sequel 3.25.0 → 3.26.0

data/lib/sequel/model/base.rb

@@ -11,7 +11,7 @@ module Sequel
     #   the Model's dataset with the method of the same name with the given arguments.
     module ClassMethods
       # Which columns should be the only columns allowed in a call to a mass assignment method (e.g. set)
-      # (default: not set, so all columns not otherwise restricted).
+      # (default: not set, so all columns not otherwise restricted are allowed).
       attr_reader :allowed_columns
   
       # Array of modules that extend this model's dataset.  Stored
@@ -390,8 +390,8 @@ module Sequel
       # setter methods (methods that end in =) that you want to be used during
       # mass assignment, they need to be listed here as well (without the =).
       #
-      # It may be better to use a method such as +set_only+ instead of this in places where
-      # only certain columns may be allowed.
+      # It may be better to use a method such as +set_only+ or +set_fields+ that lets you specify
+      # the allowed fields per call.
       #
       #   Artist.set_allowed_columns(:name, :hometown)
       #   Artist.set(:name=>'Bob', :hometown=>'Sactown') # No Error
@@ -445,7 +445,8 @@ module Sequel
     
       # Sets the primary key for this model. You can use either a regular 
       # or a composite primary key.  To not use a primary key, set to nil
-      # or use +no_primary_key+.
+      # or use +no_primary_key+.  On most adapters, Sequel can automatically
+      # determine the primary key to use, so this method is not needed often.
       #
       #   class Person < Sequel::Model
       #     # regular key
@@ -469,10 +470,9 @@ module Sequel
       # If you have any virtual setter methods (methods that end in =) that you
       # want not to be used during mass assignment, they need to be listed here as well (without the =).
       #
-      # It may be better to use a method such as +set_except+ instead of this in places where
-      # certain columns are restricted.  In general, it's better to have a whitelist approach
-      # where you specify only what is allowed, as opposed to a blacklist approach that this
-      # method uses, where everything is allowed other than what you restrict.
+      # It's generally a bad idea to rely on a blacklist approach for security.  Using a whitelist
+      # approach such as set_allowed_columns or the instance level set_only or set_fields methods
+      # is usually a better choice.  So use of this method is generally a bad idea.
       #
       #   Artist.set_restricted_column(:records_sold)
       #   Artist.set(:name=>'Bob', :hometown=>'Sactown') # No Error
@@ -512,6 +512,9 @@ module Sequel
       # 7 days ago.
       #
       # Both the args given and the block are passed to <tt>Dataset#filter</tt>.
+      #
+      # This method creates dataset methods that do not accept arguments.  To create
+      # dataset methods that accept arguments, you have to use def_dataset_method.
       def subset(name, *args, &block)
         def_dataset_method(name){filter(*args, &block)}
       end
@@ -527,6 +530,7 @@ module Sequel
       end
   
       # Allow the setting of the primary key(s) when using the mass assignment methods.
+      # Using this method can open up security issues, be very careful before using it.
       #
       #   Artist.set(:id=>1) # Error
       #   Artist.unrestrict_primary_key
@@ -777,7 +781,7 @@ module Sequel
   
       # Sets the value for the given column.  If typecasting is enabled for
       # this object, typecast the value based on the column's type.
-      # If this a a new record or the typecasted value isn't the same
+      # If this is a new record or the typecasted value isn't the same
       # as the current value for the column, mark the column as changed.
       #
       #   a = Artist.new
@@ -885,7 +889,7 @@ module Sequel
 
       # Returns true when current instance exists, false otherwise.
       # Generally an object that isn't new will exist unless it has
-      # been deleted.
+      # been deleted.  Uses a database query to check for existence.
       #
       #   Artist[1].exists? # SELECT 1 FROM artists WHERE (id = 1)
       #   # => true
@@ -982,7 +986,7 @@ module Sequel
       end
       
       # Returns the primary key value identifying the model instance.
-      # Raises an error if this model does not have a primary key.
+      # Raises an +Error+ if this model does not have a primary key.
       # If the model has a composite primary key, returns an array of values.
       #
       #   Artist[1].pk # => 1
@@ -1032,16 +1036,16 @@ module Sequel
       # If it succeeds, it returns self.
       #
       # You can provide an optional list of columns to update, in which
-      # case it only updates those columns.
+      # case it only updates those columns, or a options hash.
       #
       # Takes the following options:
       #
-      # * :changed - save all changed columns, instead of all columns or the columns given
-      # * :transaction - set to true or false to override the current
-      #   use_transactions setting
-      # * :validate - set to false to skip validation
-      # * :raise_on_failure - set to true or false to override the current
-      #   raise_on_save_failure setting
+      # :changed :: save all changed columns, instead of all columns or the columns given
+      # :transaction :: set to true or false to override the current
+      #                 +use_transactions+ setting
+      # :validate :: set to false to skip validation
+      # :raise_on_failure :: set to true or false to override the current
+      #                      +raise_on_save_failure+ setting
       def save(*columns)
         opts = columns.last.is_a?(Hash) ? columns.pop : {}
         if opts[:validate] != false
@@ -1088,7 +1092,8 @@ module Sequel
       end
   
       # Set all values using the entries in the hash, except for the keys
-      # given in except.
+      # given in except.  You should probably use +set_fields+ or +set_only+
+      # instead of this method, as blacklist approaches to security are a bad idea.
       #
       #   artist.set_except({:name=>'Jim'}, :hometown)
       #   artist.name # => 'Jim'
@@ -1111,12 +1116,13 @@ module Sequel
       end
   
       # Set the values using the entries in the hash, only if the key
-      # is included in only.
+      # is included in only.  It may be a better idea to use +set_fields+
+      # instead of this method.
       #
       #   artist.set_only({:name=>'Jim'}, :name)
       #   artist.name # => 'Jim'
       #
-      #   artist.set_only({:hometown=>'LA'}, :name) # Raise error
+      #   artist.set_only({:hometown=>'LA'}, :name) # Raise Error
       def set_only(hash, *only)
         set_restricted(hash, only.flatten, false)
       end
@@ -1135,7 +1141,7 @@ module Sequel
         @this ||= model.dataset.filter(pk_hash).limit(1).naked
       end
       
-      # Runs set with the passed hash and then runs save_changes.
+      # Runs #set with the passed hash and then runs save_changes.
       #
       #   artist.update(:name=>'Jim') # UPDATE artists SET name = 'Jim' WHERE (id = 1)
       def update(hash)
@@ -1143,7 +1149,7 @@ module Sequel
       end
   
       # Update all values using the entries in the hash, ignoring any setting of
-      # allowed_columns or restricted columns in the model.
+      # +allowed_columns+ or +restricted_columns+ in the model.
       #
       #   Artist.set_restricted_columns(:name)
       #   artist.update_all(:name=>'Jim') # UPDATE artists SET name = 'Jim' WHERE (id = 1)
@@ -1152,7 +1158,8 @@ module Sequel
       end
   
       # Update all values using the entries in the hash, except for the keys
-      # given in except.
+      # given in except.  You should probably use +update_fields+ or +update_only+
+      # instead of this method, as blacklist approaches to security are a bad idea.
       #
       #   artist.update_except({:name=>'Jim'}, :hometown) # UPDATE artists SET name = 'Jim' WHERE (id = 1)
       def update_except(hash, *except)
@@ -1173,7 +1180,8 @@ module Sequel
       end
 
       # Update the values using the entries in the hash, only if the key
-      # is included in only.
+      # is included in only.  It may be a better idea to use +update_fields+
+      # instead of this method.
       #
       #   artist.update_only({:name=>'Jim'}, :name)
       #   # UPDATE artists SET name = 'Jim' WHERE (id = 1)
@@ -1488,7 +1496,16 @@ module Sequel
           if meths.include?(m)
             send(m, v)
           elsif strict
-            raise Error, "method #{m} doesn't exist or access is restricted to it"
+            # Avoid using respond_to? or creating symbols from user input
+            if public_methods.map{|s| s.to_s}.include?(m)
+              if Array(model.primary_key).map{|s| s.to_s}.member?(k.to_s) && model.restrict_primary_key?
+                raise Error, "#{k} is a restricted primary key"
+              else
+                raise Error, "#{k} is a restricted column"
+              end
+            else
+              raise Error, "method #{m} doesn't exist"
+            end
           end
         end
         self

data/lib/sequel/model/exceptions.rb

@@ -2,6 +2,8 @@ module Sequel
   # Exception class raised when +raise_on_save_failure+ is set and a before hook returns false
   # or an around hook doesn't call super or yield.
   class HookFailed < Error; end
+
+  # Deprecated alias for HookFailed, kept for backwards compatibility
   BeforeHookFailed = HookFailed
   
   # Exception class raised when +require_modification+ is set and an UPDATE or DELETE statement to modify the dataset doesn't

data/lib/sequel/plugins/identity_map.rb

@@ -22,10 +22,7 @@ module Sequel
     # Identity maps are thread-local and only persist for the duration of the block,
     # so they should only be considered as a possible performance enhancer.
     #
-    # The identity_map plugin is not compatible with the standard eager loading of
-    # many_to_many and many_through_many associations.  If you want to use the identity_map plugin,
-    # you should use +eager_graph+ instead of +eager+ for those associations. It is also
-    # not compatible with the eager loading in the +rcte_tree+ plugin.
+    # The identity_map plugin is not compatible with the eager loading in the +rcte_tree+ plugin.
     #
     # Usage:
     #
@@ -37,6 +34,116 @@ module Sequel
     #   # would need to do Album.with_identity_map{} to use the identity map
     module IdentityMap
       module ClassMethods
+        # Override the default :eager_loader option for many_*_many associations to work
+        # with an identity_map.  If the :eager_graph association option is used, you'll probably have to use
+        # :uniq=>true on the current association amd :cartesian_product_number=>2 on the association
+        # mentioned by :eager_graph, otherwise you'll end up with duplicates because the row proc will be
+        # getting called multiple times for the same object.  If you do have duplicates and you use :eager_graph,
+        # they'll probably be lost.  Making that work correctly would require changing a lot of the core
+        # architecture, such as how graphing and eager graphing work.
+        def associate(type, name, opts = {}, &block)
+          if opts[:eager_loader]
+            super
+          elsif type == :many_to_many
+            opts = super
+            el = opts[:eager_loader] 
+            model = self
+            left_pk = opts[:left_primary_key]
+            uses_lcks = opts[:uses_left_composite_keys]
+            uses_rcks = opts[:uses_right_composite_keys]
+            right = opts[:right_key]
+            join_table = opts[:join_table]
+            left = opts[:left_key]
+            lcks = opts[:left_keys]
+            left_key_alias = opts[:left_key_alias] ||= opts.default_associated_key_alias
+            opts[:eager_loader] = lambda do |eo|
+              return el.call(eo) unless model.identity_map
+              h = eo[:key_hash][left_pk]
+              eo[:rows].each{|object| object.associations[name] = []}
+              r = uses_rcks ? rcks.zip(opts.right_primary_keys) : [[right, opts.right_primary_key]]
+              l = uses_lcks ? [[lcks.map{|k| SQL::QualifiedIdentifier.new(join_table, k)}, h.keys]] : [[left, h.keys]]
+
+              # Replace the row proc to remove the left key alias before calling the previous row proc.
+              # Associate the value of the left key alias with the associated object (through its object_id).
+              # When loading the associated objects, lookup the left key alias value and associate the
+              # associated objects to the main objects if the left key alias value matches the left primary key
+              # value of the main object.
+              # 
+              # The deleting of the left key alias from the hash before calling the previous row proc
+              # is necessary when an identity map is used, otherwise if the same associated object is returned more than
+              # once for the association, it won't know which of current objects to associate it to.
+              ds = opts.associated_class.inner_join(join_table, r + l)
+              pr = ds.row_proc
+              h2 = {}
+              ds.row_proc = proc do |hash|
+                hash_key = if uses_lcks
+                  left_key_alias.map{|k| hash.delete(k)}
+                else
+                  hash.delete(left_key_alias)
+                end
+                obj = pr.call(hash)
+                (h2[obj.object_id] ||= []) << hash_key
+                obj
+              end
+              model.eager_loading_dataset(opts, ds, Array(opts.select), eo[:associations], eo) .all do |assoc_record|
+                if hash_keys = h2.delete(assoc_record.object_id)
+                  hash_keys.each do |hash_key|
+                    if objects = h[hash_key]
+                      objects.each{|object| object.associations[name].push(assoc_record)}
+                    end
+                  end
+                end
+              end
+            end
+            opts
+          elsif type == :many_through_many
+            opts = super
+            el = opts[:eager_loader] 
+            model = self
+            left_pk = opts[:left_primary_key]
+            left_key = opts[:left_key]
+            uses_lcks = opts[:uses_left_composite_keys]
+            left_keys = Array(left_key)
+            left_key_alias = opts[:left_key_alias]
+            opts[:eager_loader] = lambda do |eo|
+              return el.call(eo) unless model.identity_map
+              h = eo[:key_hash][left_pk]
+              eo[:rows].each{|object| object.associations[name] = []}
+              ds = opts.associated_class 
+              opts.reverse_edges.each{|t| ds = ds.join(t[:table], Array(t[:left]).zip(Array(t[:right])), :table_alias=>t[:alias])}
+              ft = opts[:final_reverse_edge]
+              conds = uses_lcks ? [[left_keys.map{|k| SQL::QualifiedIdentifier.new(ft[:table], k)}, h.keys]] : [[left_key, h.keys]]
+
+              # See above comment in many_to_many eager_loader
+              ds = ds.join(ft[:table], Array(ft[:left]).zip(Array(ft[:right])) + conds, :table_alias=>ft[:alias])
+              pr = ds.row_proc
+              h2 = {}
+              ds.row_proc = proc do |hash|
+                hash_key = if uses_lcks
+                  left_key_alias.map{|k| hash.delete(k)}
+                else
+                  hash.delete(left_key_alias)
+                end
+                obj = pr.call(hash)
+                (h2[obj.object_id] ||= []) << hash_key
+                obj
+              end
+              model.eager_loading_dataset(opts, ds, Array(opts.select), eo[:associations], eo).all do |assoc_record|
+                if hash_keys = h2.delete(assoc_record.object_id)
+                  hash_keys.each do |hash_key|
+                    if objects = h[hash_key]
+                      objects.each{|object| object.associations[name].push(assoc_record)}
+                    end
+                  end
+                end
+              end
+            end
+            opts
+          else
+            super
+          end
+        end
+          
         # Returns the current thread-local identity map.  Should be a hash if
         # there is an active identity map, and nil otherwise.
         def identity_map

data/lib/sequel/plugins/sharding.rb

@@ -40,6 +40,18 @@ module Sequel
         def new_using_server(s, values={}, &block)
           new(values, &block).set_server(s)
         end
+
+        private
+
+        # Set the server for each graphed dataset to the current server
+        # unless the graphed dataset already has a server set.
+        def eager_graph_dataset(opts, eager_options)
+          ds = super
+          if s = eager_options[:self].opts[:server]
+            ds = ds.server(s) unless ds.opts[:server]
+          end
+          ds
+        end
       end
 
       module InstanceMethods
@@ -109,26 +121,6 @@ module Sequel
           end
           ds
         end
-
-        private
-
-        # Set the shard of all retrieved objects to the shard of
-        # the table's dataset, or the current shard if the table's
-        # dataset does not have a shard.
-        def graph_each
-          ta = @opts[:graph][:table_aliases]
-          s = @opts[:server]
-          super do |r|
-            r.each do |k, v|
-              if ds = ta[k]
-                dss = ds.opts[:server]
-              end
-              vs = dss || s
-              v.set_server(vs) if vs && v.respond_to?(:set_server)
-            end
-            yield r
-          end
-        end
       end
     end
   end

data/lib/sequel/plugins/xml_serializer.rb

@@ -205,9 +205,9 @@ module Sequel
                 klass.from_xml_node(node)
               end
             elsif cols.include?(k)
-              self[k.to_sym] = node[:nil] ? nil : node.children.first.to_s
+              self[k.to_sym] = node.key?('nil') ? nil : node.children.first.to_s
             elsif meths.include?("#{k}=")
-              send("#{k}=", node[:nil] ? nil : node.children.first.to_s)
+              send("#{k}=", node.key?('nil') ? nil : node.children.first.to_s)
             else
               raise Error, "Entry in XML not an association or column and no setter method exists: #{k}"
             end

data/lib/sequel/version.rb

@@ -3,7 +3,7 @@ module Sequel
   MAJOR = 3
   # The minor version of Sequel.  Bumped for every non-patch level
   # release, generally around once a month.
-  MINOR = 25
+  MINOR = 26
   # The tiny version of Sequel.  Usually 0, only bumped for bugfix
   # releases that fix regressions from previous versions.
   TINY  = 0

data/spec/adapters/postgres_spec.rb

@@ -606,12 +606,6 @@ describe "Postgres::Database schema qualified tables" do
     POSTGRES_DB.drop_table(:domains)
   end
   
-  specify "#table_exists? should not include tables from the default non-public schemas" do
-    POSTGRES_DB.create_table(:schema_test__schema_test){integer :i}
-    POSTGRES_DB.table_exists?(:schema_test).should == true
-    POSTGRES_DB.table_exists?(:domain_udt_usage).should == false
-  end
-  
   specify "#table_exists? should see if the table is in a given schema" do
     POSTGRES_DB.create_table(:schema_test__schema_test){integer :i}
     POSTGRES_DB.table_exists?(:schema_test__schema_test).should == true

data/spec/core/connection_pool_spec.rb

@@ -245,6 +245,12 @@ shared_examples_for "A threaded connection pool" do
     t.join
   end
   
+  it "should not add a disconnected connection back to the pool if the disconnection_proc raises an error" do
+    pool = Sequel::ConnectionPool.get_pool(@cp_opts.merge(:max_connections=>1, :pool_timeout=>0, :disconnection_proc=>proc{|c| raise Sequel::Error})) {@invoked_count += 1}
+    proc{pool.hold{raise Sequel::DatabaseDisconnectError}}.should raise_error(Sequel::Error)
+    pool.available_connections.length.should == 0
+  end
+
   specify "should let five threads simultaneously access separate connections" do
     cc = {}
     threads = []

data/spec/core/database_spec.rb

@@ -1332,6 +1332,18 @@ describe "Database#typecast_value" do
     proc{@db.typecast_value(:datetime, 4)}.should raise_error(Sequel::InvalidValue)
   end
 
+  specify "should handle integers with leading 0 as base 10" do
+    @db.typecast_value(:integer, "013").should == 13
+    @db.typecast_value(:integer, "08").should == 8
+    @db.typecast_value(:integer, "000013").should == 13
+    @db.typecast_value(:integer, "000008").should == 8
+  end
+
+  specify "should handle integers with leading 0x as base 16" do
+    @db.typecast_value(:integer, "0x013").should == 19
+    @db.typecast_value(:integer, "0x80").should == 128
+  end
+
   specify "should have an underlying exception class available at wrapped_exception" do
     begin
       @db.typecast_value(:date, 'a')

data/spec/core/schema_spec.rb

@@ -555,8 +555,15 @@ describe "DB#create_table!" do
     @db = SchemaDummyDatabase.new
   end
   
-  specify "should drop the table and then create it" do
-    @db.create_table!(:cats) {}
+  specify "should create the table if it does not exist" do
+    @db.meta_def(:table_exists?){|a| false}
+    @db.create_table!(:cats){|*a|}
+    @db.sqls.should == ['CREATE TABLE cats ()']
+  end
+  
+  specify "should drop the table before creating it if it already exists" do
+    @db.meta_def(:table_exists?){|a| true}
+    @db.create_table!(:cats){|*a|}
     @db.sqls.should == ['DROP TABLE cats', 'CREATE TABLE cats ()']
   end
 end