stronger_parameters 2.8.0 → 2.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 0765498e474bdda1bbd86952faeb949bb8dee68d
-  data.tar.gz: 552b525dd274336986326681a21a334139bfbb25
+  metadata.gz: a12c5ef2ac847c635c4913a85339c97fbf57779a
+  data.tar.gz: 8451750358aebf9a07138bf2336723426684fcb7
 SHA512:
-  metadata.gz: f1317839557a9579b3710b15c314de07a02766e6ac511a84ef3b98fe3dd8fe8dd5c00c442d3c952d67f0287cc57589944eac80e41fe2e2eaa27101f8bb612f06
-  data.tar.gz: 5abbe1cc2b805bf72ff355c4d79de711bb09c18aaa1a4e97aceaf13d4e7bfe8c321d890f7d118fcef69036fb19ee5613f86dce9cfa2065c7e1f5d6f6c47d8e74
+  metadata.gz: dc96fc9fa934ad431203d375653a0bf6ca2f95ddf22439f41d6dccb4632dbc7e309afd81327ac6a9b84ff7ea89dc098bb611634883109b5685a9685c6f34e76c
+  data.tar.gz: b2adbe65b3cc872823db2127deddb565614cd2e4a9840e70c93b5e9f40527fe54287b1446ef976b2f957580dfe07f9e859f4090ead0da84938b2f9466219ba1c

data/README.md

@@ -25,12 +25,11 @@ params.permit(
 This will allow an array of id parameters that all are IDs (integer less than 2**31, greater than 0) and convert to Fixnum (`'2' --> 2`).
 
 ### Empty array -> nil
-Rails converts empty arrays to nil unless `config.action_dispatch.perform_deep_munge = false` is set
-(available in Rails 4.1+). Either use this or `Parameters.array | Parameters.nil` to deal with this.
+Rails converts empty arrays to nil, so often `Parameters.array | Parameters.nil` is needed.
 
 ### Allowing nils
 
-It can be convenient to allow nil to be passed as all kinds of attributes since ActiveRecord converts it to false/0 behind the scenes.
+It can be convenient to allow nil for all attributes since ActiveRecord converts it to false/0.
 `ActionController::Parameters.allow_nil_for_everything = true`
 
 ## Nested Parameters
@@ -44,7 +43,7 @@ params.permit(
       name: Parameters.string,
       family: Parameters.map(
         name: Parameters.string
-      )
+      ),
       hobbies: Parameters.array(Parameters.string)
     )
   )
@@ -149,7 +148,7 @@ This will permit these parameters:
 }
 ```
 
-## Production rollout
+## Rollout in log-only mode
 
 Just want to log violations in production:
 
@@ -158,7 +157,7 @@ Just want to log violations in production:
 ActionController::Parameters.action_on_invalid_parameters = :log
 ```
 
-## Controller support (compatible with Rails 3 and 4, untested on Rails 5)
+## Controller support
 
 Include `PermittedParameters` into a controller to force the developer
 to explicitly permit params for every action.
@@ -183,19 +182,20 @@ class TestController < ApplicationController
   def index
   end
 
-  permitted_parameters :update, :anything # all parameters permitted, use when migrating old controllers/actions
+  permitted_parameters :update, :skip # use when migrating old controllers/actions
   def update
   end
+end
 ```
 
 
-### Log only mode
+### Log only mode for invalid parameters
 
-Just want to log violations in production, let all params pass through:
+To only log invalid (not unpermitted) parameters during rollout of stronger_parameters:
 
 ```ruby
 class MyController < ApplicationController
-  log_unpermitted_parameters! if Rails.env.production? # Still want other environments to raise
+  log_invalid_parameters! if Rails.env.production? # Still want other environments and controllers to raise
 
   permitted_parameters :update, user: { name: Parameters.string }
   def update
@@ -205,7 +205,7 @@ end
 
 ### Notifying users about unpermitted params
 
-Add headers to all requests that have unpermitted params:
+Add headers to all requests that have unpermitted params (does not log invalid):
 
 ```Ruby
 # config/application.rb

data/lib/stronger_parameters/constraint.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'stronger_parameters/errors'
 
 module StrongerParameters

data/lib/stronger_parameters/constraints/array_constraint.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'stronger_parameters/constraint'
 
 module StrongerParameters

data/lib/stronger_parameters/constraints/boolean_constraint.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'stronger_parameters/constraint'
 
 module StrongerParameters
@@ -6,13 +7,9 @@ module StrongerParameters
     FALSE_VALUES = [false, 'false', '0', 0].freeze
 
     def value(v)
-      if TRUE_VALUES.include?(v)
-        return true
-      end
+      return true if TRUE_VALUES.include?(v)
 
-      if FALSE_VALUES.include?(v)
-        return false
-      end
+      return false if FALSE_VALUES.include?(v)
 
       InvalidValue.new(v, "must be either true or false")
     end

data/lib/stronger_parameters/constraints/comparison_constraints.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'stronger_parameters/constraint'
 
 module StrongerParameters

data/lib/stronger_parameters/constraints/date_time_constraint.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'stronger_parameters/constraint'
 
 module StrongerParameters

data/lib/stronger_parameters/constraints/decimal_constraint.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'stronger_parameters/constraint'
 
 module StrongerParameters

data/lib/stronger_parameters/constraints/enumeration_constraint.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'stronger_parameters/constraint'
 
 module StrongerParameters

data/lib/stronger_parameters/constraints/file_constraint.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'stronger_parameters/constraint'
 
 module StrongerParameters
@@ -7,7 +8,7 @@ module StrongerParameters
       StringIO,
       Rack::Test::UploadedFile,
       ActionDispatch::Http::UploadedFile
-    ]
+    ].freeze
 
     def value(v)
       if VALID_FILE_TYPES.any? { |valid_file_type| v.is_a?(valid_file_type) }

data/lib/stronger_parameters/constraints/float_constraint.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'stronger_parameters/constraint'
 
 module StrongerParameters

data/lib/stronger_parameters/constraints/hash_constraint.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'stronger_parameters/constraint'
 
 module StrongerParameters
@@ -9,11 +10,10 @@ module StrongerParameters
     end
 
     def value(v)
-      case
-      when v.is_a?(Hash)
+      if v.is_a?(Hash)
         return ActionController::Parameters.new(v).permit! if constraints.nil?
         return ActionController::Parameters.new(v).permit(constraints)
-      when ActionPack::VERSION::MAJOR >= 5 && v.is_a?(ActionController::Parameters)
+      elsif ActionPack::VERSION::MAJOR >= 5 && v.is_a?(ActionController::Parameters)
         return v.permit! if constraints.nil?
         return v.permit(constraints)
       end

data/lib/stronger_parameters/constraints/hex_constraint.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'stronger_parameters/constraint'
 
 module StrongerParameters

data/lib/stronger_parameters/constraints/integer_constraint.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'stronger_parameters/constraint'
 
 module StrongerParameters

data/lib/stronger_parameters/constraints/nil_constraint.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'stronger_parameters/constraint'
 
 module StrongerParameters

data/lib/stronger_parameters/constraints/nil_string_constraint.rb

@@ -1,8 +1,9 @@
+# frozen_string_literal: true
 require 'stronger_parameters/constraint'
 
 module StrongerParameters
   class NilStringConstraint < Constraint
-    NULL_VALUES = [nil, '', 'undefined']
+    NULL_VALUES = [nil, '', 'undefined'].freeze
 
     def value(v)
       if NULL_VALUES.include?(v)

data/lib/stronger_parameters/constraints/regexp_constraint.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'stronger_parameters/constraint'
 
 module StrongerParameters

data/lib/stronger_parameters/constraints/string_constraint.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'stronger_parameters/constraint'
 
 module StrongerParameters

data/lib/stronger_parameters/constraints.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'stronger_parameters/constraint'
 require 'stronger_parameters/constraints/string_constraint'
 require 'stronger_parameters/constraints/float_constraint'

data/lib/stronger_parameters/controller_support/permitted_parameters.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'stronger_parameters/constraints'
 
 module StrongerParameters
@@ -5,86 +6,62 @@ module StrongerParameters
     module PermittedParameters
       def self.included(klass)
         klass.extend ClassMethods
-        if klass.respond_to?(:before_action)
-          klass.before_action :permit_parameters
-        else
-          klass.before_filter :permit_parameters
-        end
+        method = (klass.respond_to?(:before_action) ? :before_action : :before_filter)
+        klass.public_send method, :permit_parameters
       end
 
-      class PermittedParametersHash < Hash
-        def initialize(other = nil)
-          super()
-          merge!(other) unless other.nil?
-        end
-
-        def merge!(other)
-          other.each do |key, value|
-            value = sugar(value)
-
-            if value.is_a?(StrongerParameters::Constraint)
-              self[key] = value
-            else
-              self[key] ||= self.class.new
-              self[key].merge!(value)
-            end
-          end
-
-          self
-        end
-
-        def merge(other)
-          dup.merge!(other)
-        end
-
-        private
-
-        def sugar(value)
-          case value
-          when Array
-            ActionController::Parameters.array(*value.map { |v| sugar(v) })
-          when Hash
-            constraints = value.each_with_object({}) do |(key, v), memo|
-              memo[key] = sugar(v)
-            end
-            ActionController::Parameters.map(constraints)
-          else
-            value
+      def self.sugar(value)
+        case value
+        when Array
+          ActionController::Parameters.array(*value.map { |v| sugar(v) })
+        when Hash
+          constraints = value.each_with_object({}) do |(key, v), memo|
+            memo[key] = sugar(v)
           end
+          ActionController::Parameters.map(constraints)
+        else
+          value
         end
       end
 
-      DEFAULT_PERMITTED = PermittedParametersHash.new(
+      DEFAULT_PERMITTED = {
         controller: ActionController::Parameters.anything,
         action: ActionController::Parameters.anything,
         format: ActionController::Parameters.anything,
         authenticity_token: ActionController::Parameters.string
-      )
+      }.freeze
 
       module ClassMethods
         def self.extended(base)
           base.send :class_attribute, :log_unpermitted_parameters, instance_accessor: false
         end
 
-        def log_unpermitted_parameters!
+        def log_invalid_parameters!
           self.log_unpermitted_parameters = true
         end
 
         def permitted_parameters(action, permitted)
-          if permit_parameters[action] == :anything && permitted != :anything
-            raise ArgumentError, "#{self}/#{action} can not add to :anything"
+          if permit_parameters[action] == :skip || permitted == :skip
+            permit_parameters[action] = permitted
+          else
+            action_permitted = (permit_parameters[action] ||= {})
+            action_permitted.deep_merge!(permitted)
           end
-
-          permit_parameters.deep_merge!(action => permitted)
         end
 
         def permitted_parameters_for(action)
           unless for_action = permit_parameters[action]
             location = instance_method(action).source_location
-            raise KeyError, "Action #{action} for #{self} does not have any permitted parameters (#{location.join(":")})"
+            raise(
+              KeyError,
+              "Action #{action} for #{self} does not have any permitted parameters (#{location.join(":")})"
+            )
           end
-          return :anything if for_action == :anything
-          permit_parameters[:all].merge(for_action)
+          return :skip if for_action == :skip
+
+          # FYI: we should be able to call sugar on the result of deep_merge, but it breaks tests
+          permit_parameters[:all].deep_merge(for_action).
+            each_with_object({}) { |(k, v), a| a[k] = PermittedParameters.sugar(v) }
         end
 
         private
@@ -93,7 +70,7 @@ module StrongerParameters
           @permit_parameters ||= if superclass.respond_to?(:permit_parameters, true)
             superclass.send(:permit_parameters).deep_dup
           else
-            { all: DEFAULT_PERMITTED.dup }
+            {all: DEFAULT_PERMITTED.deep_dup}
           end
         end
       end
@@ -101,23 +78,20 @@ module StrongerParameters
       private
 
       def permit_parameters
-        action = params[:action].to_sym
+        action = params.fetch(:action).to_sym
         permitted = self.class.permitted_parameters_for(action)
+        return if permitted == :skip
 
-        if permitted == :anything
-          Rails.logger.warn("#{params[:controller]}/#{params[:action]} does not filter parameters")
-          return
-        end
-
-        permitted_params = without_invalid_parameter_exceptions { params.permit(permitted) }
-        unpermitted_keys = flat_keys(params) - flat_keys(permitted_params)
+        # TODO: invalid values should also be logged, but atm only invalid keys are
         log_unpermitted = self.class.log_unpermitted_parameters
+        permitted_params = without_invalid_parameter_exceptions(log_unpermitted) { params.permit(permitted) }
+        unpermitted_keys = flat_keys(params) - flat_keys(permitted_params)
 
         show_unpermitted_keys(unpermitted_keys, log_unpermitted)
 
         return if log_unpermitted
 
-        params.replace(permitted_params)
+        (ActionPack::VERSION::MAJOR >= 5 ? params.send(:parameters) : params).replace(permitted_params)
         params.permit!
         request.params.replace(permitted_params)
 
@@ -129,16 +103,19 @@ module StrongerParameters
         return if unpermitted_keys.empty?
 
         log_prefix = (log_unpermitted ? 'Found' : 'Removed')
-        message = "#{log_prefix} restricted keys #{unpermitted_keys.inspect} from parameters according to permitted list"
+        message =
+          "#{log_prefix} restricted keys #{unpermitted_keys.inspect} from parameters according to permitted list"
 
-        header = Rails.configuration.stronger_parameters_violation_header if Rails.configuration.respond_to?(:stronger_parameters_violation_header)
+        if Rails.configuration.respond_to?(:stronger_parameters_violation_header)
+          header = Rails.configuration.stronger_parameters_violation_header
+        end
         response.headers[header] = message if response && header
 
         Rails.logger.info("  #{message}")
       end
 
-      def without_invalid_parameter_exceptions
-        if self.class.log_unpermitted_parameters
+      def without_invalid_parameter_exceptions(log)
+        if log
           begin
             old = ActionController::Parameters.action_on_invalid_parameters
             ActionController::Parameters.action_on_invalid_parameters = :log
@@ -152,6 +129,7 @@ module StrongerParameters
       end
 
       def flat_keys(hash)
+        hash = hash.send(:parameters) if ActionPack::VERSION::MAJOR >= 5 && hash.is_a?(ActionController::Parameters)
         hash.flat_map { |k, v| v.is_a?(Hash) ? flat_keys(v).map { |x| "#{k}.#{x}" }.push(k) : k }
       end
     end

data/lib/stronger_parameters/errors.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module StrongerParameters
   class InvalidValue
     attr_accessor :value, :message

data/lib/stronger_parameters/parameters.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'action_pack'
 
 if ActionPack::VERSION::MAJOR == 3
@@ -17,8 +18,8 @@ module StrongerParameters
     included do
       alias_method :hash_filter_without_stronger_parameters, :hash_filter
       alias_method :hash_filter, :hash_filter_with_stronger_parameters
-      cattr_accessor :action_on_invalid_parameters, :instance_accessor => false
-      cattr_accessor :allow_nil_for_everything, :instance_accessor => false
+      cattr_accessor :action_on_invalid_parameters, instance_accessor: false
+      cattr_accessor :allow_nil_for_everything, instance_accessor: false
     end
 
     module ClassMethods
@@ -59,33 +60,33 @@ module StrongerParameters
       end
 
       def integer32
-        integer & lt(2 ** 31) & gte(-2 ** 31)
+        integer & lt(2**31) & gte(-2**31)
       end
 
       def integer64
-        integer & lt(2 ** 63) & gte(-2 ** 63)
+        integer & lt(2**63) & gte(-2**63)
       end
 
       def id
-        integer & lt(2 ** 31) & gte(0)
+        integer & lt(2**31) & gte(0)
       end
 
       def uid
-        integer & lt(2 ** 32) & gte(0)
+        integer & lt(2**32) & gte(0)
       end
 
       def bigid
-        integer & lt(2 ** 63) & gte(0)
+        integer & lt(2**63) & gte(0)
       end
 
       def ubigid
-        integer & lt(2 ** 64) & gte(0)
+        integer & lt(2**64) & gte(0)
       end
 
       def enumeration(*allowed)
         EnumerationConstraint.new(*allowed)
       end
-      alias_method :enum, :enumeration
+      alias enum enumeration
 
       def boolean
         BooleanConstraint.new
@@ -115,7 +116,7 @@ module StrongerParameters
         FileConstraint.new
       end
 
-      def decimal(precision = 8, scale =2)
+      def decimal(precision = 8, scale = 2)
         DecimalConstraint.new(precision, scale)
       end
 
@@ -128,7 +129,7 @@ module StrongerParameters
       stronger_filter = ActiveSupport::HashWithIndifferentAccess.new
       other_filter    = ActiveSupport::HashWithIndifferentAccess.new
 
-      filter.each do |k,v|
+      filter.each do |k, v|
         if v.is_a?(Constraint)
           stronger_filter[k] = v
         else
@@ -148,7 +149,7 @@ module StrongerParameters
         result = constraint.value(value)
         if result.is_a?(InvalidValue)
           name = "invalid_parameter.action_controller"
-          ActiveSupport::Notifications.publish(name, :key => key, :value => value, :message => result.message)
+          ActiveSupport::Notifications.publish(name, key: key, value: value, message: result.message)
 
           action = self.class.action_on_invalid_parameters
           case action
@@ -176,8 +177,11 @@ module StrongerParameters
     Parameters = ActionController::Parameters
 
     included do
+      # TODO: this is not consistent with the behavior of raising ActionController::UnpermittedParameters
+      # should have the same render vs raise behavior in test/dev ... see permitted_parameters_test.rb
       rescue_from(StrongerParameters::InvalidParameter) do |e|
-        render (ActiveSupport::VERSION::MAJOR < 5 ? :text : :plain) => e.message, :status => :bad_request
+        type = (ActiveSupport::VERSION::MAJOR < 5 ? :text : :plain)
+        render type => e.message, :status => :bad_request
       end
     end
   end

data/lib/stronger_parameters/version.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module StrongerParameters
-  VERSION = '2.8.0'
+  VERSION = '2.9.0'
 end

data/lib/stronger_parameters.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'stronger_parameters/version'
 require 'action_pack'
 require 'strong_parameters' if ActionPack::VERSION::MAJOR == 3

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: stronger_parameters
 version: !ruby/object:Gem::Version
-  version: 2.8.0
+  version: 2.9.0
 platform: ruby
 authors:
 - Mick Staugaard
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-05-17 00:00:00.000000000 Z
+date: 2017-05-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -122,6 +122,34 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: single_cov
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: rubocop
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: actionpack
   requirement: !ruby/object:Gem::Requirement
@@ -184,7 +212,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 2.0.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="