sghtmltopdf 0.3.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: de56b0b878dc4ce3c0150d6f2b51e506820b28cd2bcc0577b57b8335ec6e3a90
-  data.tar.gz: 0f91a87de49fb27ea32d627873be0c4fe743c54ea38f69ce94f696c2d5791a17
+  metadata.gz: 0f317db9c1a48c59df592601e2246186da7539007f19859be3ebbf6c057283bb
+  data.tar.gz: 10d371ed48aa9b6772c840a75d4cc9e456468c783cae83ee95a0b73588b345a1
 SHA512:
-  metadata.gz: 89dd71b47c89519290464731545bddee9fc7aa0364f8809db73478eec7a451834f453fce779698cad431a7d63aca40231c7ffd0e33dd4b543be0804d826bf0a5
-  data.tar.gz: 5f5444730f3d61dcc1efbf8c0925ca41b1868203460cbc6c53b9da6dae2c88c0e30d341df578313c276e69a574d4bd7d24d1f0ec32b7252b0beb44a76a3026c1
+  metadata.gz: ba289e596824c8cbc3a259bd1adfd9397e47c333cdbcefeff1d8e33ae512c64ec197a67d98f5f90a35f46cefc833b837b0348e6625dd69e03ff732a717844d3b
+  data.tar.gz: 9f6f870dee5e361e175d19d778d3129d416814cb7c7ae0092afe95e59f6469a1f43cbe24a5fa0e9a719c39ee406cb157cbf50285a64a67760f761705558dd9e1

data/Cargo.lock

@@ -1050,7 +1050,7 @@ dependencies = [
 
 [[package]]
 name = "sghtmltopdf"
-version = "0.3.0"
+version = "0.4.0"
 dependencies = [
  "magnus",
  "rb-sys",
@@ -1059,7 +1059,7 @@ dependencies = [
 
 [[package]]
 name = "sghtmltopdf-core"
-version = "0.3.0"
+version = "0.4.0"
 dependencies = [
  "base64",
  "clap",

data/README.md

@@ -68,14 +68,19 @@ Converter keys are flat CLI flag names, so wicked_pdf's nested `margin: {top: 10
 
 ### Assets
 
-PDF rendering does not go through the HTTP server, so `/assets/…` URLs are resolved as local files: the Railtie defaults `base_url` to `Rails.root/public` and restricts local reads to `Rails.root` via `allow`.
-That is enough for a precompiled production app; in development, these helpers inline the asset instead:
+PDF rendering does not go through the HTTP server, so `/assets/…` URLs are resolved as local files: the Railtie defaults `base_url` to `Rails.root/public` and restricts local reads to `public/` and the asset pipeline load paths via `allow_path`.
+That is enough for a precompiled production app; in development the digested `/assets/…` path names no file on disk, so these helpers look the asset up in the pipeline instead — the CSS expanded into a `<style>`, the image referenced by the path the engine can read:
 
 ```erb
 <%= sghtmltopdf_stylesheet_link_tag "pdf" %>
 <%= sghtmltopdf_image_tag "logo.png" %>
 ```
 
+`sghtmltopdf_stylesheet_link_tag` does not copy the CSS verbatim: it points every `url()` at a file the engine can read and splices in every `@import`.
+The asset pipeline rewrites `url()` through `asset_path` while precompiling, which turns a `@font-face` source into a digested `/assets/…` path, or into an absolute URL once `asset_host` is set — neither can be fetched while rendering, and a `@font-face` that fails to load falls back to the engine default rather than to the next `font-family`.
+
+A file `allow_path` does not cover is embedded as a `data:` URI instead, so that it cannot silently vanish from the PDF; pass `inline: true` to embed unconditionally.
+
 ### Streaming the response
 
 To send pages as soon as their layout is final, pass a block and use `ActionController::Live` — this also makes `Rack::Timeout` and `Thread#kill` effective at chunk boundaries:

data/ext/sghtmltopdf/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sghtmltopdf"
-version = "0.3.0"
+version = "0.4.0"
 edition = "2021"
 publish = false
 description = "Ruby binding for sghtmltopdf (see bindings/ruby)"

data/lib/sghtmltopdf/configuration.rb

@@ -24,12 +24,12 @@ module Sghtmltopdf
     end
 
     def [](key)
-      key = key.to_sym
+      key = Options.canonical_key(key)
       @options.key?(key) ? @options[key] : @defaults[key]
     end
 
     def []=(key, value)
-      @options[key.to_sym] = value
+      @options[Options.canonical_key(key)] = value
     end
 
     # @param with_defaults [Boolean] 流し込まれた既定値を含めるか。
@@ -43,7 +43,7 @@ module Sghtmltopdf
     # 既定値を流し込む。Railtieが Rails向けの既定値を入れるのに使う。
     # 明示的に設定された値より弱い(順序に関係なく`[]=`が勝つ)。
     def apply_defaults(defaults)
-      defaults.each { |key, value| @defaults[key.to_sym] = value }
+      defaults.each { |key, value| @defaults[Options.canonical_key(key)] = value }
       self
     end
 

data/lib/sghtmltopdf/options.rb

@@ -17,8 +17,26 @@ module Sghtmltopdf
     # クエリにも出さない。
     TRANSPORT_KEYS = %i[server_url server_open_timeout server_read_timeout chunk_size].freeze
 
+    # 別名のキー(値は正規名)。CLIは`--allow`を`--allow-path`の別名として
+    # 受けるが、Ruby側は2つのキーのまま持ち回ってはいけない。既定が一方の
+    # キー、呼び出し時の指定がもう一方のキーだと、ハッシュのマージでは
+    # 上書きにならず両方がargvへ出てしまう(同じフラグの繰り返しは
+    # 「置き換え」ではなく「合併」の意味になる)。
+    ALIAS_KEYS = {allow: :allow_path}.freeze
+
     module_function
 
+    # 別名のキーを正規名へ寄せる。
+    def canonical_key(key)
+      key = key.to_sym
+      ALIAS_KEYS.fetch(key, key)
+    end
+
+    # ハッシュのキーをまとめて正規化する。
+    def canonicalize(options)
+      options.to_h { |key, value| [canonical_key(key), value] }
+    end
+
     # @param options [Hash] Rubyのオプションハッシュ
     # @return [Array<String>] clapへ渡す引数列
     def to_argv(options)
@@ -113,7 +131,8 @@ module Sghtmltopdf
     # 変換オプションだけを、渡された順にペアとして列挙する。
     def each_pair(options, &block)
       options.each do |key, value|
-        next if TRANSPORT_KEYS.include?(key.to_sym)
+        key = canonical_key(key)
+        next if TRANSPORT_KEYS.include?(key)
 
         pairs_for(key, value).each(&block)
       end

data/lib/sghtmltopdf/railtie.rb

@@ -6,16 +6,38 @@ require_relative "view_helpers"
 
 module Sghtmltopdf
   class Railtie < ::Rails::Railtie
-    def self.default_options(root)
-      root = root.to_s
-      defaults = {allow: [root]}
-      public_dir = File.join(root, "public")
+    # The directories the engine may read from: `public/`, where the
+    # precompiled assets are, plus the asset pipeline load paths, where their
+    # sources are in development. The pipeline paths reach outside `Rails.root`
+    # for the assets a gem or an engine provides, which is why the whole of
+    # `Rails.root` is not a substitute for them.
+    #
+    # `config.assets` raises rather than answering `nil` when no pipeline gem is
+    # installed, hence `try`.
+    def self.default_options(app)
+      public_dir = File.join(app.root.to_s, "public")
+      pipeline = Array(app.config.try(:assets)&.paths).map(&:to_s)
+      allow = [public_dir, *pipeline].select { |dir| File.directory?(dir) }.uniq
+
+      defaults = {}
+      # An empty list would mean "no --allow-path", which is not the same thing as
+      # "allow nothing": it hands the boundary back to `base_url`. Leaving the
+      # key out says that, and says it in one place.
+      defaults[:allow_path] = allow unless allow.empty?
       defaults[:base_url] = public_dir if File.directory?(public_dir)
       defaults
     end
 
+    # 読むのはinitializerの中ではなく`after_initialize`。パイプラインが
+    # `config.assets.paths`を埋めるのは自分のinitializer(Propshaftなら
+    # `propshaft.append_assets_path`)で、そちらの方が後に走るため。
+    #
+    # `config/initializers`より後になるが、`apply_defaults`は明示的に設定した
+    # 値より常に弱いので、ユーザーの設定を踏むことはない。
     initializer "sghtmltopdf.defaults" do |app|
-      Sghtmltopdf.config.apply_defaults(Sghtmltopdf::Railtie.default_options(app.root))
+      app.config.after_initialize do
+        Sghtmltopdf.config.apply_defaults(Sghtmltopdf::Railtie.default_options(app))
+      end
     end
 
     initializer "sghtmltopdf.renderer" do

data/lib/sghtmltopdf/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Sghtmltopdf
-  VERSION = "0.3.0"
+  VERSION = "0.4.0"
 end

data/lib/sghtmltopdf/view_helpers.rb

@@ -1,65 +1,280 @@
 # frozen_string_literal: true
 
 module Sghtmltopdf
-  # Action View用のヘルパ。
+  # Action View helpers.
   #
-  # PDFのレンダリングはHTTPサーバを介さないため、`/assets/…`のようなURLは
-  # ローカルファイルとして解決される(`--base-url`の既定は
-  # `Rails.root/public`。[Railtie.default_options])。precompile済みの
-  # 本番環境ではこれで素の`stylesheet_link_tag`もそのまま動くが、開発環境の
-  # ようにアセットがまだ`public/`へ書き出されていない場合は解決できない。
+  # Rendering a PDF never goes through an HTTP server, so a URL such as
+  # `/assets/…` is resolved as a local file (`--base-url` defaults to
+  # `Rails.root/public`, see [Railtie.default_options]). In production, where
+  # the assets are precompiled, that makes a plain `stylesheet_link_tag` work as
+  # it is; in development, where nothing has been written to `public/` yet, it
+  # cannot be resolved: the digest and the `/assets/` mount point are made up by
+  # the pipeline at request time, so no file of that name is on disk.
   #
-  # そこで、
+  # Hence helpers that look the asset up in the pipeline and hand the engine
+  # something it can actually read:
   #
   #   <%= sghtmltopdf_stylesheet_link_tag "pdf" %>
+  #   <%= sghtmltopdf_image_tag "logo.png" %>
   #
-  # のようにCSSの中身を`<style>`へ展開するヘルパを用意する(wicked_pdfの
-  # `wicked_pdf_stylesheet_link_tag`に相当)。
+  # (the counterparts of wicked_pdf's `wicked_pdf_stylesheet_link_tag` and
+  # `wicked_pdf_image_tag`).
   module ViewHelpers
-    # アセットのローカルファイルパスを返す。見つからなければ`nil`。
+    # Local file path of an asset, or `nil` when it cannot be found.
     #
-    # 1. `public/`配下(precompile済み。本番環境)
-    # 2. アセットパイプラインのロードパス(開発環境。Propshaft/Sprockets)
+    # Looks in
     #
-    # の順に探す。パイプラインの参照はどちらのgemにも依存しないよう
-    # `respond_to?`で分岐している(best effort)。
+    #   1. `public/` (precompiled; production)
+    #   2. the asset pipeline load paths (development; Propshaft or Sprockets)
+    #
+    # in that order. The pipeline lookup goes through `respond_to?` so that
+    # neither gem becomes a dependency (best effort).
     def sghtmltopdf_asset_path(source)
       path = source.to_s
+      # A source that is already a URL (or a `data:` URI) is not an asset of
+      # this application. Without this, `from_public_dir` would strip the host
+      # off `https://example.com/logo.png` and hand back `public/logo.png`.
+      return nil if path.match?(%r{\A(?:[a-z][a-z0-9+.\-]*:|//)}i)
       return path if path.start_with?("/") && File.file?(path)
 
       from_public_dir(path) || from_asset_pipeline(path)
     end
 
-    # CSSの中身を`<style>`へ展開する。複数指定でき、見つからないものは
-    # 黙って飛ばす(PDF生成そのものは止めない)。
+    # Expands the CSS itself into a `<style>`. Takes several sources; any that
+    # cannot be found are skipped silently (rendering still goes ahead).
+    #
+    # The file is not copied verbatim: its `url()`s are pointed at files the
+    # engine can read and its `@import`s are spliced in, see
+    # [#inline_stylesheet].
     def sghtmltopdf_stylesheet_link_tag(*sources)
       css = sources.flatten.filter_map do |source|
         path = sghtmltopdf_asset_path(with_extension(source, ".css"))
-        File.read(path) if path
+        inline_stylesheet(path) if path
       end
       return "".html_safe if css.empty?
 
       content_tag(:style, css.join("\n").html_safe, type: "text/css")
     end
 
-    # `image_tag`のsrcをローカルファイルパスへ差し替える。
+    # An `<img>` whose `src` the engine can read.
+    #
+    # The file is referenced by path, which keeps the HTML small: relative to
+    # `base_url` when it sits under it (the precompiled case), and the absolute
+    # filesystem path otherwise (the development case, where the file is still
+    # in the pipeline's load path). The engine reads an absolute `src` as a
+    # filesystem path once it fails to resolve under `base_url` (#44), so both
+    # forms reach the same file.
+    #
+    # A path only works if the engine is allowed to read there, so it is used
+    # only when `allow_path` (or `base_url`, with none set) covers the file.
+    # Everything else falls back to a `data:` URI, which depends on no
+    # configuration at all and therefore cannot fail: without that fallback a
+    # blocked path would just disappear from the PDF, since a failed asset fetch
+    # is ignored by default.
+    #
+    # `inline: true` forces embedding.
     def sghtmltopdf_image_tag(source, options = {})
-      image_tag(sghtmltopdf_asset_path(source) || source, options)
+      options = options.symbolize_keys
+      inline = options.delete(:inline)
+      path = sghtmltopdf_asset_path(source)
+      # Not an asset of this application (a remote URL, say): leave it to Rails.
+      return image_tag(source, options) if path.nil?
+
+      if !inline && (src = engine_readable_src(path))
+        # `image_tag` would rewrite the source (prefixing `/images/`, the asset
+        # host, and so on), so the tag is built directly. That skips the one
+        # option `image_tag` does more than copy, so `size:` is expanded here.
+        return tag.img(**expand_size(options).merge(src: src))
+      end
+      # A `data:` URI matches `AssetUrlHelper::URI_REGEXP`, so `image_tag`
+      # passes it through untouched and its own options keep working.
+      image_tag(data_uri(path), options)
     end
 
     private
 
-    # `asset_path`が返すURL(asset_hostが付くこともある)からパス部分だけを
-    # 取り出し、`public/`配下の実ファイルへ対応付ける。
+    # `path` read as CSS, with every `url()` pointed at a file the engine can
+    # read and every `@import` spliced in.
+    #
+    # Both have to happen here because the engine keeps one base for the whole
+    # document: every CSS source is concatenated before it is parsed, so a
+    # `url()` is resolved against the HTML's `base_url` whatever stylesheet it
+    # came from. Only this side knows where each file sits on disk, so each
+    # one's references are resolved against its own directory before its text
+    # is spliced into the next.
+    #
+    # What has to be undone is mostly the asset pipeline's own work: it
+    # rewrites every `url()` through `asset_path` while precompiling, which
+    # yields a digested `/assets/…` path, or an absolute URL once `asset_host`
+    # is set. Rendering never goes through the HTTP server, so neither can be
+    # fetched.
+    #
+    # `chain` holds the files already being expanded, innermost last.
+    def inline_stylesheet(path, chain = [])
+      css = File.read(path)
+      dir = File.dirname(path)
+      chain += [real_path(path)].compact
+      comments = comment_ranges(css)
+      out = +""
+      cursor = 0
+      while (import = IMPORT_STATEMENT.match(css, cursor))
+        commented = comments.any? { |range| range.cover?(import.begin(0)) }
+        expanded = imported_stylesheet(import[:href], dir, chain) unless commented
+        out << rewrite_css_urls(css[cursor...import.begin(0)].to_s, dir)
+        cursor = import.end(0)
+        out << (expanded || import[0])
+      end
+      out << rewrite_css_urls(css[cursor..].to_s, dir)
+    end
+
+    # The expanded content of an `@import` target, or `nil` to leave the
+    # statement as it is, which hands it to the engine untouched. That happens
+    # when it names no asset of this application, when the nesting is too deep,
+    # and when it points back at a file already being expanded.
+    #
+    # Media conditions on the statement are dropped. The engine replaces the
+    # whole statement with the imported text too, so nothing changes by doing
+    # it here.
+    def imported_stylesheet(href, dir, chain)
+      return nil if chain.length >= MAX_IMPORT_DEPTH
+
+      target = css_url_target(unquote(href), dir)
+      return nil if target.nil?
+
+      real = real_path(target)
+      return nil if real.nil? || chain.include?(real)
+
+      inline_stylesheet(target, chain)
+    end
+
+    # Byte ranges of the `/* … */` comments in `css`. A commented-out `@import`
+    # must not be spliced in.
+    def comment_ranges(css)
+      css.enum_for(:scan, CSS_COMMENT).map { Regexp.last_match.begin(0)...Regexp.last_match.end(0) }
+    end
+
+    # Every `url()` in `css` pointed at something the engine can read: a path
+    # when it may read the file there, a `data:` URI when it may not.
+    #
+    # A reference that names no file of this application is left alone, which
+    # covers `data:` URIs, bare fragments, and genuinely remote resources such
+    # as a font served by a CDN.
+    def rewrite_css_urls(css, dir)
+      css.gsub(CSS_URL) do
+        match = Regexp.last_match
+        target = css_url_target(unquote(match[:href]), dir)
+        target ? css_url(engine_readable_src(target) || data_uri(target)) : match[0]
+      end
+    end
+
+    # The local file a CSS reference names, or `nil` when it names none.
+    def css_url_target(ref, dir)
+      path = ref.split(/[?#]/, 2).first.to_s
+      return nil if path.empty? || path.match?(/\Adata:/i)
+
+      if path.match?(%r{\A(?:[a-z][a-z0-9+.\-]*:|//)}i)
+        # Only an http(s) or protocol-relative URL can be one of ours. The host
+        # is not compared against `asset_host`: it may be a callable or carry a
+        # `%d` wildcard, so there is no general way to recognise it. Finding the
+        # path on disk is the test instead, and what that finds is the very file
+        # the reference names.
+        return nil unless path.match?(%r{\A(?:https?:)?//}i)
+
+        path = path.sub(%r{\A(?:https?:)?//[^/]*}i, "")
+        return nil if path.empty?
+      end
+
+      path.start_with?("/") ? from_site_root(path) : from_stylesheet_dir(path, dir)
+    end
+
+    # A site-root-relative reference (`/assets/pdf-<digest>.css`) mapped onto a
+    # file. `relative_url_root` comes off first: the pipeline writes it in front
+    # of every URL, but it is a mount point, not a directory under `public/`.
+    def from_site_root(path)
+      root = ::Rails.application.config.try(:relative_url_root).to_s
+      path = path.delete_prefix(root) unless root.empty?
+      candidate = File.join(::Rails.public_path.to_s, path)
+      return candidate if File.file?(candidate)
+
+      # Nothing is precompiled in development, so the load path is asked as
+      # well. The mount point is not part of a logical path either.
+      logical = path.delete_prefix("/")
+      prefix = ::Rails.application.config.try(:assets)&.prefix.to_s.delete_prefix("/")
+      from_asset_pipeline(logical) ||
+        (prefix.empty? ? nil : from_asset_pipeline(logical.delete_prefix("#{prefix}/")))
+    end
+
+    # A reference relative to the stylesheet that wrote it, which is what CSS
+    # says it means and what the pipeline assumed while compiling the file.
+    #
+    # The load path is tried too. An uncompiled stylesheet sitting at the root
+    # of its own load path names assets by logical path, which is spelled the
+    # same way but is looked up across every root.
+    def from_stylesheet_dir(path, dir)
+      candidate = File.expand_path(path, dir)
+      return candidate if File.file?(candidate)
+
+      from_asset_pipeline(path.delete_prefix("./"))
+    end
+
+    # A `url()` whose argument is always quoted, so that a path holding a space
+    # or a parenthesis survives.
+    def css_url(value)
+      %(url("#{value.gsub(/["\\]/) { |char| "\\#{char}" }}"))
+    end
+
+    def unquote(value)
+      value = value.to_s.strip
+      quoted = value.match(/\A(["'])(.*)\1\z/m)
+      quoted ? quoted[2] : value
+    end
+
+    # Matches the engine's own cap (`core/src/style/import.rs`). Past it the
+    # statement is left in place and the engine decides what to do with it.
+    MAX_IMPORT_DEPTH = 16
+    private_constant :MAX_IMPORT_DEPTH
+
+    # `@import` up to its terminating `;`, in both the `url()` and the bare
+    # string form. Media conditions are matched so they are consumed, not kept.
+    IMPORT_STATEMENT = /
+      @import \s+
+      (?: url\( \s* (?<href> "[^"]*" | '[^']*' | [^)"'\s]* ) \s* \)
+        | (?<href> "[^"]*" | '[^']*' ) )
+      [^;]* ;
+    /xi
+    private_constant :IMPORT_STATEMENT
+
+    # A `url()` token. The lookbehind keeps identifiers ending in "url" out.
+    CSS_URL = /(?<![\w-])url\( \s* (?<href> "[^"]*" | '[^']*' | [^)"'\s]* ) \s* \)/xi
+    private_constant :CSS_URL
+
+    CSS_COMMENT = %r{/\*.*?\*/}m
+    private_constant :CSS_COMMENT
+
+    # Takes the path part of the URL `asset_path` returns (which may carry an
+    # asset host) and maps it onto a real file under `public/`.
     def from_public_dir(source)
-      url = respond_to?(:asset_path) ? asset_path(source) : source
-      relative = url.to_s.sub(%r{\Ahttps?://[^/]+}, "").split(/[?#]/).first.to_s
+      relative = asset_url_for(source).to_s.sub(%r{\Ahttps?://[^/]+}, "").split(/[?#]/).first.to_s
       return nil if relative.empty?
 
       candidate = File.join(::Rails.public_path.to_s, relative)
       File.file?(candidate) ? candidate : nil
     end
 
+    # `asset_path` for `source`, falling back to `source` itself.
+    #
+    # Both pipelines raise rather than return a path for an asset outside their
+    # load path (`Propshaft::MissingAssetError`,
+    # `Sprockets::Rails::Helper::AssetNotFound`). A file that lives only in
+    # `public/` is exactly that, so the raw source is tried against `public/`.
+    def asset_url_for(source)
+      return source unless respond_to?(:asset_path)
+
+      asset_path(source)
+    rescue StandardError
+      source
+    end
+
     def from_asset_pipeline(source)
       assets = ::Rails.application.try(:assets)
       return nil if assets.nil?
@@ -77,6 +292,111 @@ module Sghtmltopdf
       nil
     end
 
+    # `data:<type>;base64,<data>` for a local file. `pack("m0")` is strict
+    # base64 (no line breaks) and needs no require, unlike `Base64`, which is no
+    # longer a default gem on Ruby 3.4.
+    def data_uri(path)
+      base64 = [File.binread(path)].pack("m0")
+      "data:#{mime_type_of(path)};base64,#{base64}"
+    end
+
+    # The `src` to reference `file` by, or `nil` when the engine would not be
+    # allowed to read it there.
+    def engine_readable_src(file)
+      return nil unless engine_can_read?(file)
+
+      relative_to_base_url(file) || real_path(file)
+    end
+
+    # Whether the engine's rules for local files let it read `file`.
+    #
+    # `allow_path` decides on its own once it is set: the engine stops treating
+    # `base_url` as the boundary and consults the allowed directories only.
+    # A run that has no local access at all, or one delegated to a server that
+    # may not even share this filesystem, can read nothing here.
+    def engine_can_read?(file)
+      config = Sghtmltopdf.config
+      return false if config[:disable_local_file_access] || config[:server_url]
+
+      file = real_path(file)
+      return false if file.nil?
+
+      dirs = Array(config[:allow_path]).filter_map { |dir| real_path(dir) }
+      dirs = [real_path(config[:base_url])].compact if dirs.empty?
+      dirs.any? { |dir| file.start_with?(dir + File::SEPARATOR) }
+    end
+
+    # The path of `file` relative to the configured `base_url`, or `nil` when
+    # `base_url` is not a directory holding it (it may be an http(s) URL, or the
+    # file may live outside it, as an asset pipeline one in development does).
+    def relative_to_base_url(file)
+      base = real_path(Sghtmltopdf.config[:base_url])
+      full = real_path(file)
+      return nil if base.nil? || full.nil?
+
+      prefix = base + File::SEPARATOR
+      full.start_with?(prefix) ? full.delete_prefix(prefix) : nil
+    end
+
+    # `path` with symlinks resolved, or `nil` when it is not a local path at
+    # all. The engine canonicalizes both sides before comparing them, so a
+    # symlink pointing out of an allowed directory does not count as inside it.
+    def real_path(path)
+      path = path.to_s
+      return nil if path.empty? || path.match?(%r{\Ahttps?://}i)
+
+      File.realpath(path)
+    rescue SystemCallError
+      nil
+    end
+
+    # `image_tag`'s `size:` shorthand: "40x30", or "40" for a square. The tag is
+    # built without `image_tag` here, so the expansion has to happen here too.
+    def expand_size(options)
+      return options unless options.key?(:size)
+
+      if options[:height] || options[:width]
+        raise ArgumentError, "Cannot pass a :size option with a :height or :width option"
+      end
+
+      size = options[:size].to_s
+      options = options.except(:size)
+      case size
+      when /\A(\d+(?:\.\d+)?)x(\d+(?:\.\d+)?)\z/ then options.merge(width: $1, height: $2)
+      when /\A\d+(?:\.\d+)?\z/ then options.merge(width: size, height: size)
+      else options
+      end
+    end
+
+    # Media type from the file extension. The engine detects the format from the
+    # bytes, so this only has to be honest, not exhaustive.
+    def mime_type_of(path)
+      MIME_TYPES.fetch(File.extname(path).downcase.delete_prefix("."), "application/octet-stream")
+    end
+
+    MIME_TYPES = {
+      "png" => "image/png",
+      "jpg" => "image/jpeg",
+      "jpeg" => "image/jpeg",
+      "gif" => "image/gif",
+      "webp" => "image/webp",
+      "avif" => "image/avif",
+      "bmp" => "image/bmp",
+      "ico" => "image/vnd.microsoft.icon",
+      "tif" => "image/tiff",
+      "tiff" => "image/tiff",
+      "svg" => "image/svg+xml",
+      # Reached through a stylesheet's `url()`, not through `image_tag`.
+      "otf" => "font/otf",
+      "ttf" => "font/ttf",
+      "ttc" => "font/collection",
+      "woff" => "font/woff",
+      "woff2" => "font/woff2",
+      "eot" => "application/vnd.ms-fontobject",
+      "css" => "text/css"
+    }.freeze
+    private_constant :MIME_TYPES
+
     def with_extension(source, extension)
       name = source.to_s
       name.end_with?(extension) ? name : "#{name}#{extension}"

data/lib/sghtmltopdf.rb

@@ -47,6 +47,7 @@ module Sghtmltopdf
     # 1回に渡すバイト数の目安は`chunk_size:`で変えられる(既定64KiB。
     # ローカル変換のみ。小さくするとGVLの取り直しが増える)。
     def render(html, **options, &block)
+      options = Options.canonicalize(options)
       client = server_client(options)
       return client.render(html.to_s, server_options(options), &block) if client
       return Native.render(html.to_s, argv_for(options)) if block.nil?
@@ -60,6 +61,7 @@ module Sghtmltopdf
     # 一時ファイルへ書いて成功時だけrenameするため、途中で失敗しても
     # 壊れたPDFが出力先に残らない(サーバへ委譲する場合も同じ)。
     def render_to_file(html, path, **options)
+      options = Options.canonicalize(options)
       client = server_client(options)
       return client.render_to_file(html.to_s, server_options(options), path.to_s) if client
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sghtmltopdf
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.0
 platform: ruby
 authors:
 - yo_waka