utopia 3.0.4 → 3.0.6

data/lib/utopia/path.rb

@@ -1,12 +1,20 @@
 # frozen_string_literal: true
 
 # Released under the MIT License.
-# Copyright, 2009-2025, by Samuel Williams.
+# Copyright, 2009-2026, by Samuel Williams.
 
 require "protocol/url/path"
 
 module Utopia
-	# Represents a path as an array of path components. Useful for efficient URL manipulation.
+	# Represents an application path as a traversal through a tree.
+	#
+	# Each component names a node and `/` represents the edge between adjacent nodes. A leading empty component anchors the traversal at the root, while a trailing empty component preserves an explicit final edge and denotes a directory:
+	#
+	# - `["foo", "bar"]` represents `foo/bar`.
+	# - `["", "foo", "bar"]` represents `/foo/bar`.
+	# - `["", "foo", "bar", ""]` represents `/foo/bar/`.
+	#
+	# The structural root is represented by `[""]` and contains no traversed edge. It is intentionally distinct from parsing `/`, which preserves the explicit edge as `["", ""]`. Both serialize as `/`, but they retain different structural representations. In particular, the structural root maps to an empty local path so it can be resolved relative to an application root.
 	class Path
 		include Comparable
 		
@@ -36,7 +44,7 @@ module Utopia
 			@components.empty?
 		end
 		
-		# Construct the root path.
+		# Construct the structural root path without an explicit trailing separator.
 		# @returns [Path] The root path.
 		def self.root
 			self.new([""])
@@ -203,12 +211,6 @@ module Utopia
 			end
 		end
 		
-		# Remove the first component when this path is relative.
-		# @returns [String | Nil] The removed component, or `nil` when the path is absolute.
-		def to_relative!
-			@components.shift if relative?
-		end
-		
 		# Convert this object to a string.
 		# @returns [String] The resulting string.
 		def to_str
@@ -532,11 +534,4 @@ module Utopia
 			return index
 		end
 	end
-	
-	# Coerce a value into a {Path}.
-	# @parameter path [Utopia::Path | String] The path.
-	# @returns [Path | Nil] The coerced path.
-	def self.Path(path)
-		Path.create(path)
-	end
 end

data/lib/utopia/request.rb

@@ -117,28 +117,13 @@ module Utopia
 			@query_parameters ||= parse_query_parameters(self.url.query)
 		end
 		
-		private def parse_cookies(cookie_header)
-			cookies = {}
-			
-			return cookies unless cookie_header
-			
-			if cookie_header.respond_to?(:to_str)
-				cookie_header = cookie_header.to_str
-			else
-				cookie_header = cookie_header.to_s
-			end
-			
-			cookie_header.split(/;\s*/).each do |pair|
-				key, value = pair.split("=", 2)
-				cookies[key] = value || ""
-			end
-			
-			return cookies
-		end
-		
 		# Decoded request cookies.
 		def cookies
-			@cookies ||= parse_cookies(self.headers["cookie"])
+			@cookies ||= if cookie_header = self.headers["cookie"]
+				cookie_header.to_h.transform_values(&:value)
+			else
+				{}
+			end
 		end
 		
 		# The request user agent.

data/lib/utopia/session/lazy_hash.rb

@@ -16,10 +16,6 @@ module Utopia
 				@loader = block
 			end
 			
-			# The loaded session values, if already loaded.
-			# @returns [Hash | Nil] The loaded values.
-			attr :values
-			
 			# Fetch a value by key, loading the hash if necessary.
 			# @parameter key [Object] The key.
 			# @returns [Object | Nil] The value.
@@ -66,10 +62,26 @@ module Utopia
 				@changed
 			end
 			
-			# Load and return the underlying values.
-			# @returns [Hash] The loaded values.
-			def load!
-				@values ||= @loader.call
+			# The current time for session expiry and persistence.
+			# @returns [Time] The current time in UTC.
+			def now
+				Time.now.utc
+			end
+			
+			# Persist the session values if they have changed or require updating.
+			# @parameter timeout [Numeric | Nil] The maximum age before an update is required.
+			# @yields {|values, updated_at| ...} The loaded values and their update time.
+			# @returns [Object | Nil] The result of the block if persistence was required.
+			def persist(timeout = nil)
+				return unless needs_update?(timeout)
+				
+				values = load!
+				updated_at = values[:updated_at] = now
+				
+				result = yield(values, updated_at)
+				@changed = false
+				
+				return result
 			end
 			
 			# Check whether the underlying values have been loaded.
@@ -88,11 +100,18 @@ module Utopia
 				# We want to be careful here and not call load! which isn't cheap operation.
 				if timeout and @values and updated_at = @values[:updated_at]
 					# If the last update was too long ago, we need update:
-					return true if updated_at < (Time.now - timeout)
+					return true if updated_at < (now - timeout)
 				end
 				
 				return false
 			end
+			
+			private
+			
+			# Load and return the underlying values.
+			def load!
+				@values ||= @loader.call(now)
+			end
 		end
 	end
 end

data/lib/utopia/session/middleware.rb

@@ -24,12 +24,14 @@ module Utopia
 			class PayloadError < StandardError
 			end
 			
-			MAXIMUM_SIZE = 1024*32
+			SIZE_LIMIT = 1024*32
 			
 			SECRET_KEY = "UTOPIA_SESSION_SECRET".freeze
 			
 			SESSION_KEY = "utopia.session".freeze
-			CIPHER_ALGORITHM = "aes-256-cbc"
+			CIPHER_ALGORITHM = "aes-256-gcm"
+			PAYLOAD_VERSION = "v1".freeze
+			AUTHENTICATION_TAG_SIZE = 16
 			
 			# The session will expire if no requests were made within 24 hours:
 			DEFAULT_EXPIRES_AFTER = 3600*24
@@ -48,8 +50,8 @@ module Utopia
 			# @param http_only [Boolean] Whether client-side scripts may access the cookie.
 			# @param same_site [Symbol | String | Boolean | Nil] Controls whether the cookie is sent with cross-site requests.
 			# @param partitioned [Boolean] Whether the cookie uses partitioned storage.
-			# @param maximum_size [Integer | Nil] The maximum encoded session payload size.
-			def initialize(app, session_name: SESSION_KEY, secret: nil, expires_after: DEFAULT_EXPIRES_AFTER, update_timeout: DEFAULT_UPDATE_TIMEOUT, domain: nil, path: "/", max_age: nil, secure: false, http_only: true, same_site: :lax, partitioned: false, maximum_size: MAXIMUM_SIZE)
+			# @param size_limit [Integer | Nil] The encoded session payload size limit.
+			def initialize(app, session_name: SESSION_KEY, secret: nil, expires_after: DEFAULT_EXPIRES_AFTER, update_timeout: DEFAULT_UPDATE_TIMEOUT, domain: nil, path: "/", max_age: nil, secure: false, http_only: true, same_site: :lax, partitioned: false, size_limit: SIZE_LIMIT)
 				super(app)
 				
 				@session_name = session_name
@@ -61,6 +63,7 @@ module Utopia
 				
 				# This generates a 32-byte key suitable for aes.
 				@key = Digest::SHA2.digest(secret)
+				@authentication_context = "#{@cookie_name}\0#{PAYLOAD_VERSION}".b.freeze
 				
 				@expires_after = expires_after
 				@update_timeout = update_timeout
@@ -82,7 +85,7 @@ module Utopia
 				}
 				
 				@serialization = Serialization.new
-				@maximum_size = maximum_size
+				@size_limit = size_limit
 			end
 			
 			attr :cookie_name
@@ -100,6 +103,7 @@ module Utopia
 				
 				@cookie_name.freeze
 				@key.freeze
+				@authentication_context.freeze
 				@expires_after.freeze
 				@update_timeout.freeze
 				@cookie_defaults.freeze
@@ -139,59 +143,53 @@ module Utopia
 			end
 			
 			def prepare_session(request)
-				LazyHash.new do
-					self.load_session_values(request)
+				LazyHash.new do |now|
+					self.load_session_values(request, now)
 				end
 			end
 			
 			def update_session(session_hash, headers)
-				if session_hash.needs_update?(@update_timeout)
-					values = session_hash.values
-					
-					values[:updated_at] = Time.now.utc
-					
-					data = encrypt(session_hash.values)
-					
-					commit(data, values[:updated_at], headers)
+				session_hash.persist(@update_timeout) do |values, updated_at|
+					commit(encrypt(values), updated_at, headers)
 				end
 			end
 			
 			# Constructs a valid session for the given request. These fields must match as per the checks performed in `valid_session?`:
-			def build_initial_session(request)
+			def build_initial_session(request, now)
 				{
 					user_agent: request.user_agent,
-					created_at: Time.now.utc,
-					updated_at: Time.now.utc,
+					created_at: now,
+					updated_at: now,
 				}
 			end
 			
 			# Load session from user supplied cookie. If the data is invalid or otherwise fails validation, `build_iniital_session` is invoked.
 			# @return hash of values.
-			def load_session_values(request)
+			def load_session_values(request, now)
 				# Decrypt the data from the user if possible:
 				if data = request.cookies[@cookie_name]
 					begin
 						if values = decrypt(data)
-							validate_session!(request, values)
+							validate_session!(request, values, now)
 							
 							return values
 						end
-					rescue => error
-						Console.error(self, error)
+					rescue PayloadError => error
+						Console.debug(self, "Discarding invalid session cookie!", exception: error)
 					end
 				end
 				
 				# If we couldn't create a session
-				return build_initial_session(request)
+				return build_initial_session(request, now)
 			end
 			
-			def validate_session!(request, values)
+			def validate_session!(request, values, now)
 				if values[:user_agent] != request.user_agent
 					raise PayloadError, "Invalid session because supplied user agent #{request.user_agent.inspect} does not match session user agent #{values[:user_agent].inspect}!"
 				end
 				
 				if expires_at = expires(values[:updated_at])
-					if expires_at < Time.now.utc
+					if expires_at < now
 						raise PayloadError, "Expired session cookie, user agent submitted a cookie that should have expired at #{expires_at}."
 					end
 				end
@@ -199,7 +197,7 @@ module Utopia
 				return true
 			end
 			
-			def expires(updated_at=Time.now.utc)
+			def expires(updated_at)
 				if @expires_after
 					return updated_at + @expires_after
 				end
@@ -253,38 +251,65 @@ module Utopia
 			end
 			
 			def encrypt(hash)
-				c = OpenSSL::Cipher.new(CIPHER_ALGORITHM)
-				c.encrypt
+				cipher = OpenSSL::Cipher.new(CIPHER_ALGORITHM)
+				cipher.encrypt
+				
+				cipher.key = @key
+				cipher.iv = initialization_vector = cipher.random_iv
+				cipher.auth_data = @authentication_context
+				
+				encrypted_data = cipher.update(@serialization.dump(hash))
+				encrypted_data << cipher.final
 				
-				# your pass is what is used to encrypt/decrypt
-				c.key = @key
-				c.iv = iv = c.random_iv
+				payload = initialization_vector + encrypted_data + cipher.auth_tag(AUTHENTICATION_TAG_SIZE)
+				data = "#{PAYLOAD_VERSION}.#{[payload].pack("m0")}"
 				
-				e = c.update(@serialization.dump(hash))
-				e << c.final
+				validate_size!(data)
 				
-				return [iv + e].pack("m0")
+				return data
 			end
 			
 			def decrypt(data)
-				if @maximum_size and data.bytesize > @maximum_size
-					raise PayloadError, "Session payload size #{data.bytesize}bytes exceeds maximum allowed size #{@maximum_size}bytes!"
-				end
-				
-				payload = data.unpack1("m0")
-				iv = payload.byteslice(0, 16)
-				e = payload.byteslice(16..)
-				
-				c = OpenSSL::Cipher.new(CIPHER_ALGORITHM)
-				c.decrypt
+				validate_size!(data)
 				
-				c.key = @key
-				c.iv = iv
+				version, encoded_payload = data.split(".", 2)
 				
-				d = c.update(e)
-				d << c.final
+				if version != PAYLOAD_VERSION or encoded_payload.nil?
+					raise PayloadError, "Unsupported session payload format!"
+				end
 				
-				return @serialization.load(d)
+				begin
+					cipher = OpenSSL::Cipher.new(CIPHER_ALGORITHM)
+					payload = encoded_payload.unpack1("m0")
+					minimum_size = cipher.iv_len + AUTHENTICATION_TAG_SIZE
+					
+					if payload.bytesize < minimum_size
+						raise PayloadError, "Invalid session payload!"
+					end
+					
+					initialization_vector = payload.byteslice(0, cipher.iv_len)
+					encrypted_data = payload.byteslice(cipher.iv_len, payload.bytesize - minimum_size)
+					authentication_tag = payload.byteslice(-AUTHENTICATION_TAG_SIZE, AUTHENTICATION_TAG_SIZE)
+					
+					cipher.decrypt
+					cipher.key = @key
+					cipher.iv = initialization_vector
+					cipher.auth_tag = authentication_tag
+					cipher.auth_data = @authentication_context
+					
+					decrypted_data = cipher.update(encrypted_data)
+					decrypted_data << cipher.final
+					
+					return @serialization.load(decrypted_data)
+				rescue ArgumentError, OpenSSL::Cipher::CipherError
+					raise PayloadError, "Invalid session payload!"
+				end
+			end
+			
+			def validate_size!(data)
+				if @size_limit and data.bytesize > @size_limit
+					raise PayloadError, "Session payload size #{data.bytesize}bytes exceeds size limit #{@size_limit}bytes!"
+				end
 			end
 		end
 	end

data/lib/utopia/static/local_file.rb

@@ -69,9 +69,13 @@ module Utopia
 				ranges = byte_ranges(request)
 				size = bytesize
 				
-				# puts "Requesting ranges: #{ranges.inspect} (#{size})"
-				
-				if ranges == nil or ranges.size != 1
+				# A valid byte-range request with no satisfiable ranges cannot be fulfilled:
+				if ranges && ranges.empty?
+					response_headers[CONTENT_LENGTH] = "0"
+					response_headers[CONTENT_RANGE] = "bytes */#{size}"
+					
+					return Response[416, response_headers, []]
+				elsif ranges == nil or ranges.size != 1
 					# No ranges, or multiple ranges (which we don't support).
 					# TODO: Support multiple byte-ranges, for now just send entire file:
 					status = 200

data/lib/utopia/static/middleware.rb

@@ -11,8 +11,6 @@ require_relative "local_file"
 require_relative "mime_types"
 require_relative "../localization/resolver"
 
-require "traces/provider"
-
 module Utopia
 	module Static
 		DEFAULT_CACHE_CONTROL = "public, max-age=3600".freeze
@@ -138,15 +136,5 @@ module Utopia
 			end
 		end
 		
-		Traces::Provider(Static) do
-			def respond(request, path, extension, content_type, localization: request.localization)
-				attributes = {
-					path: path,
-					locale: localization&.locale,
-				}
-				
-				Traces.trace("utopia.static.respond", attributes: attributes){super}
-			end
-		end
 	end
 end

data/lib/utopia/version.rb

@@ -5,5 +5,5 @@
 
 # @namespace
 module Utopia
-	VERSION = "3.0.4"
+	VERSION = "3.0.6"
 end

data/readme.md

@@ -31,6 +31,19 @@ Please see the [project documentation](https://socketry.github.io/utopia/) for m
 
 Please see the [project releases](https://socketry.github.io/utopia/releases/index) for all releases.
 
+### v3.0.6
+
+  - [JavaScript Packages](https://socketry.github.io/utopia/releases/index#javascript-packages)
+
+### v3.0.5
+
+  - **Breaking** Remove support for JavaScript packages installed in `lib/components`; use `node_modules` instead.
+  - **Breaking** Expose <code class="language-ruby">Utopia::Content::Middleware\#links</code> as the content link resolver rather than an indexed lookup method.
+  - **Security** Authenticate encrypted session cookies using AES-256-GCM. Existing session cookies are invalidated.
+  - Constrain content node local paths to the configured content root.
+  - **Security** Redact sensitive exception report fields and make bounded request body attachments opt-in.
+  - Return `416 Range Not Satisfiable` for unsatisfiable static file byte ranges.
+
 ### v3.0.0
 
 The 3.0.x series is considered a development release while the protocol HTTP application and controller interfaces stabilize.

data/releases.md

@@ -1,5 +1,22 @@
 # Releases
 
+## v3.0.6
+
+### JavaScript Packages
+
+Utopia now depends on `bake-node` for JavaScript dependency installation and static package projection. `Utopia::Components` and `utopia:components:update` have been removed. Replace the old task with `bundle exec bake node:packages:static`, and migrate package selection from `utopia.components` to `bake-node.packages` in `package.json`.
+
+Use `Utopia::ImportMap.load_manifest("public/_components")` to load the generated browser import mappings directly from the Bake Node manifest.
+
+## v3.0.5
+
+  - **Breaking** Remove support for JavaScript packages installed in `lib/components`; use `node_modules` instead.
+  - **Breaking** Expose {ruby Utopia::Content::Middleware\#links} as the content link resolver rather than an indexed lookup method.
+  - **Security** Authenticate encrypted session cookies using AES-256-GCM. Existing session cookies are invalidated.
+  - Constrain content node local paths to the configured content root.
+  - **Security** Redact sensitive exception report fields and make bounded request body attachments opt-in.
+  - Return `416 Range Not Satisfiable` for unsatisfiable static file byte ranges.
+
 ## v3.0.0
 
 The 3.0.x series is considered a development release while the protocol HTTP application and controller interfaces stabilize.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: utopia
 version: !ruby/object:Gem::Version
-  version: 3.0.4
+  version: 3.0.6
 platform: ruby
 authors:
 - Samuel Williams
@@ -57,6 +57,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.20'
+- !ruby/object:Gem::Dependency
+  name: bake-node
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby
   requirement: !ruby/object:Gem::Requirement
@@ -161,14 +175,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.70'
+        version: '0.71'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.70'
+        version: '0.71'
 - !ruby/object:Gem::Dependency
   name: protocol-media
   requirement: !ruby/object:Gem::Requirement
@@ -272,7 +286,6 @@ extensions: []
 extra_rdoc_files: []
 files:
 - bake/utopia.rb
-- bake/utopia/components.rb
 - bake/utopia/environment.rb
 - bake/utopia/server.rb
 - bake/utopia/shell.rb
@@ -285,9 +298,11 @@ files:
 - context/server-setup.md
 - context/updating-utopia.md
 - context/what-is-xnode.md
+- lib/traces/provider/utopia.rb
+- lib/traces/provider/utopia/content/middleware.rb
+- lib/traces/provider/utopia/static/middleware.rb
 - lib/utopia.rb
 - lib/utopia/application.rb
-- lib/utopia/components.rb
 - lib/utopia/content.rb
 - lib/utopia/content/builder.rb
 - lib/utopia/content/document.rb
@@ -311,6 +326,7 @@ files:
 - lib/utopia/controller/rewrite.rb
 - lib/utopia/controller/variables.rb
 - lib/utopia/exceptions.rb
+- lib/utopia/exceptions/application_errors.rb
 - lib/utopia/exceptions/handler.rb
 - lib/utopia/exceptions/mailer.rb
 - lib/utopia/extensions/array_split.rb

data/bake/utopia/components.rb

@@ -1,44 +0,0 @@
-# frozen_string_literal: true
-
-# Released under the MIT License.
-# Copyright, 2026, by Samuel Williams.
-
-NPM = ENV["NPM"] || "npm"
-
-# Update public components from production JavaScript packages.
-#
-# Packages are copied from their `dist` directory when present, or otherwise
-# from the package root. The `utopia.components` section of `package.json` can
-# specify per-package `include` patterns to select only required files.
-#
-# @parameter root [String] The project root directory.
-def update(root: context.root)
-	require "json"
-	require "open3"
-	require "utopia/components"
-	
-	components = Utopia::Components.new(root)
-	production_packages = fetch_production_packages(components.package_root)
-	
-	components.update(production_packages)
-end
-
-private
-
-def fetch_production_packages(package_root)
-	stdout, _status = Open3.capture2(NPM, "ls", "--production", "--json", chdir: package_root.to_s)
-	json = JSON.parse(stdout)
-	
-	flatten_package_dependencies(json).sort.uniq
-end
-
-def flatten_package_dependencies(json, into = [])
-	if json["dependencies"]
-		json["dependencies"].each do |name, details|
-			into << name
-			flatten_package_dependencies(details, into)
-		end
-	end
-	
-	return into
-end