roda 3.72.0 → 3.73.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d5c28e38d35f59176f159798f68d82bbd30df62a5907ace3a3750b1daf7b4fe6
-  data.tar.gz: cb5fd8d5a9d665bc820c55ccbf1fd6a068873ae3e265a1f877bbdf82b51c4d6e
+  metadata.gz: 7a47f703af806a15f523b99b38d084520bada92f23196374d6d9781d5953faa8
+  data.tar.gz: 4612153820b89e6dbcfa2370c04269666c49277d8f11256869f6c1f0bb0b571a
 SHA512:
-  metadata.gz: d8710537511b8f332c443fd41bd279c99de53c0bc9618cd92f763ab7d354f70c4496ba9eafa076438087b5ab52f36e69f649aa00d2fb6f07d5315b7d61aef4a1
-  data.tar.gz: e0af216b465facc81e81ab8a495d472685c26aa6b2c1d56c0e48631586555f78f4d5922ac5ee92c6118a08b8162ee35866dc5708155bdbed70d5851b2ff8339b
+  metadata.gz: bdc42cdc9540750195327dac290e3f0bb08c3ed0100b610441b644c85849e7e9f9f974013cea041cdf640f590e2027996d68b62eea9c31d41bd42a57df6530bb
+  data.tar.gz: 3ab05db704cf45803ad706e78b558ea7798d8d9782a06c7dec79814a4d862582249e5554946c59fff88e1f1d2d360e242268c593a8c9c95fe87b5489e4a4a44c

data/CHANGELOG

@@ -1,3 +1,9 @@
+= 3.73.0 (2023-10-13)
+
+* Support :next_if_not_found option for middleware plugin (jeremyevans) (#334)
+
+* Remove dependency on base64 library from sessions and route_csrf plugin, as it will not be part of the standard library in Ruby 3.4+ (jeremyevans)
+
 = 3.72.0 (2023-09-12)
 
 * Add invalid_request_body plugin for custom handling of invalid request bodies (jeremyevans)

data/doc/release_notes/3.73.0.txt

@@ -0,0 +1,33 @@
+= New Features
+
+* The middleware plugin now accepts a :next_if_not_found option.
+  This allows the middleware plugin to pass the request to the next
+  application if the current application handles the request but
+  ends up calling the not_found handler.  With the following
+  middleware:
+
+    class Mid < Roda
+      plugin :middleware
+
+      route do |r|
+        r.on "foo" do
+          r.get "bar" do
+            'bar'
+          end
+        end
+      end
+    end
+
+  Requests for /x would be forwarded to the next application, since
+  the application doesn't handle the request, but requests for /foo/x
+  would not be, because the middleware is partially handling the
+  request in the r.on "foo" block.  With the :next_if_not_found
+  option, only requests for /foo/bar would be handled by the
+  middleware, and all other requests would be forwarded to the next
+  application.
+
+= Other Improvements
+
+* The sessions and route_csrf plugins no longer depend on the base64
+  library. base64 will be removed from Ruby's standard library
+  starting in Ruby 3.4.

data/lib/roda/plugins/_base64.rb

@@ -0,0 +1,34 @@
+# frozen-string-literal: true
+
+#
+class Roda
+  module RodaPlugins
+    module Base64_
+      class << self
+        if RUBY_VERSION >= '2.4'
+          def decode64(str)
+            str.unpack1("m0")
+          end
+        # :nocov:
+        else
+          def decode64(str)
+            str.unpack("m0")[0]
+          end
+        # :nocov:
+        end
+
+        def urlsafe_encode64(bin)
+          str = [bin].pack("m0")
+          str.tr!("+/", "-_")
+          str
+        end
+
+        def urlsafe_decode64(str)
+          decode64(str.tr("-_", "+/"))
+        end
+      end
+    end
+
+    register_plugin(:_base64, Base64_)
+  end
+end

data/lib/roda/plugins/exception_page.rb

@@ -411,7 +411,7 @@ END
 
         private
 
-        if RUBY_VERSION >= '3.2'
+        if Exception.method_defined?(:detailed_message)
           def exception_page_exception_message(exception)
             exception.detailed_message(highlight: false).to_s
           end

data/lib/roda/plugins/middleware.rb

@@ -33,6 +33,43 @@ class Roda
     #
     #   run App
     #
+    # By default, when the app is used as middleware and handles the request at
+    # all, it does not forward the request to the next middleware.  For the
+    # following setup:
+    #
+    #   class Mid < Roda
+    #     plugin :middleware
+    #
+    #     route do |r|
+    #       r.on "foo" do
+    #         r.is "mid" do
+    #           "Mid"
+    #         end
+    #       end
+    #     end
+    #   end
+    #
+    #   class App < Roda
+    #     use Mid
+    #
+    #     route do |r|
+    #       r.on "foo" do
+    #         r.is "app" do
+    #           "App"
+    #         end
+    #       end
+    #     end
+    #   end
+    #
+    #   run App
+    #
+    # Requests for +/foo/mid will+ return +Mid+, but requests for +/foo/app+
+    # will return an empty 404 response, because the middleware handles the
+    # +/foo/app+ request in the <tt>r.on "foo" do</tt> block, but does not
+    # have the block return a result, which Roda treats as an empty 404 response.
+    # If you would like the middleware to forward +/foo/app+ request to the
+    # application, you should use the +:next_if_not_found+ plugin option.
+    #
     # It is possible to use the Roda app as a regular app even when using
     # the middleware plugin.  Using an app as middleware automatically creates
     # a subclass of the app for the middleware.  Because a subclass is automatically
@@ -64,6 +101,9 @@ class Roda
     #   # Request to App for /mid returns
     #   # "foo bar baz"
     module Middleware
+      NEXT_PROC = lambda{throw :next, true}
+      private_constant :NEXT_PROC
+
       # Configure the middleware plugin.  Options:
       # :env_var :: Set the environment variable to use to indicate to the roda
       #             application that the current request is a middleware request.
@@ -77,12 +117,15 @@ class Roda
       #                              the middleware's route block should be applied to the
       #                              final response when the request is forwarded to the app.
       #                              Defaults to false.
+      # :next_if_not_found :: If the middleware handles the request but returns a not found
+      #                       result (404 with no body), forward the result to the next middleware.
       def self.configure(app, opts={}, &block)
         app.opts[:middleware_env_var] = opts[:env_var] if opts.has_key?(:env_var)
         app.opts[:middleware_env_var] ||= 'roda.forward_next'
         app.opts[:middleware_configure] = block if block
         app.opts[:middleware_handle_result] = opts[:handle_result]
         app.opts[:middleware_forward_response_headers] = opts[:forward_response_headers]
+        app.opts[:middleware_next_if_not_found] = opts[:next_if_not_found]
       end
 
       # Forwarder instances are what is actually used as middleware.
@@ -91,6 +134,9 @@ class Roda
         # and store +app+ as the next middleware to call.
         def initialize(mid, app, *args, &block)
           @mid = Class.new(mid)
+          if @mid.opts[:middleware_next_if_not_found]
+            @mid.plugin(:not_found, &NEXT_PROC)
+          end
           if configure = @mid.opts[:middleware_configure]
             configure.call(@mid, *args, &block)
           elsif block || !args.empty?

data/lib/roda/plugins/route_csrf.rb

@@ -1,6 +1,5 @@
 # frozen-string-literal: true
 
-require 'base64'
 require 'openssl'
 require 'securerandom'
 require 'uri'
@@ -163,6 +162,10 @@ class Roda
       # a valid CSRF token was not provided.
       class InvalidToken < RodaError; end
 
+      def self.load_dependencies(app, opts=OPTS)
+        app.plugin :_base64
+      end
+
       def self.configure(app, opts=OPTS, &block)
         options = app.opts[:route_csrf] = (app.opts[:route_csrf] || DEFAULTS).merge(opts)
         if block || opts[:csrf_failure].is_a?(Proc)
@@ -260,7 +263,7 @@ class Roda
         def csrf_token(path=nil, method=('POST' if path))
           token = SecureRandom.random_bytes(31)
           token << csrf_hmac(token, method, path)
-          Base64.strict_encode64(token)
+          [token].pack("m0")
         end
 
         # Whether request-specific CSRF tokens should be used by default.
@@ -314,7 +317,7 @@ class Roda
           end
 
           begin
-            submitted_hmac = Base64.strict_decode64(encoded_token)
+            submitted_hmac = Base64_.decode64(encoded_token)
           rescue ArgumentError
             return "encoded token is not valid base64"
           end
@@ -354,7 +357,7 @@ class Roda
         # JSON is used for session serialization).
         def csrf_secret
           key = session[csrf_options[:key]] ||= SecureRandom.base64(32)
-          Base64.strict_decode64(key)
+          Base64_.decode64(key)
         end
       end
     end

data/lib/roda/plugins/sessions.rb

@@ -10,7 +10,6 @@ rescue OpenSSL::Cipher::CipherError
   # :nocov:
 end
 
-require 'base64'
 require 'json'
 require 'securerandom'
 require 'zlib'
@@ -171,6 +170,10 @@ class Roda
         [cipher_secret.freeze, hmac_secret.freeze]
       end
 
+      def self.load_dependencies(app, opts=OPTS)
+        app.plugin :_base64
+      end
+
       # Configure the plugin, see Sessions for details on options.
       def self.configure(app, opts=OPTS)
         opts = (app.opts[:sessions] || DEFAULT_OPTIONS).merge(opts)
@@ -344,7 +347,7 @@ class Roda
           opts = roda_class.opts[:sessions]
 
           begin
-            data = Base64.urlsafe_decode64(data)
+            data = Base64_.urlsafe_decode64(data)
           rescue ArgumentError
             return _session_serialization_error("Unable to decode session: invalid base64")
           end
@@ -493,7 +496,7 @@ class Roda
           data << encrypted_data
           data << OpenSSL::HMAC.digest(OpenSSL::Digest::SHA256.new, opts[:hmac_secret], data+opts[:key])
 
-          data = Base64.urlsafe_encode64(data)
+          data = Base64_.urlsafe_encode64(data)
 
           if data.bytesize >= 4096
             raise CookieTooLarge, "attempted to create cookie larger than 4096 bytes"

data/lib/roda/version.rb

@@ -4,7 +4,7 @@ class Roda
   RodaMajorVersion = 3
 
   # The minor version of Roda, updated for new feature releases of Roda.
-  RodaMinorVersion = 72
+  RodaMinorVersion = 73
 
   # The patch version of Roda, updated only for bug fixes from the last
   # feature release.

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: roda
 version: !ruby/object:Gem::Version
-  version: 3.72.0
+  version: 3.73.0
 platform: ruby
 authors:
 - Jeremy Evans
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-09-12 00:00:00.000000000 Z
+date: 2023-10-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
@@ -246,6 +246,7 @@ extra_rdoc_files:
 - doc/release_notes/3.70.0.txt
 - doc/release_notes/3.71.0.txt
 - doc/release_notes/3.72.0.txt
+- doc/release_notes/3.73.0.txt
 - doc/release_notes/3.8.0.txt
 - doc/release_notes/3.9.0.txt
 files:
@@ -325,6 +326,7 @@ files:
 - doc/release_notes/3.70.0.txt
 - doc/release_notes/3.71.0.txt
 - doc/release_notes/3.72.0.txt
+- doc/release_notes/3.73.0.txt
 - doc/release_notes/3.8.0.txt
 - doc/release_notes/3.9.0.txt
 - lib/roda.rb
@@ -332,6 +334,7 @@ files:
 - lib/roda/plugins.rb
 - lib/roda/plugins/Integer_matcher_max.rb
 - lib/roda/plugins/_after_hook.rb
+- lib/roda/plugins/_base64.rb
 - lib/roda/plugins/_before_hook.rb
 - lib/roda/plugins/_optimized_matching.rb
 - lib/roda/plugins/_symbol_regexp_matchers.rb