sequel 4.45.0 → 4.46.0

data/lib/sequel/plugins/inverted_subsets.rb

@@ -27,22 +27,29 @@ module Sequel
     #   # SELECT * FROM albums WHERE (published IS NOT TRUE)
     #
     module InvertedSubsets
-      # Default naming for inverted subsets
-      DEFAULT_NAME_BLOCK = lambda{|name| "not_#{name}"}
-
-      # Store the supplied block for calling later when subsets are defined, or
-      # create a default one if we need to.
-      def self.configure(model, &block)
-        model.instance_variable_set(:@inverted_subsets_name_block, block || DEFAULT_NAME_BLOCK)
+      def self.apply(mod, &block)
+        mod.instance_exec do
+          @dataset_module_class = Class.new(@dataset_module_class) do
+            include DatasetModuleMethods
+            if block
+              define_method(:inverted_subset_name, &block)
+              private :inverted_subset_name
+            end
+          end
+        end
       end
 
-      module ClassMethods
-        Plugins.inherited_instance_variables(self, :@inverted_subsets_name_block => nil)
-
+      module DatasetModuleMethods
         # Define a not_ prefixed subset which inverts the subset condition.
-        def subset(name, *args, &block)
+        def where(name, *args, &block)
           super
-          def_dataset_method(@inverted_subsets_name_block.call(name)){exclude(*args, &block)}
+          exclude(inverted_subset_name(name), *args, &block)
+        end
+
+        private
+
+        def inverted_subset_name(name)
+          "not_#{name}"
         end
       end
     end

data/lib/sequel/plugins/many_through_many.rb

@@ -283,7 +283,7 @@ module Sequel
                 iq = nil
               end
               fe = opts.final_edge
-              ds.graph(opts.associated_class, use_only_conditions ? only_conditions : (Array(opts.right_primary_key).zip(Array(fe[:left])) + conditions), :select=>select, :table_alias=>eo[:table_alias], :qualify=>:deep, :join_type=>eo[:join_type]||join_type, :join_only=>eo[:join_only], &graph_block)
+              ds.graph(opts.associated_class.dataset, use_only_conditions ? only_conditions : (Array(opts.right_primary_key).zip(Array(fe[:left])) + conditions), :select=>select, :table_alias=>eo[:table_alias], :qualify=>:deep, :join_type=>eo[:join_type]||join_type, :join_only=>eo[:join_only], &graph_block)
             end
           end
         end

data/lib/sequel/plugins/nested_attributes.rb

@@ -245,7 +245,7 @@ module Sequel
         def nested_attributes_set_attributes(meta, obj, attributes)
           if fields = meta[:fields]
             fields = fields.call(obj) if fields.respond_to?(:call)
-            obj.set_only(attributes, fields)
+            obj.set_fields(attributes, fields, :missing=>:skip)
           else
             obj.set(attributes)
           end

data/lib/sequel/plugins/schema.rb

@@ -59,7 +59,7 @@ module Sequel
           @schema || (superclass.schema unless superclass == Model)
         end
     
-        # Defines a table schema (see Schema::Generator for more information).
+        # Defines a table schema (see Schema::CreateTableGenerator for more information).
         #
         # This is only needed if you want to use the create_table/create_table! methods.
         # Will also set the dataset if you provide a name, as well as setting

data/lib/sequel/plugins/single_table_inheritance.rb

@@ -171,7 +171,7 @@ module Sequel
           key = Array(sti_key_map[subclass]).dup
           sti_subclass_added(key)
           rp = dataset.row_proc
-          subclass.set_dataset(sti_dataset.where(SQL::QualifiedIdentifier.new(sti_dataset.first_source_alias, sti_key)=>Sequel.delay{Sequel.synchronize{key}}), :inherited=>true)
+          subclass.set_dataset(sti_subclass_dataset(key), :inherited=>true)
           subclass.instance_eval do
             @dataset = @dataset.with_row_proc(rp)
             @sti_key_array = key
@@ -230,6 +230,12 @@ module Sequel
             raise(Error, "Invalid class type used: #{v.inspect}")
           end
         end
+
+        # Use the given dataset for the subclass, with key being the allowed
+        # values for the sti_kind field.
+        def sti_subclass_dataset(key)
+          sti_dataset.where(SQL::QualifiedIdentifier.new(sti_dataset.first_source_alias, sti_key)=>Sequel.delay{Sequel.synchronize{key}})
+        end
       end
 
       module InstanceMethods

data/lib/sequel/plugins/subset_conditions.rb

@@ -24,13 +24,21 @@ module Sequel
     #   Album.where(Sequel.|(Album.published_conditions, :ready=>true)).sql
     #   # SELECT * FROM albums WHERE ((published IS TRUE) OR (ready IS TRUE))
     module SubsetConditions
-      module ClassMethods
+      def self.apply(mod, &block)
+        mod.instance_exec do
+          @dataset_module_class = Class.new(@dataset_module_class) do
+            include DatasetModuleMethods
+          end
+        end
+      end
+
+      module DatasetModuleMethods
         # Also create a method that returns the conditions the filter uses.
-        def subset(name, *args, &block)
+        def where(name, *args, &block)
           super
           cond = args
           cond = cond.first if cond.size == 1
-          def_dataset_method(:"#{name}_conditions"){filter_expr(cond, &block)}
+          define_method(:"#{name}_conditions"){filter_expr(cond, &block)}
         end
       end
     end

data/lib/sequel/plugins/whitelist_security.rb

@@ -0,0 +1,118 @@
+# frozen-string-literal: true
+
+module Sequel
+  module Plugins
+    # The whitelist_security plugin contains whitelist-based support for
+    # mass assignment, explicitly specifying which columns to allow mass assignment for,
+    # disallowing mass assignment for columns not listed.  This exists mostly for backwards
+    # compatibility, it's best to use Sequel::Model#set_fields and Sequel::Model#update_fields
+    # to decide which fields to allow on a per-call basis.
+    #
+    # Usage:
+    #
+    #   # Make all model subclasses support allowed_columns 
+    #   Sequel::Model.plugin :whitelist_security
+    #
+    #   # Make the Album class support allowed_columns
+    #   Album.plugin :whitelist_security
+    module WhitelistSecurity
+      module ClassMethods
+        # Which columns should be the only columns allowed in a call to a mass assignment method (e.g. set)
+        # (default: not set, so all columns not otherwise restricted are allowed).
+        attr_reader :allowed_columns
+  
+        Plugins.inherited_instance_variables(self, :@allowed_columns=>:dup)
+
+        # Freeze allowed columns when freezing model class.
+        def freeze
+          @allowed_columns.freeze
+          super
+        end
+
+        # Set the columns to allow when using mass assignment (e.g. +set+).  Using this means that
+        # any columns not listed here will not be modified.  If you have any virtual
+        # setter methods (methods that end in =) that you want to be used during
+        # mass assignment, they need to be listed here as well (without the =).
+        #
+        # It may be better to use a method such as +set_only+ or +set_fields+ that lets you specify
+        # the allowed fields per call.
+        #
+        #   Artist.set_allowed_columns(:name, :hometown)
+        #   Artist.set(:name=>'Bob', :hometown=>'Sactown') # No Error
+        #   Artist.set(:name=>'Bob', :records_sold=>30000) # Error
+        def set_allowed_columns(*cols)
+          clear_setter_methods_cache
+          @allowed_columns = cols
+        end
+  
+        private
+
+        # If allowed_columns is set, only allow those columns.
+        def get_setter_methods
+          if allowed_columns
+            allowed_columns.map{|x| "#{x}="}
+          else
+            super
+          end
+        end
+      end
+
+      module InstanceMethods
+        # Set all values using the entries in the hash, ignoring any setting of
+        # allowed_columns in the model.
+        #
+        #   Artist.set_allowed_columns(:num_albums)
+        #   artist.set_all(:name=>'Jim')
+        #   artist.name # => 'Jim'
+        def set_all(hash)
+          set_restricted(hash, :all)
+        end
+  
+        # Set the values using the entries in the hash, only if the key
+        # is included in only.  It may be a better idea to use +set_fields+
+        # instead of this method.
+        #
+        #   artist.set_only({:name=>'Jim'}, :name)
+        #   artist.name # => 'Jim'
+        #
+        #   artist.set_only({:hometown=>'LA'}, :name) # Raise Error
+        def set_only(hash, *only)
+          set_restricted(hash, only.flatten)
+        end
+  
+        # Update all values using the entries in the hash, ignoring any setting of
+        # +allowed_columns+ in the model.
+        #
+        #   Artist.set_allowed_columns(:num_albums)
+        #   artist.update_all(:name=>'Jim') # UPDATE artists SET name = 'Jim' WHERE (id = 1)
+        def update_all(hash)
+          update_restricted(hash, :all)
+        end
+  
+        # Update the values using the entries in the hash, only if the key
+        # is included in only.  It may be a better idea to use +update_fields+
+        # instead of this method.
+        #
+        #   artist.update_only({:name=>'Jim'}, :name)
+        #   # UPDATE artists SET name = 'Jim' WHERE (id = 1)
+        #
+        #   artist.update_only({:hometown=>'LA'}, :name) # Raise Error
+        def update_only(hash, *only)
+          update_restricted(hash, only.flatten)
+        end
+      
+        private
+
+        # If allowed_columns is set and set/update is called, only allow those columns.
+        def setter_methods(type)
+          if type == :default && model.allowed_columns
+            model.setter_methods
+          else
+            super
+          end
+        end
+      end
+    end
+  end
+end
+

data/lib/sequel/sql.rb

@@ -35,6 +35,7 @@ module Sequel
 
       # No-op method on ruby 1.9, which has a real +BasicObject+ class.
       def self.remove_methods!
+        Sequel::Deprecation.deprecate("Sequel::BasicObject#remove_methods!", "It has no effect, so stop calling it")
       end
     end
   end
@@ -58,7 +59,8 @@ module Sequel
       # Create a new SQLTime instance given an hour, minute, and second.
       def create(hour, minute, second, usec = 0)
         t = date
-        local(t.year, t.month, t.day, hour, minute, second, usec)
+        meth = Sequel.application_timezone == :utc ? :utc : :local
+        send(meth, t.year, t.month, t.day, hour, minute, second, usec)
       end
     end
 
@@ -142,19 +144,20 @@ module Sequel
         ([self.class] + self.class.comparison_attrs.map{|x| send(x)}).hash
       end
 
-      # Show the class name and instance variables for the object, necessary
-      # for correct operation on ruby 1.9.2.
+      # Show the class name and instance variables for the object.
       def inspect
         "#<#{self.class} #{instance_variables.map{|iv| "#{iv}=>#{instance_variable_get(iv).inspect}"}.join(', ')}>"
       end
 
       # Returns +self+, because <tt>SQL::Expression</tt> already acts like +LiteralString+.
       def lit
+        Sequel::Deprecation.deprecate("Sequel::SQL::Expression#lit", "This method returns self, so just use the receiver")
         self
       end
       
       # Alias of +to_s+
       def sql_literal(ds)
+        Sequel::Deprecation.deprecate("Sequel::SQL::Expression#sql_literal", "Call Sequel::Dataset#literal with the expression instead")
         s = String.new
         to_s_append(ds, s)
         s
@@ -379,7 +382,7 @@ module Sequel
       #
       #   Sequel.case([[{:a=>[2,3]}, 1]], 0) # SQL: CASE WHEN a IN (2, 3) THEN 1 ELSE 0 END
       #   Sequel.case({:a=>1}, 0, :b) # SQL: CASE b WHEN a THEN 1 ELSE 0 END
-      def case(*args) # core_sql ignore
+      def case(*args)
         SQL::CaseExpression.new(*args)
       end
 
@@ -612,7 +615,7 @@ module Sequel
       #
       #    DB[:items].select{|o| o.count(Sequel.lit('DISTINCT ?', :a))}.sql #=>
       #      "SELECT count(DISTINCT a) FROM items"
-      def lit(s, *args) # core_sql ignore
+      def lit(s, *args)
         if args.empty?
           if s.is_a?(LiteralString)
             s
@@ -1108,7 +1111,7 @@ module Sequel
       def self.from_value_pairs(pairs, op=:AND, negate=false)
         pairs = pairs.map{|l,r| from_value_pair(l, r)}
         pairs.map!{|ce| invert(ce)} if negate
-        pairs.length == 1 ? pairs.at(0) : new(op, *pairs)
+        pairs.length == 1 ? pairs[0] : new(op, *pairs)
       end
 
       # Return a BooleanExpression based on the right side of the pair.
@@ -1422,6 +1425,7 @@ module Sequel
       end
 
       # Return a new function with an OVER clause (making it a window function).
+      # See {SQL::Window} for the list of options +over+ can receive.
       #
       #   Sequel.function(:row_number).over(:partition=>:col) # row_number() OVER (PARTITION BY col)
       def over(window=OPTS)
@@ -1614,8 +1618,14 @@ module Sequel
       # Create an object with the given string, placeholder arguments, and parens flag.
       def initialize(str, args, parens=false)
         @str = str
-        @args = args.is_a?(Array) && args.length == 1 && (v = args.at(0)).is_a?(Hash) ? v : args
+        @args = args.is_a?(Array) && args.length == 1 && (v = args[0]).is_a?(Hash) ? v : args
         @parens = parens
+        freeze
+      end
+
+      # Return a copy of the that will be surrounded by parantheses.
+      def with_parens
+        @parens ? self : self.class.new(@str, @args, true)
       end
 
       to_s_method :placeholder_literal_string_sql
@@ -1758,7 +1768,7 @@ module Sequel
           r, rre, rci = like_element(ce)
           BooleanExpression.new(LIKE_MAP[[lre||rre, lci||rci]], l, r)
         end
-        ces.length == 1 ? ces.at(0) : BooleanExpression.new(:OR, *ces)
+        ces.length == 1 ? ces[0] : BooleanExpression.new(:OR, *ces)
       end
       
       # Returns a three element array, made up of:
@@ -1925,47 +1935,81 @@ module Sequel
 
       # Return a literal string created with the given string.
       def `(s)
+        Sequel::Deprecation.deprecate("Using Sequel#VirtualRow#` to create a literal SQL fragment", "Use Sequel.lit instead")
         Sequel::LiteralString.new(s)
       end
 
-      # Return an +Identifier+, +QualifiedIdentifier+, or +Function+, depending
-      # on arguments and whether a block is provided.  Does not currently call the block.
-      # See the class level documentation.
-      def method_missing(m, *args, &block)
-        if block
-          if args.empty?
-            Function.new(m)
-          else
-            case args.shift
-            when :*
-              Function.new(m, *args).*
-            when :distinct
-              Function.new(m, *args).distinct
-            when :over
-              opts = args.shift || OPTS
-              f = Function.new(m, *::Kernel.Array(opts[:args]))
-              f = f.* if opts[:*]
-              f.over(opts)
+      include(Module.new do
+        # Return an +Identifier+, +QualifiedIdentifier+, or +Function+, depending
+        # on arguments and whether a block is provided.  Does not currently call the block.
+        # See the class level documentation.
+        def method_missing(m, *args, &block)
+          if block
+            if args.empty?
+              Sequel::Deprecation.deprecate("Passing a block to a virtual row method to create a Sequel::SQL::Function", "Replace the block with a call to .function to create a function, or use the virtual_row_method_block extension")
+              Function.new(m)
             else
-              Kernel.raise(Error, 'unsupported VirtualRow method argument used with block')
+              case args.shift
+              when :*
+                Sequel::Deprecation.deprecate("Passing a block to a virtual row method with a :* argument to create a Sequel::SQL::Function", "Remove the :* argument and block and a call to .function.* to create a function(*) call, or use the virtual_row_method_block extension")
+                Function.new(m, *args).*
+              when :distinct
+                Sequel::Deprecation.deprecate("Passing a block to a virtual row method with a :distinct argument to create a Sequel::SQL::Function", "Remove the :distinct argument and block with a call to .function.distinct to create a function(DISTINCT ...) call, or use the virtual_row_method_block extension")
+                Function.new(m, *args).distinct
+              when :over
+                opts = args.shift || OPTS
+                f = Function.new(m, *::Kernel.Array(opts[:args]))
+                if opts[:*]
+                  Sequel::Deprecation.deprecate("Passing a block to a virtual row method with a :over argument and :* option to create a Sequel::SQL::WindowFunction", "Remove the :over argument, :* option and block with a call to .function.*.over with the options to create a function(*) OVER (...) call, or use the virtual_row_method_block extension")
+                  f = f.*
+                else
+                  Sequel::Deprecation.deprecate("Passing a block to a virtual row method with a :over argument to create a Sequel::SQL::WindowFunction", "Remove the :over argument and block with a call to .function.over with the options to create a function(...) OVER (...) call, or use the virtual_row_method_block extension")
+                end
+                f.over(opts)
+              else
+                Kernel.raise(Error, 'unsupported VirtualRow method argument used with block')
+              end
+            end
+          elsif args.empty?
+            if split = Sequel.split_symbols?
+              table, column = m.to_s.split(DOUBLE_UNDERSCORE, 2)
+              if column && split == :deprecated
+                Sequel::Deprecation.deprecate("Splitting virtual row method names", "Either set Sequel.split_symbols = true, or change #{m.inspect} to #{table}[:#{column}]")
+              end
+              column ? QualifiedIdentifier.new(table, column) : Identifier.new(m)
+            else
+              Identifier.new(m)
             end
-          end
-        elsif args.empty?
-          if Sequel.split_symbols?
-            table, column = m.to_s.split(DOUBLE_UNDERSCORE, 2)
-            column ? QualifiedIdentifier.new(table, column) : Identifier.new(m)
           else
-            Identifier.new(m)
+            Function.new(m, *args)
           end
-        else
-          Function.new(m, *args)
         end
-      end
+      end)
 
       Sequel::VIRTUAL_ROW = new
     end
 
     # A +Window+ is part of a window function specifying the window over which a window function operates.
+    #
+    #   Sequel::SQL::Window.new(partition: :col1)
+    #   # (PARTITION BY col1)
+    #   Sequel::SQL::Window.new(partition: [:col2, :col3])
+    #   # (PARTITION BY col2, col3)
+    #
+    #   Sequel::SQL::Window.new(order: :col4)
+    #   # (ORDER BY col4)
+    #   Sequel::SQL::Window.new(order: [:col5, Sequel.desc(:col6)])
+    #   # (ORDER BY col5, col6 DESC)
+    #
+    #   Sequel::SQL::Window.new(partition: :col7, frame: :all)
+    #   # (PARTITION BY col7 ROWS BETWEEN UNBOUNDED PRECEDING AND UNBOUNDED FOLLOWING)
+    #   Sequel::SQL::Window.new(partition: :col7, frame: :rows)
+    #   # (PARTITION BY col7 ROWS BETWEEN UNBOUNDED PRECEDING AND CURRENT ROW)
+    #   Sequel::SQL::Window.new(partition: :col7, frame: "RANGE CURRENT ROW")
+    #   # (PARTITION BY col7 RANGE CURRENT ROW)
+    #
+    #   Sequel::SQL::Window.new(window: :named_window) # you can create a named window with Dataset#window
+    #   # (named_window)
     class Window < Expression
       # The options for this window.  Options currently supported:
       # :frame :: if specified, should be :all, :rows, or a String that is used literally. :all always operates over all rows in the

data/lib/sequel/timezones.rb

@@ -171,6 +171,7 @@ module Sequel
             v.to_datetime
           else
           # :nocov:
+            # SEQUEL5: Remove
             # Ruby 1.8 code, %N not available and %z broken on Windows
             offset_hours, offset_minutes = (v.utc_offset/60).divmod(60)
             string_to_datetime(v.strftime("%Y-%m-%dT%H:%M:%S") << sprintf(".%06i%+03i%02i", v.usec, offset_hours, offset_minutes))
@@ -186,6 +187,7 @@ module Sequel
           v.to_time
         else
         # :nocov:
+        # SEQUEL5: Remove
           string_to_datetime(v.strftime("%FT%T.%N%z"))
         # :nocov:
         end