, the block will be called with the
+        # captures returned by the block for the registered symbol or class, or the regexp
+        # captures if no block was registered with the symbol or class. In either case,
+        # if a block is given, it should return an array with the captures to yield to
+        # the match block.
+        def symbol_matcher(s, matcher, &block)
+          _symbol_class_matcher(Symbol, s, matcher, block) do |meth, array|
+            define_method(meth){array}
+          end
+
+          nil
+        end
+
+        # Freeze the class_matchers hash when freezing the app.
+        def freeze
+          opts[:symbol_matchers].freeze
+          super
         end
       end
 
@@ -97,8 +147,13 @@ class Roda
           meth = :"match_symbol_#{s}"
           if respond_to?(meth, true)
             # Allow calling private match methods
-            re, block = send(meth)
-            consume(self.class.cached_matcher(re){re}, &block)
+            _, re, convert_meth = send(meth)
+            if re
+              consume(re, convert_meth)
+            else
+              # defined in class_matchers plugin
+              _consume_segment(convert_meth)
+            end
           else
             super
           end

data/lib/roda/request.rb

@@ -443,16 +443,7 @@ class Roda
         # Match integer segment of up to 100 decimal characters, and yield resulting value as an
         # integer.
         def _match_class_Integer
-          consume(/\A\/(\d{1,100})(?=\/|\z)/) do |i|
-            if i = _match_class_convert_Integer(i)
-              [i]
-            end
-          end
-        end
-
-        # Convert the segment matched by the Integer matcher to an integer.
-        def _match_class_convert_Integer(value)
-          value.to_i
+          consume(/\A\/(\d{1,100})(?=\/|\z)/, :_convert_class_Integer)
         end
 
         # Match only if all of the arguments in the given array match.
@@ -555,14 +546,26 @@ class Roda
         # match, returns false without changes.  Otherwise, modifies
         # SCRIPT_NAME to include the matched path, removes the matched
         # path from PATH_INFO, and updates captures with any regex captures.
-        def consume(pattern)
+        def consume(pattern, meth=nil)
           if matchdata = pattern.match(@remaining_path)
             captures = matchdata.captures
-            if defined?(yield)
+
+            if meth
+              return unless captures = scope.send(meth, *captures)
+            # :nocov:
+            elsif defined?(yield)
+              # RODA4: Remove
               return unless captures = yield(*captures)
+            # :nocov:
             end
+
             @remaining_path = matchdata.post_match
-            @captures.concat(captures)
+
+            if captures.is_a?(Array)
+              @captures.concat(captures)
+            else
+              @captures << captures
+            end
           end
         end
 

data/lib/roda/response.rb

@@ -15,7 +15,7 @@ class Roda
     %w'Allow Cache-Control Content-Disposition Content-Encoding Content-Length
        Content-Security-Policy Content-Security-Policy-Report-Only Content-Type
        ETag Expires Last-Modified Link Location Set-Cookie Transfer-Encoding Vary
-       Permissions-Policy Permissions-Policy-Report-Only'.
+       Permissions-Policy Permissions-Policy-Report-Only Strict-Transport-Security'.
       each do |value|
         value = value.downcase if downcase
         const_set(value.gsub('-', '_').upcase!.to_sym, value.freeze)

data/lib/roda/version.rb

@@ -4,7 +4,7 @@ class Roda
   RodaMajorVersion = 3
 
   # The minor version of Roda, updated for new feature releases of Roda.
-  RodaMinorVersion = 83
+  RodaMinorVersion = 85
 
   # The patch version of Roda, updated only for bug fixes from the last
   # feature release.

data/lib/roda.rb

@@ -570,6 +570,13 @@ WARNING
         def session
           @_request.session
         end
+
+        private
+
+        # Convert the segment matched by the Integer matcher to an integer.
+        def _convert_class_Integer(value)
+          value.to_i
+        end
       end
     end
   end