toller 1.1.0 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bb4ebc1d6c6e8f4eaae0c68c740ae3b35693cd678c6e14e245295a40ad48f2d0
-  data.tar.gz: f380d915cb7f85ed2f3cd6873db803c71d01b9a28e96b9ba8375bb241a02432f
+  metadata.gz: 14ead1892ebc47f8a2dc0ee254545de4a013e7140d738654b9ad42dfd5c05799
+  data.tar.gz: 39fa2fa6acd9fed9e002b78f020e3b95ed89a920384481b24271b1898f955057
 SHA512:
-  metadata.gz: b84c1d90d5d1ebddb6ac81713874ce935d141664a3cb9b4601e08bd4394e844e26aa495d77d88b6381f39587093b3794411cefcc1fe082951239033ba2da070d
-  data.tar.gz: 2a1f0894da895687f8b8699073bd84932c41b1a1af591c95269f6e596e8555111af92dea2b065b598a1e3e18ee3f0869033385c46a44c04696d2fd1b74f37940
+  metadata.gz: 71f8f591c8b0d40a0e67cacfb3e9953d4a47d9ad8a542f7327f05e67f6deec12c1a8580547a47acf5d9851c016cae0588e0f20d62c1ae93245d1c0ade14b8807
+  data.tar.gz: 128e6e2f34d0bf6381b57987d73d485eeeb70628c96aba9ce557ba251395e9cfc96c5b12bb6b23f1546c822642af46ca8260a6ea5b46390f2840a9090c970697

data/README.md

@@ -16,7 +16,7 @@ See the [wiki](https://github.com/dfreerksen/toller/wiki) for usage information.
 Add this line to your application's Gemfile:
 
 ```ruby
-gem 'toller', '~> 1.1'
+gem 'toller', '~> 1.2'
 ```
 
 And then execute:
@@ -64,7 +64,7 @@ To run tests with Appraisal, run
 $ bundle exec appraisal rspec
 ```
 
-`-n 1` forces Appraisal2 to run one Rails version at a time. Without it, Appraisal2 defaults to running 2 appraisals in parallel, and since every appraisal shares the same `test/dummy/db/test.sqlite3` file, concurrent runs can intermittently fail with `SQLite3::BusyException: database is locked`.
+Without any flags, Appraisal2 defaults to running 2 appraisals in parallel. The test database is in-memory (`database: ":memory:"`), so each appraisal subprocess gets its own isolated database and parallel runs don't conflict. Pass `-n 1` to force one Rails version at a time instead.
 
 ```bash
 $ bundle exec appraisal rails-6-0 rspec

data/lib/toller/filter.rb

@@ -21,7 +21,10 @@ module Toller
     # @option options [Boolean] :default whether this filter applies automatically when no filter params were sent
     # @option options [Symbol] :scope_name for type: :scope, the model scope to call; defaults to +parameter+
     # @return [Toller::Filter] a new instance of Filter
+    # @raise [ArgumentError] if +type+ isn't one of {Toller::VALID_TYPES}
     def initialize(parameter, type, options)
+      validate_type!(parameter, type)
+
       @parameter = parameter
       @type = type
       @properties = options.reverse_merge(
@@ -51,5 +54,19 @@ module Toller
     def default
       properties[:default]
     end
+
+    private
+
+    ##
+    # @param parameter [Symbol] the public filter param name, used in the error message
+    # @param type [Symbol] the filter type to validate
+    # @return [nil]
+    # @raise [ArgumentError] if +type+ isn't one of {Toller::VALID_TYPES}
+    def validate_type!(parameter, type)
+      return if Toller::VALID_TYPES.include?(type)
+
+      raise ArgumentError, "Toller: unknown type `#{type.inspect}` for filter `#{parameter}` " \
+                           "(expected one of #{Toller::VALID_TYPES.join(', ')})"
+    end
   end
 end

data/lib/toller/filters/column_handler.rb

@@ -9,21 +9,20 @@ module Toller
       ##
       # Applies a plain `where` clause to +collection+ for a non-scope filter.
       #
-      # If +field+ isn't a real column on the collection's model, the filter is
-      # logged and skipped instead of raising once the relation is evaluated.
+      # If +field+ isn't a real column on the collection's model, or the column's actual type
+      # doesn't match the declared `type:`, the filter is logged and skipped instead of raising
+      # (or silently applying a mismatched mutator) once the relation is evaluated.
       #
       # @param collection [ActiveRecord::Relation] the collection to filter
       # @param type [Symbol] the filter type (e.g. :string, :integer, :boolean)
       # @param value [Object] the raw filter param value
       # @param properties [Hash] the filter's properties, used to resolve `:field`
-      # @return [ActiveRecord::Relation] the filtered collection, or +collection+ unchanged if `:field` is unknown
+      # @return [ActiveRecord::Relation] the filtered collection, or +collection+ unchanged if `:field` is
+      #                                  unknown or its actual column type doesn't match `type`
       def call(collection, type, value, properties)
         field_name = properties[:field]
 
-        unless collection.klass.column_names.include?(field_name.to_s)
-          Rails.logger.warn("[Toller] Skipping filter: #{collection.klass} has no column `#{field_name}`")
-          return collection
-        end
+        return collection unless resolvable_column?(collection, field_name, type)
 
         mutated_value = value_mutator(type, value)
 
@@ -32,6 +31,29 @@ module Toller
 
       private
 
+      ##
+      # Confirms +field_name+ is a real column on +collection+'s model whose actual type matches
+      # +type+, logging a warning and returning false otherwise.
+      #
+      # @param collection [ActiveRecord::Relation] the collection to filter
+      # @param field_name [Symbol] the column to look up
+      # @param type [Symbol] the filter's declared type
+      # @return [Boolean] whether +field_name+ exists and its actual column type matches +type+
+      def resolvable_column?(collection, field_name, type)
+        unless collection.klass.column_names.include?(field_name.to_s)
+          Rails.logger.warn("[Toller] Skipping filter: #{collection.klass} has no column `#{field_name}`")
+          return false
+        end
+
+        actual_type = collection.klass.columns_hash[field_name.to_s].type
+        return true if actual_type == type
+
+        Rails.logger.warn(
+          "[Toller] Skipping filter: #{collection.klass}##{field_name} is `#{actual_type}`, declared as `#{type}`"
+        )
+        false
+      end
+
       ##
       # Value mutator
       #

data/lib/toller/filters/mutators/common/range.rb

@@ -12,7 +12,7 @@ module Toller
         # `call(value)` that returns +value+ unchanged, or a Range when +value+ contains
         # Ruby range syntax (`..` for inclusive, `...` for exclusive).
         #
-        # Note: methods here must refer to Ruby's core Range class as `::Range` — a bare
+        # Methods here must refer to Ruby's core Range class as `::Range` - a bare
         # `Range` would resolve to this module (Mutators::Common::Range) instead, since
         # Ruby's constant lookup checks the lexical scope before the top level.
         module Range

data/lib/toller/filters/scope_handler.rb

@@ -19,7 +19,7 @@ module Toller
       def call(collection, value, properties)
         scoped_name = properties[:scope_name] || properties[:field]
 
-        unless collection.klass.respond_to?(scoped_name)
+        unless ScopeResolver.own_class_method?(collection.klass, scoped_name)
           Rails.logger.warn("[Toller] Skipping filter: #{collection.klass} has no scope `#{scoped_name}`")
           return collection
         end

data/lib/toller/retriever.rb

@@ -50,9 +50,9 @@ module Toller
     def filter
       active_retrievals.reduce(collection) do |items, retrieval|
         param_value = if retrieval.is_a?(Filter)
-                        filter_params.fetch(retrieval.parameter, nil)
+                        filter_params.fetch(downcased_parameter(retrieval), nil)
                       else
-                        sort_params.include?("-#{retrieval.parameter}") ? :desc : :asc
+                        sort_params.include?("-#{downcased_parameter(retrieval)}") ? :desc : :asc
                       end
 
         retrieval.apply!(items, param_value)
@@ -75,7 +75,7 @@ module Toller
     def filtering_activated?(retrieval)
       return true if filter_params.blank? && retrieval.default
 
-      filter_params.fetch(retrieval.parameter, nil).present?
+      filter_params.fetch(downcased_parameter(retrieval), nil).present?
     end
 
     ##
@@ -84,9 +84,19 @@ module Toller
     def sorting_activated?(retrieval)
       return true if sort_params.blank? && retrieval.default
 
-      string_parameter = retrieval.parameter.to_s
+      string_parameter = downcased_parameter(retrieval)
 
       sort_params.include?(string_parameter) || sort_params.include?("-#{string_parameter}")
     end
+
+    ##
+    # `filter_params`/`sort_params` are downcased at the request level, so `retrieval.parameter`
+    # (declared as-is by `filter_on`/`sort_on`) must be downcased the same way before comparison.
+    #
+    # @param retrieval [Toller::Filter,Toller::Sort] the filter/sort to check
+    # @return [String] +retrieval.parameter+ downcased
+    def downcased_parameter(retrieval)
+      retrieval.parameter.to_s.downcase
+    end
   end
 end

data/lib/toller/scope_resolver.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module Toller
+  ##
+  # Shared lookup used by the `type: :scope` filter/sort handlers to confirm a resolved
+  # `scope_name`/`field` is actually declared on the model (a real `scope`, or a plain
+  # `def self.foo`), rather than a method inherited from ActiveRecord itself. Without this,
+  # a typo'd `scope_name:` that happens to collide with a built-in ActiveRecord class method
+  # (`delete_all`, `where`, `sum`, etc.) would silently `public_send` it with the raw request
+  # value instead of being treated as an unresolvable scope.
+  module ScopeResolver
+    module_function
+
+    ##
+    # @param klass [Class] the ActiveRecord model class to check
+    # @param name [Symbol,String] the method name to look for
+    # @return [Boolean] whether +name+ is defined by +klass+ or one of its own ancestors,
+    #                   rather than inherited from ActiveRecord::Base itself
+    def own_class_method?(klass, name)
+      klass.singleton_class.ancestors
+           .take_while { |mod| mod != ActiveRecord::Base.singleton_class }
+           .any? { |mod| mod.public_method_defined?(name.to_sym, false) }
+    end
+  end
+end

data/lib/toller/sort.rb

@@ -21,7 +21,10 @@ module Toller
     # @option options [Boolean] :default whether this sort applies automatically when no sort params were sent
     # @option options [Symbol] :scope_name for type: :scope, the model scope to call; defaults to +parameter+
     # @return [Toller::Sort] a new instance of Sort
+    # @raise [ArgumentError] if +type+ isn't one of {Toller::VALID_TYPES}
     def initialize(parameter, type, options)
+      validate_type!(parameter, type)
+
       @parameter = parameter
       @type = type
       @properties = options.reverse_merge(
@@ -42,7 +45,7 @@ module Toller
       if type == :scope
         Sorts::ScopeHandler.new.call(collection, direction, properties)
       else
-        Sorts::ColumnHandler.new.call(collection, direction, properties)
+        Sorts::ColumnHandler.new.call(collection, type, direction, properties)
       end
     end
 
@@ -51,5 +54,19 @@ module Toller
     def default
       properties[:default]
     end
+
+    private
+
+    ##
+    # @param parameter [Symbol] the public sort param name, used in the error message
+    # @param type [Symbol] the sort type to validate
+    # @return [nil]
+    # @raise [ArgumentError] if +type+ isn't one of {Toller::VALID_TYPES}
+    def validate_type!(parameter, type)
+      return if Toller::VALID_TYPES.include?(type)
+
+      raise ArgumentError, "Toller: unknown type `#{type.inspect}` for sort `#{parameter}` " \
+                           "(expected one of #{Toller::VALID_TYPES.join(', ')})"
+    end
   end
 end

data/lib/toller/sorts/column_handler.rb

@@ -9,22 +9,47 @@ module Toller
       ##
       # Applies a plain `order` clause to +collection+ for a non-scope sort.
       #
-      # If +field+ isn't a real column on the collection's model, the sort is
-      # logged and skipped instead of raising once the relation is evaluated.
+      # If +field+ isn't a real column on the collection's model, or the column's actual type
+      # doesn't match the declared `type:`, the sort is logged and skipped instead of raising
+      # once the relation is evaluated.
       #
       # @param collection [ActiveRecord::Relation] the collection to sort
+      # @param type [Symbol] the sort type (e.g. :string, :integer, :boolean)
       # @param direction [Symbol] the sort direction, :asc or :desc
       # @param properties [Hash] the sort's properties, used to resolve `:field`
-      # @return [ActiveRecord::Relation] the sorted collection, or +collection+ unchanged if `:field` is unknown
-      def call(collection, direction, properties)
+      # @return [ActiveRecord::Relation] the sorted collection, or +collection+ unchanged if `:field` is
+      #                                  unknown or its actual column type doesn't match `type`
+      def call(collection, type, direction, properties)
         field_name = properties[:field]
 
+        return collection unless resolvable_column?(collection, field_name, type)
+
+        collection.order(field_name => direction)
+      end
+
+      private
+
+      ##
+      # Confirms +field_name+ is a real column on +collection+'s model whose actual type matches
+      # +type+, logging a warning and returning false otherwise.
+      #
+      # @param collection [ActiveRecord::Relation] the collection to sort
+      # @param field_name [Symbol] the column to look up
+      # @param type [Symbol] the sort's declared type
+      # @return [Boolean] whether +field_name+ exists and its actual column type matches +type+
+      def resolvable_column?(collection, field_name, type)
         unless collection.klass.column_names.include?(field_name.to_s)
           Rails.logger.warn("[Toller] Skipping sort: #{collection.klass} has no column `#{field_name}`")
-          return collection
+          return false
         end
 
-        collection.order(field_name => direction)
+        actual_type = collection.klass.columns_hash[field_name.to_s].type
+        return true if actual_type == type
+
+        Rails.logger.warn(
+          "[Toller] Skipping sort: #{collection.klass}##{field_name} is `#{actual_type}`, declared as `#{type}`"
+        )
+        false
       end
     end
   end

data/lib/toller/sorts/scope_handler.rb

@@ -19,7 +19,7 @@ module Toller
       def call(collection, direction, properties)
         scoped_name = properties[:scope_name] || properties[:field]
 
-        unless collection.klass.respond_to?(scoped_name)
+        unless ScopeResolver.own_class_method?(collection.klass, scoped_name)
           Rails.logger.warn("[Toller] Skipping sort: #{collection.klass} has no scope `#{scoped_name}`")
           return collection
         end

data/lib/toller/version.rb

@@ -2,5 +2,5 @@
 
 module Toller
   # @return [String] the current gem version
-  VERSION = "1.1.0"
+  VERSION = "1.2.0"
 end

data/lib/toller.rb

@@ -10,6 +10,7 @@ require "toller/filters/mutators/integer"
 require "toller/filters/mutators/time"
 require "toller/filters/scope_handler"
 require "toller/retriever"
+require "toller/scope_resolver"
 require "toller/sort"
 require "toller/sorts/column_handler"
 require "toller/sorts/scope_handler"
@@ -21,6 +22,9 @@ require "toller/sorts/scope_handler"
 module Toller
   extend ActiveSupport::Concern
 
+  # @return [Array<Symbol>] the types `filter_on`/`sort_on` recognize for their `type:` option
+  VALID_TYPES = %i[string text integer boolean date datetime time scope].freeze
+
   ##
   # Coerces a raw string value into a boolean, using the same rule Toller's
   # own `type: :boolean` filters use internally. Handy inside a model scope
@@ -78,15 +82,19 @@ module Toller
   end
 
   ##
+  # Filter params
+  #
   # @return [Hash] the current request's filter params, keyed by filter parameter name
   def filter_params
-    params.fetch(filter_param_key.to_sym, {})
+    params.fetch(filter_param_key.to_sym, {}).transform_keys { |key| key.to_s.strip.downcase }
   end
 
   ##
+  # Sort param split
+  #
   # @return [Array<String>] the current request's sort params, e.g. ['-published_at', 'title']
   def sort_params
-    params.fetch(sort_param_key.to_sym, "").split(",")
+    params.fetch(sort_param_key.to_sym, "").split(",").map { |param| param.strip.downcase }.reject(&:empty?)
   end
 
   ##

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: toller
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 1.2.0
 platform: ruby
 authors:
 - David Freerksen
@@ -46,6 +46,7 @@ files:
 - lib/toller/filters/mutators/time.rb
 - lib/toller/filters/scope_handler.rb
 - lib/toller/retriever.rb
+- lib/toller/scope_resolver.rb
 - lib/toller/sort.rb
 - lib/toller/sorts/column_handler.rb
 - lib/toller/sorts/scope_handler.rb