sequel 4.26.0 → 5.37.0

data/lib/sequel/plugins/validation_helpers.rb

@@ -1,7 +1,9 @@
+# frozen-string-literal: true
+
 module Sequel
   module Plugins
-    # The validation_helpers plugin contains instance method equivalents for most of the legacy
-    # class-level validations.  The names and APIs are different, though. Example:
+    # The validation_helpers plugin contains validate_* methods designed to be called inside Model#validate
+    # to perform validations:
     #
     #   Sequel::Model.plugin :validation_helpers
     #   class Album < Sequel::Model
@@ -17,9 +19,7 @@ module Sequel
     # atts :: Single attribute symbol or an array of attribute symbols specifying the
     #         attribute(s) to validate.
     # Options:
-    # :allow_blank :: Whether to skip the validation if the value is blank.  You should
-    #                 make sure all objects respond to blank if you use this option, which you can do by:
-    #                     Sequel.extension :blank
+    # :allow_blank :: Whether to skip the validation if the value is blank.
     # :allow_missing :: Whether to skip the validation if the attribute isn't a key in the
     #                   values hash.  This is different from allow_nil, because Sequel only sends the attributes
     #                   in the values when doing an insert or update.  If the attribute is not present, Sequel
@@ -38,17 +38,24 @@ module Sequel
     #             that argument is passed as an argument to the proc.
     #
     # The default validation options for all models can be modified by
-    # changing the values of the Sequel::Plugins::ValidationHelpers::DEFAULT_OPTIONS hash.  You
-    # change change the default options on a per model basis
-    # by overriding a private instance method default_validation_helpers_options.
-    #
+    # overridding the Model#default_validation_helpers_options private method.
     # By changing the default options, you can setup internationalization of the
     # error messages.  For example, you would modify the default options:
     #
-    #   Sequel::Plugins::ValidationHelpers::DEFAULT_OPTIONS.merge!(
-    #     :exact_length=>{:message=>lambda{|exact| I18n.t("errors.exact_length", :exact => exact)}},
-    #     :integer=>{:message=>lambda{I18n.t("errors.integer")}}
-    #   )
+    #   class Sequel::Model
+    #     private
+    #
+    #     def default_validation_helpers_options(type)
+    #       case type
+    #       when :exact_length
+    #         {message: lambda{|exact| I18n.t("errors.exact_length", exact: exact)}}
+    #       when :integer
+    #         {message: lambda{I18n.t("errors.integer")}}
+    #       else
+    #         super
+    #       end
+    #     end
+    #   end
     #
     # and then use something like this in your yaml translation file:
     #
@@ -61,20 +68,16 @@ module Sequel
     # you need to override the method.  Here's an example:
     #   
     #   class Sequel::Model::Errors
-    #     ATTRIBUTE_JOINER = I18n.t('errors.joiner').freeze
     #     def full_messages
     #       inject([]) do |m, kv|
     #         att, errors = *kv
     #         att.is_a?(Array) ? Array(att).map!{|v| I18n.t("attributes.#{v}")} : att = I18n.t("attributes.#{att}")
-    #         errors.each {|e| m << (e.is_a?(LiteralString) ? e : "#{Array(att).join(ATTRIBUTE_JOINER)} #{e}")}
+    #         errors.each {|e| m << (e.is_a?(LiteralString) ? e : "#{Array(att).join(I18n.t('errors.joiner'))} #{e}")}
     #         m
     #       end
     #     end
     #   end
     module ValidationHelpers
-      # Default validation options used by Sequel.  Can be modified to change the error
-      # messages for all models (e.g. for internationalization), or to set certain
-      # default options for validations (e.g. :allow_nil=>true for all validates_format).
       DEFAULT_OPTIONS = {
         :exact_length=>{:message=>lambda{|exact| "is not #{exact} characters"}},
         :format=>{:message=>lambda{|with| 'is invalid'}},
@@ -85,10 +88,12 @@ module Sequel
         :min_length=>{:message=>lambda{|min| "is shorter than #{min} characters"}},
         :not_null=>{:message=>lambda{"is not present"}},
         :numeric=>{:message=>lambda{"is not a number"}},
+        :operator=>{:message=>lambda{|operator, rhs| "is not #{operator} #{rhs}"}},
         :type=>{:message=>lambda{|klass| klass.is_a?(Array) ? "is not a valid #{klass.join(" or ").downcase}" : "is not a valid #{klass.to_s.downcase}"}},
         :presence=>{:message=>lambda{"is not present"}},
         :unique=>{:message=>lambda{'is already taken'}}
-      }
+      }.freeze
+      DEFAULT_OPTIONS.each_value(&:freeze)
 
       module InstanceMethods 
         # Check that the attribute values are the given exact length.
@@ -103,7 +108,7 @@ module Sequel
     
         # Check attribute value(s) is included in the given set.
         def validates_includes(set, atts, opts=OPTS)
-          validatable_attributes_for_type(:includes, atts, opts){|a,v,m| validation_error_message(m, set) unless set.send(set.respond_to?(:cover?) ? :cover? : :include?, v)}
+          validatable_attributes_for_type(:includes, atts, opts){|a,v,m| validation_error_message(m, set) unless set.public_send(set.respond_to?(:cover?) ? :cover? : :include?, v)}
         end
     
         # Check attribute value(s) string representation is a valid integer.
@@ -120,7 +125,7 @@ module Sequel
 
         # Check that the attribute values length is in the specified range.
         def validates_length_range(range, atts, opts=OPTS)
-          validatable_attributes_for_type(:length_range, atts, opts){|a,v,m| validation_error_message(m, range) if v.nil? || !range.send(range.respond_to?(:cover?) ? :cover? : :include?, v.length)}
+          validatable_attributes_for_type(:length_range, atts, opts){|a,v,m| validation_error_message(m, range) if v.nil? || !range.cover?(v.length)}
         end
     
         # Check that the attribute values are not longer than the given max length.
@@ -128,7 +133,13 @@ module Sequel
         # Accepts a :nil_message option that is the error message to use when the
         # value is nil instead of being too long.
         def validates_max_length(max, atts, opts=OPTS)
-          validatable_attributes_for_type(:max_length, atts, opts){|a,v,m| v ? validation_error_message(m, max) : validation_error_message(opts[:nil_message] || DEFAULT_OPTIONS[:max_length][:nil_message]) if v.nil? || v.length > max}
+          validatable_attributes_for_type(:max_length, atts, opts) do |a,v,m|
+            if v.nil?
+              validation_error_message(opts[:nil_message] || default_validation_helpers_options(:max_length)[:nil_message])
+            elsif v.length > max
+              validation_error_message(m, max)
+            end
+          end
         end
 
         # Check that the attribute values are not shorter than the given min length.
@@ -153,6 +164,12 @@ module Sequel
           end
         end
 
+        # Check attribute value(s) against a specified value and operation, e.g.
+        # validates_operator(:>, 3, :value) validates that value > 3.
+        def validates_operator(operator, rhs, atts, opts=OPTS)
+          validatable_attributes_for_type(:operator, atts, opts){|a,v,m| validation_error_message(m, operator, rhs) if v.nil? || !v.public_send(operator, rhs)}
+        end
+
         # Validates for all of the model columns (or just the given columns)
         # that the column value is an instance of the expected class based on
         # the column's schema type.
@@ -195,7 +212,7 @@ module Sequel
         # must be unique. So if you are doing a soft delete of records, in which
         # the name must be unique, but only for active records:
         #
-        #   validates_unique(:name){|ds| ds.filter(:active)}
+        #   validates_unique(:name){|ds| ds.where(:active)}
         #
         # You should also add a unique index in the
         # database, as this suffers from a fairly obvious race condition.
@@ -208,18 +225,18 @@ module Sequel
         #             model's dataset.
         # :message :: The message to use (default: 'is already taken')
         # :only_if_modified :: Only check the uniqueness if the object is new or
-        #                      one of the columns has been modified.
+        #                      one of the columns has been modified, true by default.
         # :where :: A callable object where call takes three arguments, a dataset,
         #           the current object, and an array of columns, and should return
         #           a modified dataset that is filtered to include only rows with
         #           the same values as the current object for each column in the array.
         #
-        # If you want to to a case insensitive uniqueness validation on a database that
+        # If you want to do a case insensitive uniqueness validation on a database that
         # is case sensitive by default, you can use:
         #
-        #   validates_unique :column, :where=>(proc do |ds, obj, cols|
+        #   validates_unique :column, where:(lambda do |ds, obj, cols|
         #     ds.where(cols.map do |c|
-        #       v = obj.send(c)
+        #       v = obj.public_send(c)
         #       v = v.downcase if v
         #       [Sequel.function(:lower, c), v]
         #     end)
@@ -227,7 +244,7 @@ module Sequel
         def validates_unique(*atts)
           opts = default_validation_helpers_options(:unique)
           if atts.last.is_a?(Hash)
-            opts = Hash[opts].merge!(atts.pop)
+            opts = opts.merge(atts.pop)
           end
           message = validation_error_message(opts[:message])
           from_values = opts[:from] == :values
@@ -235,7 +252,8 @@ module Sequel
           atts.each do |a|
             arr = Array(a)
             next if arr.any?{|x| errors.on(x)}
-            next if opts[:only_if_modified] && !new? && !arr.any?{|x| changed_columns.include?(x)}
+            cc = changed_columns
+            next if opts.fetch(:only_if_modified, true) && !new? && !arr.any?{|x| cc.include?(x)}
             ds = opts[:dataset] || model.dataset
             ds = if where
               where.call(ds, self, arr)
@@ -274,7 +292,7 @@ module Sequel
             next if am && !values.has_key?(a)
             v = from_values ? values[a] : get_column_value(a)
             next if an && v.nil?
-            next if ab && v.respond_to?(:blank?) && v.blank?
+            next if ab && model.db.send(:blank_object?, v)
             if message = yield(a, v, m)
               errors.add(a, message)
             end
@@ -284,7 +302,7 @@ module Sequel
         # Merge the given options with the default options for the given type
         # and call validatable_attributes with the merged options.
         def validatable_attributes_for_type(type, atts, opts, &block)
-          validatable_attributes(atts, Hash[default_validation_helpers_options(type)].merge!(opts), &block)
+          validatable_attributes(atts, default_validation_helpers_options(type).merge(opts), &block)
         end
         
         # The validation error message to use, as a string.  If message

data/lib/sequel/plugins/whitelist_security.rb

@@ -0,0 +1,122 @@
+# frozen-string-literal: true
+
+module Sequel
+  module Plugins
+    # The whitelist_security plugin contains whitelist-based support for
+    # mass assignment, explicitly specifying which columns to allow mass assignment for,
+    # disallowing mass assignment for columns not listed.  This exists mostly for backwards
+    # compatibility, it's best to use Sequel::Model#set_fields and Sequel::Model#update_fields
+    # to decide which fields to allow on a per-call basis.
+    #
+    # Usage:
+    #
+    #   # Make all model subclasses support allowed_columns 
+    #   Sequel::Model.plugin :whitelist_security
+    #
+    #   # Make the Album class support allowed_columns
+    #   Album.plugin :whitelist_security
+    module WhitelistSecurity
+      module ClassMethods
+        # Which columns should be the only columns allowed in a call to a mass assignment method (e.g. set)
+        # (default: not set, so all columns not otherwise restricted are allowed).
+        attr_reader :allowed_columns
+  
+        Plugins.inherited_instance_variables(self, :@allowed_columns=>:dup)
+
+        # Freeze allowed columns when freezing model class.
+        def freeze
+          @allowed_columns.freeze
+          super
+        end
+
+        # Set the columns to allow when using mass assignment (e.g. +set+).  Using this means that
+        # any columns not listed here will not be modified.  If you have any virtual
+        # setter methods (methods that end in =) that you want to be used during
+        # mass assignment, they need to be listed here as well (without the =).
+        #
+        # It may be better to use +set_fields+ which lets you specify
+        # the allowed fields per call.
+        #
+        #   Artist.set_allowed_columns(:name, :hometown)
+        #   Artist.set(name: 'Bob', hometown: 'Sactown') # No Error
+        #   Artist.set(name: 'Bob', records_sold: 30000) # Error
+        def set_allowed_columns(*cols)
+          clear_setter_methods_cache
+          @allowed_columns = cols
+        end
+  
+        private
+
+        # If allowed_columns is set, only allow those columns.
+        def get_setter_methods
+          if allowed_columns
+            allowed_columns.map{|x| "#{x}="}
+          else
+            super
+          end
+        end
+      end
+
+      module InstanceMethods
+        # Set all values using the entries in the hash, ignoring any setting of
+        # allowed_columns in the model.
+        #
+        #   Artist.set_allowed_columns(:num_albums)
+        #   artist.set_all(name: 'Jim')
+        #   artist.name # => 'Jim'
+        def set_all(hash)
+          set_restricted(hash, :all)
+        end
+  
+        # Set the values using the entries in the hash, only if the key
+        # is included in only.  It may be a better idea to use +set_fields+
+        # instead of this method.
+        #
+        #   artist.set_only({name: 'Jim'}, :name)
+        #   artist.name # => 'Jim'
+        #
+        #   artist.set_only({hometown: 'LA'}, :name) # Raise Error
+        def set_only(hash, *only)
+          set_restricted(hash, only.flatten)
+        end
+  
+        # Update all values using the entries in the hash, ignoring any setting of
+        # +allowed_columns+ in the model.
+        #
+        #   Artist.set_allowed_columns(:num_albums)
+        #   artist.update_all(name: 'Jim') # UPDATE artists SET name = 'Jim' WHERE (id = 1)
+        def update_all(hash)
+          update_restricted(hash, :all)
+        end
+  
+        # Update the values using the entries in the hash, only if the key
+        # is included in only.  It may be a better idea to use +update_fields+
+        # instead of this method.
+        #
+        #   artist.update_only({name: 'Jim'}, :name)
+        #   # UPDATE artists SET name = 'Jim' WHERE (id = 1)
+        #
+        #   artist.update_only({hometown: 'LA'}, :name) # Raise Error
+        def update_only(hash, *only)
+          update_restricted(hash, only.flatten)
+        end
+      
+        private
+
+        # If allowed_columns is set and set/update is called, only allow those columns.
+        def setter_methods(type)
+          if type == :default && model.allowed_columns
+            model.setter_methods
+          elsif type.is_a?(Array)
+            type.map{|x| "#{x}="}
+          elsif type == :all && primary_key && model.restrict_primary_key?
+            super + Array(primary_key).map{|x| "#{x}="}
+          else
+            super
+          end
+        end
+      end
+    end
+  end
+end
+

data/lib/sequel/plugins/xml_serializer.rb

@@ -1,3 +1,5 @@
+# frozen-string-literal: true
+
 require 'nokogiri'
 
 module Sequel
@@ -21,15 +23,15 @@ module Sequel
     #
     # You can provide options to control the XML output:
     #
-    #   puts album.to_xml(:only=>:name)
-    #   puts album.to_xml(:except=>[:id, :artist_id])
+    #   puts album.to_xml(only: :name)
+    #   puts album.to_xml(except: [:id, :artist_id])
     #   # Output:
     #   # <?xml version="1.0"?>
     #   # <album>
     #   #   <name>RF</name>
     #   # </album>
     #
-    #   album.to_xml(:include=>:artist)
+    #   album.to_xml(include: :artist)
     #   # Output:
     #   # <?xml version="1.0"?>
     #   # <album>
@@ -45,7 +47,7 @@ module Sequel
     # You can use a hash value with <tt>:include</tt> to pass options
     # to associations:
     #
-    #   album.to_xml(:include=>{:artist=>{:only=>:name}})
+    #   album.to_xml(include: {artist: {only: :name}})
     #   # Output:
     #   # <?xml version="1.0"?>
     #   # <album>
@@ -61,12 +63,12 @@ module Sequel
     # of which return all objects in the dataset:
     #
     #   Album.to_xml
-    #   Album.filter(:artist_id=>1).to_xml(:include=>:tags)
+    #   Album.where(artist_id: 1).to_xml(include: :tags)
     #
     # If you have an existing array of model instances you want to convert to
     # XML, you can call the class to_xml method with the :array option:
     #
-    #   Album.to_xml(:array=>[Album[1], Album[2]])
+    #   Album.to_xml(array: [Album[1], Album[2]])
     #
     # In addition to creating XML, this plugin also enables Sequel::Model
     # classes to create instances directly from XML using the from_xml class
@@ -78,7 +80,7 @@ module Sequel
     # The array_from_xml class method exists to parse arrays of model instances
     # from xml:
     #
-    #   xml = Album.filter(:artist_id=>1).to_xml
+    #   xml = Album.where(artist_id: 1).to_xml
     #   albums = Album.array_from_xml(xml)
     #
     # These does not necessarily round trip, since doing so would let users
@@ -87,7 +89,7 @@ module Sequel
     # fields, you can use the :fields option, which will call set_fields with
     # the given fields:
     #
-    #   Album.from_xml(album.to_xml, :fields=>%w'id name')
+    #   Album.from_xml(album.to_xml, fields: %w'id name')
     #
     # If you want to update an existing instance, you can use the from_xml
     # instance method:
@@ -97,11 +99,11 @@ module Sequel
     # Both of these allow creation of cached associated objects, if you provide
     # the :associations option:
     #
-    #   album.from_xml(xml, :associations=>:artist)
+    #   album.from_xml(xml, associations: :artist)
     #
     # You can even provide options when setting up the associated objects:
     #
-    #   album.from_xml(xml, :associations=>{:artist=>{:fields=>%w'id name', :associations=>:tags}})
+    #   album.from_xml(xml, associations: {artist: {fields: %w'id name', associations: :tags}})
     #
     # Usage:
     #
@@ -113,17 +115,17 @@ module Sequel
     module XmlSerializer
       module ClassMethods
         # Proc that camelizes the input string, used for the :camelize option
-        CAMELIZE = proc(&:camelize)
+        CAMELIZE = :camelize.to_proc
 
         # Proc that dasherizes the input string, used for the :dasherize option
-        DASHERIZE = proc(&:dasherize)
+        DASHERIZE = :dasherize.to_proc
 
         # Proc that returns the input string as is, used if
         # no :name_proc, :dasherize, or :camelize option is used.
         IDENTITY = proc{|s| s}
 
         # Proc that underscores the input string, used for the :underscore option
-        UNDERSCORE = proc(&:underscore)
+        UNDERSCORE = :underscore.to_proc
 
         # Return an array of instances of this class based on
         # the provided XML.
@@ -135,28 +137,27 @@ module Sequel
           node.children.reject{|c| c.is_a?(Nokogiri::XML::Text)}.map{|c| from_xml_node(c, opts)}
         end
 
-        # Return an instance of this class based on the provided
-        # XML.
+        # Return an instance of this class based on the provided XML.
         def from_xml(xml, opts=OPTS)
           from_xml_node(Nokogiri::XML(xml).children.first, opts)
         end
 
         # Return an instance of this class based on the given
         # XML node, which should be Nokogiri::XML::Node instance.
-        # This should probably not be used directly by user code.
+        # This should not be used directly by user code.
         def from_xml_node(parent, opts=OPTS)
           new.from_xml_node(parent, opts)
         end
 
         # Return an appropriate Nokogiri::XML::Builder instance
-        # used to create the XML.  This should probably not be used
+        # used to create the XML.  This should not be used
         # directly by user code.
         def xml_builder(opts=OPTS)
           if opts[:builder]
             opts[:builder]
           else
             builder_opts = if opts[:builder_opts]
-              opts[:builder_opts]
+              Hash[opts[:builder_opts]]
             else
               {}
             end
@@ -167,7 +168,7 @@ module Sequel
 
         # Return a proc (or any other object that responds to []),
         # used for formatting XML tag names when serializing to XML.
-        # This should probably not be used directly by user code.
+        # This should not be used directly by user code.
         def xml_deserialize_name_proc(opts=OPTS)
           if opts[:name_proc]
             opts[:name_proc]
@@ -180,7 +181,7 @@ module Sequel
 
         # Return a proc (or any other object that responds to []),
         # used for formatting XML tag names when serializing to XML.
-        # This should probably not be used directly by user code.
+        # This should not be used directly by user code.
         def xml_serialize_name_proc(opts=OPTS)
           pr = if opts[:name_proc]
             opts[:name_proc]
@@ -232,10 +233,10 @@ module Sequel
           if assocs = opts[:associations]
             assocs = case assocs
             when Symbol
-              {assocs=>{}}
+              {assocs=>OPTS}
             when Array
               assocs_tmp = {}
-              assocs.each{|v| assocs_tmp[v] = {}}
+              assocs.each{|v| assocs_tmp[v] = OPTS}
               assocs_tmp
             when Hash
               assocs
@@ -341,17 +342,17 @@ module Sequel
 
           name_proc = model.xml_serialize_name_proc(opts)
           x = model.xml_builder(opts)
-          x.send(name_proc[opts.fetch(:root_name, model.send(:underscore, model.name).gsub('/', '__')).to_s]) do |x1|
+          x.public_send(name_proc[opts.fetch(:root_name, model.send(:underscore, model.name).gsub('/', '__')).to_s]) do |x1|
             cols.each do |c|
               attrs = {}
               if types
-                attrs[:type] = db_schema.fetch(c, {})[:type]
+                attrs[:type] = db_schema.fetch(c, OPTS)[:type]
               end
               v = vals[c]
               if v.nil?
                 attrs[:nil] = ''
               end
-              x1.send(name_proc[c.to_s], v, attrs)
+              x1.public_send(name_proc[c.to_s], v, attrs)
             end
             if inc.is_a?(Hash)
               inc.each{|k, v| to_xml_include(x1, k, v)}
@@ -369,15 +370,15 @@ module Sequel
         # the xml.
         def to_xml_include(node, i, opts=OPTS)
           name_proc = model.xml_serialize_name_proc(opts)
-          objs = send(i)
+          objs = public_send(i)
           if objs.is_a?(Array) && objs.all?{|x| x.is_a?(Sequel::Model)}
-            node.send(name_proc[i.to_s]) do |x2|
+            node.public_send(name_proc[i.to_s]) do |x2|
               objs.each{|obj| obj.to_xml(opts.merge(:builder=>x2))}
             end
           elsif objs.is_a?(Sequel::Model)
             objs.to_xml(opts.merge(:builder=>node, :root_name=>i))
           else
-            node.send(name_proc[i.to_s], objs)
+            node.public_send(name_proc[i.to_s], objs)
           end
         end
       end
@@ -388,7 +389,7 @@ module Sequel
         # as well as the :array_root_name option for specifying the name of
         # the root node that contains the nodes for all of the instances.
         def to_xml(opts=OPTS)
-          raise(Sequel::Error, "Dataset#to_xml") unless row_proc
+          raise(Sequel::Error, "Dataset#to_xml") unless row_proc || @opts[:eager_graph]
           x = model.xml_builder(opts)
           name_proc = model.xml_serialize_name_proc(opts)
           array = if opts[:array]
@@ -397,7 +398,7 @@ module Sequel
           else
             all
           end
-          x.send(name_proc[opts.fetch(:array_root_name, model.send(:pluralize, model.send(:underscore, model.name))).to_s]) do |x1|
+          x.public_send(name_proc[opts.fetch(:array_root_name, model.send(:pluralize, model.send(:underscore, model.name))).to_s]) do |x1|
             array.each do |obj|
               obj.to_xml(opts.merge(:builder=>x1))
             end