spikard 0.8.3 → 0.10.2

data/vendor/crates/spikard-rb/src/lib.rs

@@ -106,6 +106,7 @@ use magnus::{
     Error, Module, RArray, RHash, RString, Ruby, TryConvert, Value, function, gc::Marker, method, r_hash::ForEach,
 };
 use serde_json::Value as JsonValue;
+use spikard_bindings_shared::ErrorResponseBuilder;
 use spikard_http::ProblemDetails;
 use spikard_http::testing::ResponseSnapshot;
 use spikard_http::{Handler, HandlerResponse, HandlerResult, RequestData};
@@ -136,7 +137,7 @@ struct NativeTestClient {
 
 struct ClientInner {
     http_server: Arc<TestServer>,
-    transport_server: Arc<TestServer>,
+    transport_server: Option<Arc<TestServer>>,
     /// Keep Ruby handler closures alive for GC; accessed via the `mark` hook.
     _handlers: Vec<RubyHandler>,
 }
@@ -204,6 +205,7 @@ struct NativeDependencyRegistry {
     #[allow(dead_code)]
     gc_handles: RefCell<Vec<Opaque<Value>>>,
     registered_keys: RefCell<Vec<String>>,
+    registered_dependencies: RefCell<Vec<(String, Arc<dyn spikard_core::di::Dependency>)>>,
 }
 
 impl StreamingResponsePayload {
@@ -367,6 +369,8 @@ impl NativeLifecycleRegistry {
     where
         F: Fn(&mut spikard_http::LifecycleHooks, Arc<crate::lifecycle::RubyLifecycleHook>),
     {
+        let ruby = Ruby::get().map_err(|err| Error::new(magnus::exception::runtime_error(), err.to_string()))?;
+        let hook_value = crate::conversion::ensure_callable(&ruby, hook_value, kind)?;
         let idx = self.ruby_hooks.borrow().len();
         let hook = Arc::new(crate::lifecycle::RubyLifecycleHook::new(
             format!("{kind}_{idx}"),
@@ -385,6 +389,7 @@ impl Default for NativeDependencyRegistry {
             container: RefCell::new(Some(spikard_core::di::DependencyContainer::new())),
             gc_handles: RefCell::new(Vec::new()),
             registered_keys: RefCell::new(Vec::new()),
+            registered_dependencies: RefCell::new(Vec::new()),
         }
     }
 }
@@ -426,6 +431,7 @@ impl NativeDependencyRegistry {
         let container = container_ref
             .as_mut()
             .ok_or_else(|| Error::new(ruby.exception_runtime_error(), "Dependency container already consumed"))?;
+        let dependency_clone = dependency.clone();
 
         container.register(key.clone(), dependency).map_err(|err| {
             Error::new(
@@ -438,7 +444,10 @@ impl NativeDependencyRegistry {
             self.gc_handles.borrow_mut().push(Opaque::from(val));
         }
 
-        self.registered_keys.borrow_mut().push(key);
+        self.registered_keys.borrow_mut().push(key.clone());
+        self.registered_dependencies
+            .borrow_mut()
+            .push((key.clone(), dependency_clone));
 
         Ok(())
     }
@@ -463,9 +472,34 @@ impl NativeDependencyRegistry {
         Ok(container)
     }
 
+    fn clone_container(&self, ruby: &Ruby) -> Result<spikard_core::di::DependencyContainer, Error> {
+        let mut container = spikard_core::di::DependencyContainer::new();
+        for (key, dependency) in self.registered_dependencies.borrow().iter() {
+            container.register(key.clone(), dependency.clone()).map_err(|err| {
+                Error::new(
+                    ruby.exception_runtime_error(),
+                    format!("Failed to clone dependency '{key}': {err}"),
+                )
+            })?;
+        }
+        Ok(container)
+    }
+
     fn keys(&self) -> Vec<String> {
         self.registered_keys.borrow().clone()
     }
+
+    fn resolve(ruby: &Ruby, this: &Self, key: String) -> Result<Value, Error> {
+        let registered = this.registered_keys.borrow();
+        if registered.contains(&key) {
+            Ok(ruby.qnil().as_value())
+        } else {
+            Err(Error::new(
+                ruby.exception_runtime_error(),
+                format!("Failed to resolve dependency '{}': key '{}' not registered", key, key),
+            ))
+        }
+    }
 }
 
 fn poll_stream_chunk(enumerator: &Arc<Opaque<Value>>) -> Result<Option<Bytes>, io::Error> {
@@ -508,6 +542,23 @@ impl NativeTestClient {
         sse_producers: Value,
         dependencies: Value,
     ) -> Result<(), Error> {
+        let (hooks_value, dependencies_value) = if let Some(arg_hash) = RHash::from_value(dependencies) {
+            let hooks_value = arg_hash.get(ruby.to_symbol("hooks")).or_else(|| arg_hash.get("hooks"));
+            let dependencies_value = arg_hash
+                .get(ruby.to_symbol("dependencies"))
+                .or_else(|| arg_hash.get("dependencies"));
+
+            if hooks_value.is_some() || dependencies_value.is_some() {
+                (
+                    hooks_value.unwrap_or_else(|| ruby.qnil().as_value()),
+                    dependencies_value.unwrap_or_else(|| ruby.qnil().as_value()),
+                )
+            } else {
+                (ruby.qnil().as_value(), dependencies)
+            }
+        } else {
+            (ruby.qnil().as_value(), dependencies)
+        };
         let metadata: Vec<RouteMetadata> = serde_json::from_str(&routes_json)
             .map_err(|err| Error::new(ruby.exception_arg_error(), format!("Invalid routes JSON: {err}")))?;
 
@@ -527,10 +578,10 @@ impl NativeTestClient {
 
         #[cfg(feature = "di")]
         {
-            if let Ok(registry) = <&NativeDependencyRegistry>::try_convert(dependencies) {
-                server_config.di_container = Some(Arc::new(registry.take_container()?));
-            } else if !dependencies.is_nil() {
-                match build_dependency_container(ruby, dependencies) {
+            if let Ok(registry) = <&NativeDependencyRegistry>::try_convert(dependencies_value) {
+                server_config.di_container = Some(Arc::new(registry.clone_container(ruby)?));
+            } else if !dependencies_value.is_nil() {
+                match build_dependency_container(ruby, dependencies_value) {
                     Ok(container) => {
                         server_config.di_container = Some(Arc::new(container));
                     }
@@ -544,15 +595,77 @@ impl NativeTestClient {
             }
         }
 
+        let lifecycle_hooks = if let Ok(registry) = <&NativeLifecycleRegistry>::try_convert(hooks_value) {
+            Some(registry.take_hooks())
+        } else if !hooks_value.is_nil() {
+            let hooks_hash = RHash::from_value(hooks_value)
+                .ok_or_else(|| Error::new(ruby.exception_arg_error(), "lifecycle_hooks parameter must be a Hash"))?;
+
+            let mut hooks = spikard_http::LifecycleHooks::new();
+            type RubyHook = Arc<
+                dyn spikard_http::lifecycle::LifecycleHook<
+                        axum::http::Request<axum::body::Body>,
+                        axum::http::Response<axum::body::Body>,
+                    >,
+            >;
+
+            let extract_hooks = |key: &str| -> Result<Vec<RubyHook>, Error> {
+                let key_sym = ruby.to_symbol(key);
+                if let Some(hooks_array) = hooks_hash.get(key_sym)
+                    && !hooks_array.is_nil()
+                {
+                    let array = magnus::RArray::from_value(hooks_array)
+                        .ok_or_else(|| Error::new(ruby.exception_type_error(), format!("{} must be an Array", key)))?;
+
+                    let mut result = Vec::new();
+                    let len = array.len();
+                    for i in 0..len {
+                        let hook_value: Value = array.entry(i as isize)?;
+                        let name = format!("{}_{}", key, i);
+                        let ruby_hook = crate::lifecycle::RubyLifecycleHook::new(name, hook_value);
+                        result.push(Arc::new(ruby_hook) as RubyHook);
+                    }
+                    Ok(result)
+                } else {
+                    Ok(Vec::new())
+                }
+            };
+
+            for hook in extract_hooks("on_request")? {
+                hooks.add_on_request(hook);
+            }
+            for hook in extract_hooks("pre_validation")? {
+                hooks.add_pre_validation(hook);
+            }
+            for hook in extract_hooks("pre_handler")? {
+                hooks.add_pre_handler(hook);
+            }
+            for hook in extract_hooks("on_response")? {
+                hooks.add_on_response(hook);
+            }
+            for hook in extract_hooks("on_error")? {
+                hooks.add_on_error(hook);
+            }
+
+            Some(hooks)
+        } else {
+            None
+        };
+
+        if let Some(hooks) = lifecycle_hooks {
+            server_config.lifecycle_hooks = Some(Arc::new(hooks));
+        }
+
         let schema_registry = spikard_http::SchemaRegistry::new();
         let mut prepared_routes = Vec::with_capacity(metadata.len());
         let mut handler_refs = Vec::with_capacity(metadata.len());
         let mut route_metadata_vec = Vec::with_capacity(metadata.len());
 
         for meta in metadata.clone() {
-            let handler_value = fetch_handler(ruby, &handlers_hash, &meta.handler_name)?;
+            validate_route_metadata(ruby, &meta)?;
             let route = Route::from_metadata(meta.clone(), &schema_registry)
                 .map_err(|err| Error::new(ruby.exception_runtime_error(), format!("Failed to build route: {err}")))?;
+            let handler_value = fetch_handler(ruby, &handlers_hash, &meta.handler_name)?;
 
             let handler = RubyHandler::new(&route, handler_value, json_module)?;
             prepared_routes.push((route, Arc::new(handler.clone()) as Arc<dyn spikard_http::Handler>));
@@ -573,9 +686,9 @@ impl NativeTestClient {
                 .ok_or_else(|| Error::new(ruby.exception_arg_error(), "WebSocket handlers must be a Hash"))?;
 
             ws_hash.foreach(|path: String, factory: Value| -> Result<ForEach, Error> {
-                let ws_state = crate::websocket::create_websocket_state(ruby, factory)?;
-
-                ws_endpoints.push((path, ws_state));
+                if let Some(ws_state) = crate::websocket::create_websocket_state(ruby, factory)? {
+                    ws_endpoints.push((path, ws_state));
+                }
 
                 Ok(ForEach::Continue)
             })?;
@@ -602,6 +715,8 @@ impl NativeTestClient {
             })?;
         }
 
+        let has_ws = !ws_endpoints.is_empty();
+
         use axum::routing::get;
         for (path, ws_state) in ws_endpoints {
             router = router.route(
@@ -627,22 +742,27 @@ impl NativeTestClient {
                 )
             })?;
 
-        let ws_config = TestServerConfig {
-            transport: Some(Transport::HttpRandomPort),
-            ..Default::default()
+        let transport_server = if has_ws {
+            let ws_config = TestServerConfig {
+                transport: Some(Transport::HttpRandomPort),
+                ..Default::default()
+            };
+            let server = runtime
+                .block_on(async { TestServer::new_with_config(router, ws_config) })
+                .map_err(|err| {
+                    Error::new(
+                        ruby.exception_runtime_error(),
+                        format!("Failed to initialise WebSocket transport server: {err}"),
+                    )
+                })?;
+            Some(Arc::new(server))
+        } else {
+            None
         };
-        let transport_server = runtime
-            .block_on(async { TestServer::new_with_config(router, ws_config) })
-            .map_err(|err| {
-                Error::new(
-                    ruby.exception_runtime_error(),
-                    format!("Failed to initialise WebSocket transport server: {err}"),
-                )
-            })?;
 
         *this.inner.borrow_mut() = Some(ClientInner {
             http_server: Arc::new(http_server),
-            transport_server: Arc::new(transport_server),
+            transport_server,
             _handlers: handler_refs,
         });
 
@@ -699,7 +819,12 @@ impl NativeTestClient {
             .as_ref()
             .ok_or_else(|| Error::new(ruby.exception_runtime_error(), "TestClient not initialised"))?;
 
-        let server = Arc::clone(&inner.transport_server);
+        let server = inner.transport_server.clone().ok_or_else(|| {
+            Error::new(
+                ruby.exception_runtime_error(),
+                "WebSocket transport server unavailable (no WebSocket handlers registered)",
+            )
+        })?;
 
         drop(inner_borrow);
 
@@ -893,6 +1018,14 @@ fn to_ws_url(mut url: Url) -> Result<Url, WebSocketConnectError> {
 
 impl RubyHandler {
     fn new(route: &Route, handler_value: Value, json_module: Value) -> Result<Self, Error> {
+        let ruby = Ruby::get().map_err(|_| {
+            Error::new(
+                magnus::exception::runtime_error(),
+                "Ruby VM unavailable while creating handler",
+            )
+        })?;
+        let handler_value = crate::conversion::ensure_callable(&ruby, handler_value, &route.handler_name)?;
+
         Ok(Self {
             inner: Arc::new(RubyHandlerInner {
                 handler_proc: Opaque::from(handler_value),
@@ -909,12 +1042,14 @@ impl RubyHandler {
     ///
     /// This is used by run_server to create handlers from Ruby Procs
     fn new_for_server(
-        _ruby: &Ruby,
+        ruby: &Ruby,
         handler_value: Value,
         handler_name: String,
         json_module: Value,
         route: &Route,
     ) -> Result<Self, Error> {
+        let handler_value = crate::conversion::ensure_callable(ruby, handler_value, &handler_name)?;
+
         Ok(Self {
             inner: Arc::new(RubyHandlerInner {
                 handler_proc: Opaque::from(handler_value),
@@ -950,6 +1085,9 @@ impl RubyHandler {
     }
 
     fn handle_inner(&self, request_data: RequestData) -> HandlerResult {
+        // Clone Arc to avoid borrow checker issues with request_data later in the function.
+        // The Arc clone is cheap (increment ref count) and necessary here because we need to
+        // extract validated_params and also borrow request_data below.
         let validated_params = request_data.validated_params.clone();
 
         let ruby = Ruby::get().map_err(|_| {
@@ -962,8 +1100,17 @@ impl RubyHandler {
         #[cfg(feature = "di")]
         let dependencies = request_data.dependencies.clone();
 
-        let request_value = build_ruby_request(&ruby, request_data, validated_params)
-            .map_err(|err| (StatusCode::INTERNAL_SERVER_ERROR, err.to_string()))?;
+        // Use Arc::try_unwrap to eliminate the clone when validated_params Arc has unique ref.
+        // This is passed to NativeRequest::from_request_data which also tries to unwrap.
+        // The pattern handles both cases:
+        // - Most requests: Arc has unique ref → try_unwrap succeeds, no extra clone
+        // - Shared Arc (rare): try_unwrap fails → fallback to clone, safe and correct
+        let request_value = build_ruby_request(
+            &ruby,
+            request_data,
+            validated_params.map(|arc| Arc::try_unwrap(arc).unwrap_or_else(|a| (*a).clone())),
+        )
+        .map_err(|err| (StatusCode::INTERNAL_SERVER_ERROR, err.to_string()))?;
 
         let handler_proc = self.inner.handler_proc.get_inner_with(&ruby);
 
@@ -1018,38 +1165,18 @@ impl RubyHandler {
                     }
                 }
 
-                let wrapper_code = ruby
-                    .eval::<Value>(
-                        r#"
-                    lambda do |proc, request, kwargs|
-                        proc.call(request, **kwargs)
-                    end
-                "#,
-                    )
-                    .map_err(|e| {
-                        (
-                            StatusCode::INTERNAL_SERVER_ERROR,
-                            format!("Failed to create kwarg wrapper: {}", e),
-                        )
-                    })?;
-
-                wrapper_code.funcall("call", (handler_proc, request_value, kwargs_hash))
+                call_handler_proc_with_kwargs(&ruby, handler_proc, request_value, kwargs_hash.as_value())
             } else {
-                handler_proc.funcall("call", (request_value,))
+                call_handler_proc(&ruby, handler_proc, request_value)
             }
         };
 
         #[cfg(not(feature = "di"))]
-        let handler_result = handler_proc.funcall("call", (request_value,));
+        let handler_result = call_handler_proc(&ruby, handler_proc, request_value);
 
         let response_value = match handler_result {
             Ok(value) => value,
-            Err(err) => {
-                return Err((
-                    StatusCode::INTERNAL_SERVER_ERROR,
-                    format!("Handler '{}' failed: {}", self.inner.handler_name, err),
-                ));
-            }
+            Err(err) => return Err(problem_from_ruby_error(&ruby, &self.inner, err)),
         };
 
         let handler_result = interpret_handler_response(&ruby, &self.inner, response_value).map_err(|err| {
@@ -1162,6 +1289,242 @@ impl Handler for RubyHandler {
     }
 }
 
+fn call_handler_proc(ruby: &Ruby, handler_proc: Value, request_value: Value) -> Result<Value, Error> {
+    let arity: i64 = handler_proc.funcall("arity", ())?;
+    let call_arity = normalize_proc_arity(arity);
+
+    if call_arity == 0 {
+        return handler_proc.funcall("call", ());
+    }
+
+    if call_arity == 1 {
+        return handler_proc.funcall("call", (request_value,));
+    }
+
+    let (params_value, query_value, body_value) = request_parts_from_value(ruby, request_value)?;
+    if call_arity == 2 {
+        return handler_proc.funcall("call", (params_value, query_value));
+    }
+
+    handler_proc.funcall("call", (params_value, query_value, body_value))
+}
+
+fn call_handler_proc_with_kwargs(
+    ruby: &Ruby,
+    handler_proc: Value,
+    request_value: Value,
+    kwargs_hash: Value,
+) -> Result<Value, Error> {
+    let arity: i64 = handler_proc.funcall("arity", ())?;
+    let call_arity = normalize_proc_arity(arity);
+    let (params_value, query_value, body_value) = request_parts_from_value(ruby, request_value)?;
+
+    let wrapper_code = ruby.eval::<Value>(
+        r"
+        lambda do |proc, arity, request, params, query, body, kwargs|
+            kwargs = {} if kwargs.nil?
+            case arity
+            when 0
+                kwargs.empty? ? proc.call : proc.call(**kwargs)
+            when 1
+                kwargs.empty? ? proc.call(request) : proc.call(request, **kwargs)
+            when 2
+                kwargs.empty? ? proc.call(params, query) : proc.call(params, query, **kwargs)
+            else
+                kwargs.empty? ? proc.call(params, query, body) : proc.call(params, query, body, **kwargs)
+            end
+        end
+        ",
+    )?;
+
+    wrapper_code.funcall(
+        "call",
+        (
+            handler_proc,
+            ruby.integer_from_i64(call_arity),
+            request_value,
+            params_value,
+            query_value,
+            body_value,
+            kwargs_hash,
+        ),
+    )
+}
+
+fn request_parts_from_value(ruby: &Ruby, request_value: Value) -> Result<(Value, Value, Value), Error> {
+    if let Ok(request) = <&NativeRequest>::try_convert(request_value) {
+        let params_value = NativeRequest::path_params(ruby, request)?;
+        let query_value = NativeRequest::query(ruby, request)?;
+        let body_value = NativeRequest::body(ruby, request)?;
+        return Ok((params_value, query_value, body_value));
+    }
+
+    if let Ok(hash) = RHash::try_convert(request_value) {
+        let params_value = hash.get("path_params").unwrap_or_else(|| ruby.qnil().as_value());
+        let query_value = hash.get("query").unwrap_or_else(|| ruby.qnil().as_value());
+        let body_value = hash.get("body").unwrap_or_else(|| ruby.qnil().as_value());
+        return Ok((params_value, query_value, body_value));
+    }
+
+    Ok((ruby.qnil().as_value(), ruby.qnil().as_value(), ruby.qnil().as_value()))
+}
+
+fn normalize_proc_arity(arity: i64) -> i64 {
+    if arity < 0 { 3 } else { arity }
+}
+
+fn problem_from_ruby_error(ruby: &Ruby, handler: &RubyHandlerInner, err: Error) -> (StatusCode, String) {
+    let mut status = StatusCode::INTERNAL_SERVER_ERROR;
+    let mut detail = ruby_error_message(ruby, &err);
+    let mut code_value: Option<JsonValue> = None;
+    let mut details_value: Option<JsonValue> = None;
+    let mut extensions: HashMap<String, JsonValue> = HashMap::new();
+
+    if err.is_kind_of(ruby.exception_arg_error()) {
+        status = StatusCode::BAD_REQUEST;
+    }
+
+    if let Some(exception) = err.value() {
+        if matches!(exception.respond_to("status", false), Ok(true)) {
+            if let Ok(code) = exception.funcall::<_, _, i64>("status", ()) {
+                status = StatusCode::from_u16(code as u16).unwrap_or(StatusCode::INTERNAL_SERVER_ERROR);
+            }
+        } else if matches!(exception.respond_to("status_code", false), Ok(true))
+            && let Ok(code) = exception.funcall::<_, _, i64>("status_code", ())
+        {
+            status = StatusCode::from_u16(code as u16).unwrap_or(StatusCode::INTERNAL_SERVER_ERROR);
+        }
+
+        let json_module = handler.json_module.get_inner_with(ruby);
+        if matches!(exception.respond_to("code", false), Ok(true))
+            && let Ok(value) = exception.funcall::<_, _, Value>("code", ())
+            && let Ok(json_value) = ruby_value_to_json(ruby, json_module, value)
+        {
+            code_value = Some(json_value);
+        }
+
+        if matches!(exception.respond_to("details", false), Ok(true))
+            && let Ok(value) = exception.funcall::<_, _, Value>("details", ())
+            && let Ok(json_value) = ruby_value_to_json(ruby, json_module, value)
+        {
+            details_value = Some(json_value);
+        }
+    }
+
+    detail = sanitize_error_detail(&detail);
+
+    let code_value = code_value.unwrap_or_else(|| JsonValue::String(error_code_for_status(status).to_string()));
+    let details_value = details_value.unwrap_or_else(|| JsonValue::Object(serde_json::Map::new()));
+    extensions.insert("error".to_string(), JsonValue::String(detail.clone()));
+    extensions.insert("code".to_string(), code_value);
+    extensions.insert("details".to_string(), details_value);
+
+    let mut problem = problem_for_status(status, detail);
+    for (key, value) in extensions {
+        problem = problem.with_extension(key, value);
+    }
+
+    ErrorResponseBuilder::problem_details_response(&problem)
+}
+
+fn ruby_error_message(_ruby: &Ruby, err: &Error) -> String {
+    if let Some(exception) = err.value()
+        && matches!(exception.respond_to("message", false), Ok(true))
+        && let Ok(message) = exception.funcall::<_, _, String>("message", ())
+    {
+        return message;
+    }
+    err.to_string()
+}
+
+fn problem_for_status(status: StatusCode, detail: String) -> ProblemDetails {
+    match status {
+        StatusCode::BAD_REQUEST => ProblemDetails::bad_request(detail),
+        StatusCode::UNAUTHORIZED => {
+            ProblemDetails::new("https://spikard.dev/errors/unauthorized", "Unauthorized", status).with_detail(detail)
+        }
+        StatusCode::FORBIDDEN => {
+            ProblemDetails::new("https://spikard.dev/errors/forbidden", "Forbidden", status).with_detail(detail)
+        }
+        StatusCode::NOT_FOUND => ProblemDetails::not_found(detail),
+        StatusCode::UNPROCESSABLE_ENTITY => ProblemDetails::new(
+            ProblemDetails::TYPE_VALIDATION_ERROR,
+            "Request Validation Failed",
+            status,
+        )
+        .with_detail(detail),
+        _ => ProblemDetails::internal_server_error(detail),
+    }
+}
+
+fn error_code_for_status(status: StatusCode) -> &'static str {
+    match status {
+        StatusCode::BAD_REQUEST => "bad_request",
+        StatusCode::UNAUTHORIZED => "unauthorized",
+        StatusCode::FORBIDDEN => "forbidden",
+        StatusCode::NOT_FOUND => "not_found",
+        StatusCode::METHOD_NOT_ALLOWED => "method_not_allowed",
+        StatusCode::REQUEST_TIMEOUT => "request_timeout",
+        StatusCode::CONFLICT => "conflict",
+        StatusCode::SERVICE_UNAVAILABLE => "service_unavailable",
+        StatusCode::UNPROCESSABLE_ENTITY => "unprocessable_entity",
+        _ => "internal_error",
+    }
+}
+
+fn sanitize_error_detail(detail: &str) -> String {
+    let mut tokens = Vec::new();
+    let mut redact_next = false;
+
+    for token in detail.split_whitespace() {
+        let lower = token.to_lowercase();
+        if token.starts_with('/') || token.contains(".rb:") {
+            tokens.push("[redacted]".to_string());
+            redact_next = false;
+            continue;
+        }
+
+        if lower.starts_with("password=") {
+            tokens.push("password=[redacted]".to_string());
+            redact_next = false;
+            continue;
+        }
+
+        if lower.starts_with("host=") {
+            tokens.push("host=[redacted]".to_string());
+            redact_next = false;
+            continue;
+        }
+
+        if lower.starts_with("token=") || lower.starts_with("secret=") {
+            tokens.push("[redacted]".to_string());
+            redact_next = false;
+            continue;
+        }
+
+        if redact_next {
+            tokens.push("[redacted]".to_string());
+            redact_next = false;
+            continue;
+        }
+
+        if token.eq_ignore_ascii_case("in") {
+            tokens.push(token.to_string());
+            redact_next = true;
+            continue;
+        }
+
+        tokens.push(token.to_string());
+    }
+
+    let mut sanitized = tokens.join(" ");
+    sanitized = sanitized.replace("SELECT *", "[redacted]");
+    sanitized = sanitized.replace("select *", "[redacted]");
+    sanitized = sanitized.replace("FROM users", "[redacted]");
+    sanitized = sanitized.replace("from users", "[redacted]");
+    sanitized
+}
+
 // These functions are now in testing::client module - use call_without_gvl! macro to call them
 
 fn response_snapshot_to_ruby(ruby: &Ruby, snapshot: ResponseSnapshot) -> Result<Value, Error> {
@@ -1311,7 +1674,7 @@ fn build_ruby_request(
     request_data: RequestData,
     validated_params: Option<JsonValue>,
 ) -> Result<Value, Error> {
-    let native_request = NativeRequest::from_request_data(request_data, validated_params);
+    let native_request = NativeRequest::from_request_data(request_data, validated_params, None);
 
     Ok(ruby.obj_wrap(native_request).as_value())
 }
@@ -1495,20 +1858,32 @@ fn get_kw(ruby: &Ruby, hash: RHash, name: &str) -> Option<Value> {
 }
 
 fn fetch_handler(ruby: &Ruby, handlers: &RHash, name: &str) -> Result<Value, Error> {
-    let symbol_key = ruby.intern(name);
-    if let Some(value) = handlers.get(symbol_key) {
-        return Ok(value);
+    crate::conversion::fetch_handler(ruby, handlers, name)
+}
+
+pub(crate) fn validate_route_metadata(ruby: &Ruby, meta: &RouteMetadata) -> Result<(), Error> {
+    // Validate method field is a valid HTTP method (must be uppercase)
+    match meta.method.as_str() {
+        "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD" | "OPTIONS" | "TRACE" => {}
+        _ => {
+            return Err(Error::new(
+                ruby.exception_arg_error(),
+                format!(
+                    "Invalid routes JSON: method must be a valid HTTP method in uppercase (got '{}')",
+                    meta.method
+                ),
+            ));
+        }
     }
 
-    let string_key = ruby.str_new(name);
-    if let Some(value) = handlers.get(string_key) {
-        return Ok(value);
+    if meta.path.trim().is_empty() || !meta.path.starts_with('/') {
+        return Err(Error::new(
+            ruby.exception_arg_error(),
+            format!("Invalid routes JSON: path must start with '/' (got '{}')", meta.path),
+        ));
     }
 
-    Err(Error::new(
-        ruby.exception_name_error(),
-        format!("Handler '{name}' not provided"),
-    ))
+    Ok(())
 }
 
 /// GC mark hook so Ruby keeps handler closures alive.
@@ -1684,12 +2059,19 @@ pub fn init(ruby: &Ruby) -> Result<(), Error> {
     let lifecycle_registry_class = native.define_class("LifecycleRegistry", ruby.class_object())?;
     lifecycle_registry_class.define_alloc_func::<NativeLifecycleRegistry>();
     lifecycle_registry_class.define_method("add_on_request", method!(NativeLifecycleRegistry::add_on_request, 1))?;
+    lifecycle_registry_class.define_method(
+        "add_pre_validation",
+        method!(NativeLifecycleRegistry::add_pre_validation, 1),
+    )?;
     lifecycle_registry_class.define_method(
         "pre_validation",
         method!(NativeLifecycleRegistry::add_pre_validation, 1),
     )?;
+    lifecycle_registry_class.define_method("add_pre_handler", method!(NativeLifecycleRegistry::add_pre_handler, 1))?;
     lifecycle_registry_class.define_method("pre_handler", method!(NativeLifecycleRegistry::add_pre_handler, 1))?;
+    lifecycle_registry_class.define_method("add_on_response", method!(NativeLifecycleRegistry::add_on_response, 1))?;
     lifecycle_registry_class.define_method("on_response", method!(NativeLifecycleRegistry::add_on_response, 1))?;
+    lifecycle_registry_class.define_method("add_on_error", method!(NativeLifecycleRegistry::add_on_error, 1))?;
     lifecycle_registry_class.define_method("on_error", method!(NativeLifecycleRegistry::add_on_error, 1))?;
 
     let dependency_registry_class = native.define_class("DependencyRegistry", ruby.class_object())?;
@@ -1700,6 +2082,7 @@ pub fn init(ruby: &Ruby) -> Result<(), Error> {
         method!(NativeDependencyRegistry::register_factory, 5),
     )?;
     dependency_registry_class.define_method("keys", method!(NativeDependencyRegistry::keys, 0))?;
+    dependency_registry_class.define_method("resolve", method!(NativeDependencyRegistry::resolve, 1))?;
 
     let spikard_module = ruby.define_module("Spikard")?;
     testing::websocket::init(ruby, &spikard_module)?;
@@ -1711,7 +2094,6 @@ pub fn init(ruby: &Ruby) -> Result<(), Error> {
     let _ = NativeDependencyRegistry::mark as fn(&NativeDependencyRegistry, &Marker);
     let _ = NativeRequest::mark as fn(&NativeRequest, &Marker);
     let _ = RubyHandler::mark as fn(&RubyHandler, &Marker);
-    let _ = grpc::handler::RubyGrpcHandler::mark as fn(&grpc::handler::RubyGrpcHandler, &Marker);
     let _ = mark as fn(&NativeTestClient, &Marker);
 
     Ok(())