roda 3.85.0 → 3.86.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a862ed0414bf90081e744ed7c50ac19806f141ebeae8c699d5f96b9a4e718e10
-  data.tar.gz: b1fcd622255d24044ba7f26c2c3f35e5fc8ea7f30b2ba577bec5fe306ca75c76
+  metadata.gz: a1851a201539b728f1af90ea1b85b2b33a9026f71986cb65c1aabdd079f653ad
+  data.tar.gz: f360e0bfeb3442df2fa1f96e28362eee9850c0f54d160bfbfc2b11d62d33ba39
 SHA512:
-  metadata.gz: '086d21f564d66b14fafabbb99c6d670559c12fed91105c1acb9e5e9147623bf15de0730d35f2b5bd098a6e26aba0d6a73497a914ee23d97d8cb58dbbf0f6dd5b'
-  data.tar.gz: 713dee3419ce7bf52742d7da6be4243c393b393aeb5762dcd0dc61a58d691e586226636b5df687e56e0dd280a89930a18b1e32f3c9b499516afc461cf92fcf4c
+  metadata.gz: d2bef4abc3d5e08ddb5a1c9c27f8b626b631a5951cec7cee062c497074cb7f68e6c8b36e75261cc913a580a87d5111438e8a21488669812c9a3b227bf9609e0b
+  data.tar.gz: e668a47039e529aa026e21ddfd6346b3e1fa224f432b46085b33242c9551ced88278328f2d2d471b2593f841da0a882d8f85dd2468277484409f679485a219df

data/lib/roda/plugins/autoload_hash_branches.rb

@@ -68,7 +68,7 @@ class Roda
 
         # Eagerly load all hash branches when freezing the application.
         def freeze
-          opts.delete(:autoload_hash_branch_files).each{|file| require file}
+          opts.delete(:autoload_hash_branch_files).each{|file| require file} unless opts.frozen?
           super
         end
       end

data/lib/roda/plugins/autoload_named_routes.rb

@@ -54,7 +54,7 @@ class Roda
 
         # Eagerly load all autoloaded named routes when freezing the application.
         def freeze
-          opts.delete(:autoload_named_route_files).each{|file| require file}
+          opts.delete(:autoload_named_route_files).each{|file| require file} unless opts.frozen?
           super
         end
       end

data/lib/roda/plugins/conditional_sessions.rb

@@ -0,0 +1,67 @@
+# frozen-string-literal: true
+
+class Roda
+  module RodaPlugins
+    # The conditional_sessions plugin loads the sessions plugin.  However,
+    # it only allows sessions if the block passed to the plugin returns
+    # truthy.  The block is evaluated in request context. This is designed for
+    # use in applications that want to use sessions for some requests,
+    # and want to be sure that sessions are not used for other requests.
+    # For example, if you want to make sure that sessions are not used for
+    # requests with paths starting with /static, you could do:
+    #
+    #   plugin :conditional_sessions, secret: ENV["SECRET"] do
+    #     !path_info.start_with?('/static')
+    #   end
+    #
+    # The the request session, session_created_at, and session_updated_at methods
+    # raise a RodaError exception when sessions are not allowed.  The request
+    # persist_session and route scope clear_session methods do nothing when
+    # sessions are not allowed.
+    module ConditionalSessions
+      # Pass all options to the sessions block, and use the block to define
+      # a request method for whether sessions are allowed.
+      def self.load_dependencies(app, opts=OPTS, &block)
+        app.plugin :sessions, opts
+        app::RodaRequest.class_eval do
+          define_method(:use_sessions?, &block)
+          alias use_sessions? use_sessions?
+        end
+      end
+
+      module InstanceMethods
+        # Do nothing if not using sessions.
+        def clear_session
+          super if @_request.use_sessions?
+        end
+      end
+
+      module RequestMethods
+        # Raise RodaError if not using sessions.
+        def session
+          raise RodaError, "session called on request not using sessions" unless use_sessions?
+          super
+        end
+
+        # Raise RodaError if not using sessions.
+        def session_created_at
+          raise RodaError, "session_created_at called on request not using sessions" unless use_sessions?
+          super
+        end
+
+        # Raise RodaError if not using sessions.
+        def session_updated_at
+          raise RodaError, "session_updated_at called on request not using sessions" unless use_sessions?
+          super
+        end
+
+        # Do nothing if not using sessions.
+        def persist_session(headers, session)
+          super if use_sessions?
+        end
+      end
+    end
+
+    register_plugin(:conditional_sessions, ConditionalSessions)
+  end
+end

data/lib/roda/plugins/content_security_policy.rb

@@ -92,7 +92,10 @@ class Roda
     #   content_security_policy.get_script_src
     #   # => [:self, :unsafe_eval, 'example.com', [:nonce, 'foobarbaz']]
     #
-    # The clear method can be used to remove all settings from the policy.
+    # The clear method can be used to remove all settings from the policy. Empty policies
+    # do not set any headers. You can use +response.skip_content_security_policy!+ to skip
+    # setting a policy.  This is faster than calling +content_security_policy.clear+, since
+    # it does not duplicate the default policy.
     #
     # The following methods to set boolean settings are also defined:
     #
@@ -304,12 +307,19 @@ class Roda
           @content_security_policy ||= roda_class.opts[:content_security_policy].dup
         end
 
+        # Do not set a content security policy header for this response.
+        def skip_content_security_policy!
+          @skip_content_security_policy = true
+        end
+
         private
 
         # Set the appropriate content security policy header.
         def set_default_headers
           super
-          (@content_security_policy || roda_class.opts[:content_security_policy]).set_header(headers)
+          unless @skip_content_security_policy
+            (@content_security_policy || roda_class.opts[:content_security_policy]).set_header(headers)
+          end
         end
       end
     end

data/lib/roda/plugins/early_hints.rb

@@ -4,8 +4,7 @@
 class Roda
   module RodaPlugins
     # The early_hints plugin allows sending 103 Early Hints responses
-    # using the rack.early_hints environment variable.  Currently, this
-    # is only supported by puma 3.11+, and on other servers this is a no-op.
+    # using the rack.early_hints environment variable.
     # Early hints allow clients to preload necessary files before receiving
     # the response.
     module EarlyHints

data/lib/roda/plugins/permissions_policy.rb

@@ -99,7 +99,10 @@ class Roda
     #   permissions_policy.get_fullscreen
     #   # => [:self, "https://example.com", "https://*.example.com"]
     #
-    # The clear method can be used to remove all settings from the policy.
+    # The clear method can be used to remove all settings from the policy. Empty policies
+    # do not set any headers. You can use +response.skip_permissions_policy!+ to skip
+    # setting a policy.  This is faster than calling +permissions_policy.clear+, since
+    # it does not duplicate the default policy.
     module PermissionsPolicy
       SUPPORTED_SETTINGS = %w'
       accelerometer
@@ -311,12 +314,19 @@ class Roda
           @permissions_policy ||= roda_class.opts[:permissions_policy].dup
         end
 
+        # Do not set a permissions policy header for this response.
+        def skip_permissions_policy!
+          @skip_permissions_policy = true
+        end
+
         private
 
         # Set the appropriate permissions policy header.
         def set_default_headers
           super
-          (@permissions_policy || roda_class.opts[:permissions_policy]).set_header(headers)
+          unless @skip_permissions_policy
+            (@permissions_policy || roda_class.opts[:permissions_policy]).set_header(headers)
+          end
         end
       end
     end

data/lib/roda/version.rb

@@ -4,7 +4,7 @@ class Roda
   RodaMajorVersion = 3
 
   # The minor version of Roda, updated for new feature releases of Roda.
-  RodaMinorVersion = 85
+  RodaMinorVersion = 86
 
   # The patch version of Roda, updated only for bug fixes from the last
   # feature release.

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: roda
 version: !ruby/object:Gem::Version
-  version: 3.85.0
+  version: 3.86.0
 platform: ruby
 authors:
 - Jeremy Evans
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-10-11 00:00:00.000000000 Z
+date: 2024-11-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
@@ -186,6 +186,7 @@ files:
 - lib/roda/plugins/class_level_routing.rb
 - lib/roda/plugins/class_matchers.rb
 - lib/roda/plugins/common_logger.rb
+- lib/roda/plugins/conditional_sessions.rb
 - lib/roda/plugins/content_for.rb
 - lib/roda/plugins/content_security_policy.rb
 - lib/roda/plugins/cookie_flags.rb
@@ -326,7 +327,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.16
+rubygems_version: 3.5.22
 signing_key:
 specification_version: 4
 summary: Routing tree web toolkit