Hello <%= @user %>!
" end route do |r| @user = 'You' render(:index) end # => "Hello You!
" end * A multi_run plugin has been added, for dispatching to multiple rack applications based on the request path prefix. This provides a similar API as the multi_route plugin, but allows you to separate your applications per routing subtree, as opposed to multi_route which uses the same application for all routing subtrees. With the multi_run plugin, you call the class level run method with the routing prefix and the rack application to use, and you call r.multi_run to dispatch to all of the applications based on the prefix. class App < Roda plugin :multi_run run "foo", Foo run "bar", Bar run "baz", Baz route do |r| r.multi_run end end In this case, Foo, Bar, and Baz, can be subclasses of App, which allows them to share methods that should be shared, but still define methods themselves that are not shared by the other applications. * A sinatra_helpers plugin has been added, that ports over most of the Sinatra::Helpers methods that haven't already been added by other plugins. All of the methods are added either to the request or response class as appropriate. By default, delegate methods are also added to the route block scope, but you can turn this off by passing a :delegate=>false option when loading the plugin, which avoids polluting the route block namespace. The sinatra_helpers plugin adds the following request methods: * back * error * not_found * uri * send_file And the following response methods: * body * body= * status * headers * mime_type * content_type * attachment * informational? * success? * redirect? * client_error? * not_found? * server_error? * A slash_path_empty plugin has been added, which changes Roda so that "/" is considered an empty path when doing a terminal match via r.is or r.get/r.post with a path. class App < Roda plugin :slash_path_empty route do |r| r.get "albums" do # matches both GET /albums and GET /albums/ end end end * An empty_root plugin has been added, which makes r.root match the empty string, in addition to /. This can be useful in cases where a partial match on the patch has been completed. class App < Roda plugin :empty_root route do |r| r.on "albums" do r.root do # matches both GET /albums and GET /albums/ end end end end * A match_affix plugin has been added, for overriding the default prefix/suffix used in match patterns. For example, if you want to require that a leading / be specified in your routes. and you want to consume any trailing slash: class App < Roda plugin :match_affix, "", /(\/|\z)/ route do |r| r.on "/albums" do |s| # GET /albums # s => "" # GET /albums/ # s => "/" end end end * An environments plugin has been added, giving some simple helpers for executing code in different environments. Example: class App < Roda plugin :environments environment # => :development development? # => true test? # => false production? # => false # Set the environment for the application self.environment = :test test? # => true configure do # called, as no environments given end configure :development, :production do # not called, as no environments match end configure :test do # called, as environment given matches current environment end end * A drop_body plugin has been added, which automatically drops the body, Content-Type header, and Content-Length header when the response status indicates no body (100-102, 204, 205, 304). * A delay_build plugin has been added, which delays building the rack application until Roda.app is called, and only rebuilds the rack application if build! is called. This removes O(n^2) performance in the pathological case of adding a route block and then calling Roda.use many times to add middlewares, though you have to add a few hundred middlewares for the difference to be noticeable. = New Features * r.remaining_path and r.matched_path have been added for returning the remaining path that will be used for matching, and for returning the path already matched. Currently, these just provide the PATH_INFO and SCRIPT_NAME, but starting in Roda 2 PATH_INFO and SCRIPT_NAME will not be modified during routing, and you'll need to use these methods if you want to find out the remaining or already matched paths. * The render plugin now supports a :template option to render/view to specify the template to use, instead of requiring a separate argument. * The render plugin now supports a :template_class option, allowing you to override the default template class that Roda would use. * The render plugin now supports a :template_block option, specifying the block to pass when creating a template. * The path class method added by the path plugin now accepts :name, :url, :url_only, and :add_script_name options: :name :: Specifies name for method :url :: Creates a url method in addition to a path method :url_only :: Only creates a url method, not a path method :add_script_name :: prefixes the path with SCRIPT_NAME Note that if you plan to use :add_script_name, you should use the static_path_info plugin so that the method created does not return different results depending on where you are in the routing tree. * A :user_agent hash matcher has been added to the header_matchers plugin. * An inherit_middleware class accessor has been added. This can be set to false if you do not want subclasses to inherit middleware from the superclass. This is useful if the superclass dispatches to the subclass via r.run, as otherwise it would have to run the same middleware stack twice. * A clear_middleware! class accessor has been added, allowing you to clear the current middleware stack. * RodaRequest#default_redirect_status has been added, allowing plugins to override the default status used for redirect if a status is not given. * Roda{Request,Response}#roda_class has been added, which returns the Roda class related to the given request/response. = Other Improvements * The render plugin no longer caches templates by default if RACK_ENV is development. * When subclassing a Roda app, unfrozen Array/Hash entries in the opts hash are now duped into the subclass, so the subclass no longer needs to dup them manually. Note that plugins that use nested arrays/hashes in the opts hash still need to dup manually inside ClassMethods#inherited. For the plugins where it is possible, it is recommended to store plugin options in a frozen object in the opts hash, and require loading the plugin again to modify the plugin options. * Caching of templates is now fixed when the render/view :opts is used to specify template options per-call. * An explicit :default_encoding of nil in the render plugin's :opts hash is no longer overwritten with Encoding.default_external. * Roda#session now returns the same object as RodaRequest#session. * The view_subdirs, content_for, and render_each plugins now all depend on the render plugin. * The not_allowed plugin now depends on the all_verbs plugin. * Local/instance variables are now used in more places instead of method calls, improving performance. = Backwards Compatibility * The render plugin's render/view methods no longer pass the given hash directly to the underlying template. To pass options to the template engine, use a separate hash under the :opts key: render :file, :opts=>{:foo=>'bar'} This is more consistent with the class-level render plugin options, which also uses :opts to pass options to the template engine. The :js_opts and :css_opts options to the assets plugin are now passed as the :opts hash, so they continue to affect the template engine, so they no longer specify general render method options. * Modifying render_opts :layout after loading the render plugin now has no effect. You need to use plugin :render, :layout=>'...' to set the layout to use now. * Default headers are not set on a response until the response is finished. This allows you to check for header presence during routing to detect whether the header was specifically set for the current request. * RodaRequest.consume_pattern no longer captures anything by default. Previously, it did so in order to update SCRIPT_NAME, but that is now handled differently. This should only affect external plugins that attempt to override RodaRequest#consume. * RodaRequest.def_verb_method has been removed. * The hooks, default_headers, json, and multi_route plugins all store their class-level metadata in the opts hash instead of separate class instance variables. This should have no affect unless you were accessing the class instance variables directly. * The render plugin internals changed significantly, it now passes internal data using a hash. This should only affect users that were overriding render plugin methods. jeremyevans-roda-4f30bb3/doc/release_notes/1.3.0.txt 0000664 0000000 0000000 00000010215 15167207754 0022204 0 ustar 00root root 0000000 0000000 = Preparation for Roda 2 * In Roda 2 (the next version), the PATH_INFO and SCRIPT_NAME env variables will not be modified during routing. Instead, Roda will use the static_path_info plugin behavior by default. Users are strongly encouraged to use the static_path_info plugin to make sure their apps will work with Roda 2. * In Roda 2, Roda#initialize will take the env hash, and #call will take the route block. The private #_route method will be eliminated. This should not affect applications, but it will affect plugins that override these methods. * The issues mentioned below should all have deprecation warnings, except where noted. == New Plugins to Replace Deprecated Features * RodaResponse#set_cookie and #delete_cookie have been moved to the cookies plugin. * Roda.request_module and .response_module have been moved to the module_include plugin. * Roda.hash_matcher has been moved to the hash_matcher plugin. * The :extension hash matcher has been moved to the path_machers plugin. This plugin also contains new :prefix and :suffix hash matchers. * The :param and :param! hash matchers have been moved to the param_matchers plugin. == Other Deprecation Issues * The :opts render plugin option and :opts option to render and view are now deprecated. Use the :template_opts option instead. * RodaRequest#full_path_info has been deprecated, switch to using #path. * Mutating plugin option hashes for the chunked, default_headers, error_email, json, and render plugins is now deprecated, these option hashes will be frozen in Roda 2. * The :header hash matcher in the header_matchers plugin now gives a deprecation warning, because in Roda 2, the matcher will yield the value of the header to the block. To get the new behavior and silence the deprecation warning, you need to set an option: Roda.opts[:match_header_yield] = true * Mutating json_result_classes directly in the json plugin is now deprecated. You should now pass a :classes option to the plugin specifying the classes to convert, if you want to handle classes other than Array and Hash. There will not be a deprecation warning if you attempt to mutate json_result_classes. = New Features * The Roda.freeze method now freezes internal datastructures to avoid thread safety issues. The plugins that ship with Roda will freeze their datastructures when Roda.freeze is called. It is recommended that production applications call freeze on the application after fully loading it, especially if they are using a threaded webserver and a non-MRI ruby. * A delete_empty_headers plugin has been added that automatically deletes headers set to the empty string. This makes it simpler to delete default headers if they shouldn't be set for a specific request. * A class_delegate method has been added to the delegate plugin. This makes it easier to create instance methods that call class methods. * Roda::RodaMajorVersion, RodaMinorVersion, and RodaPatchVersion constants have been added. = Other Improvements * The error_handler plugin now uses a new response instead of reusing the existing response. This fixes cases where changing the Content-Type and then raising an exception would result in a error page that used the previously set Content-Type. * The not_found plugin now clears previous set headers before calling not found. This fixes cases where Content-Type was set previously, and also fixes an incorrect Content-Length being used for the response. * The static_path_info plugin now restores the original SCRIPT_NAME and PATH_INFO before returning from r.run, fixing usage with some middleware. * The multi_run plugin now works when subclassing the app. * The default_headers plugin is now faster by skipping an unnecessary hash duplication. * A Gemfile has been added to make development slightly easier. = Backwards Compatibility * RodaResponse is no longer a subclass of Rack::Response, it is now a subclass of Object. This shouldn't have an effect unless you were calling a method on an instance that was defined by Rack::Response and not RodaResponse, but most of those methods would have raised exceptions. jeremyevans-roda-4f30bb3/doc/release_notes/2.0.0.txt 0000664 0000000 0000000 00000004673 15167207754 0022215 0 ustar 00root root 0000000 0000000 = Backwards Compatibility * RodaResponse#set_cookie and #delete_cookie have been removed. * Roda.request_module and .response_module have been removed. * Roda.hash_matcher has been removed. * The :extension hash matcher has been removed. * The :param and :param! hash matchers have been removed. * RodaRequest#full_path_info has been removed. * The :opts render plugin option is no longer respected, Use the :template_opts option instead. * Plugin option hashes for the chunked, default_headers, error_email, and render plugins are now frozen. * The :header hash matcher in the header_matchers plugin now yields the header value to the block. * Roda.json_result_classes in the json plugin is now frozen. * The PATH_INFO and SCRIPT_NAME env variables are no longer modified during routing. * Roda#initialize now takes an env hash, and #call now takes the route block. The private #_route method has been removed. * RodaRequest#keep_remaining_path/#updating_remaining_path private methods have been removed. * The render plugin's :layout option is now always set to true or false, specifying whether a layout should be used by default. The template used for a layout is now located as the :template option inside :layout_opts. = New Plugins * A padrino_render plugin has been added, which adds render/partial methods that work similarly to Padrino's. = Other New Features * A Roda#render_template private method has been added to the render plugin. All internal users of render should switch to calling render_template. * The halt plugin now integrates with the symbol_views and json plugins, allowing things like: r.halt(:template) r.halt('key'=>'value') = Other Improvements * The error_handler plugin now rescues ScriptError in addition to StandardError. This handles SyntaxError (raised by ERB), LoadError (raised by require), and NotImplementedError (raised by TSort). * Using a :layout=>true option to the render plugin's view method now uses the default layout template, instead of a template named 'true'. It can be used to force a layout even if the render plugin has been configured to not use a layout by default. * Roda apps that use the middleware plugin can now be used as regular rack apps. Previously, using the middleware plugin made it impossible to use the app as a regular rack app. * Roda#request and #response are now faster. * Roda avoids creating unnecessary hashes in more places now. jeremyevans-roda-4f30bb3/doc/release_notes/2.1.0.txt 0000664 0000000 0000000 00000010631 15167207754 0022205 0 ustar 00root root 0000000 0000000 = New Plugins * A view_options plugin has been added, for branch/route specific setting of view and layout options and locals. This allows for DRYer code when you want to change the view or layout settings for an entire routing branch. Options and locals set at the branch or route level have higher priority than those set at the plugin level, but lower priority than those provided as arguments to the render/view methods. Example: class App < Roda plugin :view_options route do |r| r.on 'albums' do layout_options :template=>'layouts/3_columns' layout_locals :heading=>'Albums' view_options :ext=>'haml' view_locals :name=>'Foo' # ... end end end The view_options plugin is also a superset of the previous view_subdirs plugin, and attempts to load view_subdirs will now load view_options. In addition to set_view_subdir, the view_options plugin now supports append_view_subdir, which will append a subdirectory to an existing subdirectory, which makes it simpler to deal with nested view file hierarchies. * A static plugin has been added for easily serving static files using Rack::Static. Example: class App < Roda plugin :static, ['/js', '/css'] # or: plugin :static, ['/js', '/css'], :root=>'pub' end = Other New Features * Roda now supports a :root option for the application that sets the root directory. This is useful if the application's files are not stored in the process's working directory, which is common for processes containing of multiple Roda applications. By setting the :root option, plugins that use the file system will default to making relative paths relative to the :root option instead of the process's working directory. The assets, render, and static plugins currently support the :root option. Example: class App < Roda opts[:root] = File.dirname(__FILE__) end * Roda now supports an :add_script_name option for the application, which makes plugins automatically prepend the SCRIPT_NAME for the request's environment to any paths created. This allows Roda applications to work transparently whenever they are mounted inside of another rack application. The assets and path plugins currently recognize the :add_script_name option. Example: class App < Roda opts[:add_script_name] = true end * The path plugin now adds a Roda#path method, which creates paths based on the type of argument used. You can register classes with the path plugin by providing Roda.path with a class, which will cause Roda#path to recognize them and handle them accordingly. Example: class App < Roda plugin :path path(Track){|track| "/albums/#{track.album_id}/tracks/#{track.number}"} route do r.get 'tracks/:id' do |track_id| r.redirect(path(Track[track_id])) end end end = Other Improvements * add_file in the mailer plugin now adds the files after the email body instead of before. This fixes some issues where the email body would end up empty, due to issues with the mail gem's API. add_file now accepts a block, and the block is called after the file has been attached. Among other things, this allows you to change the content_type for an attached file: add_file 'path/to/file' do response.mail.attachments.last.content_type = 'text/foo' end * r.multi_route in the multi_route plugin now works if there are no named routes defined. * A render plugin :locals option is now respected, setting defaults to use for locals in views. Additionally, a :locals option in the :layout_opts option is now respected for setting locals in layouts. If both the render plugin option is set and :locals is passed to render/view, the two will be merged together. Previously, providing a :locals option to render/view would cause the plugin level option to be ignored. = Backwards Compatibility * Using the render plugin :layout=>nil option now removes any layout template set previously using :layout. Previously, the layout template would still be kept, but it would not be used by default. * Accessing attachments after adding a file using add_file in the mailer plugin no longer works, as the adding is now delayed until after the body is set. You should now pass a block to add_file if you want to access the attachment after it has been added. jeremyevans-roda-4f30bb3/doc/release_notes/2.10.0.txt 0000664 0000000 0000000 00000001541 15167207754 0022265 0 ustar 00root root 0000000 0000000 = New Features * The json plugin now accepts a :content_type option, which will override the default Content-Type response header used for responses. * Stream#write has been added to the streaming plugin, allowing the following type of code to work: stream do |out| IO.copy_stream(StringIO.new(content), out) end = Other Improvements * Roda now works with ruby 2.3's --enable-frozen-string-literal, and all of the library files are set to use frozen string literals by default. Most of roda's plugin-specific dependencies were found to have issues with frozen string literals, and while pull requests have been sent to fix the issues, it's unlikely that you would currently be able to use --enable-frozen-string-literal in production. * The json plugin will no longer override a Content-Type header if one is already set. jeremyevans-roda-4f30bb3/doc/release_notes/2.11.0.txt 0000664 0000000 0000000 00000004145 15167207754 0022271 0 ustar 00root root 0000000 0000000 = New Features * A params_capturing plugin has been added, which makes string and symbol matchers update the request params with the value of the captured segments, using the matcher as the key: plugin :params_capturing route do |r| # GET /foo/123/abc/67 r.on("foo/:bar/:baz", :quux) do r[:bar] #=> '123' r[:baz] #=> 'abc' r[:quux] #=> '67' end end Note that this updating of the request params using the matcher as the key is only done if all arguments to the matcher are symbols or strings. All matchers will update the request params by adding all captured segments to the captures key, including symbol and string matchers: r.on(:x, /(\d+)\/(\w+)/, ':y') do r[:x] #=> nil r[:y] #=> nil r[:captures] #=> ["foo", "123", "abc", "67"] end Note that the request params captures entry will be appended to with each nested match: r.on(:w) do r.on(:x) do r.on(:y) do r.on(:z) do r[:captures] # => ["foo", "123", "abc", "67"] end end end end Note that any existing params captures entry will be overwritten by this plugin. You can use r.GET or r.POST to get the underlying entry, depending on how it was submitted. Also note that the param keys are actually stored in r.params as strings and not symbols (r[] converts the argument to a string before looking it up in r.params). Also note that this plugin will not work correctly if you are using the symbol_matchers plugin with custom symbol matching and are using symbols that capture multiple values or no values. * A :scope option is now supported by render/view in the render plugin, which allows you to specify the object in which context to evaluate the template. = Other Improvements * The assets plugin's support for the Minjs javascript minifier now supports the latest version (0.4.1). = Backwards Compatibility * Support for Minjs <0.4.0 has been dropped from the assets plugin. Please upgrade Minjs at the same time you upgrade Roda if you are using both of them. jeremyevans-roda-4f30bb3/doc/release_notes/2.12.0.txt 0000664 0000000 0000000 00000002612 15167207754 0022267 0 ustar 00root root 0000000 0000000 = New Features * An optimized_string_matchers plugin has been added, which contains optimized matchers for single strings. r.on_branch is an optimized version of r.on and r.is_exactly is optimized version of r.is: plugin :optimized_string_matchers route do |r| r.on_branch "x" do # matches /x and paths starting with /x/ r.is_exactly "y" do # matches /x/y end end end Both of these methods will work even if the strings have placeholders, but no captures will be yielded to the blocks. * The error_handler plugin now has access to the request's remaining_path when handling an error. You can then compare the remaining_path to path_info to see how much of request was already routed, which can be useful when reporting errors. = Other Improvements * String matching for strings without placeholders is now 60% faster as it uses optimized string operations instead of a regexp match. * Symbol matching is now 60% faster as it uses optimized string operations instead of a regexp match. = Backwards Compatibility * The match methods no longer automatically reset the remaining_path via ensure. This means that using non-local jumps out of the code such as begin/rescue and throw/catch will not reset remaining_path automatically. Users that want to reset remaining path in such cases should use their own ensure blocks. jeremyevans-roda-4f30bb3/doc/release_notes/2.13.0.txt 0000664 0000000 0000000 00000001003 15167207754 0022261 0 ustar 00root root 0000000 0000000 = New Features * The render plugin now supports :check_paths and :allowed_paths options. Setting :check_paths to true will turn on path checking of template files. By default, template files are required to be in the :views directory, otherwise an exception will be raised. Using the :check_paths option can prevent security issues when template names are derived from user input. The :allowed_paths option overrides which path prefixes are allowed. In Roda 3, :check_paths will default to true. jeremyevans-roda-4f30bb3/doc/release_notes/2.14.0.txt 0000664 0000000 0000000 00000002511 15167207754 0022267 0 ustar 00root root 0000000 0000000 = New Features * A symbol_status plugin has been added for using symbolic status names in response.status=: class App < Roda plugin :symbol_status route do |r| r.is "needs_authorization" response.status = :unauthorized end end = Other Improvements * The middleware plugin will now also run the application's middleware when the application is used as middleware. For example, if you have the following code in your config.ru file: class App < Roda plugin :csrf plugin :middleware route{} end use App previously, the csrf protection would not be enforced, as it uses a middleware instead of being part of the application. Now, csrf protection will be enforced. This change makes it so the Roda application operates the same way regardless of whether it is run as the rack application or used as rack middleware. Because of this change, if you are nesting roda applications using the middleware plugin, you may need to use the middleware plugin's :env_var option to specify the environment variable used to indicate to the Roda application that it is being run as middleware. = Backwards Compatibility * See above changes to the middleware plugin if you are using middleware inside a Roda application that uses the middleware plugin. jeremyevans-roda-4f30bb3/doc/release_notes/2.15.0.txt 0000664 0000000 0000000 00000003277 15167207754 0022302 0 ustar 00root root 0000000 0000000 = New Features * A public plugin has been added. This adds an r.public method for serving all files in the public directory. The public plugin can replace usage of the static plugin, and is more flexible. You can place r.public at any point in the routing tree, and it will use the remaining path to lookup the file in the public directory. You can also pass the :gzip option when loading the plugin, and it will serve already gzipped files to the client if the client supports gzipped transfer encoding and the file exists with a .gz extension. Example: plugin :public route do |r| # Serve public files before routing r.public # ... end * The :header matcher added by the header_matchers plugin now automatically prefixes the key with HTTP_ when looking it up in the environment, if the :header_matcher_prefix application option is set. This behavior will probably be the default in Roda 3. # Before r.on :header => 'http_accept' # Now, with :header_matcher_prefix=>true application option r.on :header => 'accept' * The content_for plugin now accepts an :append=>true option to support appending to the existing content instead of overwriting the existing content if called multiple times. This behavior will probably be the default in Roda 3. # Before content_for(:form, 'a') content_for(:form, 'b') content_for(:form) # => 'b' # Now, with :append=>true option content_for(:form, 'a') content_for(:form, 'b') content_for(:form) # => 'ab' = Other Improvements * The r.send_file method in the sinatra_helpers plugin now works correctly when using rack 2. * The specs now run correctly on Windows. jeremyevans-roda-4f30bb3/doc/release_notes/2.16.0.txt 0000664 0000000 0000000 00000002775 15167207754 0022305 0 ustar 00root root 0000000 0000000 = New Features * A type_routing plugin has been added. This plugin allows routing based on the requested type, which can be submitted either via a file extension or Accept header: plugin :type_routing route do |r| r.get 'a' do r.html{ "<%= text %>
<% end %> If can also be used to reduce memory usage even in the case where you are not wrapping template output. Instead of: <%= render_each([1,2,3], :foo) %> You can do: <% render_each([1,2,3], :foo) %><%= body %><% end %> This will avoid building a potentially large unnecessary intermediate string. * The capture_erb plugin now supports a returns: :buffer method and plugin option. When this option is provided, the capture_erb method returns the buffer instead of the return value of the block passed to it. This better handles cases where the template ends in a conditional: <% value = capture_erb do %> Some content here. <% if something %> Some more content here. <% end %> <% end %> jeremyevans-roda-4f30bb3/doc/release_notes/3.92.0.txt 0000664 0000000 0000000 00000001160 15167207754 0022275 0 ustar 00root root 0000000 0000000 = New Features * An each_part plugin has been added, offering a simpler method for using render_each with locals: # With render_each: render_each(array_of_foos, :foo, locals: {bar: 1}) # With each_part: each_part(array_of_foos, :foo, bar: 1) The each_part provides similar benefits to the render_each plugin that the part plugin provides to the render plugin. The each_part method has been optimized to work with the render plugin's :assume_fixed_locals option. = Other Improvements * The render_each plugin has been optimized to work with the render plugin's :assume_fixed_locals option. jeremyevans-roda-4f30bb3/doc/release_notes/3.93.0.txt 0000664 0000000 0000000 00000003426 15167207754 0022305 0 ustar 00root root 0000000 0000000 = New Features * The typecast_params plugin handle_type method now supports an :invalid_value_message option, for a custom error message for the type, explaining why the input is invalid. This error message is used when there is a parameter given, but it cannot be converted to the desired type: plugin :typecast_params do handle_type(:single_char, invalid_value_message: \ "value not a single character") do |v| v if v.is_a?(String) && v.length == 1 end end Previously, the error message in this case was the same as when no parameter was provided, which was misleading. The types natively supported by the typecast_params and typecast_params_sized_integers plugins now use :invalid_value_message for better error reporting. You can override the invalid value messages for these types using the invalid_value_message method: plugin :typecast_params do invalid_value_message(:pos_int, "value must be greater than 0 for parameter") end = Other Improvements * Many minor performance improvements, mostly from rubocop-performance: * flat_map instead of map.flatten(1) * tr/delete instead of gsub * symbol instead of string argument to method_defined? * hoist literal arrays outside blocks * end_with?/include? instead of =~ = Backwards Compatibility * The fourth parameter in the process and process_arg private methods in the typecast_params plugin has changed from being the max input bytesize of the type, to the type symbol, and is now a required parameter. External callers of these private methods will need to be updated. * Code rescuing Roda::RodaPlugins::TypecastParams::Error and handling the reason may need to adjust to handling :invalid_value in cases where it was handling :missing. jeremyevans-roda-4f30bb3/doc/release_notes/3.94.0.txt 0000664 0000000 0000000 00000001412 15167207754 0022277 0 ustar 00root root 0000000 0000000 = New Features * A view_subdir_leading_slash plugin has been added, for using the current view subdirectory for all templates that do not start with a slash. The default behavior when using view subdirectories remains to use the current view subdirectory unless the template name includes a slash. This makes it easier to use nested view subdirectories, at the expense of making it slightly more difficult to use templates outside the current view subdirectory. = Other Improvements * The render_each and each_part plugin template selection code is now more optimized when the application is frozen and using the :assume_fixed_locals render plugin option. * The render_each and each_part plugin default local generation is now more optimized on Ruby 3+. jeremyevans-roda-4f30bb3/doc/release_notes/3.95.0.txt 0000664 0000000 0000000 00000003345 15167207754 0022307 0 ustar 00root root 0000000 0000000 = New Features * A response_content_type plugin has been added for more easily setting the content type of responses: When setting the content-type, you can pass either a string, which is used directly: response.content_type = "text/html" Or, if you have registered mime types when loading the plugin: plugin :response_content_type, mime_types: { plain: "text/plain", html: "text/html", pdf: "application/pdf" } You can use a symbol: response.content_type = :html If you would like to load all mime types supported by rack/mime, you can use the mime_types: :from_rack_mime option: plugin :response_content_type, mime_types: :from_rack_mime Note that you are unlikely to be using all of these mime types, so doing this will likely result in unnecessary memory usage. It is recommended to use a hash with only the mime types your application actually uses. To prevent silent failures, if you attempt to set the response type with a symbol, and the symbol is not recognized, a KeyError is raised. * The typecast_params plugin now includes typecast_query_params and typecast_body_params methods in addition to typecast_params. typecast_query_params deals with query string parameters (r.GET), and typecast_body_params deals with request body parameters (r.POST). = Other Improvements * The sessions plugin now raises Roda::RodaPlugins::Sessions::CookieTooLarge if the total cookie size is over 4K. Previously, it only raised the exception if the cookie value was over 4K. Browsers enforce the limit on the total cookie size, not just the value, so this change prevents Roda from setting a cookie that a browser would ignore due to size restrictions. jeremyevans-roda-4f30bb3/doc/release_notes/3.96.0.txt 0000664 0000000 0000000 00000000727 15167207754 0022311 0 ustar 00root root 0000000 0000000 = New Features * A redirect_path plugin has been added, which integrates the path plugin with r.redirect: Foo = Struct.new(:id) foo = Foo.new(1) plugin :redirect_path path Foo do |foo| "/foo/#{foo.id}" end route do |r| r.get "example" do # redirects to /foo/1 r.redirect(foo) end r.get "suffix-example" do # redirects to /foo/1/status r.redirect(foo, "/status") end end jeremyevans-roda-4f30bb3/doc/release_notes/3.97.0.txt 0000664 0000000 0000000 00000002120 15167207754 0022277 0 ustar 00root root 0000000 0000000 = New Features * A map_matcher plugin has been added, for matching the next segment in the request path to a hash key, yielding the hash value. This allows for a better approach for metaprogramming routes. When dealing with many similar routes, it is common to use a hash keyed by route segment, and then match against an array of the keys: map = { 'album' => Album, 'artist' => Artist, # ... }.freeze keys = map.keys.freeze route do |r| r.on "type", keys do |key| value = map[key] # ... end end For large maps, this approach is suboptimal, since the array matcher will iterate over each element in the array, checking whether it matches. The map_matcher plugin allows for: plugin :map_matcher route do |r| r.on "type", map: map do |value| # ... end end This gets the next route segment and checks whether it is a key in the map, instead of iterating over an array of hash keys, so it is more efficient for large maps. It also results in simpler code. jeremyevans-roda-4f30bb3/doc/release_notes/3.98.0.txt 0000664 0000000 0000000 00000001260 15167207754 0022304 0 ustar 00root root 0000000 0000000 = New Features * The sessions plugin now supports an :env_key option, which allows the use of a non-default env key. This allows you to maintain the session for the Roda application separately from the default Rack session. This can be useful in all of the following cases when you want to have the Roda application use a separate session from other applications or middleware: * Using middleware in the Roda application. * Using the Roda application as middleware in another Rack application. * Using r.run in the Roda application to call another Rack application. * Calling the Roda application from another Rack application using the same env hash. jeremyevans-roda-4f30bb3/doc/release_notes/3.99.0.txt 0000664 0000000 0000000 00000000641 15167207754 0022307 0 ustar 00root root 0000000 0000000 = New Features * Set instances are now supported as matchers by default, as Set will be a core class in Ruby 4.0. A Set matcher operates similarly to an array matcher if all of the array elements are strings, with the difference that the Set matcher will perform better for large numbers of elements, since it will look for a matching entry in the set, instead of iterating over the elements of the set. jeremyevans-roda-4f30bb3/lib/ 0000775 0000000 0000000 00000000000 15167207754 0016156 5 ustar 00root root 0000000 0000000 jeremyevans-roda-4f30bb3/lib/roda.rb 0000664 0000000 0000000 00000054712 15167207754 0017441 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true require "thread" require_relative "roda/request" require_relative "roda/response" require_relative "roda/plugins" require_relative "roda/cache" require_relative "roda/version" # The main class for Roda. Roda is built completely out of plugins, with the # default plugin being Roda::RodaPlugins::Base, so this class is mostly empty # except for some constants. class Roda # Error class raised by Roda class RodaError < StandardError; end @app = nil @inherit_middleware = true @middleware = [] @opts = {} @raw_route_block = nil @route_block = nil @rack_app_route_block = nil module RodaPlugins # The base plugin for Roda, implementing all default functionality. # Methods are put into a plugin so future plugins can easily override # them and call super to get the default behavior. module Base # Class methods for the Roda class. module ClassMethods # The rack application that this class uses. def app @app || build_rack_app end # Whether middleware from the current class should be inherited by subclasses. # True by default, should be set to false when using a design where the parent # class accepts requests and uses run to dispatch the request to a subclass. attr_accessor :inherit_middleware # The settings/options hash for the current class. attr_reader :opts # The route block that this class uses. attr_reader :route_block # Call the internal rack application with the given environment. # This allows the class itself to be used as a rack application. # However, for performance, it's better to use #app to get direct # access to the underlying rack app. def call(env) app.call(env) end # Clear the middleware stack def clear_middleware! @middleware.clear @app = nil end # Define an instance method using the block with the provided name and # expected arity. If the name is given as a Symbol, it is used directly. # If the name is given as a String, a unique name will be generated using # that string. The expected arity should be either 0 (no arguments), # 1 (single argument), or :any (any number of arguments). # # If the :check_arity app option is not set to false, Roda will check that # the arity of the block matches the expected arity, and compensate for # cases where it does not. If it is set to :warn, Roda will warn in the # cases where the arity does not match what is expected. # # If the expected arity is :any, Roda must perform a dynamic arity check # when the method is called, which can hurt performance even in the case # where the arity matches. The :check_dynamic_arity app option can be # set to false to turn off the dynamic arity checks. The # :check_dynamic_arity app option can be to :warn to warn if Roda needs # to adjust arity dynamically. # # Roda only checks arity for regular blocks, not lambda blocks, as the # fixes Roda uses for regular blocks would not work for lambda blocks. # # Roda does not support blocks with required keyword arguments if the # expected arity is 0 or 1. def define_roda_method(meth, expected_arity, &block) if meth.is_a?(String) meth = roda_method_name(meth) end call_meth = meth # RODA4: Switch to false # :warn in last Roda 3 version if (check_arity = opts.fetch(:check_arity, true)) && !block.lambda? required_args, optional_args, rest, keyword = _define_roda_method_arg_numbers(block) if keyword == :required && (expected_arity == 0 || expected_arity == 1) raise RodaError, "cannot use block with required keyword arguments when calling define_roda_method with expected arity #{expected_arity}" end case expected_arity when 0 unless required_args == 0 if check_arity == :warn RodaPlugins.warn "Arity mismatch in block passed to define_roda_method. Expected Arity 0, but arguments required for #{block.inspect}" end b = block block = lambda{instance_exec(&b)} # Fallback end when 1 if required_args == 0 && optional_args == 0 && !rest if check_arity == :warn RodaPlugins.warn "Arity mismatch in block passed to define_roda_method. Expected Arity 1, but no arguments accepted for #{block.inspect}" end temp_method = roda_method_name("temp") class_eval("def #{temp_method}(_) #{meth =~ /\A\w+\z/ ? "#{meth}_arity" : "send(:\"#{meth}_arity\")"} end", __FILE__, __LINE__) alias_method meth, temp_method undef_method temp_method private meth alias_method meth, meth meth = :"#{meth}_arity" elsif required_args > 1 if check_arity == :warn RodaPlugins.warn "Arity mismatch in block passed to define_roda_method. Expected Arity 1, but multiple arguments required for #{block.inspect}" end b = block block = lambda{|r| instance_exec(r, &b)} # Fallback end when :any if check_dynamic_arity = opts.fetch(:check_dynamic_arity, check_arity) if keyword # Complexity of handling keyword arguments using define_method is too high, # Fallback to instance_exec in this case. b = block block = if RUBY_VERSION >= '2.7' eval('lambda{|*a, **kw| instance_exec(*a, **kw, &b)}', nil, __FILE__, __LINE__) # Keyword arguments fallback else # :nocov: lambda{|*a| instance_exec(*a, &b)} # Keyword arguments fallback # :nocov: end else arity_meth = meth meth = :"#{meth}_arity" end end else raise RodaError, "unexpected arity passed to define_roda_method: #{expected_arity.inspect}" end end define_method(meth, &block) private meth alias_method meth, meth if arity_meth required_args, optional_args, rest, keyword = _define_roda_method_arg_numbers(instance_method(meth)) max_args = required_args + optional_args define_method(arity_meth) do |*a| arity = a.length if arity > required_args if arity > max_args && !rest if check_dynamic_arity == :warn RodaPlugins.warn "Dynamic arity mismatch in block passed to define_roda_method. At most #{max_args} arguments accepted, but #{arity} arguments given for #{block.inspect}" end a = a.slice(0, max_args) end elsif arity < required_args if check_dynamic_arity == :warn RodaPlugins.warn "Dynamic arity mismatch in block passed to define_roda_method. #{required_args} args required, but #{arity} arguments given for #{block.inspect}" end a.concat([nil] * (required_args - arity)) end send(meth, *a) end private arity_meth alias_method arity_meth, arity_meth end call_meth end # Expand the given path, using the root argument as the base directory. def expand_path(path, root=opts[:root]) ::File.expand_path(path, root) end # Freeze the internal state of the class, to avoid thread safety issues at runtime. # It's optional to call this method, as nothing should be modifying the # internal state at runtime anyway, but this makes sure an exception will # be raised if you try to modify the internal state after calling this. # # Note that freezing the class prevents you from subclassing it, mostly because # it would cause some plugins to break. def freeze return self if frozen? unless opts[:subclassed] # If the _roda_run_main_route instance method has not been overridden, # make it an alias to _roda_main_route for performance if instance_method(:_roda_run_main_route).owner == InstanceMethods class_eval("alias _roda_run_main_route _roda_main_route") end self::RodaResponse.class_eval do if instance_method(:set_default_headers).owner == ResponseMethods && instance_method(:default_headers).owner == ResponseMethods private alias set_default_headers set_default_headers def set_default_headers @headers[RodaResponseHeaders::CONTENT_TYPE] ||= 'text/html' end end end if @middleware.empty? && use_new_dispatch_api? plugin :direct_call end if ([:on, :is, :_verb, :_match_class_String, :_match_class_Integer, :_match_string, :_match_regexp, :empty_path?, :if_match, :match, :_match_class]).all?{|m| self::RodaRequest.instance_method(m).owner == RequestMethods} plugin :_optimized_matching end end build_rack_app @opts.freeze @middleware.freeze super end # Rebuild the _roda_before and _roda_after methods whenever a plugin might # have added a _roda_before_* or _roda_after_* method. def include(*a) res = super def_roda_before def_roda_after res end # When inheriting Roda, copy the shared data into the subclass, # and setup the request and response subclasses. def inherited(subclass) raise RodaError, "Cannot subclass a frozen Roda class" if frozen? # Mark current class as having been subclassed, as some optimizations # depend on the class not being subclassed opts[:subclassed] = true super subclass.instance_variable_set(:@inherit_middleware, @inherit_middleware) subclass.instance_variable_set(:@middleware, @inherit_middleware ? @middleware.dup : []) subclass.instance_variable_set(:@opts, opts.dup) subclass.opts.delete(:subclassed) subclass.opts.to_a.each do |k,v| if (v.is_a?(Array) || v.is_a?(Hash)) && !v.frozen? subclass.opts[k] = v.dup end end if block = @raw_route_block subclass.route(&block) end request_class = Class.new(self::RodaRequest) request_class.roda_class = subclass request_class.match_pattern_cache = RodaCache.new subclass.const_set(:RodaRequest, request_class) response_class = Class.new(self::RodaResponse) response_class.roda_class = subclass subclass.const_set(:RodaResponse, response_class) end # Load a new plugin into the current class. A plugin can be a module # which is used directly, or a symbol representing a registered plugin # which will be required and then used. Returns nil. # # Note that you should not load plugins into a Roda class after the # class has been subclassed, as doing so can break the subclasses. # # Roda.plugin PluginModule # Roda.plugin :csrf def plugin(plugin, *args, &block) raise RodaError, "Cannot add a plugin to a frozen Roda class" if frozen? plugin = RodaPlugins.load_plugin(plugin) if plugin.is_a?(Symbol) raise RodaError, "Invalid plugin type: #{plugin.class.inspect}" unless plugin.is_a?(Module) if !plugin.respond_to?(:load_dependencies) && !plugin.respond_to?(:configure) && (!args.empty? || block) # RODA4: switch from warning to error RodaPlugins.warn("Plugin #{plugin} does not accept arguments or a block, but arguments or a block was passed when loading this. This will raise an error in Roda 4.") end plugin.load_dependencies(self, *args, &block) if plugin.respond_to?(:load_dependencies) include(plugin::InstanceMethods) if defined?(plugin::InstanceMethods) extend(plugin::ClassMethods) if defined?(plugin::ClassMethods) self::RodaRequest.send(:include, plugin::RequestMethods) if defined?(plugin::RequestMethods) self::RodaRequest.extend(plugin::RequestClassMethods) if defined?(plugin::RequestClassMethods) self::RodaResponse.send(:include, plugin::ResponseMethods) if defined?(plugin::ResponseMethods) self::RodaResponse.extend(plugin::ResponseClassMethods) if defined?(plugin::ResponseClassMethods) plugin.configure(self, *args, &block) if plugin.respond_to?(:configure) @app = nil end # :nocov: ruby2_keywords(:plugin) if respond_to?(:ruby2_keywords, true) # :nocov: # Setup routing tree for the current Roda application, and build the # underlying rack application using the stored middleware. Requires # a block, which is yielded the request. By convention, the block # argument should be named +r+. Example: # # Roda.route do |r| # r.root do # "Root" # end # end # # This should only be called once per class, and if called multiple # times will overwrite the previous routing. def route(&block) unless block RodaPlugins.warn "no block passed to Roda.route" return end @raw_route_block = block @route_block = block = convert_route_block(block) @rack_app_route_block = block = rack_app_route_block(block) public define_roda_method(:_roda_main_route, 1, &block) @app = nil end # Add a middleware to use for the rack application. Must be # called before calling #route to have an effect. Example: # # Roda.use Rack::ShowExceptions def use(*args, &block) @middleware << [args, block].freeze @app = nil end # :nocov: ruby2_keywords(:use) if respond_to?(:ruby2_keywords, true) # :nocov: private # Return the number of required argument, optional arguments, # whether the callable accepts any additional arguments, # and whether the callable accepts keyword arguments (true, false # or :required). def _define_roda_method_arg_numbers(callable) optional_args = 0 rest = false keyword = false callable.parameters.map(&:first).each do |arg_type, _| case arg_type when :opt optional_args += 1 when :rest rest = true when :keyreq keyword = :required when :key, :keyrest keyword ||= true end end arity = callable.arity if arity < 0 arity = arity.abs - 1 end required_args = arity arity -= 1 if keyword == :required if callable.is_a?(Proc) && !callable.lambda? optional_args -= arity end [required_args, optional_args, rest, keyword] end # The base rack app to use, before middleware is added. def base_rack_app_callable(new_api=true) if new_api lambda{|env| new(env)._roda_handle_main_route} else block = @rack_app_route_block lambda{|env| new(env).call(&block)} end end # Build the rack app to use def build_rack_app app = base_rack_app_callable(use_new_dispatch_api?) @middleware.reverse_each do |args, bl| mid, *args = args app = mid.new(app, *args, &bl) app.freeze if opts[:freeze_middleware] end @app = app end # Modify the route block to use for any route block provided as input, # which can include route blocks that are delegated to by the main route block. # Can be modified by plugins. def convert_route_block(block) block end # Build a _roda_before method that calls each _roda_before_* method # in order, if any _roda_before_* methods are defined. Also, rebuild # the route block if a _roda_before method is defined. def def_roda_before meths = private_instance_methods.grep(/\A_roda_before_\d\d/).sort unless meths.empty? plugin :_before_hook unless private_method_defined?(:_roda_before) if meths.length == 1 class_eval("alias _roda_before #{meths.first}", __FILE__, __LINE__) else class_eval("def _roda_before; #{meths.join(';')} end", __FILE__, __LINE__) end private :_roda_before alias_method :_roda_before, :_roda_before end end # Build a _roda_after method that calls each _roda_after_* method # in order, if any _roda_after_* methods are defined. Also, use # the internal after hook plugin if the _roda_after method is defined. def def_roda_after meths = private_instance_methods.grep(/\A_roda_after_\d\d/).sort unless meths.empty? plugin :error_handler unless private_method_defined?(:_roda_after) if meths.length == 1 class_eval("alias _roda_after #{meths.first}", __FILE__, __LINE__) else class_eval("def _roda_after(res); #{meths.map{|s| "#{s}(res)"}.join(';')} end", __FILE__, __LINE__) end private :_roda_after alias_method :_roda_after, :_roda_after end end # The route block to use when building the rack app (or other initial # entry point to the route block). # By default, modifies the rack app route block to support before hooks # if any before hooks are defined. # Can be modified by plugins. def rack_app_route_block(block) block end # Whether the new dispatch API should be used. def use_new_dispatch_api? # RODA4: remove this method ancestors.each do |mod| break if mod == InstanceMethods meths = mod.instance_methods(false) if meths.include?(:call) && !(meths.include?(:_roda_handle_main_route) || meths.include?(:_roda_run_main_route)) RodaPlugins.warn <| Variable | Value | #{h key} | #{h val.inspect} |
END2
}
|---|
| Ruby |
#{(first = frames.first) ? "#{h first[:filename]}: in #{h first[:function]}, line #{first[:lineno]}" : "unknown location"}
|
|---|---|
| Web | #{r.request_method} #{h r.host}#{h r.path} |
#{h frame[:filename]}:#{frame[:lineno]} in #{h frame[:function]}
#{frame[:context_line] ? (<You're seeing this error because you use the Roda exception_page plugin.
Hello <%= @user %>!
" # end # # route do |r| # @user = 'You' # render(:index) # end # # => "Hello You!
" # # You can provide options for the template, for example to change the # engine that the template uses: # # template :index, engine: :str do # "Hello #{@user}!
" # end # # The block you use is reevaluted on every call, allowing you to easily # include additional setup logic: # # template :index do # greeting = ['hello', 'hi', 'howdy'].sample # @user.downcase! # "#{greating} <%= @user %>!
" # end # # This plugin also works with the view_options plugin, as long as you # prefix the template name with the view subdirectory: # # template "main/index" do # "<%= yield %>" # end # # route do |r| # set_view_subdir("main") # @user = 'You' # render(:index) # end module NamedTemplates # Depend on the render plugin def self.load_dependencies(app) app.plugin :render end # Initialize the storage for named templates. def self.configure(app) app.opts[:named_templates] ||= {} end module ClassMethods # Freeze the named templates so that there can be no thread safety issues at runtime. def freeze opts[:named_templates].freeze super end # Store a new template block and options for the given template name. def template(name, options=nil, &block) opts[:named_templates][name.to_s] = [options, define_roda_method("named_templates_#{name}", 0, &block)].freeze nil end end module InstanceMethods private # If a template name is given and it matches a named template, call # the named template block to get the inline template to use. def find_template(options) if options[:template] && (template_opts, meth = opts[:named_templates][template_name(options)]; meth) if template_opts options = template_opts.merge(options) else options = Hash[options] end options[:inline] = send(meth) super(options) else super end end end end register_plugin(:named_templates, NamedTemplates) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/not_allowed.rb 0000664 0000000 0000000 00000010501 15167207754 0023415 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The not_allowed plugin makes Roda attempt to automatically # support the 405 Method Not Allowed response status. The plugin # changes the +r.get+ and +r.post+ verb methods to automatically # return a 405 status if they are called with any arguments, and # the arguments match but the request method does not match. So # this code: # # r.get '' do # "a" # end # # will return a 200 response for GET / and a 405 # response for POST /. # # This plugin changes the +r.root+ method to return a 405 status # for non-GET requests to +/+. # # This plugin also changes the +r.is+ method so that if you use # a verb method inside +r.is+, it returns a 405 status if none # of the verb methods match. So this code: # # r.is '' do # r.get do # "a" # end # # r.post do # "b" # end # end # # will return a 200 response for GET / and POST /, # but a 405 response for PUT /. # # Note that this plugin will probably not do what you want for # code such as: # # r.get '' do # "a" # end # # r.post '' do # "b" # end # # Since for a POST / request, when +r.get+ method matches # the path but not the request method, it will return an immediate # 405 response. You must DRY up this code for it work correctly, # like this: # # r.is '' do # r.get do # "a" # end # # r.post do # "b" # end # end # # In all cases where it uses a 405 response, it also sets the +Allow+ # header in the response to contain the request methods supported. # # This plugin depends on the all_verbs plugin. module NotAllowed # Depend on the all_verbs plugin, as this plugin overrides methods # defined by it and calls super. def self.load_dependencies(app) app.plugin :all_verbs end module RequestMethods # Keep track of verb calls inside the block. If there are any # verb calls inside the block, but the block returned, assume # that the verb calls inside the block did not match, and # since there was already a successful terminal match, the # request method must not be allowed, so return a 405 # response in that case. def is(*args) super(*args) do begin is_verbs = @_is_verbs = [] ret = if args.empty? yield else yield(*captures) end unless is_verbs.empty? method_not_allowed(is_verbs.join(', ')) end ret ensure @_is_verbs = nil end end end # Treat +r.root+ similar to r.get '', using a 405 # response for non-GET requests. def root super if @remaining_path == "/" && !is_get? always{method_not_allowed("GET")} end end # Setup methods for all verbs. If inside an is block and not given # arguments, record the verb used. If given an argument, add an is # check with the arguments. %w'get post delete head options link patch put trace unlink'.each do |verb| if ::Rack::Request.method_defined?("#{verb}?") class_eval(<<-END, __FILE__, __LINE__+1) def #{verb}(*args, &block) if (empty = args.empty?) && @_is_verbs @_is_verbs << "#{verb.to_s.upcase}" end super unless empty is(*args){method_not_allowed("#{verb.to_s.upcase}")} end end END end end private # Set the response status to 405 (Method Not Allowed), and set the Allow header # to the given string of allowed request methods. def method_not_allowed(verbs) res = response res.status = 405 res[RodaResponseHeaders::ALLOW] = verbs nil end end end register_plugin(:not_allowed, NotAllowed) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/not_found.rb 0000664 0000000 0000000 00000003031 15167207754 0023101 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The not_found plugin adds a +not_found+ class method which sets # a block that is called whenever a 404 response with an empty body # would be returned. The usual use case for this is the desire for # nice error pages if the page is not found. # # You can provide the block with the plugin call: # # plugin :not_found do # "Where did it go?" # end # # Or later via a separate call to +not_found+: # # plugin :not_found # # not_found do # "Where did it go?" # end # # Before not_found is called, any existing headers on the response # will be cleared. So if you want to be sure the headers are set # even in a not_found block, you need to reset them in the # not_found block. # # This plugin is now a wrapper around the +status_handler+ plugin and # still exists mainly for backward compatibility. module NotFound # Require the status_handler plugin def self.load_dependencies(app, &_) app.plugin :status_handler end # If a block is given, install the block as the not_found handler. def self.configure(app, &block) if block app.not_found(&block) end end module ClassMethods # Install the given block as the not_found handler. def not_found(&block) status_handler(404, &block) end end end register_plugin(:not_found, NotFound) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/optimized_segment_matchers.rb 0000664 0000000 0000000 00000003420 15167207754 0026524 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The optimized_segment_matchers plugin adds two optimized matcher methods, # +r.on_segment+ and +r.is_segment+. +r.on_segment+ is an optimized version of # +r.on String+ that accepts no arguments and yields the next segment if there # is a segment. +r.is_segment+ is an optimized version of +r.is String+ that accepts # no arguments and yields the next segment only if it is the last segment. # # plugin :optimized_segment_matchers # # route do |r| # r.on_segment do |x| # # matches any segment (e.g. /a, /b, but not /) # r.is_segment do |y| # # matches only if final segment (e.g. /a/b, /b/c, but not /c, /c/d/, /c/d/e) # end # end # end module OptimizedSegmentMatchers module RequestMethods # Optimized version of +r.on String+ that yields the next segment if there # is a segment. def on_segment rp = @remaining_path if rp.getbyte(0) == 47 if last = rp.index('/', 1) @remaining_path = rp[last, rp.length] always{yield rp[1, last-1]} elsif (len = rp.length) > 1 @remaining_path = "" always{yield rp[1, len]} end end end # Optimized version of +r.is String+ that yields the next segment only if it # is the final segment. def is_segment rp = @remaining_path if rp.getbyte(0) == 47 && !rp.index('/', 1) && (len = rp.length) > 1 @remaining_path = "" always{yield rp[1, len]} end end end end register_plugin(:optimized_segment_matchers, OptimizedSegmentMatchers) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/optimized_string_matchers.rb 0000664 0000000 0000000 00000003051 15167207754 0026370 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The optimized_string_matchers plugin adds two optimized matcher methods, # +r.on_branch+ and +r.is_exactly+. +r.on_branch+ is an optimized version of # +r.on+ that only accepts a single string, and +r.is_exactly+ is an # optimized version of +r.is+ that only accepts a single string. # # plugin :optimized_string_matchers # # route do |r| # r.on_branch "x" do # # matches /x and paths starting with /x/ # r.is_exactly "y" do # # matches /x/y # end # end # end # # If you are using the placeholder_string_matchers plugin, note # that both of these methods only work with plain strings, not # with strings with embedded colons for capturing. Matching will work # correctly in such cases, but the captures will not be yielded to the # match blocks. module OptimizedStringMatchers module RequestMethods # Optimized version of +on+ that only supports a single string. def on_branch(s) always{yield} if _match_string(s) end # Optimized version of +is+ that only supports a single string. def is_exactly(s) rp = @remaining_path if _match_string(s) if @remaining_path.empty? always{yield} else @remaining_path = rp end end end end end register_plugin(:optimized_string_matchers, OptimizedStringMatchers) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/padrino_render.rb 0000664 0000000 0000000 00000002457 15167207754 0024114 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The padrino_render plugin adds rendering support that is # similar to Padrino's. While not everything Padrino's # rendering supports is supported by this plugin, it # currently handles enough to be a drop in replacement for # some applications. # # plugin :padrino_render, views: 'path/2/views' # # Most notably, this makes the +render+ method default to # using the layout, similar to how the +view+ method works # in the render plugin. If you want to call render and not # use a layout, you can use the layout: false # option: # # render('test') # layout # render('test', layout: false) # no layout # # Note that this plugin loads the :partials plugin. module PadrinoRender # Depend on the render plugin, since this overrides # some of its methods. def self.load_dependencies(app, opts=OPTS) app.plugin :partials, opts end module InstanceMethods # Call view with the given arguments, so that render # uses a layout by default. def render(template, opts=OPTS) view(template, opts) end end end register_plugin(:padrino_render, PadrinoRender) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/param_matchers.rb 0000664 0000000 0000000 00000004733 15167207754 0024106 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The param_matchers plugin adds hash matchers that operate # on the request's params. # # It adds a :param matcher for matching on any param with the # same name, yielding the value of the param: # # r.on param: 'foo' do |foo| # # Matches '?foo=bar', '?foo=' # # Doesn't match '?bar=foo' # end # # It adds a :param! matcher for matching on any non-empty param # with the same name, yielding the value of the param: # # r.on(param!: 'foo') do |foo| # # Matches '?foo=bar' # # Doesn't match '?foo=', '?bar=foo' # end # # It also adds :params and :params! matchers, for matching multiple # params at the same time: # # r.on params: ['foo', 'baz'] do |foo, baz| # # Matches '?foo=bar&baz=quuz', '?foo=&baz=' # # Doesn't match '?foo=bar', '?baz=' # end # # r.on params!: ['foo', 'baz'] do |foo, baz| # # Matches '?foo=bar&baz=quuz' # # Doesn't match '?foo=bar', '?baz=', '?foo=&baz=', '?foo=bar&baz=' # end # # Because users have some control over the types of submitted parameters, # it is recommended that you explicitly force the correct type for values # yielded by the block: # # r.get(:param=>'foo') do |foo| # foo = foo.to_s # end module ParamMatchers module RequestMethods # Match the given parameter if present, even if the parameter is empty. # Adds match to the captures. def match_param(key) if v = params[key.to_s] @captures << v end end # Match the given parameter if present and not empty. # Adds match to the captures. def match_param!(key) if (v = params[key.to_s]) && !v.empty? @captures << v end end # Match all given parameters if present, even if any/all parameters is empty. # Adds all matches to the captures. def match_params(keys) keys.each do |key| return false unless match_param(key) end end # Match all given parameters if present and not empty. # Adds all matches to the captures. def match_params!(keys) keys.each do |key| return false unless match_param!(key) end end end end register_plugin(:param_matchers, ParamMatchers) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/params_capturing.rb 0000664 0000000 0000000 00000006747 15167207754 0024466 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The params_capturing plugin makes symbol matchers # update the request params with the value of the captured segments, # using the matcher as the key: # # plugin :params_capturing # # route do |r| # # GET /foo/123/abc/67 # r.on("foo", :bar, :baz, :quux) do # r.params['bar'] #=> '123' # r.params['baz'] #=> 'abc' # r.params['quux'] #=> '67' # end # end # # Note that this updating of the request params using the matcher as # the key is only done if all arguments to the matcher are symbols # or strings. # # All matchers will update the request params by adding all # captured segments to the +captures+ key: # # r.on(:x, /(\d+)\/(\w+)/, :y) do # r.params['x'] #=> nil # r.params['y'] #=> nil # r.params['captures'] #=> ["foo", "123", "abc", "67"] # end # # Note that the request params +captures+ entry will be appended to with # each nested match: # # r.on(:w) do # r.on(:x) do # r.on(:y) do # r.on(:z) do # r.params['captures'] # => ["foo", "123", "abc", "67"] # end # end # end # end # # Note that any existing params captures entry will be overwritten # by this plugin. You can use +r.GET+ or +r.POST+ to get the underlying # entry, depending on how it was submitted. # # This plugin will also handle string matchers with placeholders if # the placeholder_string_matchers plugin is loaded before this plugin. # # Also note that this plugin will not work correctly if you are using # the symbol_matchers plugin with custom symbol matching and are using # symbols that capture multiple values or no values. module ParamsCapturing module RequestMethods # Lazily initialize captures entry when params is called. def params ret = super ret['captures'] ||= [] ret end private # Add the capture names from this string to list of param # capture names if param capturing. def _match_string(str) cap_len = @captures.length if (ret = super) && (pc = @_params_captures) && (cap_len != @captures.length) # Handle use with placeholder_string_matchers plugin pc.concat(str.scan(/(?<=:)\w+/)) end ret end # Add the symbol to the list of param capture names if param capturing. def _match_symbol(sym) if pc = @_params_captures pc << sym.to_s end super end # If all arguments are strings or symbols, turn on param capturing during # the matching, but turn it back off before yielding to the block. Add # any captures to the params based on the param capture names added by # the matchers. def if_match(args) params = self.params if args.all?{|x| x.is_a?(String) || x.is_a?(Symbol)} pc = @_params_captures = [] end super do |*a| if pc @_params_captures = nil pc.zip(a).each do |k,v| params[k] = v end end params['captures'].concat(a) yield(*a) end end end end register_plugin(:params_capturing, ParamsCapturing) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/part.rb 0000664 0000000 0000000 00000004176 15167207754 0022067 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The part plugin adds a part method, which is a # render-like method that treats all keywords as locals. # # # Can replace this: # render(:template, locals: {foo: 'bar'}) # # # With this: # part(:template, foo: 'bar') # # On Ruby 2.7+, the part method takes a keyword splat, so you # must pass keywords and not a positional hash for the locals. # # If you are using the :assume_fixed_locals render plugin option, # template caching is enabled, you are using Ruby 3+, and you # are freezing your Roda application, in addition to providing a # simpler API, this also provides a significant performance # improvement (more significant on Ruby 3.4+). module Part def self.load_dependencies(app) app.plugin :render end module ClassMethods # When freezing, optimize the part method if assuming fixed locals # and caching templates. def freeze if render_opts[:assume_fixed_locals] && !render_opts[:check_template_mtime] include AssumeFixedLocalsInstanceMethods end super end end module InstanceMethods if RUBY_VERSION >= '2.7' class_eval(<<-RUBY, __FILE__, __LINE__ + 1) def part(template, **locals, &block) render(template, :locals=>locals, &block) end RUBY # :nocov: else def part(template, locals=OPTS, &block) render(template, :locals=>locals, &block) end end # :nocov: end module AssumeFixedLocalsInstanceMethods # :nocov: if RUBY_VERSION >= '3.0' # :nocov: class_eval(<<-RUBY, __FILE__, __LINE__ + 1) def part(template, ...) if optimized_method = _optimized_render_method_for_locals(template, OPTS) send(optimized_method[0], ...) else super end end RUBY end end end register_plugin(:part, Part) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/partials.rb 0000664 0000000 0000000 00000004333 15167207754 0022733 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The partials plugin adds a +partial+ method, which renders # templates without the layout. # # plugin :partials, views: 'path/2/views' # # Template files are prefixed with an underscore: # # partial('test') # uses _test.erb # partial('dir/test') # uses dir/_test.erb # # This is basically equivalent to: # # render('_test') # render('dir/_test') # # To render the same template once for each object in an enumerable, # you can use the +render_partials+ method: # # each_partial([1,2,3], :foo) # uses _foo.erb # # This is basically equivalent to: # # render_each([1,2,3], "_foo", local: :foo) # # This plugin depends on the render and render_each plugins. module Partials # Depend on the render plugin, passing received options to it. # Also depend on the render_each plugin. def self.load_dependencies(app, opts=OPTS) app.plugin :render, opts app.plugin :render_each end module InstanceMethods # For each object in the given enumerable, render the given # template (prefixing the template filename with an underscore). def each_partial(enum, template, opts=OPTS) unless opts.has_key?(:local) opts = Hash[opts] opts[:local] = render_each_default_local(template) end render_each(enum, partial_template_name(template.to_s), opts) end # Renders the given template without a layout, but # prefixes the template filename to use with an # underscore. def partial(template, opts=OPTS) opts = parse_template_opts(template, opts) if opts[:template] opts[:template] = partial_template_name(opts[:template]) end render_template(opts) end private # Prefix the template base filename with an underscore. def partial_template_name(template) segments = template.split('/') segments[-1] = "_#{segments[-1]}" segments.join('/') end end end register_plugin(:partials, Partials) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/pass.rb 0000664 0000000 0000000 00000001726 15167207754 0022065 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The pass plugin adds a request +pass+ method to skip the current match # block as if it did not match. # # plugin :pass # # route do |r| # r.on "foo", :bar do |bar| # r.pass if bar == 'baz' # "/foo/#{bar} (not baz)" # end # # r.on "foo/baz" do # "/foo/baz" # end # end module Pass module RequestMethods # Skip the current match block as if it did not match. def pass throw :pass end private # Handle passing inside the match block. def always catch(:pass){super} end # Handle passing inside the match block. def if_match(_) rp = @remaining_path ret = catch(:pass){super} @remaining_path = rp ret end end end register_plugin(:pass, Pass) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/path.rb 0000664 0000000 0000000 00000023005 15167207754 0022045 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The path plugin adds support for named paths. Using the +path+ class method, you can # easily create *_path instance methods for each named path. Those instance # methods can then be called if you need to get the path for a form action, link, # redirect, or anything else. # # Additionally, you can call the +path+ class method with a class and a block, and it will register # the class. You can then call the +path+ instance method with an instance of that class, and it will # execute the block in the context of the route block scope with the arguments provided to path. You # can call the +url+ instance method with the same arguments as the +path+ method to get the full URL. # # Example: # # plugin :path # path :foo, '/foo' # path :bar do |bar| # "/bar/#{bar.id}" # end # path Baz do |baz, *paths| # "/baz/#{baz.id}/#{paths.join('/')}" # end # path Quux do |quux, path| # "/quux/#{quux.id}/#{path}" # end # path 'FooBar', class_name: true do |foobar| # "/foobar/#{foobar.id}" # end # # route do |r| # r.post 'foo' do # r.redirect foo_path # /foo # end # # r.post 'bar' do # bar_params = r.params['bar'] # if bar_params.is_a?(Hash) # bar = Bar.create(bar_params) # r.redirect bar_path(bar) # /bar/1 # end # end # # r.post 'baz' do # baz = Baz[1] # r.redirect path(baz, 'c', 'd') # /baz/1/c/d # end # # r.post 'quux' do # quux = Quux[1] # r.redirect url(quux, '/bar') # http://example.com/quux/1/bar # end # end # # The path class method accepts the following options when not called with a class: # # :add_script_name :: Prefix the path generated with SCRIPT_NAME. This defaults to the app's # :add_script_name option. # :name :: Provide a different name for the method, instead of using *_path. # :relative :: Generate paths relative to the current request instead of absolute paths by prepending # an appropriate prefix. This implies :add_script_name. # :url :: Create a url method in addition to the path method, which will prefix the string generated # with the appropriate scheme, host, and port. If true, creates a *_url # method. If a Symbol or String, uses the value as the url method name. # :url_only :: Do not create a path method, just a url method. # # Note that if :add_script_name, :relative, :url, or :url_only is used, the path method will also create a # _*_path private method. # # If the path class method is passed a string or symbol as the first argument, and the second argument # is a hash with the :class_name option passed, the symbol/string is treated as a class name. # This enables the use of class-based paths without forcing autoloads for the related # classes. If the plugin is not registering classes by name, this will use the symbol or # string to find the related class. module Path DEFAULT_PORTS = {'http' => 80, 'https' => 443}.freeze # Regexp for valid constant names, to prevent code execution. VALID_CONSTANT_NAME_REGEXP = /\A(?:::)?([A-Z]\w*(?:::[A-Z]\w*)*)\z/.freeze # Initialize the path classes when loading the plugin. Options: # :by_name :: Register classes by name, which is friendlier when reloading code (defaults to # true in development mode) def self.configure(app, opts=OPTS) app.instance_eval do self.opts[:path_class_by_name] = opts.fetch(:by_name, ENV['RACK_ENV'] == 'development') self.opts[:path_classes] ||= {} self.opts[:path_class_methods] ||= {} unless path_block(String) path(String){|str| str} end end end module ClassMethods # Hash of recognizes classes for path instance method. Keys are classes, values are procs. def path_classes opts[:path_classes] end # Freeze the path classes when freezing the app. def freeze path_classes.freeze opts[:path_classes_methods].freeze super end # Create a new instance method for the named path. See plugin module documentation for options. def path(name, path=nil, opts=OPTS, &block) if name.is_a?(Class) || (path.is_a?(Hash) && (class_name = path[:class_name])) raise RodaError, "can't provide path when calling path with a class" if path && !class_name raise RodaError, "can't provide options when calling path with a class" unless opts.empty? raise RodaError, "must provide a block when calling path with a class" unless block if self.opts[:path_class_by_name] if class_name name = name.to_s else name = name.name end elsif class_name name = name.to_s raise RodaError, "invalid class name passed when using class_name option" unless VALID_CONSTANT_NAME_REGEXP =~ name name = Object.class_eval(name, __FILE__, __LINE__) end path_classes[name] = block self.opts[:path_class_methods][name] = define_roda_method("path_#{name}", :any, &block) return end if path.is_a?(Hash) raise RodaError, "cannot provide two option hashses to Roda.path" unless opts.empty? opts = path path = nil end raise RodaError, "cannot provide both path and block to Roda.path" if path && block raise RodaError, "must provide either path or block to Roda.path" unless path || block if path path = path.dup.freeze block = lambda{path} end meth = opts[:name] || "#{name}_path" url = opts[:url] url_only = opts[:url_only] relative = opts[:relative] add_script_name = opts.fetch(:add_script_name, self.opts[:add_script_name]) if relative if (url || url_only) raise RodaError, "cannot provide :url or :url_only option if using :relative option" end add_script_name = true plugin :relative_path end if add_script_name || url || url_only || relative _meth = "_#{meth}" define_method(_meth, &block) private _meth end unless url_only if relative define_method(meth) do |*a, &blk| # Allow calling private _method to get path relative_path(request.script_name.to_s + send(_meth, *a, &blk)) end # :nocov: ruby2_keywords(meth) if respond_to?(:ruby2_keywords, true) # :nocov: elsif add_script_name define_method(meth) do |*a, &blk| # Allow calling private _method to get path request.script_name.to_s + send(_meth, *a, &blk) end # :nocov: ruby2_keywords(meth) if respond_to?(:ruby2_keywords, true) # :nocov: else define_method(meth, &block) end end if url || url_only url_meth = if url.is_a?(String) || url.is_a?(Symbol) url else "#{name}_url" end url_block = lambda do |*a, &blk| # Allow calling private _method to get path "#{_base_url}#{request.script_name if add_script_name}#{send(_meth, *a, &blk)}" end define_method(url_meth, &url_block) # :nocov: ruby2_keywords(url_meth) if respond_to?(:ruby2_keywords, true) # :nocov: end nil end # Return the block related to the given class, or nil if there is no block. def path_block(klass) # RODA4: Remove if opts[:path_class_by_name] klass = klass.name end path_classes[klass] end end module InstanceMethods # Return a path based on the class of the object. The object passed must have # had its class previously registered with the application. If the app's # :add_script_name option is true, this prepends the SCRIPT_NAME to the path. def path(obj, *args, &block) app = self.class opts = app.opts klass = opts[:path_class_by_name] ? obj.class.name : obj.class unless meth = opts[:path_class_methods][klass] raise RodaError, "unrecognized object given to Roda#path: #{obj.inspect}" end path = send(meth, obj, *args, &block) path = request.script_name.to_s + path if opts[:add_script_name] path end # Similar to #path, but returns a complete URL. def url(*args, &block) "#{_base_url}#{path(*args, &block)}" end private # The string to prepend to the path to make the path a URL. def _base_url r = @_request scheme = r.scheme port = r.port "#{scheme}://#{r.host}#{":#{port}" unless DEFAULT_PORTS[scheme] == port}" end end end register_plugin(:path, Path) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/path_matchers.rb 0000664 0000000 0000000 00000003270 15167207754 0023735 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The path_matchers plugin adds hash matchers that operate # on the request's path. # # It adds a :prefix matcher for matching on the path's prefix, # yielding the rest of the matched segment: # # r.on prefix: 'foo' do |suffix| # # Matches '/foo-bar', yielding '-bar' # # Does not match bar-foo # end # # It adds a :suffix matcher for matching on the path's suffix, # yielding the part of the segment before the suffix: # # r.on suffix: 'bar' do |prefix| # # Matches '/foo-bar', yielding 'foo-' # # Does not match bar-foo # end # # It adds an :extension matcher for matching on the given file extension, # yielding the part of the segment before the extension: # # r.on extension: 'bar' do |reset| # # Matches '/foo.bar', yielding 'foo' # # Does not match bar.foo # end module PathMatchers module RequestMethods # Match when the current segment ends with the given extension. # request path end with the extension. def match_extension(ext) match_suffix(".#{ext}") end # Match when the current path segment starts with the given prefix. def match_prefix(prefix) consume(self.class.cached_matcher([:prefix, prefix]){/#{prefix}([^\\\/]+)/}) end # Match when the current path segment ends with the given suffix. def match_suffix(suffix) consume(self.class.cached_matcher([:suffix, suffix]){/([^\\\/]+)#{suffix}/}) end end end register_plugin(:path_matchers, PathMatchers) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/path_rewriter.rb 0000664 0000000 0000000 00000010052 15167207754 0023766 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The path_rewriter plugin allows you to rewrite the remaining path # or the path info for requests. This is useful if you want to # transparently treat some paths the same as other paths. # # By default, +rewrite_path+ will rewrite just the remaining path. So # only routing in the current Roda app will be affected. This is useful # if you have other code in your app that uses PATH_INFO and needs to # see the original PATH_INFO (for example, when using relative links). # # rewrite_path '/a', '/b' # # PATH_INFO '/a' => remaining_path '/b' # # PATH_INFO '/a/c' => remaining_path '/b/c' # # In some cases, you may want to override PATH_INFO for the rewritten # paths, such as when you are passing the request to another Rack app. # For those cases, you can use the path_info: true option to # +rewrite_path+. # # rewrite_path '/a', '/b', path_info: true # # PATH_INFO '/a' => PATH_INFO '/b' # # PATH_INFO '/a/c' => PATH_INFO '/b/c' # # If you pass a string to +rewrite_path+, it will rewrite all paths starting # with that string. You can provide a regexp if you want more complete control, # such as only matching exact paths. # # rewrite_path /\A\/a\z/, '/b' # # PATH_INFO '/a' => remaining_path '/b' # # PATH_INFO '/a/c' => remaining_path '/a/c', no change # # Patterns can be rewritten dynamically by providing a block accepting a MatchData # object and evaluating to the replacement. # # rewrite_path(/\A\/a\/(\w+)/){|match| "/a/#{match[1].capitalize}"} # # PATH_INFO '/a/moo' => remaining_path '/a/Moo' # rewrite_path(/\A\/a\/(\w+)/, path_info: true){|match| "/a/#{match[1].capitalize}"} # # PATH_INFO '/a/moo' => PATH_INFO '/a/Moo' # # All path rewrites are applied in order, so if a path is rewritten by one rewrite, # it can be rewritten again by a later rewrite. Note that PATH_INFO rewrites are # processed before remaining_path rewrites. module PathRewriter def self.configure(app) app.instance_exec do app.opts[:remaining_path_rewrites] ||= [] app.opts[:path_info_rewrites] ||= [] end end module ClassMethods # Freeze the path rewrite metadata. def freeze opts[:remaining_path_rewrites].freeze opts[:path_info_rewrites].freeze super end # Record a path rewrite from path +was+ to path +is+. Options: # :path_info :: Modify PATH_INFO, not just remaining path. def rewrite_path(was, is = nil, opts=OPTS, &block) if is.is_a? Hash raise RodaError, "cannot provide two hashes to rewrite_path" unless opts.empty? opts = is is = nil end if block raise RodaError, "cannot provide both block and string replacement to rewrite_path" if is is = block end was = /\A#{Regexp.escape(was)}/ unless was.is_a?(Regexp) array = @opts[opts[:path_info] ? :path_info_rewrites : :remaining_path_rewrites] array << [was, is.dup.freeze].freeze end end module RequestMethods # Rewrite remaining_path and/or PATH_INFO based on the path rewrites. def initialize(scope, env) path_info = env['PATH_INFO'] rewrite_path(scope.class.opts[:path_info_rewrites], path_info) super remaining_path = @remaining_path = @remaining_path.dup rewrite_path(scope.class.opts[:remaining_path_rewrites], remaining_path) end private # Rewrite the given path using the given replacements. def rewrite_path(replacements, path) replacements.each do |was, is| if is.is_a?(Proc) path.sub!(was){is.call($~)} else path.sub!(was, is) end end end end end register_plugin(:path_rewriter, PathRewriter) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/permissions_policy.rb 0000664 0000000 0000000 00000023762 15167207754 0025055 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # A permissions_policy plugin has been added that allows you to easily set a # Permissions-Policy header for the application, which browsers can use to # determine whether to allow specific functionality on the returned page # (mainly related to which JavaScript APIs the page is allowed to use). # # You would generally call the plugin with a block to set the default policy: # # plugin :permissions_policy do |pp| # pp.camera :none # pp.fullscreen :self # pp.clipboard_read :self, 'https://example.com' # end # # Then, anywhere in the routing tree, you can customize the policy for just that # branch or action using the same block syntax: # # r.get 'foo' do # permissions_policy do |pp| # pp.camera :self # end # # ... # end # # In addition to using a block, you can also call methods on the object returned # by the method: # # r.get 'foo' do # permissions_policy.camera :self # # ... # end # # You can use the :default plugin option to set the default for all settings. # For example, to disallow all access for each setting by default: # # plugin :permissions_policy, default: :none # # The following methods are available for configuring the permissions policy, # which specify the setting (substituting _ with -): # # * accelerometer # * ambient_light_sensor # * autoplay # * bluetooth # * camera # * clipboard_read # * clipboard_write # * display_capture # * encrypted_media # * fullscreen # * geolocation # * gyroscope # * hid # * idle_detection # * keyboard_map # * magnetometer # * microphone # * midi # * payment # * picture_in_picture # * publickey_credentials_get # * screen_wake_lock # * serial # * sync_xhr # * usb # * web_share # * window_management # # All of these methods support any number of arguments, and each argument should # be one of the following values: # # :all :: Grants permission to all domains (must be only argument) # :none :: Does not allow permission at all (must be only argument) # :self :: Allows feature in current document and any nested browsing contexts # that use the same domain as the current document. # :src :: Allows feature in current document and any nested browsing contexts # that use the same domain as the src of the iframe. # String :: Specifies origin domain where access is allowed # # When calling a method with no arguments, the setting is removed from the policy instead # of being left empty, since all of these setting require at least one value. Likewise, # if the policy does not have any settings, the header will not be added. # # Calling the method overrides any previous setting. Each of the methods has +add_*+ and # +get_*+ methods defined. The +add_*+ method appends to any existing setting, and the +get_*+ method # returns the current value for the setting (this will be +:all+ if all domains are allowed, or # any array of strings/:self/:src). # # permissions_policy.fullscreen :self, 'https://example.com' # # fullscreen (self "https://example.com") # # permissions_policy.add_fullscreen 'https://*.example.com' # # fullscreen (self "https://example.com" "https://*.example.com") # # permissions_policy.get_fullscreen # # => [:self, "https://example.com", "https://*.example.com"] # # The clear method can be used to remove all settings from the policy. Empty policies # do not set any headers. You can use +response.skip_permissions_policy!+ to skip # setting a policy. This is faster than calling +permissions_policy.clear+, since # it does not duplicate the default policy. module PermissionsPolicy SUPPORTED_SETTINGS = %w' accelerometer ambient-light-sensor autoplay bluetooth camera clipboard-read clipboard-write display-capture encrypted-media fullscreen geolocation gyroscope hid idle-detection keyboard-map magnetometer microphone midi payment picture-in-picture publickey-credentials-get screen-wake-lock serial sync-xhr usb web-share window-management '.each(&:freeze).freeze private_constant :SUPPORTED_SETTINGS # Represents a permissions policy. class Policy SUPPORTED_SETTINGS.each do |setting| meth = setting.tr('-', '_').freeze # Setting method name sets the setting value, or removes it if no args are given. define_method(meth) do |*args| if args.empty? @opts.delete(setting) else @opts[setting] = option_value(args) end nil end # add_* method name adds to the setting value, or clears setting if no values # are given. define_method(:"add_#{meth}") do |*args| unless args.empty? case v = @opts[setting] when :all # If all domains are already allowed, there is no reason to add more. return when Array @opts[setting] = option_value(v + args) else @opts[setting] = option_value(args) end end nil end # get_* method always returns current setting value. define_method(:"get_#{meth}") do @opts[setting] end end def initialize clear end # Clear all settings, useful to remove any inherited settings. def clear @opts = {} end # Do not allow future modifications to any settings. def freeze @opts.freeze header_value.freeze super end # The header name to use, depends on whether report only mode has been enabled. def header_key @report_only ? RodaResponseHeaders::PERMISSIONS_POLICY_REPORT_ONLY : RodaResponseHeaders::PERMISSIONS_POLICY end # The header value to use. def header_value return @header_value if @header_value s = String.new @opts.each do |k, vs| s << k << "=" if vs == :all s << '*, ' else s << '(' vs.each{|v| append_formatted_value(s, v)} s.chop! unless vs.empty? s << '), ' end end s.chop! s.chop! @header_value = s end # Set whether the Permissions-Policy-Report-Only header instead of the # default Permissions-Policy header. def report_only(report=true) @report_only = report end # Whether this policy uses report only mode. def report_only? !!@report_only end # Set the current policy in the headers hash. If no settings have been made # in the policy, does not set a header. def set_header(headers) return if @opts.empty? headers[header_key] ||= header_value end private # Formats nested values, quoting strings and using :self and :src verbatim. def append_formatted_value(s, v) case v when String s << v.inspect << ' ' when :self s << 'self ' when :src s << 'src ' else raise RodaError, "unsupported Permissions-Policy item value used: #{v.inspect}" end end # Make object copy use copy of settings, and remove cached header value. def initialize_copy(_) super @opts = @opts.dup @header_value = nil end # The option value to store for the given args. def option_value(args) if args.length == 1 case args[0] when :all :all when :none EMPTY_ARRAY else args.freeze end else args.freeze end end end # Yield the current Permissions Policy to the block. def self.configure(app, opts=OPTS) policy = app.opts[:permissions_policy] = if policy = app.opts[:permissions_policy] policy.dup else Policy.new end if default = opts[:default] SUPPORTED_SETTINGS.each do |setting| policy.send(setting.tr('-', '_'), *default) end end yield policy if defined?(yield) policy.freeze end module InstanceMethods # If a block is given, yield the current permission policy. Returns the # current permissions policy. def permissions_policy policy = @_response.permissions_policy yield policy if defined?(yield) policy end end module ResponseMethods # Unset any permissions policy when reinitializing def initialize super @permissions_policy &&= nil end # The current permissions policy to be used for this response. def permissions_policy @permissions_policy ||= roda_class.opts[:permissions_policy].dup end # Do not set a permissions policy header for this response. def skip_permissions_policy! @skip_permissions_policy = true end private # Set the appropriate permissions policy header. def set_default_headers super unless @skip_permissions_policy (@permissions_policy || roda_class.opts[:permissions_policy]).set_header(headers) end end end end register_plugin(:permissions_policy, PermissionsPolicy) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/placeholder_string_matchers.rb 0000664 0000000 0000000 00000002676 15167207754 0026662 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The placeholder_string_matcher plugin exists for backwards compatibility # with previous versions of Roda that allowed placeholders inside strings # if they were prefixed by colons: # # plugin :placeholder_string_matchers # # route do |r| # r.is("foo/:bar") |v| # # matches foo/baz, yielding "baz" # # does not match foo, foo/, or foo/baz/ # end # end # # It is not recommended to use this in new applications, and it is encouraged # to use separate string class or symbol matchers instead: # # r.is "foo", String # r.is "foo", :bar # # If used with the symbol_matchers plugin, this plugin respects the regexps # for the registered symbols, but it does not perform the conversions, the # captures for the regexp are used directly as the captures for the match method. module PlaceholderStringMatchers def self.load_dependencies(app) app.plugin :_symbol_regexp_matchers end module RequestMethods private def _match_string(str) if str.index(":") consume(self.class.cached_matcher(str){Regexp.escape(str).gsub(/:(\w+)/){|m| _match_symbol_regexp($1)}}) else super end end end end register_plugin(:placeholder_string_matchers, PlaceholderStringMatchers) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/plain_hash_response_headers.rb 0000664 0000000 0000000 00000001765 15167207754 0026641 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The plain_hash_response_headers plugin will change Roda to # use a plain hash for response headers. This is Roda's # default behavior on Rack 2, but on Rack 3+, Roda defaults # to using Rack::Headers for response headers for backwards # compatibility (Rack::Headers automatically lower cases header # keys). # # On Rack 3+, you should use this plugin for better performance # if you are sure all headers in your application and middleware # are already lower case (lower case response header keys are # required by the Rack 3 spec). module PlainHashResponseHeaders if defined?(Rack::Headers) && Rack::Headers.is_a?(Class) module ResponseMethods private # Use plain hash for headers def _initialize_headers {} end end end end register_plugin(:plain_hash_response_headers, PlainHashResponseHeaders) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/precompile_templates.rb 0000664 0000000 0000000 00000014044 15167207754 0025331 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The precompile_templates plugin adds support for precompiling template code. # This can result in a large memory savings for applications that have large # templates or a large number of small templates if the application uses a # forking webserver. By default, template compilation is lazy, so all the # child processes in a forking webserver will have their own copy of the # compiled template. By using the precompile_templates plugin, you can # precompile the templates in the parent process before forking, and then # all of the child processes can use the same precompiled templates, which # saves memory. # # Another advantage of the precompile_templates plugin is that after # template precompilation, access to the template file in the file system is # no longer needed, so this can be used with security features that do not # allow access to the template files at runtime. # # After loading the plugin, you should call precompile_views with an array # of views to compile, using the same argument you are passing to view or # render: # # plugin :precompile_templates # precompile_views %w'view1 view2' # # If the view requires local variables, you should call precompile_views with a second # argument for the local variables: # # plugin :precompile_templates # precompile_views :view3, [:local_var1, :local_var2] # # After all templates are precompiled, you can optionally use freeze_template_caches!, # which will freeze the template caches so that any template compilation at runtime # will result in an error. This also speeds up template cache access, since the # template caches no longer need a mutex. # # freeze_template_caches! # # Note that you should use Tilt 2.0.1+ if you are using this plugin, so # that locals are handled in the same order. module PrecompileTemplates # Load the render plugin as precompile_templates depends on it. def self.load_dependencies(app, opts=OPTS) app.plugin :render end module ClassMethods # Freeze the template caches. Should be called after precompiling all templates during # application startup, if you don't want to allow templates to be cached at runtime. # In addition to ensuring that no templates are compiled at runtime, this also speeds # up rendering by freezing the template caches, so that a mutex is not needed to access # them. def freeze_template_caches! _freeze_layout_method opts[:render] = render_opts.merge( :cache=>render_opts[:cache].freeze, :template_method_cache=>render_opts[:template_method_cache].freeze, ).freeze self::RodaCompiledTemplates.freeze nil end # Precompile the templates using the given options. Note that this doesn't # handle optimized template methods supported in newer versions of Roda, but # there are still cases where makes sense to use it. # # You can call +precompile_templates+ with the pattern of templates you would # like to precompile: # # precompile_templates "views/**/*.erb" # # That will precompile all erb template files in the views directory or # any subdirectory. # # If the templates use local variables, you need to specify which local # variables to precompile, which should be an array of symbols: # # precompile_templates 'views/users/_*.erb', locals: [:user] # # You can specify other render options when calling +precompile_templates+, # including +:cache_key+, +:template_class+, and +:template_opts+. If you # are passing any of those options to render/view for the template, you # should pass the same options when precompiling the template. # # To compile inline templates, just pass a single hash containing an :inline # to +precompile_templates+: # # precompile_templates inline: some_template_string def precompile_templates(pattern, opts=OPTS) if pattern.is_a?(Hash) opts = pattern.merge(opts) end if locals = opts[:locals] locals.sort! else locals = EMPTY_ARRAY end compile_opts = if pattern.is_a?(Hash) [opts] else Dir[pattern].map{|file| opts.merge(:path=>File.expand_path(file, nil))} end instance = allocate compile_opts.each do |compile_opt| template = instance.send(:retrieve_template, compile_opt) begin Render.tilt_template_compiled_method(template, locals, self) rescue NotImplementedError # When freezing template caches, you may want to precompile a template for a # template type that doesn't support template precompilation, just to populate # the cache. Tilt rescues NotImplementedError in this case, which we can ignore. nil end end nil end # Precompile the given views with the given locals, handling optimized template methods. def precompile_views(views, locals=EMPTY_ARRAY) instance = allocate views = Array(views) if locals.empty? opts = OPTS else locals_hash = {} locals.each{|k| locals_hash[k] = nil} opts = {:locals=>locals_hash} end views.each do |view| instance.send(:retrieve_template, instance.send(:render_template_opts, view, opts)) end if locals_hash views.each do |view| instance.send(:_optimized_render_method_for_locals, view, locals_hash) end end nil end end end register_plugin(:precompile_templates, PrecompileTemplates) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/public.rb 0000664 0000000 0000000 00000015244 15167207754 0022375 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true require 'uri' begin require 'rack/files' rescue LoadError require 'rack/file' end # class Roda module RodaPlugins # The public plugin adds a +r.public+ routing method to serve static files # from a directory. # # The public plugin recognizes the application's :root option, and defaults to # using the +public+ subfolder of the application's +:root+ option. If the application's # :root option is not set, it defaults to the +public+ folder in the working # directory. Additionally, if a relative path is provided as the +:root+ # option to the plugin, it will be considered relative to the application's # +:root+ option. # # Examples: # # # Use public folder as location of files # plugin :public # # # Use /path/to/app/static as location of files # opts[:root] = '/path/to/app' # plugin :public, root: 'static' # # # Assuming public is the location of files # route do # # Make GET /images/foo.png look for public/images/foo.png # r.public # # # Make GET /static/images/foo.png look for public/images/foo.png # r.on(:static) do # r.public # end # end module Public SPLIT = Regexp.union(*[File::SEPARATOR, File::ALT_SEPARATOR].compact) RACK_FILES = defined?(Rack::Files) ? Rack::Files : Rack::File ENCODING_MAP = {:zstd=>'zstd', :brotli=>'br', :gzip=>'gzip'}.freeze ENCODING_EXTENSIONS = {'br'=>'.br', 'gzip'=>'.gz', 'zstd'=>'.zst'}.freeze # :nocov: PARSER = defined?(::URI::RFC2396_PARSER) ? ::URI::RFC2396_PARSER : ::URI::DEFAULT_PARSER MATCH_METHOD = RUBY_VERSION >= '2.4' ? :match? : :match # :nocov: # Use options given to setup a Rack::File instance for serving files. Options: # :brotli :: Whether to serve already brotli-compressed files with a .br extension # for clients supporting "br" transfer encoding. # :default_mime :: The default mime type to use if the mime type is not recognized. # :encodings :: An enumerable of pairs to handle accepted encodings. The first # element of the pair is the accepted encoding name (e.g. 'gzip'), # and the second element of the pair is the file extension (e.g. # '.gz'). This allows configuration of the order in which encodings # are tried, to prefer brotli to zstd for example, or to support # encodings other than zstd, brotli, and gzip. This takes # precedence over the :brotli, :gzip, and :zstd options if given. # :gzip :: Whether to serve already gzipped files with a .gz extension for clients # supporting "gzip" transfer encoding. # :headers :: A hash of headers to use for statically served files # :root :: Use this option for the root of the public directory (default: "public") # :zstd :: Whether to serve already zstd-compressed files with a .zst extension # for clients supporting "zstd" transfer encoding. def self.configure(app, opts={}) if opts[:root] app.opts[:public_root] = app.expand_path(opts[:root]) elsif !app.opts[:public_root] app.opts[:public_root] = app.expand_path("public") end app.opts[:public_server] = RACK_FILES.new(app.opts[:public_root], opts[:headers]||{}, opts[:default_mime] || 'text/plain') unless encodings = opts[:encodings] if ENCODING_MAP.any?{|k,| opts.has_key?(k)} encodings = ENCODING_MAP.map{|k, v| [v, ENCODING_EXTENSIONS[v]] if opts[k]}.compact end end encodings = (encodings || app.opts[:public_encodings] || EMPTY_ARRAY).map(&:dup).freeze encodings.each do |a| a << /\b#{a[0]}\b/ end encodings.each(&:freeze) app.opts[:public_encodings] = encodings end module RequestMethods # Serve files from the public directory if the file exists and this is a GET request. def public public_serve_with(roda_class.opts[:public_server]) end private # Return an array of segments for the given path, handling .. # and . components def public_path_segments(path) segments = [] path.split(SPLIT).each do |seg| next if seg.empty? || seg == '.' seg == '..' ? segments.pop : segments << seg end segments end # Return whether the given path is a readable regular file. def public_file_readable?(path) ::File.file?(path) && ::File.readable?(path) rescue SystemCallError # :nocov: false # :nocov: end def public_serve_with(server) return unless is_get? path = PARSER.unescape(real_remaining_path) return if path.include?("\0") roda_opts = roda_class.opts path = ::File.join(server.root, *public_path_segments(path)) if accept_encoding = env['HTTP_ACCEPT_ENCODING'] roda_opts[:public_encodings].each do |enc, ext, regexp| if regexp.send(MATCH_METHOD, accept_encoding) public_serve_compressed(server, path, ext, enc) end end end if public_file_readable?(path) s, h, b = public_serve(server, path) headers = response.headers headers.replace(h) halt [s, headers, b] end end # Serve the compressed file if it exists. This should only # be called if the client will accept the related encoding. def public_serve_compressed(server, path, suffix, encoding) compressed_path = path + suffix if public_file_readable?(compressed_path) s, h, b = public_serve(server, compressed_path) headers = response.headers headers.replace(h) unless s == 304 headers[RodaResponseHeaders::CONTENT_TYPE] = ::Rack::Mime.mime_type(::File.extname(path), 'text/plain') headers[RodaResponseHeaders::CONTENT_ENCODING] = encoding end halt [s, headers, b] end end if ::Rack.release > '2' # Serve the given path using the given Rack::Files server. def public_serve(server, path) server.serving(self, path) end else def public_serve(server, path) server = server.dup server.path = path server.serving(env) end end end end register_plugin(:public, Public) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/r.rb 0000664 0000000 0000000 00000001272 15167207754 0021354 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The r plugin adds an +r+ instance method that will return the request. # This allows you to use common Roda idioms such as +r.halt+ and # +r.redirect+ even when +r+ isn't a local variable in scope. Example: # # plugin :r # # def foo # r.redirect "/bar" # end # # route do |r| # r.get "foo" do # foo # end # r.get "bar" do # "bar" # end # end module R module InstanceMethods # The request object. def r @_request end end end register_plugin(:r, R) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/recheck_precompiled_assets.rb 0000664 0000000 0000000 00000007500 15167207754 0026464 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The recheck_precompiled_assets plugin enables checking for the precompiled asset metadata file. # You need to have already loaded the assets plugin with the +:precompiled+ option and the file # specified by the +:precompiled+ option must already exist in order to use the # recheck_precompiled_assets plugin. # # Any time you want to check whether the precompiled asset metadata file has changed and should be # reloaded, you can call the +recheck_precompiled_assets+ class method. This method will check # whether the file has changed, and reload it if it has. If you want to check for modifications on # every request, you can use +self.class.recheck_precompiled_assets+ inside your route block. module RecheckPrecompiledAssets # Thread safe wrapper for the compiled asset metadata hash. Does not wrap all # hash methods, only a few that are used. class CompiledAssetsHash include Enumerable def initialize @hash = {} @mutex = Mutex.new end def [](key) @mutex.synchronize{@hash[key]} end def []=(key, value) @mutex.synchronize{@hash[key] = value} end def replace(hash) hash = hash.instance_variable_get(:@hash) if (CompiledAssetsHash === hash) @mutex.synchronize{@hash.replace(hash)} self end def each(&block) @mutex.synchronize{@hash.dup}.each(&block) self end def to_json(*args) @mutex.synchronize{@hash.dup}.to_json(*args) end end def self.load_dependencies(app) unless app.respond_to?(:assets_opts) && app.assets_opts[:precompiled] raise RodaError, "must load assets plugin with precompiled option before loading recheck_precompiled_assets plugin" end end def self.configure(app) precompiled_file = app.assets_opts[:precompiled] prev_mtime = ::File.mtime(precompiled_file) app.instance_exec do opts[:assets] = opts[:assets].merge(:compiled=>_compiled_assets_initial_hash.replace(assets_opts[:compiled])).freeze define_singleton_method(:recheck_precompiled_assets) do new_mtime = ::File.mtime(precompiled_file) if new_mtime != prev_mtime prev_mtime = new_mtime assets_opts[:compiled].replace(_precompiled_asset_metadata(precompiled_file)) # Unset the cached asset matchers, so new ones will be generated. # This is needed in case the new precompiled metadata uses # different files. app::RodaRequest.instance_variable_set(:@assets_matchers, nil) end end singleton_class.send(:alias_method, :recheck_precompiled_assets, :recheck_precompiled_assets) end end module ClassMethods private # Wrap the precompiled asset metadata in a thread-safe hash. def _precompiled_asset_metadata(file) CompiledAssetsHash.new.replace(super) end # Use a thread-safe wrapper of a hash for the :compiled assets option, since # the recheck_precompiled_asset_metadata can modify it at runtime. def _compiled_assets_initial_hash CompiledAssetsHash.new end end module RequestClassMethods private # Use a regexp that matches any digest. When the precompiled asset metadata # file is updated, this allows requests for a previous precompiled asset to # still work. def _asset_regexp(type, key, _) /#{Regexp.escape(key.sub(/\A#{type}/, ''))}\.[0-9a-fA-F]+\.#{type}/ end end end register_plugin(:recheck_precompiled_assets, RecheckPrecompiledAssets) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/redirect_http_to_https.rb 0000664 0000000 0000000 00000007730 15167207754 0025704 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The redirect_http_to_https plugin exposes a +redirect_http_to_https+ # request method that redirects HTTP requests to HTTPS, helping to ensure # that future requests by the same browser will be submitted securely. # # You should use this plugin if you have an application that can receive # requests using both HTTP and HTTPS, and you want to make sure that all # or a subset of routes are only handled for HTTPS requests. # # The reason this exposes a request method is so that you can choose where # in your routing tree to do the redirection: # # route do |r| # # routes available via both HTTP and HTTPS # r.redirect_http_to_https # # routes available only via HTTPS # end # # If you want to redirect to HTTPS for all routes in the routing tree, you # can have this as the very first method call in the routing tree. Note that # in Roda it is possible to handle routing before the normal routing tree # using before hooks. The static_routing and heartbeat plugins use this # feature. If you would like to handle routes before the normal routing tree, # you can setup a before hook: # # plugin :hooks # # before do # request.redirect_http_to_https # end module RedirectHttpToHttps status_map = Hash.new(307) status_map['GET'] = status_map['HEAD'] = 301 status_map.freeze DEFAULTS = {:status_map => status_map}.freeze private_constant :DEFAULTS # Configures redirection from HTTP to HTTPS. Available options: # # :body :: The body used in the redirect. If not set, uses an empty body. # :headers :: Any additional headers used in the redirect response. By default, # no additional headers are set, the only header used is the Location header. # :host :: The host to redirect to. If not set, redirects to the same host as the HTTP # requested to. It is highly recommended that you set this if requests with # arbitrary Host headers can be submitted to the application. # :port :: The port to use in the redirect. By default, will not set an explicit port, # so that it will implicitly use the HTTPS default port of 443. # :status_map :: A hash mapping request methods to response status codes. By default, # uses a hash that redirects GET and HEAD requests with a 301 status, # and other request methods with a 307 status. def self.configure(app, opts=OPTS) previous = app.opts[:redirect_http_to_https] || DEFAULTS opts = app.opts[:redirect_http_to_https] = previous.merge(opts) opts[:port_string] = opts[:port] ? ":#{opts[:port]}".freeze : "".freeze opts[:prefix] = opts[:host] ? "https://#{opts[:host]}#{opts[:port_string]}".freeze : nil opts.freeze end module RequestMethods # Redirect HTTP requests to HTTPS. While this doesn't secure the # current request, it makes it more likely that the browser will submit # future requests securely via HTTPS. def redirect_http_to_https return if ssl? opts = roda_class.opts[:redirect_http_to_https] res = response if body = opts[:body] res.write(body) end if headers = opts[:headers] res.headers.merge!(headers) end path = if prefix = opts[:prefix] prefix + fullpath else "https://#{host}#{opts[:port_string]}#{fullpath}" end unless status = opts[:status_map][@env['REQUEST_METHOD']] raise RodaError, "redirect_http_to_https :status_map provided does not support #{@env['REQUEST_METHOD']}" end redirect(path, status) end end end register_plugin(:redirect_http_to_https, RedirectHttpToHttps) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/redirect_path.rb 0000664 0000000 0000000 00000002674 15167207754 0023737 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The redirect_path plugin builds on top of the path plugin, # and allows the +r.redirect+ method to be passed a non-string # object that will be passed to +path+, and redirect to the # result of +path+. # # In the second argument, you can provide a suffix to the # generated path. However, in this case you cannot provide a # non-default redirect status in the same call). # # Example: # # Foo = Struct.new(:id) # foo = Foo.new(1) # # plugin :redirect_path # path Foo do |foo| # "/foo/#{foo.id}" # end # # route do |r| # r.get "example" do # # redirects to /foo/1 # r.redirect(foo) # end # # r.get "suffix-example" do # # redirects to /foo/1/status # r.redirect(foo, "/status") # end # end module RedirectPath def self.load_dependencies(app) app.plugin :path end module RequestMethods def redirect(path=default_redirect_path, status=default_redirect_status) if String === path super else path = scope.path(path) if status.is_a?(String) super(path + status) else super end end end end end register_plugin(:redirect_path, RedirectPath) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/relative_path.rb 0000664 0000000 0000000 00000004402 15167207754 0023740 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The relative_path plugin adds a relative_path method that accepts # an absolute path and returns a path relative to the current request # by adding an appropriate prefix: # # plugin :relative_path # route do |r| # relative_path("/foo") # end # # # GET / # "./foo" # # # GET /bar # "./foo" # # # GET /bar/ # "../foo" # # # GET /bar/baz/quux # "../../foo" # # It also offers a relative_prefix method that returns a string that can # be prepended to an absolute path. This can be more efficient if you # need to convert multiple paths. # # This plugin is mostly designed for applications using Roda as a static # site generator, where the generated site can be hosted at any subpath. module RelativePath module InstanceMethods # Return a relative path for the absolute path based on the current path # of the request by adding the appropriate prefix. def relative_path(absolute_path) relative_prefix + absolute_path end # Return a relative prefix to append to an absolute path to a relative path # based on the current path of the request. def relative_prefix return @_relative_prefix if @_relative_prefix env = @_request.env script_name = env["SCRIPT_NAME"] path_info = env["PATH_INFO"] # Check path begins with slash. All valid paths should, but in case this # request is bad, just skip using a relative prefix. case script_name.getbyte(0) when nil # SCRIPT_NAME empty unless path_info.getbyte(0) == 47 # PATH_INFO starts with / return(@_relative_prefix = '') end when 47 # SCRIPT_NAME starts with / # nothing else return(@_relative_prefix = '') end slash_count = script_name.count('/') + path_info.count('/') @_relative_prefix = if slash_count > 1 ("../" * (slash_count - 2)) << ".." else "." end end end end register_plugin(:relative_path, RelativePath) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/render.rb 0000664 0000000 0000000 00000122500 15167207754 0022370 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true require "tilt" class Roda module RodaPlugins # The render plugin adds support for template rendering using the tilt # library. Two methods are provided for template rendering, +view+ # (which uses the layout) and +render+ (which does not). # # plugin :render # # route do |r| # r.is 'foo' do # view('foo') # renders views/foo.erb inside views/layout.erb # end # # r.is 'bar' do # render('bar') # renders views/bar.erb # end # end # # The +render+ and +view+ methods just return strings, they do not have # side effects (unless the templates themselves have side effects). # As Roda uses the routing block return value as the body of the response, # in most cases you will call these methods as the last expression in a # routing block to have the response body be the result of the template # rendering. # # Because +render+ and +view+ just return strings, you can call them inside # templates (i.e. for subtemplates/partials), or multiple times in the # same route and combine the results together: # # route do |r| # r.is 'foo-bars' do # @bars = Bar.where(:foo).map{|b| render(:bar, locals: {bar: b})}.join # view('foo') # end # end # # You can provide options to the plugin method: # # plugin :render, engine: 'haml', views: 'admin_views' # # = Plugin Options # # The following plugin options are supported: # # :allowed_paths :: Set the template paths to allow. Attempts to render paths outside # of these paths will raise an error. Defaults to the +:views+ directory. # :assume_fixed_locals :: Set if you are sure all templates in your application use fixed locals # to allow for additional optimization. This is ignored unless both # compiled methods and fixed locals are not supported. # :cache :: nil/false to explicitly disable permanent template caching. By default, permanent # template caching is disabled by default if RACK_ENV is development. When permanent # template caching is disabled, for templates with paths in the file system, the # modification time of the file will be checked on every render, and if it has changed, # a new template will be created for the current content of the file. # :cache_class :: A class to use as the template cache instead of the default. # :check_paths :: Can be set to false to turn off template path checking. # :engine :: The tilt engine to use for rendering, also the default file extension for # templates, defaults to 'erb'. # :escape :: Use Erubi as the ERB template engine, and enable escaping by default, # which makes <%= %> escape output and <%== %> not escape output. # If given, sets the escape: true option for all template engines, which # can break some non-ERB template engines. You can use a string or array of strings # as the value for this option to only set the escape: true option for those # specific template engines. # :layout :: The base name of the layout file, defaults to 'layout'. This can be provided as a hash # with the :template or :inline options. # :layout_opts :: The options to use when rendering the layout, if different from the default options. # :template_opts :: The tilt options used when rendering all templates. defaults to: # {outvar: '@_out_buf', default_encoding: Encoding.default_external}. # :engine_opts :: The tilt options to use per template engine. Keys are # engine strings, values are hashes of template options. # :views :: The directory holding the view files, defaults to the 'views' subdirectory of the # application's :root option (the process's working directory by default). # # = Render/View Method Options # # Most of these options can be overridden at runtime by passing options # to the +view+ or +render+ methods: # # view('foo', engine: 'html.erb') # render('foo', views: 'admin_views') # # There are additional options to +view+ and +render+ that are # available at runtime: # # :cache :: Set to false to not cache this template, even when # caching is on by default. Set to true to force caching for # this template, even when the default is to not permantently cache (e.g. # when using the :template_block option). # :cache_key :: Explicitly set the hash key to use when caching. # :content :: Only respected by +view+, provides the content to render # inside the layout, instead of rendering a template to get # the content. # :inline :: Use the value given as the template code, instead of looking # for template code in a file. # :locals :: Hash of local variables to make available inside the template. # :path :: Use the value given as the full pathname for the file, instead # of using the :views and :engine option in combination with the # template name. # :scope :: The object in which context to evaluate the template. By # default, this is the Roda instance. # :template :: Provides the name of the template to use. This allows you # pass a single options hash to the render/view method, while # still allowing you to specify the template name. # :template_block :: Pass this block when creating the underlying template, # ignored when using :inline. Disables caching of the # template by default. # :template_class :: Provides the template class to use, instead of using # Tilt or Tilt[:engine]. # # Here's an example of using these options: # # view(inline: '<%= @foo %>') # render(path: '/path/to/template.erb') # # If you pass a hash as the first argument to +view+ or +render+, it should # have either +:template+, +:inline+, +:path+, or +:content+ (for +view+) as # one of the keys. # # = Fixed Locals in Templates # # By default, you can pass any local variables to any templates. A separate # template method is compiled for each combination of locals. This causes # multiple issues: # # * It is inefficient, especially for large templates that are called with # many combinations of locals. # * It hides issues if unused local variable names are passed to the template # * It does not support default values for local variables # * It does not support required local variables # * It does not support cases where you want to pass values via a keyword splat # * It does not support named blocks # # If you are using Tilt 2.6+, you can used fixed locals in templates, by # passing the appropriate options in :template_opts. For example, if you # are using ERB templates, the recommended way to use the render plugin is to # use the +:extract_fixed_locals+ and +:default_fixed_locals+ template options: # # plugin :render, template_opts: {extract_fixed_locals: true, default_fixed_locals: '()'} # # This will default templates to not allowing any local variables to be passed. # If the template requires local variables, you can specify them using a magic # comment in the template, such as: # # <%# locals(required_local:, optional_local: nil) %> # # The magic comment is used as method parameters when defining the compiled template # method. # # For better debugging of issues with invalid keywords being passed to templates that # have not been updated to support fixed locals, it can be helpful to set # +:default_fixed_locals+ to use a single optional keyword argument # '(_no_kw: nil)'. This makes the error message show which keywords # were passed, instead of showing that the takes no arguments (if you use '()'), # or that no keywords are accepted (if you pass (**nil)). # # If you are sure your application works with all templates using fixed locals, # set the :assume_fixed_locals render plugin option, which will allow the plugin # to optimize cache lookup for renders with locals, and avoid duplicate compiled # methods for templates rendered both with and without locals. # # See Tilt's documentation for more information regarding fixed locals. # # = Speeding Up Template Rendering # # The render/view method calls are optimized for usage with a single symbol/string # argument specifying the template name. So for fastest rendering, pass only a # symbol/string to render/view. Next best optimized are template calls with a # single :locals option. Use of other options disables the compiled template # method optimizations and can be significantly slower. # # If you must pass a hash to render/view, either as a second argument or as the # only argument, you can speed things up by specifying a +:cache_key+ option in # the hash, making sure the +:cache_key+ is unique to the template you are # rendering. # # = Recommended +template_opts+ # # Here are the recommended values of :template_opts for new applications (a couple # are Erubi-specific and can be ignored if you are using other templates engines): # # plugin :render, # assume_fixed_locals: true, # Optimize plugin by assuming all templates use fixed locals # template_opts: { # scope_class: self, # Always uses current class as scope class for compiled templates # freeze: true, # Freeze string literals in templates # extract_fixed_locals: true, # Support fixed locals in templates # default_fixed_locals: '()', # Default to templates not supporting local variables # escape: true, # For Erubi templates, escapes <%= by default (use <%== for unescaped # chain_appends: true, # For Erubi templates, improves performance # skip_compiled_encoding_detection: true, # Unless you need encodings explicitly specified # } # # = Accepting Template Blocks in Methods # # If you are used to Rails, you may be surprised that this type of template code # doesn't work in Roda: # # <%= some_method do %> # Some HTML # <% end %> # # The reason this doesn't work is that this is not valid ERB syntax, it is Rails syntax, # and requires attempting to parse the some_method do Ruby code with a regular # expression. Since Roda uses ERB syntax, it does not support this. # # In general, these methods are used to wrap the content of the block and # inject the content into the output. To get similar behavior with Roda, you have # a few different options you can use. # # == Use Erubi::CaptureBlockEngine # # Roda defaults to using Erubi for erb template rendering. Erubi 1.13.0+ includes # support for an erb variant that supports blocks in <%= and <%== # tags. To use it: # # require 'erubi/capture_block' # plugin :render, template_opts: {engine_class: Erubi::CaptureBlockEngine} # # See the Erubi documentation for how to capture data inside the block. Make sure # the method call (+some_method+ in the example) returns the output you want added # to the rendered body. # # == Directly Inject Template Output # # You can switch from a <%= tag to using a <% tag: # # <% some_method do %> # Some HTML # <% end %> # # While this would output Some HTML into the template, it would not be able # to inject content before or after the block. However, you can use the inject_erb_plugin # to handle the injection: # # def some_method # inject_erb "content before block" # yield # inject_erb "content after block" # end # # If you need to modify the captured block before injecting it, you can use the # capture_erb plugin to capture content from the template block, and modify that content, # then use inject_erb to inject it into the template output: # # def some_method(&block) # inject_erb "content before block" # inject_erb capture_erb(&block).upcase # inject_erb "content after block" # end # # This is the recommended approach for handling this type of method, if you want to keep # the template block in the same template. # # == Separate Block Output Into Separate Template # # By moving the Some HTML into a separate template, you can render that # template inside the block: # # <%= some_method{render('template_name')} %> # # It's also possible to use an inline template: # # <%= some_method do render(:inline=><<-END) # Some HTML # END # end %> # # This approach is useful if it makes sense to separate the template block into its # own template. You lose the ability to use local variable from outside the # template block inside the template block with this approach. # # == Separate Header and Footer # # You can define two separate methods, one that outputs the content before the block, # and one that outputs the content after the block, and use those instead of a single # call: # # <%= some_method_before %> # Some HTML # <%= some_method_after %> # # This is the simplest option to setup, but it is fairly tedious to use. module Render # Support for using compiled methods directly requires Ruby 2.3 for the # method binding to work, and Tilt 1.2 for Tilt::Template#compiled_method. tilt_compiled_method_support = defined?(Tilt::VERSION) && Tilt::VERSION >= '1.2' && ([1, -2].include?(((compiled_method_arity = Tilt::Template.instance_method(:compiled_method).arity) rescue false))) NO_CACHE = {:cache=>false}.freeze COMPILED_METHOD_SUPPORT = RUBY_VERSION >= '2.3' && tilt_compiled_method_support && ENV['RODA_RENDER_COMPILED_METHOD_SUPPORT'] != 'no' FIXED_LOCALS_COMPILED_METHOD_SUPPORT = COMPILED_METHOD_SUPPORT && Tilt::Template.method_defined?(:fixed_locals?) if FIXED_LOCALS_COMPILED_METHOD_SUPPORT def self.tilt_template_fixed_locals?(template) template.fixed_locals? end # :nocov: else def self.tilt_template_fixed_locals?(template) false end end # :nocov: if compiled_method_arity == -2 def self.tilt_template_compiled_method(template, locals_keys, scope_class) template.send(:compiled_method, locals_keys, scope_class) end # :nocov: else def self.tilt_template_compiled_method(template, locals_keys, scope_class) template.send(:compiled_method, locals_keys) end # :nocov: end # Setup default rendering options. See Render for details. def self.configure(app, opts=OPTS) if app.opts[:render] orig_cache = app.opts[:render][:cache] orig_method_cache = app.opts[:render][:template_method_cache] opts = app.opts[:render][:orig_opts].merge(opts) end app.opts[:render] = opts.dup app.opts[:render][:orig_opts] = opts opts = app.opts[:render] opts[:engine] = (opts[:engine] || "erb").dup.freeze opts[:views] = app.expand_path(opts[:views]||"views").freeze opts[:allowed_paths] ||= [opts[:views]].freeze opts[:allowed_paths] = opts[:allowed_paths].map{|f| app.expand_path(f, nil)}.uniq.freeze opts[:check_paths] = true unless opts.has_key?(:check_paths) opts[:assume_fixed_locals] &&= FIXED_LOCALS_COMPILED_METHOD_SUPPORT unless opts.has_key?(:check_template_mtime) opts[:check_template_mtime] = if opts[:cache] == false || opts[:explicit_cache] true else ENV['RACK_ENV'] == 'development' end end begin app.const_get(:RodaCompiledTemplates, false) rescue NameError compiled_templates_module = Module.new app.send(:include, compiled_templates_module) app.const_set(:RodaCompiledTemplates, compiled_templates_module) end opts[:template_method_cache] = orig_method_cache || (opts[:cache_class] || RodaCache).new opts[:template_method_cache][:_roda_layout] = nil if opts[:template_method_cache][:_roda_layout] opts[:cache] = orig_cache || (opts[:cache_class] || RodaCache).new opts[:layout_opts] = (opts[:layout_opts] || {}).dup opts[:layout_opts][:_is_layout] = true if opts[:layout_opts][:views] opts[:layout_opts][:views] = app.expand_path(opts[:layout_opts][:views]).freeze end if layout = opts.fetch(:layout, true) opts[:layout] = true case layout when Hash opts[:layout_opts].merge!(layout) when true opts[:layout_opts][:template] ||= 'layout' else opts[:layout_opts][:template] = layout end opts[:optimize_layout] = (opts[:layout_opts][:template] if opts[:layout_opts].keys.sort == [:_is_layout, :template]) end opts[:layout_opts].freeze template_opts = opts[:template_opts] = (opts[:template_opts] || {}).dup template_opts[:outvar] ||= '@_out_buf' unless template_opts.has_key?(:default_encoding) template_opts[:default_encoding] = Encoding.default_external end engine_opts = opts[:engine_opts] = (opts[:engine_opts] || {}).dup engine_opts.to_a.each do |k,v| engine_opts[k] = v.dup.freeze end if escape = opts[:escape] require 'tilt/erubi' case escape when String, Array Array(escape).each do |engine| engine_opts[engine] = (engine_opts[engine] || {}).merge(:escape => true).freeze end else template_opts[:escape] = true end end template_opts.freeze engine_opts.freeze opts.freeze end # Wrapper object for the Tilt template, that checks the modified # time of the template file, and rebuilds the template if the # template file has been modified. This is an internal class and # the API is subject to change at any time. class TemplateMtimeWrapper def initialize(roda_class, opts, template_opts) @roda_class = roda_class @opts = opts @template_opts = template_opts reset_template @path = opts[:path] deps = opts[:dependencies] @dependencies = ([@path] + Array(deps)) if deps @mtime = template_last_modified end # If the template file exists and the modification time has # changed, rebuild the template file, then call render on it. def render(*args, &block) res = nil modified = false if_modified do res = @template.render(*args, &block) modified = true end modified ? res : @template.render(*args, &block) end # Return when the template was last modified. If the template depends on any # other files, check the modification times of all dependencies and # return the maximum. def template_last_modified if deps = @dependencies deps.map{|f| File.mtime(f)}.max else File.mtime(@path) end end # If the template file has been updated, return true and update # the template object and the modification time. Other return false. def if_modified begin mtime = template_last_modified rescue # ignore errors else if mtime != @mtime reset_template yield @mtime = mtime end end end if COMPILED_METHOD_SUPPORT # Whether the underlying template uses fixed locals. def fixed_locals? Render.tilt_template_fixed_locals?(@template) end # Compile a method in the given module with the given name that will # call the compiled template method, updating the compiled template method def define_compiled_method(roda_class, method_name, locals_keys=EMPTY_ARRAY) mod = roda_class::RodaCompiledTemplates internal_method_name = :"_#{method_name}" begin mod.send(:define_method, internal_method_name, compiled_method(locals_keys, roda_class)) rescue ::NotImplementedError return false end mod.send(:private, internal_method_name) mod.send(:define_method, method_name, &compiled_method_lambda(roda_class, internal_method_name, locals_keys)) mod.send(:private, method_name) method_name end # Returns an appropriate value for the template method cache. def define_compiled_method_cache_value(roda_class, method_name, locals_keys=EMPTY_ARRAY) if compiled_method = define_compiled_method(roda_class, method_name, locals_keys) [compiled_method, false].freeze else compiled_method end end private # Return the compiled method for the current template object. def compiled_method(locals_keys=EMPTY_ARRAY, roda_class=nil) Render.tilt_template_compiled_method(@template, locals_keys, roda_class) end # Return the lambda used to define the compiled template method. This # is separated into its own method so the lambda does not capture any # unnecessary local variables def compiled_method_lambda(roda_class, method_name, locals_keys=EMPTY_ARRAY) mod = roda_class::RodaCompiledTemplates template = self lambda do |locals, &block| template.if_modified do mod.send(:define_method, method_name, Render.tilt_template_compiled_method(template, locals_keys, roda_class)) mod.send(:private, method_name) end _call_optimized_template_method([method_name, Render.tilt_template_fixed_locals?(template)], locals, &block) end end end private # Reset the template, done every time the template or one of its # dependencies is modified. def reset_template @template = @roda_class.create_template(@opts, @template_opts) end end module ClassMethods if COMPILED_METHOD_SUPPORT # If using compiled methods and there is an optimized layout, speed up # access to the layout method to improve the performance of view. def freeze begin _freeze_layout_method rescue # This is only for optimization, if any errors occur, they can be ignored. # One possibility for error is the app doesn't use a layout, but doesn't # specifically set the :layout=>false plugin option. nil end # Optimize _call_optimized_template_method if you know all templates # are going to be using fixed locals. if render_opts[:assume_fixed_locals] && !render_opts[:check_template_mtime] include AssumeFixedLocalsInstanceMethods end super end end # Return an Tilt::Template object based on the given opts and template_opts. def create_template(opts, template_opts) opts[:template_class].new(opts[:path], 1, template_opts, &opts[:template_block]) end # A proc that returns content, used for inline templates, so that the template # doesn't hold a reference to the instance of the class def inline_template_block(content) Proc.new{content} end # Copy the rendering options into the subclass, duping # them as necessary to prevent changes in the subclass # affecting the parent class. def inherited(subclass) super opts = subclass.opts[:render] = subclass.opts[:render].dup if COMPILED_METHOD_SUPPORT opts[:template_method_cache] = (opts[:cache_class] || RodaCache).new end opts[:cache] = opts[:cache].dup opts.freeze end # Return the render options for this class. def render_opts opts[:render] end private # Precompile the layout method, to reduce method calls to look it up at runtime. def _freeze_layout_method if render_opts[:layout] instance = allocate # This needs to be called even if COMPILED_METHOD_SUPPORT is not set, # in order for the precompile_templates plugin to work correctly. instance.send(:retrieve_template, instance.send(:view_layout_opts, OPTS)) if COMPILED_METHOD_SUPPORT && (layout_template = render_opts[:optimize_layout]) && !opts[:render][:optimized_layout_method_created] instance.send(:retrieve_template, :template=>layout_template, :cache_key=>nil, :template_method_cache_key => :_roda_layout) layout_method = opts[:render][:template_method_cache][:_roda_layout] define_method(:_layout_method){layout_method} private :_layout_method alias_method(:_layout_method, :_layout_method) opts[:render] = opts[:render].merge(:optimized_layout_method_created=>true) end end end end module InstanceMethods # Render the given template. See Render for details. def render(template, opts = (no_opts = true; optimized_template = _cached_template_method(template); OPTS), &block) if optimized_template _call_optimized_template_method(optimized_template, OPTS, &block) elsif !no_opts && opts.length == 1 && (locals = opts[:locals]) && (optimized_template = _optimized_render_method_for_locals(template, locals)) _call_optimized_template_method(optimized_template, locals, &block) else opts = render_template_opts(template, opts) retrieve_template(opts).render((opts[:scope]||self), (opts[:locals]||OPTS), &block) end end # Return the render options for the instance's class. def render_opts self.class.render_opts end # Render the given template. If there is a default layout # for the class, take the result of the template rendering # and render it inside the layout. Blocks passed to view # are passed to render when rendering the template. # See Render for details. def view(template, opts = (content = _optimized_view_content(template) unless defined?(yield); OPTS), &block) if content # First, check if the optimized layout method has already been created, # and use it if so. This way avoids the extra conditional and local variable # assignments in the next section. if layout_method = _layout_method return _call_optimized_template_method(layout_method, OPTS){content} end # If we have an optimized template method but no optimized layout method, create the # optimized layout method if possible and use it. If you can't create the optimized # layout method, fall through to the slower approach. if layout_template = self.class.opts[:render][:optimize_layout] retrieve_template(:template=>layout_template, :cache_key=>nil, :template_method_cache_key => :_roda_layout) if layout_method = _layout_method return _call_optimized_template_method(layout_method, OPTS){content} end end else opts = parse_template_opts(template, opts) content = opts[:content] || render_template(opts, &block) end if layout_opts = view_layout_opts(opts) content = render_template(layout_opts){content} end content end private if COMPILED_METHOD_SUPPORT # If there is an instance method for the template, return the instance # method symbol. This optimization is only used for render/view calls # with a single string or symbol argument. def _cached_template_method(template) case template when String, Symbol if (method_cache = render_opts[:template_method_cache]) _cached_template_method_lookup(method_cache, template) end end end # The key to use in the template method cache for the given template. def _cached_template_method_key(template) template end # Return the instance method symbol for the template in the method cache. def _cached_template_method_lookup(method_cache, template) method_cache[template] end # Return a symbol containing the optimized layout method def _layout_method self.class.opts[:render][:template_method_cache][:_roda_layout] end # Use an optimized render path for templates with a hash of locals. Returns the result # of the template render if the optimized path is used, or nil if the optimized # path is not used and the long method needs to be used. def _optimized_render_method_for_locals(template, locals) render_opts = self.render_opts return unless method_cache = render_opts[:template_method_cache] case template when String, Symbol if fixed_locals = render_opts[:assume_fixed_locals] key = template if optimized_template = _cached_template_method_lookup(method_cache, key) return optimized_template end else key = [:_render_locals, template] if optimized_template = _cached_template_method_lookup(method_cache, key) # Fixed locals case return optimized_template end locals_keys = locals.keys.sort key << locals_keys if optimized_template = _cached_template_method_lookup(method_cache, key) # Regular locals case return optimized_template end end else return end if method_cache_key = _cached_template_method_key(key) template_obj = retrieve_template(render_template_opts(template, NO_CACHE)) unless fixed_locals key.pop if fixed_locals = Render.tilt_template_fixed_locals?(template_obj) key.freeze end method_name = :"_roda_template_locals_#{self.class.object_id}_#{method_cache_key}" method_cache[method_cache_key] = case template_obj when Render::TemplateMtimeWrapper template_obj.define_compiled_method_cache_value(self.class, method_name, locals_keys) else begin unbound_method = Render.tilt_template_compiled_method(template_obj, locals_keys, self.class) rescue ::NotImplementedError false else self.class::RodaCompiledTemplates.send(:define_method, method_name, unbound_method) self.class::RodaCompiledTemplates.send(:private, method_name) [method_name, fixed_locals].freeze end end end end # Get the content for #view, or return nil to use the unoptimized approach. Only called if # a single argument is passed to view. def _optimized_view_content(template) if optimized_template = _cached_template_method(template) _call_optimized_template_method(optimized_template, OPTS) elsif template.is_a?(Hash) && template.length == 1 template[:content] end end if RUBY_VERSION >= '3' class_eval(<<-RUBY, __FILE__, __LINE__ + 1) def _call_optimized_template_method((meth, fixed_locals), locals, &block) if fixed_locals send(meth, **locals, &block) else send(meth, locals, &block) end end RUBY # :nocov: elsif RUBY_VERSION >= '2' class_eval(<<-RUBY, __FILE__, __LINE__ + 1) def _call_optimized_template_method((meth, fixed_locals), locals, &block) if fixed_locals if locals.empty? send(meth, &block) else send(meth, **locals, &block) end else send(meth, locals, &block) end end RUBY else # Call the optimized template method. This is designed to be used with the # method cache, which caches the method name and whether the method uses # fixed locals. Methods with fixed locals need to be called with a keyword # splat. def _call_optimized_template_method((meth, fixed_locals), locals, &block) send(meth, locals, &block) end end # :nocov: else def _cached_template_method(_) nil end def _cached_template_method_key(_) nil end def _optimized_render_method_for_locals(_, _) nil end def _optimized_view_content(template) nil end end # Convert template options to single hash when rendering templates using render. def render_template_opts(template, opts) parse_template_opts(template, opts) end # Private alias for render. Should be used by other plugins when they want to render a template # without a layout, as plugins can override render to use a layout. alias render_template render # If caching templates, attempt to retrieve the template from the cache. Otherwise, just yield # to get the template. def cached_template(opts, &block) if key = opts[:cache_key] cache = render_opts[:cache] unless template = cache[key] template = cache[key] = yield end template else yield end end # Given the template name and options, set the template class, template path/content, # template block, and locals to use for the render in the passed options. def find_template(opts) render_opts = self.class.opts[:render] engine_override = opts[:engine] engine = opts[:engine] ||= render_opts[:engine] if content = opts[:inline] path = opts[:path] = content template_class = opts[:template_class] ||= ::Tilt[engine] opts[:template_block] = self.class.inline_template_block(content) else opts[:views] ||= render_opts[:views] path = opts[:path] ||= template_path(opts) template_class = opts[:template_class] opts[:template_class] ||= ::Tilt end if (cache = opts[:cache]).nil? cache = content || !opts[:template_block] end if cache unless opts.has_key?(:cache_key) template_block = opts[:template_block] unless content template_opts = opts[:template_opts] opts[:cache_key] = if template_class || engine_override || template_opts || template_block [path, template_class, engine_override, template_opts, template_block] else path end end else opts.delete(:cache_key) end opts end # Return a single hash combining the template and opts arguments. def parse_template_opts(template, opts) opts = Hash[opts] if template.is_a?(Hash) opts.merge!(template) else if opts.empty? && (key = _cached_template_method_key(template)) opts[:template_method_cache_key] = key end opts[:template] = template opts end end # The default render options to use. These set defaults that can be overridden by # providing a :layout_opts option to the view/render method. def render_layout_opts Hash[render_opts[:layout_opts]] end # Retrieve the Tilt::Template object for the given template and opts. def retrieve_template(opts) cache = opts[:cache] if !opts[:cache_key] || cache == false found_template_opts = opts = find_template(opts) end cached_template(opts) do opts = found_template_opts || find_template(opts) render_opts = self.class.opts[:render] template_opts = render_opts[:template_opts] if engine_opts = render_opts[:engine_opts][opts[:engine]] template_opts = template_opts.merge(engine_opts) end if current_template_opts = opts[:template_opts] template_opts = template_opts.merge(current_template_opts) end define_compiled_method = COMPILED_METHOD_SUPPORT && (method_cache_key = opts[:template_method_cache_key]) && (method_cache = render_opts[:template_method_cache]) && (method_cache[method_cache_key] != false) && !opts[:inline] if render_opts[:check_template_mtime] && !opts[:template_block] && !cache template = TemplateMtimeWrapper.new(self.class, opts, template_opts) if define_compiled_method method_name = :"_roda_template_#{self.class.object_id}_#{method_cache_key}" method_cache[method_cache_key] = template.define_compiled_method_cache_value(self.class, method_name) end else template = self.class.create_template(opts, template_opts) if define_compiled_method && cache != false begin unbound_method = Render.tilt_template_compiled_method(template, EMPTY_ARRAY, self.class) rescue ::NotImplementedError method_cache[method_cache_key] = false else method_name = :"_roda_template_#{self.class.object_id}_#{method_cache_key}" self.class::RodaCompiledTemplates.send(:define_method, method_name, unbound_method) self.class::RodaCompiledTemplates.send(:private, method_name) method_cache[method_cache_key] = [method_name, Render.tilt_template_fixed_locals?(template)].freeze end end end template end end # The name to use for the template. By default, just converts the :template option to a string. def template_name(opts) opts[:template].to_s end # The template path for the given options. def template_path(opts) path = "#{opts[:views]}/#{template_name(opts)}.#{opts[:engine]}" if opts.fetch(:check_paths){render_opts[:check_paths]} full_path = self.class.expand_path(path) unless render_opts[:allowed_paths].any?{|f| full_path.start_with?(f)} raise RodaError, "attempt to render path not in allowed_paths: #{full_path} (allowed: #{render_opts[:allowed_paths].join(', ')})" end end path end # If a layout should be used, return a hash of options for # rendering the layout template. If a layout should not be # used, return nil. def view_layout_opts(opts) if layout = opts.fetch(:layout, render_opts[:layout]) layout_opts = render_layout_opts method_layout_opts = opts[:layout_opts] layout_opts.merge!(method_layout_opts) if method_layout_opts case layout when Hash layout_opts.merge!(layout) when true # use default layout else layout_opts[:template] = layout end layout_opts end end end module AssumeFixedLocalsInstanceMethods # :nocov: if RUBY_VERSION >= '3.0' # :nocov: class_eval(<<-RUBY, __FILE__, __LINE__ + 1) def _call_optimized_template_method((meth,_), locals, &block) send(meth, **locals, &block) end RUBY end end end register_plugin(:render, Render) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/render_coverage.rb 0000664 0000000 0000000 00000010232 15167207754 0024241 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true require 'tilt' # :nocov: raise 'Tilt version does not support coverable templates' unless Tilt::Template.method_defined?(:compiled_path=) # :nocov: # class Roda module RodaPlugins # The render_coverage plugin builds on top of the render plugin # and sets compiled_path on created templates. This allows # Ruby's coverage library before Ruby 3.2 to consider code created # by templates. You may not need this plugin on Ruby 3.2+, since # on Ruby 3.2+, coverage can consider code loaded with +eval+. # This plugin is only supported when using tilt 2.1+, since it # requires the compiled_path supported added in tilt 2.1. # # By default, the render_coverage plugin will use +coverage/views+ # as the directory containing the compiled template files. You can # change this by passing the :dir option when loading the plugin. # By default, the plugin will set the compiled_path by taking the # template file path, stripping off any of the allowed_paths used # by the render plugin, and converting slashes to dashes. You can # override the allowed_paths to strip by passing the :strip_paths # option when loading the plugin. Paths outside :strip_paths (or # the render plugin allowed_paths if :strip_paths is not set) will # not have a compiled_path set. # # Due to how Ruby's coverage library works in regards to loading # a compiled template file with identical code more than once, # it may be beneficial to run coverage testing with the # +RODA_RENDER_COMPILED_METHOD_SUPPORT+ environment variable set # to +no+ if using this plugin. module RenderCoverage def self.load_dependencies(app, opts=OPTS) app.plugin :render end # Use the :dir option to set the directory to store the compiled # template files, and the :strip_paths directory for paths to # strip. def self.configure(app, opts=OPTS) app.opts[:render_coverage_strip_paths] = opts[:strip_paths].map{|f| File.expand_path(f)} if opts.has_key?(:strip_paths) coverage_dir = app.opts[:render_coverage_dir] = opts[:dir] || app.opts[:render_coverage_dir] || 'coverage/views' Dir.mkdir(coverage_dir) unless File.directory?(coverage_dir) end module ClassMethods # Set a compiled path on the created template, if the path for # the template is in one of the allowed_views. def create_template(opts, template_opts) return super if opts[:template_block] path = File.expand_path(opts[:path]) compiled_path = nil (self.opts[:render_coverage_strip_paths] || render_opts[:allowed_paths]).each do |dir| if path.start_with?(dir + '/') compiled_path = File.join(self.opts[:render_coverage_dir], path[dir.length+1, 10000000].tr('/', '-')) break end end # For Tilt 2.6+, when using :scope_class and fixed locals, must provide # compiled path as option, since compilation happens during initalization # in that case. This option should be ignored if the template does not # support it, but some template class may break if the option is not # handled, so for compatibility, only set the method if Tilt::Template # will handle it. if compiled_path && Tilt::Template.method_defined?(:fixed_locals?) template_opts = template_opts.dup template_opts[:compiled_path] = compiled_path compiled_path = nil end template = super # Set compiled path for template when using older tilt versions. # :nocov: template.compiled_path = compiled_path if compiled_path # :nocov: template end end module InstanceMethods private # Convert template paths to real paths to try to ensure the same template is cached. def template_path(opts) path = super if File.file?(path) File.realpath(path) else path end end end end register_plugin(:render_coverage, RenderCoverage) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/render_each.rb 0000664 0000000 0000000 00000017630 15167207754 0023357 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true require_relative 'render' # class Roda module RodaPlugins # The render_each plugin allows you to render a template for each # value in an enumerable, returning the concatention of all of the # template renderings. For example: # # render_each([1,2,3], :foo) # # will render the +foo+ template 3 times. Each time the template # is rendered, the local variable +foo+ will contain the given # value (e.g. on the first rendering +foo+ is 1). # # If you provide a block when calling the method, it will yield # each rendering instead of returning a concatentation of the # renderings. This is useful if you want to wrap each rendering in # something else. For example, instead of calling +render+ multiple # times in a loop: # # <% [1,2,3].each do |v| %> #<%= render(:foo, locals: {foo: v}) %>
# <% end %> # # You can use +render_each+, allowing for simpler and more optimized # code: # # <% render_each([1,2,3], :foo) do |text| %> #<%= text %>
# <% end %> # # You can also provide a block to avoid excess memory usage. For # example, if you are calling the method inside an erb template, # instead of doing: # # <%= render_each([1,2,3], :foo) %> # # You can do: # # <% render_each([1,2,3], :foo) %><%= body %><% end %> # # This results in the same behavior, but avoids building a large # intermediate string just to concatenate to the template result. # # When passing a block, +render_each+ returns +nil+. # # You can pass additional render options via an options hash: # # render_each([1,2,3], :foo, views: 'partials') # # One additional option supported by is +:local+, which sets the # local variable containing the current value to use. So: # # render_each([1,2,3], :foo, local: :bar) # # Will render the +foo+ template, but the local variable used inside # the template will be +bar+. You can use local: nil to # not set a local variable inside the template. By default, the # local variable name is based on the template name, with any # directories and file extensions removed. module RenderEach # Load the render plugin before this plugin, since this plugin # calls the render method. def self.load_dependencies(app) app.plugin :render end ALLOWED_KEYS = [:locals, :local].freeze if Render::COMPILED_METHOD_SUPPORT module ClassMethods # If using compiled methods and assuming fixed locals, optimize # _cached_render_each_template_method. def freeze if render_opts[:assume_fixed_locals] && !render_opts[:check_template_mtime] include AssumeFixedLocalsInstanceMethods end super end end module AssumeFixedLocalsInstanceMethods private # Optimize method since this module is only loaded when using fixed locals # and when caching templates. def _cached_render_each_template_method(template) case template when String, Symbol _cached_template_method_lookup(render_opts[:template_method_cache], template) else false end end end end module InstanceMethods # For each value in enum, render the given template using the # given opts. The template and options hash are passed to +render+. # Additional options supported: # :local :: The local variable to use for the current enum value # inside the template. An explicit +nil+ value does not # set a local variable. If not set, uses the template name. def render_each(enum, template, opts=(no_opts = true; optimized_template = _cached_render_each_template_method(template); OPTS), &block) if optimized_template return _optimized_render_each(enum, optimized_template, render_each_default_local(template), {}, &block) elsif opts.has_key?(:local) as = opts[:local] else as = render_each_default_local(template) if no_opts && optimized_template.nil? && (optimized_template = _optimized_render_method_for_locals(template, (locals = {as=>nil}))) return _optimized_render_each(enum, optimized_template, as, locals, &block) end end if as opts = opts.dup if locals opts[:locals] = locals else locals = opts[:locals] = if locals = opts[:locals] Hash[locals] else {} end locals[as] = nil end if (opts.keys - ALLOWED_KEYS).empty? && (optimized_template = _optimized_render_method_for_locals(template, locals)) return _optimized_render_each(enum, optimized_template, as, locals, &block) end end if defined?(yield) enum.each do |v| locals[as] = v if as yield render_template(template, opts) end nil else enum.map do |v| locals[as] = v if as render_template(template, opts) end.join end end private if File.basename("a/b") == "b" && File.basename("a\\b") == "a\\b" && RUBY_VERSION >= '3' # The default local variable name to use for the template, if the :local option # is not used when calling render_each. def render_each_default_local(template) # Optimize to avoid allocations when possible template = case template when Symbol s = template.name return template unless s.include?("/") || s.include?(".") s when String return template.to_sym unless template.include?("/") || template.include?(".") template else template.to_s end File.basename(template).sub(/\..+\z/, '').to_sym end # :nocov: else def render_each_default_local(template) File.basename(template.to_s).sub(/\..+\z/, '').to_sym end # :nocov: end if Render::COMPILED_METHOD_SUPPORT # If compiled method support is enabled in the render plugin, return the # method name to call to render the template. Return false if not given # a string or symbol, or if compiled method support for this template has # been explicitly disabled. Otherwise return nil. def _cached_render_each_template_method(template) case template when String, Symbol if (method_cache = render_opts[:template_method_cache]) key = render_opts[:assume_fixed_locals] ? template : [:_render_locals, template, [template.to_sym]] _cached_template_method_lookup(method_cache, key) end else false end end # Use an optimized render for each value in the enum. def _optimized_render_each(enum, optimized_template, as, locals) if defined?(yield) enum.each do |v| locals[as] = v yield _call_optimized_template_method(optimized_template, locals) end nil else enum.map do |v| locals[as] = v _call_optimized_template_method(optimized_template, locals) end.join end end else def _cached_render_each_template_method(template) nil end end end end register_plugin(:render_each, RenderEach) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/render_locals.rb 0000664 0000000 0000000 00000006117 15167207754 0023732 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true require_relative 'render' # class Roda module RodaPlugins # The render_locals plugin allows setting default locals for rendering templates. # # plugin :render_locals, render: {heading: 'Hello'} # # route do |r| # r.get "foo" do # view 'foo', locals: {name: 'Foo'} # locals: {:heading=>'Hello', :name=>'Foo'} # end # # r.get "bar" do # view 'foo', locals: {heading: 'Bar'} # locals: {:heading=>'Bar'} # end # # view "default" # locals: {:heading=>'Hello'} # end # # The render_locals plugin accepts the following options: # # render :: The default locals to use for template rendering # layout :: The default locals to use for layout rendering # merge :: Whether to merge template locals into layout locals module RenderLocals def self.load_dependencies(app, opts=OPTS) app.plugin :render end def self.configure(app, opts=OPTS) app.opts[:render_locals] = (app.opts[:render_locals] || {}).merge(opts[:render]||{}).freeze app.opts[:layout_locals] = (app.opts[:layout_locals] || {}).merge(opts[:layout]||{}).freeze if opts.has_key?(:merge) app.opts[:merge_locals] = opts[:merge] app.opts[:layout_locals] = app.opts[:render_locals].merge(app.opts[:layout_locals]).freeze end end module InstanceMethods private if Render::COMPILED_METHOD_SUPPORT # Disable use of cached templates, since it assumes a render/view call with no # options will have no locals. def _cached_template_method(template) nil end def _optimized_view_content(template) nil end end def render_locals opts[:render_locals] end def layout_locals opts[:layout_locals] end # If this isn't the layout template, then use the plugin's render locals as the default locals. def render_template_opts(template, opts) opts = super return opts if opts[:_is_layout] plugin_locals = render_locals if locals = opts[:locals] plugin_locals = Hash[plugin_locals].merge!(locals) end opts[:locals] = plugin_locals opts end # If using a layout, then use the plugin's layout locals as the default locals. def view_layout_opts(opts) if layout_opts = super merge_locals = layout_opts.has_key?(:merge_locals) ? layout_opts[:merge_locals] : self.opts[:merge_locals] locals = {} locals.merge!(layout_locals) if merge_locals && (method_locals = opts[:locals]) locals.merge!(method_locals) end if method_layout_locals = layout_opts[:locals] locals.merge!(method_layout_locals) end layout_opts[:locals] = locals layout_opts end end end end register_plugin(:render_locals, RenderLocals) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/request_aref.rb 0000664 0000000 0000000 00000004607 15167207754 0023605 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The request_aref plugin allows for custom handling of the r[] and r[]= # methods (where r is the Request instance). In the current version of # rack, these methods are deprecated, but the deprecation message is only # printed in verbose mode. This plugin can allow for handling calls to # these methods in one of three ways: # # :allow :: Allow the method calls without a deprecation, which is the # historical behavior # :warn :: Always issue a deprecation message by calling +warn+, not just # in verbose mode. # :raise :: Raise an error if either method is called module RequestAref # Make #[] and #[]= methods work as configured by aliasing the appropriate # request_a(ref|set)_* methods to them. def self.configure(app, setting) case setting when :allow, :raise, :warn app::RodaRequest.class_eval do alias_method(:[], :"request_aref_#{setting}") alias_method(:[]=, :"request_aset_#{setting}") public :[], :[]= end else raise RodaError, "Unsupport request_aref plugin setting: #{setting.inspect}" end end # Exception class raised when #[] or #[]= are called when the # :raise setting is used. class Error < RodaError end module RequestMethods private # Allow #[] calls def request_aref_allow(k) params[k.to_s] end # Always warn on #[] calls def request_aref_warn(k) warn("#{self.class}#[] is deprecated, use #params.[] instead") params[k.to_s] end # Raise error on #[] calls def request_aref_raise(k) raise Error, "#{self.class}#[] has been removed, use #params.[] instead" end # Allow #[]= calls def request_aset_allow(k, v) params[k.to_s] = v end # Always warn on #[]= calls def request_aset_warn(k, v) warn("#{self.class}#[]= is deprecated, use #params.[]= instead") params[k.to_s] = v end # Raise error on #[]= calls def request_aset_raise(k, v) raise Error, "#{self.class}#[]= has been removed, use #params.[]= instead" end end end register_plugin(:request_aref, RequestAref) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/request_headers.rb 0000664 0000000 0000000 00000004013 15167207754 0024272 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true require 'set' class Roda module RodaPlugins # The request_headers plugin provides access to headers sent in the # request in a more natural way than directly accessing the env hash. # # In practise this means you don't need to uppercase, convert dashes # to underscores, or add a HTTP_ prefix. # # For example, to access a header called X-My-Header you # would previously need to do: # # r.env['HTTP_X_MY_HEADER'] # # But with this plugin you can now say: # # r.headers['X-My-Header'] # # The name is actually case-insensitive so x-my-header will work as well. # # Example: # # plugin :request_headers module RequestHeaders module RequestMethods # Provide access to the request headers while normalizing indexes. def headers @request_headers ||= Headers.new(@env) end end class Headers # Set of environment variable names that don't need HTTP_ prepended to them. CGI_VARIABLES = Set.new(%w' AUTH_TYPE CONTENT_LENGTH CONTENT_TYPE GATEWAY_INTERFACE HTTPS PATH_INFO PATH_TRANSLATED QUERY_STRING REMOTE_ADDR REMOTE_HOST REMOTE_IDENT REMOTE_USER REQUEST_METHOD SCRIPT_NAME SERVER_NAME SERVER_PORT SERVER_PROTOCOL SERVER_SOFTWARE ').freeze def initialize(env) @env = env end # Returns the value for the given key mapped to @env def [](key) @env[env_name(key)] end private # Convert a HTTP header name into an environment variable name def env_name(key) key = key.to_s.upcase key.tr!('-', '_') key = 'HTTP_' + key unless CGI_VARIABLES.include?(key) key end end end register_plugin(:request_headers, RequestHeaders) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/response_attachment.rb 0000664 0000000 0000000 00000007702 15167207754 0025165 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true require 'rack/mime' # class Roda module RodaPlugins # The attachment plugin adds a response.attachment method. # When called with no filename, +attachment+ sets the Content-Disposition # to attachment. When called with a filename,+attachment+ sets the Content-Disposition # to attachment with the appropriate filename parameter, and if the filename # extension is recognized, this also sets the Content-Type to the appropriate # MIME type if not already set. # # # set Content-Disposition to 'attachment' # response.attachment # # # set Content-Disposition to 'attachment; filename="a.csv"', # # also set Content-Type to 'text/csv' # response.attachment 'a.csv' # # == License # # The implementation was originally taken from Sinatra, # which is also released under the MIT License: # # Copyright (c) 2007, 2008, 2009 Blake Mizerany # Copyright (c) 2010, 2011, 2012, 2013, 2014 Konstantin Haase # # Permission is hereby granted, free of charge, to any person # obtaining a copy of this software and associated documentation # files (the "Software"), to deal in the Software without # restriction, including without limitation the rights to use, # copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the # Software is furnished to do so, subject to the following # conditions: # # The above copyright notice and this permission notice shall be # included in all copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, # EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES # OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND # NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT # HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, # WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING # FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR # OTHER DEALINGS IN THE SOFTWARE. module ResponseAttachment UTF8_ENCODING = Encoding.find('UTF-8') ISO88591_ENCODING = Encoding.find('ISO-8859-1') BINARY_ENCODING = Encoding.find('BINARY') module ResponseMethods # Set the Content-Disposition to "attachment" with the specified filename, # instructing the user agents to prompt to save. def attachment(filename = nil, disposition='attachment') if filename param_filename = File.basename(filename) encoding = param_filename.encoding needs_encoding = param_filename.gsub!(/[^ 0-9a-zA-Z!\#$&\+\.\^_`\|~]+/, '-') params = "; filename=#{param_filename.inspect}" if needs_encoding && (encoding == UTF8_ENCODING || encoding == ISO88591_ENCODING) # File name contains non attr-char characters from RFC 5987 Section 3.2.1 encoded_filename = File.basename(filename).force_encoding(BINARY_ENCODING) # Similar regexp as above, but treat each byte separately, and encode # space characters, since those aren't allowed in attr-char encoded_filename.gsub!(/[^0-9a-zA-Z!\#$&\+\.\^_`\|~]/) do |c| "%%%X" % c.ord end encoded_params = "; filename*=#{encoding.to_s}''#{encoded_filename}" end unless @headers[RodaResponseHeaders::CONTENT_TYPE] ext = File.extname(filename) if !ext.empty? && (content_type = Rack::Mime.mime_type(ext, nil)) @headers[RodaResponseHeaders::CONTENT_TYPE] = content_type end end end @headers[RodaResponseHeaders::CONTENT_DISPOSITION] = "#{disposition}#{params}#{encoded_params}" end end end register_plugin(:response_attachment, ResponseAttachment) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/response_content_type.rb 0000664 0000000 0000000 00000005167 15167207754 0025553 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The response_content_type extension adds response.content_type # and response.content_type= methods for getting and setting the # response content-type. # # When setting the content-type, you can pass either a string, which # is used directly: # # response.content_type = "text/html" # # Or, if you have registered mime types when loading the plugin: # # plugin :response_content_type, mime_types: { # plain: "text/plain", # html: "text/html", # pdf: "application/pdf" # } # # You can use a symbol: # # response.content_type = :html # # If you would like to load all mime types supported by rack/mime, # you can use the mime_types: :from_rack_mime option: # # plugin :response_content_type, mime_types: :from_rack_mime # # Note that you are unlikely to be using all of these mime types, # so doing this will likely result in unnecessary memory usage. It # is recommended to use a hash with only the mime types your # application actually uses. # # To prevent silent failures, if you attempt to set the response # type with a symbol, and the symbol is not recognized, a KeyError # is raised. module ResponseContentType def self.configure(app, opts=OPTS) if mime_types = opts[:mime_types] mime_types = if mime_types == :from_rack_mime require "rack/mime" h = {} Rack::Mime::MIME_TYPES.each do |k, v| h[k.slice(1,100).to_sym] = v end h else mime_types.dup end app.opts[:repsonse_content_types] = mime_types.freeze else app.opts[:repsonse_content_types] ||= {} end end module ResponseMethods # Return the content-type of the response. Will be nil if it has # not yet been explicitly set. def content_type @headers[RodaResponseHeaders::CONTENT_TYPE] end # Set the content-type of the response. If given a string, # it is used directly. If given a symbol, looks up the mime # type with the given file extension. If the symbol is not # a recognized mime type, raises KeyError. def content_type=(mime_type) mime_type = roda_class.opts[:repsonse_content_types].fetch(mime_type) if mime_type.is_a?(Symbol) @headers[RodaResponseHeaders::CONTENT_TYPE] = mime_type end end end register_plugin(:response_content_type, ResponseContentType) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/response_request.rb 0000664 0000000 0000000 00000001232 15167207754 0024515 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The response_request plugin gives the response access to the # related request instance via the #request method. # # Example: # # plugin :response_request module ResponseRequest module InstanceMethods # Set the response's request to the current request. def initialize(env) super @_response.request = @_request end end module ResponseMethods # The request related to this response. attr_accessor :request end end register_plugin(:response_request, ResponseRequest) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/route_block_args.rb 0000664 0000000 0000000 00000002745 15167207754 0024445 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The route_block_args plugin lets you customize what arguments are passed to # the +route+ block. So if you have an application that always needs access # to the +response+, the +params+, the +env+, or the +session+, you can use # this plugin so that any of those can be arguments to the route block. # Example: # # class App < Roda # plugin :route_block_args do # [request, request.params, response] # end # # route do |r, params, res| # r.post do # artist = Artist.create(name: params['name'].to_s) # res.status = 201 # artist.id.to_s # end # end # end module RouteBlockArgs def self.configure(app, &block) app.instance_exec do define_roda_method(:_roda_route_block_args, 0, &block) route(&@raw_route_block) if @raw_route_block end end # Override the route block input so that the block # given is passed the arguments specified by the # block given to the route_block_args plugin. module ClassMethods private def convert_route_block(block) meth = define_roda_method("convert_route_block_args", :any, &super(block)) lambda do |_| send(meth, *_roda_route_block_args) end end end end register_plugin :route_block_args, RouteBlockArgs end end jeremyevans-roda-4f30bb3/lib/roda/plugins/route_csrf.rb 0000664 0000000 0000000 00000046072 15167207754 0023275 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true require 'openssl' require 'securerandom' require 'uri' require 'rack/utils' class Roda module RodaPlugins # The route_csrf plugin is the recommended plugin to use to support # CSRF protection in Roda applications. This plugin allows you set # where in the routing tree to enforce CSRF protection. Additionally, # the route_csrf plugin uses modern security practices. # # By default, the plugin requires tokens be specific to the request # method and request path, so a CSRF token generated for one form will # not be usable to submit a different form. # # This plugin also takes care to not expose the underlying CSRF key # (except in the session), so that it is not possible for an attacker # to generate valid CSRF tokens specific to an arbitrary request method # and request path even if they have access to a token that is not # specific to request method and request path. To get this security # benefit, you must ensure an attacker does not have access to the # session. Rack::Session::Cookie versions shipped with Rack before # Rack 3 use signed sessions, not encrypted # sessions, so if the attacker has the ability to read cookie data # and you are using one of those Rack::Session::Cookie versions, # it will still be possible # for an attacker to generate valid CSRF tokens specific to arbitrary # request method and request path. Roda's session plugin uses # encrypted sessions and therefore is safe even if the attacker can # read cookie data. # # == Usage # # It is recommended to use the plugin defaults, loading the # plugin with no options: # # plugin :route_csrf # # This plugin supports the following options: # # :field :: Form input parameter name for CSRF token (default: '_csrf') # :formaction_field :: Form input parameter name for path-specific CSRF tokens (used by the # +csrf_formaction_tag+ method). If present, this parameter should be # submitted as a hash, keyed by path, with CSRF token values. # :header :: HTTP header name for CSRF token (default: 'X-CSRF-Token') # :key :: Session key for CSRF secret (default: '_roda_csrf_secret') # :require_request_specific_tokens :: Whether request-specific tokens are required (default: true). # A false value will allow tokens that are not request-specific # to also work. You should only set this to false if it is # impossible to use request-specific tokens. If you must # use non-request-specific tokens in certain cases, it is best # to leave this option true by default, and override it on a # per call basis in those specific cases. # :csrf_failure :: The action to taken if a request fails the CSRF check (default: :raise). Options: # :raise :: raise a Roda::RodaPlugins::RouteCsrf::InvalidToken exception # :empty_403 :: return a blank 403 page (rack_csrf's default behavior) # :clear_session :: Clear the current session # Proc :: Treated as a routing block, called with request object # :check_header :: Whether the HTTP header should be checked for the token value (default: false). # If true, checks the HTTP header after checking for the form input parameter. # If :only, only checks the HTTP header and doesn't check the form input parameter. # :check_request_methods :: Which request methods require CSRF protection # (default: ['POST', 'DELETE', 'PATCH', 'PUT']) # :upgrade_from_rack_csrf_key :: If provided, the session key that should be checked for the # rack_csrf raw token. If the session key is present, the value # will be checked against the submitted token, and if it matches, # the CSRF check will be passed. Should only be set temporarily # if upgrading from using rack_csrf to the route_csrf plugin, and # should be removed as soon as you are OK with CSRF forms generated # before the upgrade not longer being usable. The default rack_csrf # key is 'csrf.token'. # # The plugin also supports a block, in which case the block will be used # as the value of the :csrf_failure option. # # == Methods # # This adds the following instance methods: # # check_csrf!(opts={}) :: Used for checking if the submitted CSRF token is valid. # If a block is provided, it is treated as a routing block if the # CSRF token is not valid. Otherwise, by default, raises a # Roda::RodaPlugins::RouteCsrf::InvalidToken exception if a CSRF # token is necessary for the request and there is no token provided # or the provided token is not valid. Options can be provided to # override any of the plugin options for this specific call. # The :token option can be used to specify the provided CSRF token # (instead of looking for the token in the submitted parameters). # csrf_formaction_tag(path, method='POST') :: An HTML hidden input tag string containing the CSRF token, suitable # for placing in an HTML form that has inputs that use formaction # attributes to change the endpoint to which the form is submitted. # Takes the same arguments as csrf_token. # csrf_field :: The field name to use for the hidden tag containing the CSRF token. # csrf_path(action) :: This takes an argument that would be the value of the HTML form's # action attribute, and returns a path you can pass to csrf_token # that should be valid for the form submission. The argument should # either be nil or a string representing a relative path, absolute # path, or full URL (using appropriate URL encoding). # csrf_tag(path=nil, method='POST') :: An HTML hidden input tag string containing the CSRF token, suitable # for placing in an HTML form. Takes the same arguments as csrf_token. # csrf_token(path=nil, method='POST') :: The value of the csrf token, in case it needs to be accessed # directly. It is recommended to call this method with a # path, which will create a request-specific token. Calling # this method without an argument will create a token that is # not specific to the request, but such a token will only # work if you set the :require_request_specific_tokens option # to false, which is a bad idea from a security standpoint. # use_request_specific_csrf_tokens? :: Whether the plugin is configured to only support # request-specific tokens, true by default. # valid_csrf?(opts={}) :: Returns whether the submitted CSRF token is valid (also true if # the request does not require a CSRF token). Takes same option hash # as check_csrf!. # # This plugin also adds the following instance methods for compatibility with the # older csrf plugin, but it is not recommended to use these methods in new code: # # csrf_header :: The header name to use for submitting the CSRF token via an HTTP header # (useful for javascript). Note that this plugin will not look in # the HTTP header by default, it will only do so if the :check_header # option is used. # csrf_metatag :: An HTML meta tag string containing the CSRF token, suitable # for placing in the page header. It is not recommended to use # this method, as the token generated is not request-specific and # will not work unless you set the :require_request_specific_tokens option to # false, which is a bad idea from a security standpoint. # # == Token Cryptography # # route_csrf uses HMAC-SHA-256 to generate all CSRF tokens. It generates a random 32-byte secret, # which is stored base64 encoded in the session. For each CSRF token, it generates 31 bytes # of random data. # # For request-specific CSRF tokens, this pseudocode generates the HMAC: # # hmac = HMAC(secret, method + path + random_data) # # For CSRF tokens not specific to a request, this pseudocode generates the HMAC: # # hmac = HMAC(secret, random_data) # # This pseudocode generates the final CSRF token in both cases: # # token = Base64Encode(random_data + hmac) # # Using this construction for generating CSRF tokens means that generating any # valid CSRF token without knowledge of the secret is equivalent to a successful generic attack # on HMAC-SHA-256. # # By using an HMAC for tokens not specific to a request, it is not possible to use a # valid CSRF token that is not specific to a request to generate a valid request-specific # CSRF token. # # By including random data in the HMAC for all tokens, different tokens are generated # each time, mitigating compression ratio attacks such as BREACH. module RouteCsrf # Default CSRF option values DEFAULTS = { :field => '_csrf'.freeze, :formaction_field => '_csrfs'.freeze, :header => 'X-CSRF-Token'.freeze, :key => '_roda_csrf_secret'.freeze, :require_request_specific_tokens => true, :csrf_failure => :raise, :check_header => false, :check_request_methods => %w'POST DELETE PATCH PUT'.freeze.each(&:freeze) }.freeze # Exception class raised when :csrf_failure option is :raise and # a valid CSRF token was not provided. class InvalidToken < RodaError; end def self.load_dependencies(app, opts=OPTS, &_) app.plugin :_base64 end def self.configure(app, opts=OPTS, &block) options = app.opts[:route_csrf] = (app.opts[:route_csrf] || DEFAULTS).merge(opts) if block || opts[:csrf_failure].is_a?(Proc) if block && opts[:csrf_failure] raise RodaError, "Cannot specify both route_csrf plugin block and :csrf_failure option" end block ||= opts[:csrf_failure] options[:csrf_failure] = :csrf_failure_method app.define_roda_method(:_roda_route_csrf_failure, 1, &app.send(:convert_route_block, block)) end options[:env_header] = "HTTP_#{options[:header].to_s.tr('-', '_').upcase}".freeze options.freeze end module InstanceMethods # Check that the submitted CSRF token is valid, if the request requires a CSRF token. # If the CSRF token is valid or the request does not require a CSRF token, return nil. # Otherwise, if a block is given, treat it as a routing block and yield to it, and # if a block is not given, use the :csrf_failure option to determine how to handle it. def check_csrf!(opts=OPTS, &block) if msg = csrf_invalid_message(opts) if block @_request.on(&block) end case failure_action = opts.fetch(:csrf_failure, csrf_options[:csrf_failure]) when :raise raise InvalidToken, msg when :empty_403 @_response.status = 403 headers = @_response.headers headers.clear headers[RodaResponseHeaders::CONTENT_TYPE] = 'text/html' headers[RodaResponseHeaders::CONTENT_LENGTH] ='0' throw :halt, @_response.finish_with_body([]) when :clear_session session.clear when :csrf_failure_method @_request.on{_roda_route_csrf_failure(@_request)} when Proc RodaPlugins.warn "Passing a Proc as the :csrf_failure option value to check_csrf! is deprecated" @_request.on{instance_exec(@_request, &failure_action)} # Deprecated else raise RodaError, "Unsupported :csrf_failure option: #{failure_action.inspect}" end end end # The name of the hidden input tag containing the CSRF token. Also used as the name # for the meta tag. def csrf_field csrf_options[:field] end # The HTTP header name to use when submitting CSRF tokens in an HTTP header, if # such support is enabled (it is not by default). def csrf_header csrf_options[:header] end # An HTML meta tag string containing a CSRF token that is not request-specific. # It is not recommended to use this, as it doesn't support request-specific tokens. def csrf_metatag "" end # Given a form action, return the appropriate path to use for the CSRF token. # This makes it easier to generate request-specific tokens without having to # worry about the different types of form actions (relative paths, absolute # paths, URLs, empty paths). def csrf_path(action) case action when nil, '', /\A[#?]/ # use current path request.path when /\A(?:https?:\/)?\// # Either full URI or absolute path, extract just the path URI.parse(action).path else # relative path, join to current path URI.join(request.url, action).path end end # An HTML hidden input tag string containing the CSRF token, used for inputs # with formaction, so the same form can be used to submit to multiple endpoints # depending on which button was clicked. See csrf_token for arguments, but the # path argument is required. def csrf_formaction_tag(path, *args) "" end # An HTML hidden input tag string containing the CSRF token. See csrf_token for # arguments. def csrf_tag(*args) "" end # The value of the csrf token. For a path specific token, provide a path # argument. By default, it a path is provided, the POST request method will # be assumed. To generate a token for a non-POST request method, pass the # method as the second argument. def csrf_token(path=nil, method=('POST' if path)) token = SecureRandom.random_bytes(31) token << csrf_hmac(token, method, path) [token].pack("m0") end # Whether request-specific CSRF tokens should be used by default. def use_request_specific_csrf_tokens? csrf_options[:require_request_specific_tokens] end # Whether the submitted CSRF token is valid for the request. True if the # request does not require a CSRF token. def valid_csrf?(opts=OPTS) csrf_invalid_message(opts).nil? end private # Returns error message string if the CSRF token is not valid. # Returns nil if the CSRF token is valid. def csrf_invalid_message(opts) opts = opts.empty? ? csrf_options : csrf_options.merge(opts) method = request.request_method unless opts[:check_request_methods].include?(method) return end path = @_request.path unless encoded_token = opts[:token] encoded_token = case opts[:check_header] when :only env[opts[:env_header]] when true return (csrf_invalid_message(opts.merge(:check_header=>false)) && csrf_invalid_message(opts.merge(:check_header=>:only))) else params = @_request.params ((formactions = params[opts[:formaction_field]]).is_a?(Hash) && (formactions[path])) || params[opts[:field]] end end unless encoded_token.is_a?(String) return "encoded token is not a string" end if (rack_csrf_key = opts[:upgrade_from_rack_csrf_key]) && (rack_csrf_value = session[rack_csrf_key]) && csrf_compare(rack_csrf_value, encoded_token) return end # 31 byte random initialization vector # 32 byte HMAC # 63 bytes total # 84 bytes when base64 encoded unless encoded_token.bytesize == 84 return "encoded token length is not 84" end begin submitted_hmac = Base64_.decode64(encoded_token) rescue ArgumentError return "encoded token is not valid base64" end random_data = submitted_hmac.slice!(0...31) if csrf_compare(csrf_hmac(random_data, method, path), submitted_hmac) return end if opts[:require_request_specific_tokens] "decoded token is not valid for request method and path" else unless csrf_compare(csrf_hmac(random_data, '', ''), submitted_hmac) "decoded token is not valid for either request method and path or for blank method and path" end end end # Helper for getting the plugin options. def csrf_options opts[:route_csrf] end # Perform a constant-time comparison of the two strings, returning true if they match and false otherwise. def csrf_compare(s1, s2) Rack::Utils.secure_compare(s1, s2) end # Return the HMAC-SHA-256 for the secret and the given arguments. def csrf_hmac(random_data, method, path) OpenSSL::HMAC.digest(OpenSSL::Digest::SHA256.new, csrf_secret, "#{method.to_s.upcase}#{path}#{random_data}") end # If a secret has not already been specified, generate a random 32-byte # secret, stored base64 encoded in the session (to handle cases where # JSON is used for session serialization). def csrf_secret key = session[csrf_options[:key]] ||= SecureRandom.base64(32) Base64_.decode64(key) end end end register_plugin(:route_csrf, RouteCsrf) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/run_append_slash.rb 0000664 0000000 0000000 00000003011 15167207754 0024431 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The run_append_slash plugin makes +r.run+ use +/+ as the +PATH_INFO+ # when calling the rack application if +PATH_INFO+ would be empty. # Example: # # route do |r| # r.on "a" do # r.run App # end # end # # # without run_append_slash: # # GET /a => App gets "" as PATH_INFO # # GET /a/ => App gets "/" as PATH_INFO # # # with run_append_slash: # # GET /a => App gets "/" as PATH_INFO # # GET /a/ => App gets "/" as PATH_INFO module RunAppendSlash # Set plugin specific options. Options: # :use_redirects :: Whether to issue 302 redirects when appending the # trailing slash. def self.configure(app, opts=OPTS) app.opts[:run_append_slash_redirect] = !!opts[:use_redirects] end module RequestMethods # Calls the given rack app. If the path matches the root of the app but # does not contain a trailing slash, a trailing slash is appended to the # path internally, or a redirect is issued when configured with # use_redirects: true. def run(*) if @remaining_path.empty? if scope.opts[:run_append_slash_redirect] redirect("#{path}/") else @remaining_path += '/' end end super end end end register_plugin(:run_append_slash, RunAppendSlash) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/run_handler.rb 0000664 0000000 0000000 00000003133 15167207754 0023412 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The run_handler plugin allows r.run to take a block, which is yielded # the rack response array, before it returns it as a response. # # Additionally, r.run also takes a options hash, and you can provide a # not_found: :pass option to keep routing normally if the rack # app returns a 404 response. # # # plugin :run_handler # # route do |r| # r.on 'a' do # # Keep running code if RackAppFoo doesn't return a result # r.run RackAppFoo, not_found: :pass # # # Change response status codes before returning. # r.run(RackAppBar) do |response| # response[0] = 200 if response[0] == 201 # end # end # end module RunHandler module RequestMethods # If a block is given, yield the rack response array to it. The response can # be modified before it is returned by the current app. # # If the not_found: :pass option is given, and the rack response # returned by the app is a 404 response, do not return the response, continue # routing normally. def run(app, opts=OPTS) res = catch(:halt){super(app)} yield res if defined?(yield) if opts[:not_found] == :pass && res[0] == 404 body = res[2] body.close if body.respond_to?(:close) nil else throw(:halt, res) end end end end register_plugin(:run_handler, RunHandler) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/run_require_slash.rb 0000664 0000000 0000000 00000002657 15167207754 0024655 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The run_require_slash plugin makes +r.run+ a no-op if the remaining # path is not empty and does not start with +/+. The Rack SPEC requires that # +PATH_INFO+ start with a slash if not empty, so this plugin prevents # dispatching to the application with an environment that would violate the # Rack SPEC. # # You are unlikely to want to use this plugin unless you are consuming partial # segments of the request path, or using the match_affix plugin to change # how routing is done: # # plugin :match_affix, "", /(\/|\z)/ # route do |r| # r.on "/a" do # r.on "b" do # r.run App # end # end # end # # # with run_require_slash: # # GET /a/b/e => Not dispatched to application # # GET /a/b => App gets "" as PATH_INFO # # # without run_require_slash: # # GET /a/b/e => App gets "e" as PATH_INFO, violating rack SPEC # # GET /a/b => App gets "" as PATH_INFO module RunRequireSlash module RequestMethods # Calls the given rack app only if the remaining patch is empty or # starts with a slash. def run(*) if @remaining_path.empty? || @remaining_path.start_with?('/') super end end end end register_plugin(:run_require_slash, RunRequireSlash) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/sec_fetch_site_csrf.rb 0000664 0000000 0000000 00000013206 15167207754 0025077 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true class Roda module RodaPlugins # The sec_fetch_site plugin allows for CSRF protection using the # Sec-Fetch-Site header added in modern browsers. It allows for CSRF # protection without the use of CSRF tokens, which can simplify # form creation. # # The protection offered by the sec_fetch_site plugin is weaker than # the protection offered by the route_csrf plugin with default settings, # since it doesn't support per-request tokens. Be aware you are trading # security for simplicity when using the sec_fetch_site plugin instead # of the route_csrf plugin. Other caveats in using the sec_fetch_site # plugin: # # * Not all browsers set the Sec-Fetch-Site header. Some browsers # didn't start setting the header until 2023. In these cases, you # need to decide how to handle the request. The default is to deny # the request, though you can use the :allow_missing option to allow # it. # # * Sec-Fetch-Site headers are not set for http requests, only https # requests, so this doesn't offer protection for http requests. # # * It isn't possible to share a CSRF secret between applications in # different origins to allow cross-site requests between the # applications. # # This plugin adds the +check_sec_fetch_site!+ method to the routing # block scope. You should call this method at the appropriate place # in the routing tree to enforce the CSRF protection. The method can # accept a block to override the :csrf_failure plugin option behavior # on a per-call basis. # # When loading the plugin with no options: # # plugin :sec_fetch_site_csrf # # Only same-origin requests are allowed by default. # # This plugin supports the following options: # # :allow_missing :: Whether to allow requests lacking the Sec-Fetch-Site # header (false by default). # :allow_none :: Whether to allow requests where Sec-Fetch-Value is none # (false by default). # :allow_same_site :: Whether to allow requests where Sec-Fetch-Value is # same-site (false by default) # :check_request_methods :: Which request methods require CSRF protection # (default: ['POST', 'DELETE', 'PATCH', 'PUT']) # :csrf_failure :: The action to taken if a request does not have a valid header # (default: :raise). Options: # :raise :: raise a Roda::RodaPlugins::SecFetchSiteCsrf::CsrfFailure # exception # :empty_403 :: return a blank 403 page # :clear_session :: clear the current session # # The plugin also supports a block, in which case failures will call the block # as a routing block (the block should accept the request object). module SecFetchSiteCsrf DEFAULTS = { :csrf_failure => :raise, :check_request_methods => %w'POST DELETE PATCH PUT'.freeze.each(&:freeze) }.freeze # Exception class raised when :csrf_failure option is :raise and # the Sec-Fetch-Site header is not considered valid. class CsrfFailure < RodaError; end def self.configure(app, opts=OPTS, &block) options = app.opts[:sec_fetch_site_csrf] = (app.opts[:sec_fetch_site_csrf] || DEFAULTS).merge(opts) allowed_values = options[:allowed_values] = ["same-origin"] allowed_values << "same-site" if opts[:allow_same_site] allowed_values << "none" if opts[:allow_none] allowed_values << nil if opts[:allow_missing] allowed_values.freeze if block options[:csrf_failure] = :method app.define_roda_method(:_roda_sec_fetch_site_csrf_failure, 1, &app.send(:convert_route_block, block)) end case options[:csrf_failure] when :raise, :empty_403, :clear_session, :method # nothing else raise RodaError, "Unsupported :csrf_failure plugin option: #{options[:csrf_failure].inspect}" end options.freeze end module InstanceMethods # Check that the Sec-Fetch-Site header is valid, if the request requires it. # If the header is valid or the request does not require the header, return nil. # Otherwise, if a block is given, treat it as a routing block and yield to it, and # if a block is not given, use the plugin :csrf_failure option to determine how to # handle it. def check_sec_fetch_site!(&block) plugin_opts = self.class.opts[:sec_fetch_site_csrf] return unless plugin_opts[:check_request_methods].include?(request.request_method) sec_fetch_site = env["HTTP_SEC_FETCH_SITE"] return if plugin_opts[:allowed_values].include?(sec_fetch_site) @_request.on(&block) if block case failure_action = plugin_opts[:csrf_failure] when :raise raise CsrfFailure, "potential cross-site request, Sec-Fetch-Site value: #{sec_fetch_site.inspect}" when :empty_403 @_response.status = 403 headers = @_response.headers headers.clear headers[RodaResponseHeaders::CONTENT_TYPE] = 'text/html' headers[RodaResponseHeaders::CONTENT_LENGTH] ='0' throw :halt, @_response.finish_with_body([]) when :clear_session session.clear else # when :method @_request.on{_roda_sec_fetch_site_csrf_failure(@_request)} end end end end register_plugin(:sec_fetch_site_csrf, SecFetchSiteCsrf) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/send_file.rb 0000664 0000000 0000000 00000010724 15167207754 0023045 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true begin require 'rack/files' rescue LoadError require 'rack/file' end # class Roda module RodaPlugins # The send_file plugin adds a send_file method, used for # returning the contents of a file as the body of a request. # It also loads the response_attachment plugin to set the # Content-Disposition and Content-Type based on the file's # extension. # # senf_file will serve the file with the given path from the file system: # # send_file 'path/to/file.txt' # # Options: # # :disposition :: Set the Content-Disposition to the given disposition. # :filename :: Set the Content-Disposition to attachment (unless :disposition is set), # and set the filename parameter to the value. # :last_modified :: Explicitly set the Last-Modified header to the given value, and # return a not modified response if there has not been modified since # the previous request. This option requires the caching plugin. # :status :: Override the status for the response. # :type :: Set the Content-Type to use for this response. # # == License # # The implementation was originally taken from Sinatra, # which is also released under the MIT License: # # Copyright (c) 2007, 2008, 2009 Blake Mizerany # Copyright (c) 2010, 2011, 2012, 2013, 2014 Konstantin Haase # # Permission is hereby granted, free of charge, to any person # obtaining a copy of this software and associated documentation # files (the "Software"), to deal in the Software without # restriction, including without limitation the rights to use, # copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the # Software is furnished to do so, subject to the following # conditions: # # The above copyright notice and this permission notice shall be # included in all copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, # EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES # OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND # NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT # HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, # WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING # FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR # OTHER DEALINGS IN THE SOFTWARE. module SendFile RACK_FILES = defined?(Rack::Files) ? Rack::Files : Rack::File # Depend on the status_303 plugin. def self.load_dependencies(app) app.plugin :response_attachment end module InstanceMethods # Use the contents of the file at +path+ as the response body. See plugin documentation for options. def send_file(path, opts = OPTS) r = @_request res = @_response headers = res.headers if (type = opts[:type]) || !headers[RodaResponseHeaders::CONTENT_TYPE] type_str = type.to_s if type_str.include?('/') type = type_str else if type type = ".#{type}" unless type_str.start_with?(".") else type = ::File.extname(path) end type &&= Rack::Mime.mime_type(type, nil) type ||= 'application/octet-stream' end headers[RodaResponseHeaders::CONTENT_TYPE] = type end disposition = opts[:disposition] filename = opts[:filename] if disposition || filename disposition ||= 'attachment' filename = path if filename.nil? res.attachment(filename, disposition) end if lm = opts[:last_modified] r.last_modified(lm) end file = RACK_FILES.new nil s, h, b = if Rack.release > '2' file.serving(r, path) else file.path = path file.serving(env) end res.status = opts[:status] || s headers.delete(RodaResponseHeaders::CONTENT_LENGTH) headers.replace(h.merge!(headers)) r.halt res.finish_with_body(b) rescue Errno::ENOENT response.status = 404 r.halt end end end register_plugin(:send_file, SendFile) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/sessions.rb 0000664 0000000 0000000 00000062504 15167207754 0022766 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true require 'openssl' begin OpenSSL::Cipher.new("aes-256-ctr") rescue OpenSSL::Cipher::CipherError # :nocov: raise LoadError, "Roda sessions plugin requires the aes-256-ctr cipher" # :nocov: end require 'json' require 'securerandom' require 'zlib' require 'rack/utils' class Roda module RodaPlugins # The sessions plugin adds support for sessions using cookies. It is the recommended # way to support sessions in Roda applications. # # The session cookies are encrypted with AES-256-CTR using a separate encryption key per cookie, # and then signed with HMAC-SHA-256. By default, session data is padded to reduce information # leaked based on the session size. # # Sessions are serialized via JSON, so session information should only store data that # allows roundtrips via JSON (String, Integer, Float, Array, Hash, true, false, and nil). # In particular, note that Symbol does not round trip via JSON, so symbols should not be # used in sessions when this plugin is used. This plugin sets the # +:sessions_convert_symbols+ application option to +true+ if it hasn't been set yet, # for better integration with plugins that can use either symbol or string session or # flash keys. Unlike Rack::Session::Cookie, the session is stored as a plain ruby hash, # and does not convert all keys to strings. # # All sessions are timestamped and session expiration is enabled by default, with sessions # being valid for 30 days maximum and 7 days since last use by default. Session creation time is # reset whenever the session is empty when serialized and also whenever +clear_session+ # is called while processing the request. # # Session secrets can be rotated. See options below. # # The sessions plugin can transparently upgrade sessions from versions of Rack::Session::Cookie # shipped with Rack before Rack 3, # if the default Rack::Session::Cookie coder and HMAC are used, see options below. # It is recommended to only enable transparent upgrades for a brief transition period, # and remove support for them once old sessions have converted or timed out. # # If the final cookie is too large (>=4096 bytes), a Roda::RodaPlugins::Sessions::CookieTooLarge # exception will be raised. # # = Required Options # # The session cookies this plugin uses are both encrypted and signed, so two separate # secrets are used internally. However, for ease of use, these secrets are combined into # a single +:secret+ option. The +:secret+ option must be a string of at least 64 bytes # and should be randomly generated. The first 32 bytes are used as the secret for the # cipher, any remaining bytes are used for the secret for the HMAC. # # = Other Options # # :cookie_options :: Any cookie options to set on the session cookie. By default, uses # httponly: true, path: '/', same_site: :lax so that the cookie is not accessible # to javascript, allowed for all paths, and will not be used for cross-site non-GET requests # that. If the +:secure+ option is not present in the hash, then # secure: true is also set if the request is made over HTTPS. If this option is # given, it will be merged into the default cookie options. # :env_key :: The key in `env` where the session should be located. Defaults to "rack.session", the # default key for sessions in Rack. # :gzip_over :: For session data over this many bytes, compress it with the deflate algorithm (default: nil, # so never compress). Note that compression should not be enabled if you are storing data in # the session derived from user input and also storing sensitive data in the session. # :key :: The cookie name to use (default: 'roda.session') # :max_seconds :: The maximum number of seconds to allow for total session lifetime, starting with when # the session was originally created. Default is 86400*30 (30 days). Can be set to # +nil+ to disable session lifetime checks. # :max_idle_seconds :: The maximum number of seconds to allow since the session was last updated. # Default is 86400*7 (7 days). Can be set to nil to disable session idleness # checks. # :old_secret :: The previous secret to use, allowing for secret rotation. Must be a string of at least 64 # bytes if given. # :pad_size :: Pad session data (after possible compression, before encryption), to a multiple of this # many bytes (default: 32). This can be between 2-4096 bytes, or +nil+ to disable padding. # :per_cookie_cipher_secret :: Uses a separate cipher key for every cookie, with the key used generated using # HMAC-SHA-256 of 32 bytes of random data with the default cipher secret. This # offers additional protection in case the random initialization vector used when # encrypting the session data has been reused. Odds of that are 1 in 2**64 if # initialization vector is truly random, but weaknesses in the random number # generator could make the odds much higher. Default is +true+. # :parser :: The parser for the serialized session data (default: JSON.method(:parse)). # :serializer :: The serializer for the session data (default +:to_json.to_proc+). # :skip_within :: If the last update time for the session cookie is less than this number of seconds from the # current time, and the session has not been modified, do not set a new session cookie # (default: 3600). # :upgrade_from_rack_session_cookie_key :: The cookie name to use for transparently upgrading from # Rack::Session:Cookie (defaults to 'rack.session'). # :upgrade_from_rack_session_cookie_secret :: The secret for the HMAC-SHA1 signature when allowing # transparent upgrades from Rack::Session::Cookie. Using this # option is only recommended during a short transition period, # and is not enabled by default as it lowers security. # :upgrade_from_rack_session_cookie_options :: Options to pass when deleting the cookie used by # Rack::Session::Cookie after converting it to use the session # cookies used by this plugin. # # = Not a Rack Middleware # # Unlike some other approaches to sessions, the sessions plugin does not use # a rack middleware, so session information is not available to other rack middleware, # only to the application itself, with the session not being loaded from the cookie # until the +session+ method is called. # # If you need rack middleware to access the session information, then # require 'roda/session_middleware' and use RodaSessionMiddleware. # RodaSessionMiddleware passes the options given to this plugin. # # = Session Cookie Cryptography/Format # # Session cookies created by this plugin by default use the following format: # # urlsafe_base64("\1" + random_data + IV + encrypted session data + HMAC) # # If +:per_cookie_cipher_secret+ option is set to +false+, an older format is used: # # urlsafe_base64("\0" + IV + encrypted session data + HMAC) # # where: # # version :: 1 byte, currently must be 1 or 0, other values reserved for future expansion. # random_data :: 32 bytes, used for generating the per-cookie secret # IV :: 16 bytes, initialization vector for AES-256-CTR cipher. # encrypted session data :: >=12 bytes of data encrypted with AES-256-CTR cipher, see below. # HMAC :: 32 bytes, HMAC-SHA-256 of all preceding data plus cookie key (so that a cookie value # for a different key cannot be used even if the secret is the same). # # The encrypted session data uses the following format: # # bitmap + creation time + update time + padding + serialized data # # where: # # bitmap :: 2 bytes in little endian format, lower 12 bits storing number of padding # bytes, 13th bit storing whether serialized data is compressed with deflate. # Bits 14-16 reserved for future expansion. # creation time :: 4 byte integer in unsigned little endian format, storing unix timestamp # since session initially created. # update time :: 4 byte integer in unsigned little endian format, storing unix timestamp # since session last updated. # padding :: >=0 padding bytes specified in bitmap, filled with random data, can be ignored. # serialized data :: >=2 bytes of serialized data in JSON format. If the bitmap indicates # deflate compression, this contains the deflate compressed data. module Sessions DEFAULT_COOKIE_OPTIONS = {:httponly=>true, :path=>'/'.freeze, :same_site=>:lax}.freeze DEFAULT_OPTIONS = {:key => 'roda.session'.freeze, :max_seconds=>86400*30, :max_idle_seconds=>86400*7, :pad_size=>32, :gzip_over=>nil, :skip_within=>3600, :env_key=>'rack.session'}.freeze DEFLATE_BIT = 0x1000 PADDING_MASK = 0x0fff SESSION_CREATED_AT = 'roda.session.created_at'.freeze SESSION_UPDATED_AT = 'roda.session.updated_at'.freeze SESSION_SERIALIZED = 'roda.session.serialized'.freeze SESSION_VERSION_NUM = 'roda.session.version'.freeze SESSION_DELETE_RACK_COOKIE = 'roda.session.delete_rack_session_cookie'.freeze # Exception class used when creating a session cookie that would exceed the # allowable cookie size limit. class CookieTooLarge < RodaError end # Split given secret into a cipher secret and an hmac secret. def self.split_secret(name, secret) raise RodaError, "sessions plugin :#{name} option must be a String" unless secret.is_a?(String) raise RodaError, "invalid sessions plugin :#{name} option length: #{secret.bytesize}, must be >=64" unless secret.bytesize >= 64 hmac_secret = secret = secret.dup.force_encoding('BINARY') cipher_secret = secret.slice!(0, 32) [cipher_secret.freeze, hmac_secret.freeze] end def self.load_dependencies(app, opts=OPTS) app.plugin :_base64 end # Configure the plugin, see Sessions for details on options. def self.configure(app, opts=OPTS) opts = (app.opts[:sessions] || DEFAULT_OPTIONS).merge(opts) co = opts[:cookie_options] = DEFAULT_COOKIE_OPTIONS.merge(opts[:cookie_options] || OPTS).freeze opts[:remove_cookie_options] = co.merge(:max_age=>'0', :expires=>Time.at(0)) opts[:parser] ||= app.opts[:json_parser] || JSON.method(:parse) opts[:serializer] ||= app.opts[:json_serializer] || :to_json.to_proc opts[:per_cookie_cipher_secret] = true unless opts.has_key?(:per_cookie_cipher_secret) opts[:session_version_num] = opts[:per_cookie_cipher_secret] ? 1 : 0 if opts[:upgrade_from_rack_session_cookie_secret] opts[:upgrade_from_rack_session_cookie_key] ||= 'rack.session' rsco = opts[:upgrade_from_rack_session_cookie_options] = Hash[opts[:upgrade_from_rack_session_cookie_options] || OPTS] rsco[:path] ||= co[:path] rsco[:domain] ||= co[:domain] end opts[:cipher_secret], opts[:hmac_secret] = split_secret(:secret, opts[:secret]) opts[:old_cipher_secret], opts[:old_hmac_secret] = (split_secret(:old_secret, opts[:old_secret]) if opts[:old_secret]) case opts[:pad_size] when nil # no changes when Integer raise RodaError, "invalid :pad_size: #{opts[:pad_size]}, must be >=2, < 4096" unless opts[:pad_size] >= 2 && opts[:pad_size] < 4096 else raise RodaError, "invalid :pad_size option: #{opts[:pad_size].inspect}, must be Integer or nil" end app.opts[:sessions] = opts.freeze app.opts[:sessions_convert_symbols] = true unless app.opts.has_key?(:sessions_convert_symbols) end module InstanceMethods # Clear data from the session, and update the request environment # so that the session cookie will use a new creation timestamp # instead of the previous creation timestamp. def clear_session session.clear env.delete(SESSION_CREATED_AT) env.delete(SESSION_UPDATED_AT) nil end private # If session information has been set in the request environment, # update the rack response headers to set the session cookie in # the response. def _roda_after_50__sessions(res) if res && (session = env[self.class.opts[:sessions][:env_key]]) @_request.persist_session(res[1], session) end end end module RequestMethods # Load the session information from the cookie. With the sessions # plugin, you must call this method to get the session, instead of # trying to access the session directly through the request environment. # For maximum compatibility with other software that uses rack sessions, # this method stores the session in 'rack.session' in the request environment, # but that does not happen until this method is called. def session @env[roda_class.opts[:sessions][:env_key]] ||= _load_session end # The time the session was originally created. nil if there is no active session. def session_created_at session Time.at(@env[SESSION_CREATED_AT]) if @env[SESSION_SERIALIZED] end # The time the session was last updated. nil if there is no active session. def session_updated_at session Time.at(@env[SESSION_UPDATED_AT]) if @env[SESSION_SERIALIZED] end # Persist the session data as a cookie. If transparently upgrading from # Rack::Session::Cookie, mark the related cookie for expiration so it isn't # sent in the future. def persist_session(headers, session) opts = roda_class.opts[:sessions] if session.empty? if env[SESSION_SERIALIZED] # If session was submitted and is now empty, remove the cookie Rack::Utils.delete_cookie_header!(headers, opts[:key], opts[:remove_cookie_options]) # else # If no session was submitted, and the session is empty # then there is no need to do anything end elsif cookie_value = _serialize_session(session) cookie = Hash[opts[:cookie_options]] cookie[:value] = cookie_value cookie[:secure] = true if !cookie.has_key?(:secure) && ssl? before_size = if (set_cookie_before = headers[RodaResponseHeaders::SET_COOKIE]).is_a?(String) set_cookie_before.bytesize else 0 end Rack::Utils.set_cookie_header!(headers, opts[:key], cookie) cookie_size = case set_cookie_after = headers[RodaResponseHeaders::SET_COOKIE] when String # Rack < 3 always takes this branch, combines cookies into string, subtract previous size # Rack 3+ takes this branch if this is the first cookie set, in which case before size is 0 set_cookie_after.bytesize - before_size else # when Array # Rack 3+ takes branch if this is not the first cookie set, and last element of the array # is most recently added cookie set_cookie_after.last.bytesize end if cookie_size >= 4096 raise CookieTooLarge, "attempted to create cookie larger than 4096 bytes (bytes: #{cookie_size})" end end if env[SESSION_DELETE_RACK_COOKIE] Rack::Utils.delete_cookie_header!(headers, opts[:upgrade_from_rack_session_cookie_key], opts[:upgrade_from_rack_session_cookie_options]) end nil end private # Load the session by looking for the appropriate cookie, or falling # back to the rack session cookie if configured. def _load_session opts = roda_class.opts[:sessions] cs = cookies if data = cs[opts[:key]] _deserialize_session(data) elsif (key = opts[:upgrade_from_rack_session_cookie_key]) && (data = cs[key]) _deserialize_rack_session(data) end || {} end # If 'rack.errors' is set, write the error message to it. # This is used for errors that shouldn't be raised as exceptions, # such as improper session cookies. def _session_serialization_error(msg) return unless error_stream = @env['rack.errors'] error_stream.puts(msg) nil end # Interpret given cookie data as a Rack::Session::Cookie # serialized session using the default Rack::Session::Cookie # hmac and coder. def _deserialize_rack_session(data) opts = roda_class.opts[:sessions] data, digest = data.split("--", 2) unless digest return _session_serialization_error("Not decoding Rack::Session::Cookie session: invalid format") end unless Rack::Utils.secure_compare(digest, OpenSSL::HMAC.hexdigest(OpenSSL::Digest::SHA1.new, opts[:upgrade_from_rack_session_cookie_secret], data)) return _session_serialization_error("Not decoding Rack::Session::Cookie session: HMAC invalid") end begin session = Marshal.load(data.unpack('m').first) rescue return _session_serialization_error("Error decoding Rack::Session::Cookie session: not base64 encoded marshal dump") end # Mark rack session cookie for deletion on success env[SESSION_DELETE_RACK_COOKIE] = true # Delete the session id before serializing it. Starting in rack 2.0.8, # this is an object and not just a string, and calling to_s on it raises # a RuntimeError. session.delete("session_id") # Convert the rack session by roundtripping it through # the parser and serializer, so that you would get the # same result as you would if the session was handled # by this plugin. env[SESSION_SERIALIZED] = data = opts[:serializer].call(session) env[SESSION_CREATED_AT] = Time.now.to_i opts[:parser].call(data) end # Interpret given cookie data as a Rack::Session::Cookie def _deserialize_session(data) opts = roda_class.opts[:sessions] begin data = Base64_.urlsafe_decode64(data) rescue ArgumentError return _session_serialization_error("Unable to decode session: invalid base64") end case version = data.getbyte(0) when 1 per_cookie_secret = true # minimum length (1+32+16+12+32) (version+random_data+cipher_iv+minimum session+hmac) # 1 : version # 32 : random_data (if per_cookie_cipher_secret) # 16 : cipher_iv # 12 : minimum_session # 2 : bitmap for gzip + padding info # 4 : creation time # 4 : update time # 2 : data # 32 : HMAC-SHA-256 min_data_length = 93 when 0 per_cookie_secret = false # minimum length (1+16+12+32) (version+cipher_iv+minimum session+hmac) min_data_length = 61 when nil return _session_serialization_error("Unable to decode session: no data") else return _session_serialization_error("Unable to decode session: version marker unsupported") end length = data.bytesize if data.length < min_data_length return _session_serialization_error("Unable to decode session: data too short") end encrypted_data = data.slice!(0, length-32) unless Rack::Utils.secure_compare(data, OpenSSL::HMAC.digest(OpenSSL::Digest::SHA256.new, opts[:hmac_secret], encrypted_data+opts[:key])) if opts[:old_hmac_secret] && Rack::Utils.secure_compare(data, OpenSSL::HMAC.digest(OpenSSL::Digest::SHA256.new, opts[:old_hmac_secret], encrypted_data+opts[:key])) use_old_cipher_secret = true else return _session_serialization_error("Not decoding session: HMAC invalid") end end # Remove version encrypted_data.slice!(0) cipher_secret = opts[use_old_cipher_secret ? :old_cipher_secret : :cipher_secret] if per_cookie_secret cipher_secret = OpenSSL::HMAC.digest(OpenSSL::Digest::SHA256.new, cipher_secret, encrypted_data.slice!(0, 32)) end cipher_iv = encrypted_data.slice!(0, 16) cipher = OpenSSL::Cipher.new("aes-256-ctr") # Not rescuing cipher errors. If there is an error in the decryption, that's # either a bug in the plugin that needs to be fixed, or an attacker is already # able to forge a valid HMAC, in which case the error should be raised to # alert the application owner about the problem. cipher.decrypt cipher.key = cipher_secret cipher.iv = cipher_iv data = cipher.update(encrypted_data) << cipher.final bitmap, created_at, updated_at = data.unpack('vVV') padding_bytes = bitmap & PADDING_MASK now = Time.now.to_i if (max = opts[:max_seconds]) && now > created_at + max return _session_serialization_error("Not returning session: maximum session time expired") end if (max = opts[:max_idle_seconds]) && now > updated_at + max return _session_serialization_error("Not returning session: maximum session idle time expired") end data = data.slice(10+padding_bytes, data.bytesize) if bitmap & DEFLATE_BIT > 0 data = Zlib::Inflate.inflate(data) end env = @env env[SESSION_CREATED_AT] = created_at env[SESSION_UPDATED_AT] = updated_at env[SESSION_SERIALIZED] = data env[SESSION_VERSION_NUM] = version opts[:parser].call(data) end def _serialize_session(session) opts = roda_class.opts[:sessions] env = @env now = Time.now.to_i json_data = opts[:serializer].call(session).force_encoding('BINARY') if (serialized_session = env[SESSION_SERIALIZED]) && (opts[:session_version_num] == env[SESSION_VERSION_NUM]) && (updated_at = env[SESSION_UPDATED_AT]) && (now - updated_at < opts[:skip_within]) && (serialized_session == json_data) return end bitmap = 0 json_length = json_data.bytesize gzip_over = opts[:gzip_over] if gzip_over && json_length > gzip_over json_data = Zlib.deflate(json_data) json_length = json_data.bytesize bitmap |= DEFLATE_BIT end # When calculating padding bytes to use, include 10 bytes for bitmap and # session create/update times, so total size of encrypted data is a # multiple of pad_size. if (pad_size = opts[:pad_size]) && (padding_bytes = (json_length+10) % pad_size) != 0 padding_bytes = pad_size - padding_bytes bitmap |= padding_bytes padding_data = SecureRandom.random_bytes(padding_bytes) end session_create_time = env[SESSION_CREATED_AT] serialized_data = [bitmap, session_create_time||now, now].pack('vVV') serialized_data << padding_data if padding_data serialized_data << json_data cipher_secret = opts[:cipher_secret] if opts[:per_cookie_cipher_secret] version = "\1" per_cookie_secret_base = SecureRandom.random_bytes(32) cipher_secret = OpenSSL::HMAC.digest(OpenSSL::Digest::SHA256.new, cipher_secret, per_cookie_secret_base) else version = "\0" end cipher = OpenSSL::Cipher.new("aes-256-ctr") cipher.encrypt cipher.key = cipher_secret cipher_iv = cipher.random_iv encrypted_data = cipher.update(serialized_data) << cipher.final data = String.new data << version data << per_cookie_secret_base if per_cookie_secret_base data << cipher_iv data << encrypted_data data << OpenSSL::HMAC.digest(OpenSSL::Digest::SHA256.new, opts[:hmac_secret], data+opts[:key]) data = Base64_.urlsafe_encode64(data) if data.bytesize >= 4096 raise CookieTooLarge, "attempted to create cookie larger than 4096 bytes (bytes: #{data.bytesize})" end data end end end register_plugin(:sessions, Sessions) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/shared_vars.rb 0000664 0000000 0000000 00000004511 15167207754 0023413 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The shared_vars plugin adds a +shared+ method for storing # shared variables across nested Roda apps. # # class API < Roda # plugin :shared_vars # route do |r| # user = shared[:user] # # ... # end # end # # class App < Roda # plugin :shared_vars # # route do |r| # r.on Integer do |user_id| # shared[:user] = User[user_id] # r.run API # end # end # end # # If you pass a hash to shared, it will update the shared # vars with the content of the hash: # # route do |r| # r.on Integer do |user_id| # shared(user: User[user_id]) # r.run API # end # end # # You can also pass a block to shared, which will set the # shared variables only for the given block, restoring the # previous shared variables afterward: # # route do |r| # r.on Integer do |user_id| # shared(user: User[user_id]) do # r.run API # end # end # end module SharedVars module InstanceMethods # Returns the current shared vars for the request. These are # stored in the request's environment, so they will be implicitly # shared with other apps using this plugin. # # If the +vars+ argument is given, it should be a hash that will be # merged into the current shared vars. # # If a block is given, a +vars+ argument must be provided, and it will # only make the changes to the shared vars for the duration of the # block, restoring the previous shared vars before the block returns. def shared(vars=nil) h = env['roda.shared'] ||= {} if defined?(yield) if vars begin env['roda.shared'] = h.merge(vars) yield ensure env['roda.shared'] = h end else raise RodaError, "must pass a vars hash when calling shared with a block" end elsif vars h.merge!(vars) end h end end end register_plugin(:shared_vars, SharedVars) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/sinatra_helpers.rb 0000664 0000000 0000000 00000035553 15167207754 0024307 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true require 'rack/mime' # class Roda module RodaPlugins # The sinatra_helpers plugin ports most of the helper methods # defined in Sinatra::Helpers to Roda, other than those # helpers that were already covered by other plugins such # as caching and streaming. # # Unlike Sinatra, the helper methods are added to either # the request or response classes instead of directly to # the scope of the route block. However, for consistency # with Sinatra, delegate methods are added to the scope # of the route block that call the methods on the request # or response. If you do not want to pollute the namespace # of the route block, you should load the plugin with the # delegate: false option: # # plugin :sinatra_helpers, delegate: false # # == Class Methods Added # # The only class method added by this plugin is +mime_type+, # which is a shortcut for retrieving or setting MIME types # in Rack's MIME database: # # Roda.mime_type 'csv' # => 'text/csv' # Roda.mime_type 'foobar', 'application/foobar' # set # # == Request Methods Added # # In addition to adding the following methods, this changes # +redirect+ to use a 303 response status code by default for # HTTP 1.1 non-GET requests, and to automatically use # absolute URIs if the +:absolute_redirects+ Roda class option # is true, and to automatically prefix redirect paths with the # script name if the +:prefixed_redirects+ Roda class option is # true. # # When adding delegate methods, a logger method is added to # the route block scope that calls the logger method on the request. # # === back # # +back+ is an alias to referrer, so you can do: # # redirect back # # === error # # +error+ sets the response status code to 500 (or a status code you provide), # and halts the request. It takes an optional body: # # error # 500 response, empty boby # error 501 # 501 response, empty body # error 'b' # 500 response, 'b' body # error 501, 'b' # 501 response, 'b' body # # === not_found # # +not_found+ sets the response status code to 404 and halts the request. # It takes an optional body: # # not_found # 404 response, empty body # not_found 'b' # 404 response, 'b' body # # === uri # # +uri+ by default returns absolute URIs that are prefixed # by the script name: # # request.script_name # => '/foo' # uri '/bar' # => 'http://example.org/foo/bar' # # You can turn of the absolute or script name prefixing if you want: # # uri '/bar', false # => '/foo/bar' # uri '/bar', true, false # => 'http://example.org/bar' # uri '/bar', false, false # => '/bar' # # This method is aliased as +url+ and +to+. # # === send_file # # See send_file plugin documentation for details. # # == Response Methods Added # # === body # # When called with an argument or block, +body+ sets the body, otherwise # it returns the body: # # body # => [] # body('b') # set body to 'b' # body{'b'} # set body to 'b', but don't call until body is needed # # === body= # # +body+ sets the body to the given value: # # response.body = 'v' # # This method is not delegated to the scope of the route block, # call +body+ with an argument to set the value. # # === status # # When called with an argument, +status+ sets the status, otherwise # it returns the status: # # status # => 200 # status(301) # sets status to 301 # # === headers # # When called with an argument, +headers+ merges the given headers # into the current headers, otherwise it returns the headers: # # headers['Foo'] = 'Bar' # headers 'Foo' => 'Bar' # # === mime_type # # +mime_type+ just calls the Roda class method to get the mime_type. # # === content_type # # When called with an argument, +content_type+ sets the Content-Type # based on the argument, otherwise it returns the Content-Type. # # mime_type # => 'text/html' # mime_type 'csv' # set Content-Type to 'text/csv' # mime_type :csv # set Content-Type to 'text/csv' # mime_type '.csv' # set Content-Type to 'text/csv' # mime_type 'text/csv' # set Content-Type to 'text/csv' # # Options: # # :charset :: Set the charset for the mime type to the given charset, if the charset is # not already set in the mime type. # :default :: Uses the given type if the mime type is not known. If this option is not # used and the mime type is not known, an exception will be raised. # # === attachment # # See response_attachment plugin for details. # # === status predicates # # This adds the following predicate methods for checking the status: # # informational? # 100-199 # success? # 200-299 # redirect? # 300-399 # client_error? # 400-499 # not_found? # 404 # server_error? # 500-599 # # If the status has not yet been set for the response, these will # return +nil+. # # == License # # The implementation was originally taken from Sinatra, # which is also released under the MIT License: # # Copyright (c) 2007, 2008, 2009 Blake Mizerany # Copyright (c) 2010, 2011, 2012, 2013, 2014 Konstantin Haase # # Permission is hereby granted, free of charge, to any person # obtaining a copy of this software and associated documentation # files (the "Software"), to deal in the Software without # restriction, including without limitation the rights to use, # copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the # Software is furnished to do so, subject to the following # conditions: # # The above copyright notice and this permission notice shall be # included in all copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, # EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES # OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND # NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT # HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, # WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING # FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR # OTHER DEALINGS IN THE SOFTWARE. module SinatraHelpers # Depend on the status_303 plugin. def self.load_dependencies(app, _opts = nil) app.plugin :status_303 app.plugin :send_file end # Add delegate methods to the route block scope # calling request or response methods, unless the # :delegate option is false. def self.configure(app, opts=OPTS) app.send(:include, DelegateMethods) unless opts[:delegate] == false end # Class used when the response body is set explicitly, instead # of using Roda's default body array and response.write to # write to it. class DelayedBody # Save the block that will return the body, it won't be # called until the body is needed. def initialize(&block) @block = block end # If the body is a String, yield it, otherwise yield each string # returned by calling each on the body. def each v = value if v.is_a?(String) yield v else v.each{|s| yield s} end end # Assume that if the body has been set directly that it is # never empty. def empty? false end # Return the body as a single string, mostly useful during testing. def join a = [] each{|s| a << s} a.join end # Calculate the length for the body. def length length = 0 each{|s| length += s.bytesize} length end private # Cache the body returned by the block. This way the block won't # be called multiple times. def value @value ||= @block.call end end module RequestMethods # Alias for referrer def back referrer end # Halt processing and return the error status provided with the given code and # optional body. # If a single argument is given and it is not an integer, consider it the body # and use a 500 status code. def error(code=500, body = nil) unless code.is_a?(Integer) body = code code = 500 end response.status = code response.body = body if body halt end # Halt processing and return a 404 response with an optional body. def not_found(body = nil) error(404, body) end # If the absolute_redirects or :prefixed_redirects roda class options has been set, respect those # and update the path. def redirect(path=(no_add_script_name = true; default_redirect_path), status=default_redirect_status) opts = roda_class.opts absolute_redirects = opts[:absolute_redirects] prefixed_redirects = no_add_script_name ? false : opts[:prefixed_redirects] path = uri(path, absolute_redirects, prefixed_redirects) if absolute_redirects || prefixed_redirects super(path, status) end # Backwards compatibility for callers of r.send_file. def send_file(path, opts = OPTS) scope.send_file(path, opts) end # Generates the absolute URI for a given path in the app. # Takes Rack routers and reverse proxies into account. def uri(addr = nil, absolute = true, add_script_name = true) addr = addr.to_s if addr return addr if addr =~ /\A[A-z][A-z0-9\+\.\-]*:/ uri = if absolute h = if @env.has_key?("HTTP_X_FORWARDED_HOST") || port != (ssl? ? 443 : 80) host_with_port else host end ["http#{'s' if ssl?}://#{h}"] else [''] end uri << script_name.to_s if add_script_name uri << (addr || path_info) File.join(uri) end alias url uri alias to uri end module ResponseMethods # Set or retrieve the response status code. def status(value = nil || (return @status)) @status = value end # Set or retrieve the response body. When a block is given, # evaluation is deferred until the body is needed. def body(value = (return @body unless defined?(yield); nil), &block) if block @body = DelayedBody.new(&block) else self.body = value end end # Set the body to the given value. def body=(body) @body = DelayedBody.new{body} end # If the body is a DelayedBody, set the appropriate length for it. def finish @length = @body.length if @body.is_a?(DelayedBody) && !@headers[RodaResponseHeaders::CONTENT_LENGTH] super end # Set multiple response headers with Hash, or return the headers if no # argument is given. def headers(hash = nil || (return @headers)) @headers.merge!(hash) end # Look up a media type by file extension in Rack's mime registry. def mime_type(type) roda_class.mime_type(type) end # Set the Content-Type of the response body given a media type or file # extension. See plugin documentation for options. def content_type(type = nil || (return @headers[RodaResponseHeaders::CONTENT_TYPE]), opts = OPTS) unless (mime_type = mime_type(type) || opts[:default]) raise RodaError, "Unknown media type: #{type}" end unless opts.empty? opts.each do |key, val| next if key == :default || (key == :charset && mime_type.include?('charset')) val = val.inspect if val =~ /[";,]/ mime_type += "#{mime_type.include?(';') ? ', ' : ';'}#{key}=#{val}" end end @headers[RodaResponseHeaders::CONTENT_TYPE] = mime_type end # Whether or not the status is set to 1xx. Returns nil if status not yet set. def informational? @status.between?(100, 199) if @status end # Whether or not the status is set to 2xx. Returns nil if status not yet set. def success? @status.between?(200, 299) if @status end # Whether or not the status is set to 3xx. Returns nil if status not yet set. def redirect? @status.between?(300, 399) if @status end # Whether or not the status is set to 4xx. Returns nil if status not yet set. def client_error? @status.between?(400, 499) if @status end # Whether or not the status is set to 5xx. Returns nil if status not yet set. def server_error? @status.between?(500, 599) if @status end # Whether or not the status is set to 404. Returns nil if status not yet set. def not_found? @status == 404 if @status end end module ClassMethods # If a type and value are given, set the value in Rack's MIME registry. # If only a type is given, lookup the type in Rack's MIME registry and # return it. def mime_type(type=nil || (return), value = nil) return type.to_s if type.to_s.include?('/') type = ".#{type}" unless type.to_s[0] == ?. if value Rack::Mime::MIME_TYPES[type] = value else Rack::Mime.mime_type(type, nil) end end end module DelegateMethods [:logger, :back].each do |meth| define_method(meth){@_request.public_send(meth)} end [:redirect, :uri, :url, :to, :error, :not_found].each do |meth| define_method(meth){|*v, &block| @_request.public_send(meth, *v, &block)} end [:informational?, :success?, :redirect?, :client_error?, :server_error?, :not_found?].each do |meth| define_method(meth){@_response.public_send(meth)} end [:status, :body, :headers, :mime_type, :content_type, :attachment].each do |meth| define_method(meth){|*v, &block| @_response.public_send(meth, *v, &block)} end end end register_plugin(:sinatra_helpers, SinatraHelpers) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/slash_path_empty.rb 0000664 0000000 0000000 00000001445 15167207754 0024461 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The slash_path_empty plugin considers "/" as an empty path, # in addition to the default of "" being considered an empty # path. This makes it so +r.is+ without an argument will match # a path of "/", and +r.is+ and verb methods such as +r.get+ and # +r.post+ will match if the path is "/" after the arguments # are processed. This can make it easier to handle applications # where a trailing "/" in the path should be ignored. module SlashPathEmpty module RequestMethods private # Consider the path empty if it is "/". def empty_path? super || remaining_path == '/' end end end register_plugin(:slash_path_empty, SlashPathEmpty) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/static.rb 0000664 0000000 0000000 00000003124 15167207754 0022400 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true require 'rack/static' # class Roda module RodaPlugins # The static plugin loads the Rack::Static middleware into the application. # It mainly exists to make serving static files simpler, by supplying # defaults to Rack::Static that are appropriate for Roda. # # The static plugin recognizes the application's :root option, and by default # sets the Rack::Static +:root+ option to the +public+ subfolder of the application's # +:root+ option. Additionally, if a relative path is provided as the :root # option to the plugin, it will be considered relative to the application's # +:root+ option. # # Since the :urls option for Rack::Static is always required, the static plugin # uses a separate option for it. # # Users of this plugin may want to consider using the public plugin instead. # # Examples: # # opts[:root] = '/path/to/app' # plugin :static, ['/js', '/css'] # path: /path/to/app/public # plugin :static, ['/images'], root: 'pub' # path: /path/to/app/pub # plugin :static, ['/media'], root: '/path/to/public' # path: /path/to/public module Static # Load the Rack::Static middleware. Use the paths given as the :urls option, # and set the :root option to be relative to the application's :root option. def self.configure(app, paths, opts={}) opts = opts.dup opts[:urls] = paths opts[:root] = app.expand_path(opts[:root]||"public") app.use ::Rack::Static, opts end end register_plugin(:static, Static) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/static_routing.rb 0000664 0000000 0000000 00000006436 15167207754 0024160 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The static_routing plugin adds static_* routing class methods for handling # static routes (i.e. routes with static paths, no nesting or placeholders). These # routes are processed before the normal routing tree and designed for # maximum performance. This can be substantially faster than Roda's normal # tree based routing if you have large numbers of static routes, about 3-4x # for 100-10000 static routes. Example: # # plugin :static_routing # # static_route '/foo' do |r| # @var = :foo # # r.get do # 'Not actually reached' # end # # r.post{'static POST /#{@var}'} # end # # static_get '/foo' do |r| # 'static GET /foo' # end # # route do |r| # 'Not a static route' # end # # A few things to note in the above example. First, unlike most other # routing methods in Roda, these take the full path of the request, and only # match if r.path_info matches exactly. This is why you need to include the # leading slash in the path argument. # # Second, the static_* routing methods only take a single string argument for # the path, they do not accept other options, and do not handle placeholders # in strings. For any routes needing placeholders, you should use Roda's # routing tree. # # There are separate static_* methods for each type of request method, and these # request method specific routes are tried first. There is also a static_route # method that will match regardless of the request method, if there is no # matching request methods specific route. This is why the static_get # method call takes precedence over the static_route method call for /foo. # As shown above, you can use Roda's routing tree methods inside the # static_route block to have shared behavior for different request methods, # while still handling the request methods differently. module StaticRouting def self.load_dependencies(app) app.plugin :hash_paths end module ClassMethods # Add a static route for any request method. These are # tried after the request method specific static routes (e.g. # static_get), but allow you to use Roda's routing tree # methods inside the route for handling shared behavior while # still allowing request method specific handling. def static_route(path, &block) hash_path(:static_routing, path, &block) end [:get, :post, :delete, :head, :options, :link, :patch, :put, :trace, :unlink].each do |meth| request_method = meth.to_s.upcase define_method("static_#{meth}") do |path, &block| hash_path(request_method, path, &block) end end end module InstanceMethods private # If there is a static routing method for the given path, call it # instead having the routing tree handle the request. def _roda_before_30__static_routing r = @_request r.hash_paths(r.request_method) r.hash_paths(:static_routing) end end end register_plugin(:static_routing, StaticRouting) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/status_303.rb 0000664 0000000 0000000 00000001350 15167207754 0023020 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The status_303 plugin sets the default redirect status to be 303 # rather than 302 when the request is not a GET and the # redirection occurs on an HTTP 1.1 connection as per RFC 7231. # There are some frontend frameworks that require this behavior. # # Example: # # plugin :status_303 module Status303 module RequestMethods private def default_redirect_status return super if is_get? case http_version when 'HTTP/1.0', 'HTTP/0.9', nil super else 303 end end end end register_plugin(:status_303, Status303) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/status_handler.rb 0000664 0000000 0000000 00000005630 15167207754 0024135 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The status_handler plugin adds a +status_handler+ method which sets a # block that is called whenever a response with the relevant response code # with an empty body would be returned. # # This plugin does not support providing the blocks with the plugin call; # you must provide them to status_handler calls afterwards: # # plugin :status_handler # # status_handler(403) do # "You are forbidden from seeing that!" # end # # status_handler(404) do # "Where did it go?" # end # # status_handler(405, keep_headers: ['Accept']) do # "Use a different method!" # end # # Before a block is called, any existing headers on the response will be # cleared, unless the +:keep_headers+ option is used. If the +:keep_headers+ # option is used, the value should be an array, and only the headers listed # in the array will be kept. module StatusHandler CLEAR_HEADERS = :clear.to_proc private_constant :CLEAR_HEADERS def self.configure(app) app.opts[:status_handler] ||= {} end module ClassMethods # Install the given block as a status handler for the given HTTP response code. def status_handler(code, opts=OPTS, &block) # For backwards compatibility, pass request argument if block accepts argument arity = block.arity == 0 ? 0 : 1 handle_headers = case keep_headers = opts[:keep_headers] when nil, false CLEAR_HEADERS when Array if Rack.release >= '3' keep_headers = keep_headers.map(&:downcase) end lambda{|headers| headers.delete_if{|k,_| !keep_headers.include?(k)}} else raise RodaError, "Invalid :keep_headers option" end meth = define_roda_method(:"_roda_status_handler__#{code}", arity, &block) self.opts[:status_handler][code] = define_roda_method(:"_roda_status_handler_#{code}", 1) do |result| res = @_response res.status = result[0] handle_headers.call(res.headers) result.replace(_roda_handle_route{arity == 1 ? send(meth, @_request) : send(meth)}) end end # Freeze the hash of status handlers so that there can be no thread safety issues at runtime. def freeze opts[:status_handler].freeze super end end module InstanceMethods private # If routing returns a response we have a handler for, call that handler. def _roda_after_20__status_handler(result) if result && (meth = opts[:status_handler][result[0]]) && (v = result[2]).is_a?(Array) && v.empty? send(meth, result) end end end end register_plugin(:status_handler, StatusHandler) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/streaming.rb 0000664 0000000 0000000 00000011672 15167207754 0023111 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The streaming plugin adds support for streaming responses # from roda using the +stream+ method: # # plugin :streaming # # route do |r| # stream do |out| # ['a', 'b', 'c'].each{|v| out << v; sleep 1} # end # end # # In order for streaming to work, any webservers used in # front of the roda app must not buffer responses. # # The stream method takes the following options: # # :callback :: A callback proc to call when the connection is closed. # :loop :: Whether to call the stream block continuously until the connection is closed. # :async :: Whether to call the stream block in a separate thread (default: false). Only supported on Ruby 2.3+. # :queue :: A queue object to use for asynchronous streaming (default: `SizedQueue.new(10)`). # # If the :loop option is used, you can override the # handle_stream_error method to change how exceptions # are handled during streaming. This method is passed the # exception and the stream. By default, this method # just reraises the exception, but you can choose to output # the an error message to the stream, before raising: # # def handle_stream_error(e, out) # out << 'ERROR!' # raise e # end # # Ignore errors completely while streaming: # # def handle_stream_error(e, out) # end # # or handle the errors in some other way. module Streaming # Class of the response body in case you use #stream. class Stream include Enumerable # Handle streaming options, see Streaming for details. def initialize(opts=OPTS, &block) @block = block @out = nil @callback = opts[:callback] @closed = false end # Add output to the streaming response body. Returns number of bytes written. def write(data) data = data.to_s @out.call(data) data.bytesize end # Add output to the streaming response body. Returns self. def <<(data) write(data) self end # If not already closed, close the connection, and call # any callbacks. def close return if closed? @closed = true @callback.call if @callback end # Whether the connection has already been closed. def closed? @closed end # Yield values to the block as they are passed in via #<<. def each(&out) @out = out @block.call(self) ensure close end end # Class of the response body if you use #stream with :async set to true. # Uses a separate thread that pushes streaming results to a queue, so that # data can be streamed to clients while it is being prepared by the application. class AsyncStream include Enumerable # Handle streaming options, see Streaming for details. def initialize(opts=OPTS, &block) @stream = Stream.new(opts, &block) @queue = opts[:queue] || SizedQueue.new(10) # have some default backpressure @thread = Thread.new { enqueue_chunks } end # Continue streaming data until the stream is finished. def each(&out) dequeue_chunks(&out) @thread.join end # Stop streaming. def close @queue.close # terminate the producer thread @stream.close end private # Push each streaming chunk onto the queue. def enqueue_chunks @stream.each do |chunk| @queue.push(chunk) end rescue ClosedQueueError # connection was closed ensure @queue.close end # Pop each streaming chunk from the queue and yield it. def dequeue_chunks while chunk = @queue.pop yield chunk end end end module InstanceMethods # Immediately return a streaming response using the current response # status and headers, calling the block to get the streaming response. # See Streaming for details. def stream(opts=OPTS, &block) if opts[:loop] block = proc do |out| until out.closed? begin yield(out) rescue => e handle_stream_error(e, out) end end end end stream_class = (opts[:async] && RUBY_VERSION >= '2.3') ? AsyncStream : Stream throw :halt, @_response.finish_with_body(stream_class.new(opts, &block)) end # Handle exceptions raised while streaming when using :loop def handle_stream_error(e, out) raise e end end end register_plugin(:streaming, Streaming) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/strip_path_prefix.rb 0000664 0000000 0000000 00000002270 15167207754 0024644 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The strip_path_prefix plugin makes Roda strip a given prefix off internal absolute paths, # turning them to relative paths. Roda by default stores internal paths as absolute paths. # The main reason to use this plugin is when the internal absolute path could change at # runtime, either due to a symlink change or chroot call, or you really want to use # relative paths instead of absolute paths. # # Examples: # # plugin :strip_path_prefix # Defaults to Dir.pwd # plugin :strip_path_prefix, File.dirname(Dir.pwd) module StripPathPrefix # Set the regexp to use when stripping prefixes from internal paths. def self.configure(app, prefix=Dir.pwd) prefix += '/' unless prefix.end_with?("/") app.opts[:strip_path_prefix] = /\A#{Regexp.escape(prefix)}/ end module ClassMethods # Strip the path prefix from the gien path if it starts with the prefix. def expand_path(path, root=opts[:root]) super.sub(opts[:strip_path_prefix], '') end end end register_plugin(:strip_path_prefix, StripPathPrefix) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/symbol_matchers.rb 0000664 0000000 0000000 00000014436 15167207754 0024314 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The symbol_matchers plugin allows you do define custom regexps to use # for specific symbols. For example, if you have a route such as: # # r.on :username do |username| # # ... # end # # By default this will match all nonempty segments. However, if your usernames # must be 6-20 characters, and can only contain +a-z+ and +0-9+, you can do: # # plugin :symbol_matchers # symbol_matcher :username, /([a-z0-9]{6,20})/ # # Then the route will only if the path is +/foobar123+, but not if it is # +/foo+, +/FooBar123+, or +/foobar_123+. # # By default, this plugin sets up the following symbol matchers: # # :d :: /(\d+)/, a decimal segment # :rest :: /(.*)/, all remaining characters, if any # :w :: /(\w+)/, an alphanumeric segment # # If the placeholder_string_matchers plugin is loaded, this feature also applies to # placeholders in strings, so the following: # # r.on "users/:username" do |username| # # ... # end # # Would match +/users/foobar123+, but not +/users/foo+, +/users/FooBar123+, # or +/users/foobar_123+. # # If using this plugin with the params_capturing plugin, this plugin should # be loaded first. # # You can provide a block when calling +symbol_matcher+, and it will be called # for all matches to allow for type conversion: # # symbol_matcher(:date, /(\d\d\d\d)-(\d\d)-(\d\d)/) do |y, m, d| # Date.new(y.to_i, m.to_i, d.to_i) # end # # route do |r| # r.on :date do |date| # # date is an instance of Date # end # end # # If you have a segment match the passed regexp, but decide during block # processing that you do not want to treat it as a match, you can have the # block return nil or false. This is useful if you want to make sure you # are using valid data: # # symbol_matcher(:date, /(\d\d\d\d)-(\d\d)-(\d\d)/) do |y, m, d| # y = y.to_i # m = m.to_i # d = d.to_i # Date.new(y, m, d) if Date.valid_date?(y, m, d) # end # # You can have the block return an array to yield multiple captures. # # The second argument to symbol_matcher can be a symbol already registered # as a symbol matcher. This can DRY up code that wants a conversion # performed by an existing class matcher or to use the same regexp: # # symbol_matcher :employee_id, :d do |id| # id.to_i # end # symbol_matcher :employee, :employee_id do |id| # Employee[id] # end # # With the above example, the :d matcher matches only decimal strings, but # yields them as string. The registered :employee_id matcher converts the # decimal string to an integer. The registered :employee matcher builds # on that and uses the integer to lookup the related employee. If there is # no employee with that id, then the :employee matcher will not match. # # If using the class_matchers plugin, you can provide a recognized class # matcher as the second argument to symbol_matcher, and it will work in # a similar manner: # # symbol_matcher :employee, Integer do |id| # Employee[id] # end # # Blocks passed to the symbol matchers plugin are evaluated in route # block context. # # If providing a block to the symbol_matchers plugin, the symbol may # not work with the params_capturing plugin. Note that the use of # symbol matchers inside strings when using the placeholder_string_matchers # plugin only uses the regexp, it does not respect the conversion blocks # registered with the symbols. module SymbolMatchers def self.load_dependencies(app) app.plugin :_symbol_regexp_matchers app.plugin :_symbol_class_matchers end def self.configure(app) app.opts[:symbol_matchers] ||= {} app.symbol_matcher(:d, /(\d+)/) app.symbol_matcher(:w, /(\w+)/) app.symbol_matcher(:rest, /(.*)/) end module ClassMethods # Set the matcher and block to use for the given class. # The matcher can be a regexp, registered symbol matcher, or registered class # matcher (if using the class_matchers plugin). # # If providing a regexp, the block given will be called with all regexp captures. # If providing a registered symbol or class, the block will be called with the # captures returned by the block for the registered symbol or class, or the regexp # captures if no block was registered with the symbol or class. In either case, # if a block is given, it should return an array with the captures to yield to # the match block. def symbol_matcher(s, matcher, &block) _symbol_class_matcher(Symbol, s, matcher, block) do |meth, array| define_method(meth){array} end nil end # Freeze the class_matchers hash when freezing the app. def freeze opts[:symbol_matchers].freeze super end end module RequestMethods private # Use regular expressions to the symbol-specific regular expression # if the symbol is registered. Otherwise, call super for the default # behavior. def _match_symbol(s) meth = :"match_symbol_#{s}" if respond_to?(meth, true) # Allow calling private match methods _, re, convert_meth = send(meth) if re consume(re, convert_meth) else # defined in class_matchers plugin _consume_segment(convert_meth) end else super end end # Return the symbol-specific regular expression if one is registered. # Otherwise, call super for the default behavior. def _match_symbol_regexp(s) meth = :"match_symbol_#{s}" if respond_to?(meth, true) # Allow calling private match methods re, = send(meth) re else super end end end end register_plugin(:symbol_matchers, SymbolMatchers) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/symbol_status.rb 0000664 0000000 0000000 00000001533 15167207754 0024023 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true require 'rack/utils' class Roda module RodaPlugins # The symbol_status plugin patches the +status=+ response method to # accept the status name as a symbol. If given an integer value, # the default behaviour is used. # # Examples: # r.is "needs_authorization" do # response.status = :unauthorized # end # r.is "nothing" do # response.status = :no_content # end # # The conversion is done through Rack::Utils.status_code. module SymbolStatus module ResponseMethods # Sets the response status code by fixnum or symbol name def status=(code) code = Rack::Utils.status_code(code) if code.is_a?(Symbol) super(code) end end end register_plugin(:symbol_status, SymbolStatus) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/symbol_views.rb 0000664 0000000 0000000 00000001365 15167207754 0023640 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The symbol_views plugin allows match blocks to return # symbols, and consider those symbols as views to use for the # response body. So you can take code like: # # r.root do # view :index # end # r.is "foo" do # view :foo # end # # and DRY it up: # # r.root do # :index # end # r.is "foo" do # :foo # end module SymbolViews def self.load_dependencies(app) app.plugin :custom_block_results end def self.configure(app) app.opts[:custom_block_results][Symbol] = :view end end register_plugin(:symbol_views, SymbolViews) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/timestamp_public.rb 0000664 0000000 0000000 00000006015 15167207754 0024454 0 ustar 00root root 0000000 0000000 # frozen-string-literal: true # class Roda module RodaPlugins # The timestamp_public plugin adds a +timestamp_path+ method for constructing # timestamp paths, and a +r.timestamp_public+ routing method to serve static files # from a directory (using the public plugin). This plugin is useful when you want # to modify the path to static files when the modify timestamp on the file changes, # ensuring that requests for the static file will not be cached. # # Note that while this plugin will not serve files outside of the public directory, # for performance reasons it does not check the path of the file is inside the public # directory when getting the modify timestamp. If the +timestamp_path+ method is # called with untrusted input, it is possible for an attacker to get the modify # timestamp for any file on the file system. # # Examples: # # # Use public folder as location of files, and static as the path prefix # plugin :timestamp_public # # # Use /path/to/app/static as location of files, and public as the path prefix # opts[:root] = '/path/to/app' # plugin :public, root: 'static', prefix: 'public' # # # Assuming public is the location of files, and static is the path prefix # route do # # Make GET /static/1238099123/images/foo.png look for public/images/foo.png # r.timestamp_public # # r.get "example" do # # "/static/1238099123/images/foo.png" # timestamp_path("images/foo.png") # end # end module TimestampPublic # Use options given to setup timestamped file serving. The following option is # recognized by the plugin: # # :prefix :: The prefix for paths, before the timestamp segment # # The options given are also passed to the public plugin. def self.configure(app, opts={}) app.plugin :public, opts app.opts[:timestamp_public_prefix] = (opts[:prefix] || app.opts[:timestamp_public_prefix] || "static").dup.freeze end module InstanceMethods # Return a path to the static file that could be served by r.timestamp_public. # This does not check the file is inside the directory for performance reasons, # so this should not be called with untrusted input. def timestamp_path(file) mtime = File.mtime(File.join(opts[:public_root], file)) "/#{opts[:timestamp_public_prefix]}/#{sprintf("%i%06i", mtime.to_i, mtime.usec)}/#{file}" end end module RequestMethods # Serve files from the public directory if the file exists, # it includes the timestamp_public prefix segment followed by # a integer segment for the timestamp, and this is a GET request. def timestamp_public if is_get? on roda_class.opts[:timestamp_public_prefix], Integer do |_| public end end end end end register_plugin(:timestamp_public, TimestampPublic) end end jeremyevans-roda-4f30bb3/lib/roda/plugins/type_routing.rb 0000664 0000000 0000000 00000016311 15167207754 0023643 0 ustar 00root root 0000000 0000000 # frozen_string_literal: true # class Roda module RodaPlugins # This plugin makes it easier to to respond to specific request data types. User agents can request # specific data types by either supplying an appropriate +Accept+ request header # or by appending it as file extension to the path. # # Example: # # plugin :type_routing # # route do |r| # r.get 'a' do # r.html{ "# a # * b
" end end end end if Roda::RodaPlugins::Render::FIXED_LOCALS_COMPILED_METHOD_SUPPORT [true, false].each do |cache_plugin_option| multiplier = cache_plugin_option ? 1 : 2 it "support fixed locals in layout templates with plugin option :cache=>#{cache_plugin_option}" do template = "comp_each_test" app(:bare) do plugin :render, :views=>'spec/views/fixed', :layout_opts=>{:locals=>{:title=>"Home"}}, :cache=>cache_plugin_option, :template_opts=>{:extract_fixed_locals=>true} plugin :each_part route do each_part([1], template) end end key = [:_render_locals, "comp_each_test"] app.render_opts[:template_method_cache][key].must_be_nil body.strip.must_equal "ct" app.render_opts[:template_method_cache][key].must_be_kind_of(Array) body.strip.must_equal "ct" app.render_opts[:template_method_cache][key].must_be_kind_of(Array) body.strip.must_equal "ct" app.render_opts[:template_method_cache][key].must_be_kind_of(Array) app::RodaCompiledTemplates.private_instance_methods.length.must_equal multiplier end it "support fixed locals in render templates with plugin option :cache=>#{cache_plugin_option}" do template = "local_test" app(:bare) do plugin :render, :views=>'spec/views/fixed', :cache=>cache_plugin_option, :template_opts=>{:extract_fixed_locals=>true} plugin :each_part route do each_part([1], template, title: 'ct') end end key = [:_render_locals, template] app.render_opts[:template_method_cache][key].must_be_nil body.strip.must_equal "ct" app.render_opts[:template_method_cache][key].must_be_kind_of(Array) body.strip.must_equal "ct" app.render_opts[:template_method_cache][key].must_be_kind_of(Array) body.strip.must_equal "ct" app.render_opts[:template_method_cache][key].must_be_kind_of(Array) app::RodaCompiledTemplates.private_instance_methods.length.must_equal multiplier end [true, false].each do |assume_fixed_locals_option| [true, false].each do |freeze_app| it "caches expectedly for cache: #{cache_plugin_option}, assume_fixed_locals: #{assume_fixed_locals_option} options, with #{'un' unless freeze_app}frozen app" do template = "opt_local_test" app(:bare) do plugin :render, :views=>'spec/views/fixed', :cache=>cache_plugin_option, :template_opts=>{:extract_fixed_locals=>true}, :assume_fixed_locals=>assume_fixed_locals_option, :layout=>false plugin :each_part route do |r| r.is 'a' do each_part([1], template) end r.is 'b' do s = String.new each_part([1], template){|v| s << v} s end each_part([1], template, title: 'ct') end freeze if freeze_app end cache_size = 1 key = if assume_fixed_locals_option template else [:_render_locals, template] end cache = app.render_opts[:template_method_cache] cache[key].must_be_nil body.strip.must_equal "ct" cache[key].must_be_kind_of(Array) cache.instance_variable_get(:@hash).length.must_equal cache_size body.strip.must_equal "ct" cache[key].must_be_kind_of(Array) cache.instance_variable_get(:@hash).length.must_equal cache_size body.strip.must_equal "ct" cache[key].must_be_kind_of(Array) cache.instance_variable_get(:@hash).length.must_equal cache_size app::RodaCompiledTemplates.private_instance_methods.length.must_equal multiplier body('/a').strip.must_equal "ct" cache[key].must_be_kind_of(Array) cache.instance_variable_get(:@hash).length.must_equal cache_size body('/a').strip.must_equal "ct" cache[key].must_be_kind_of(Array) cache.instance_variable_get(:@hash).length.must_equal cache_size body('/a').strip.must_equal "ct" cache[key].must_be_kind_of(Array) cache.instance_variable_get(:@hash).length.must_equal cache_size app::RodaCompiledTemplates.private_instance_methods.length.must_equal(multiplier * cache_size) body('/b').strip.must_equal "ct" cache[key].must_be_kind_of(Array) cache.instance_variable_get(:@hash).length.must_equal cache_size body('/b').strip.must_equal "ct" cache[key].must_be_kind_of(Array) cache.instance_variable_get(:@hash).length.must_equal cache_size body('/b').strip.must_equal "ct" cache[key].must_be_kind_of(Array) cache.instance_variable_get(:@hash).length.must_equal cache_size app::RodaCompiledTemplates.private_instance_methods.length.must_equal(multiplier * cache_size) end end end end end end end jeremyevans-roda-4f30bb3/spec/plugin/early_hints_spec.rb 0000664 0000000 0000000 00000000763 15167207754 0023526 0 ustar 00root root 0000000 0000000 require_relative "../spec_helper" describe "early_hints plugin" do it "allows sending early hints to rack.early_hints" do queue = [] app(:early_hints) do |r| send_early_hints('link'=>'; rel=preload; as=script') queue << 'OK' 'OK' end body.must_equal 'OK' queue.must_equal ['OK'] queue = [] body('rack.early_hints'=>proc{|h| queue << h}).must_equal 'OK' queue.must_equal [{'link'=>'; rel=preload; as=script'}, 'OK'] end end jeremyevans-roda-4f30bb3/spec/plugin/empty_root_spec.rb 0000664 0000000 0000000 00000000474 15167207754 0023405 0 ustar 00root root 0000000 0000000 require_relative "../spec_helper" describe "empty_root plugin" do it "makes root match on emtpy path" do app(:empty_root) do |r| r.root{"root"} "notroot" end body.must_equal 'root' unless_lint do body("").must_equal 'root' end body("/a").must_equal 'notroot' end end jeremyevans-roda-4f30bb3/spec/plugin/environments_spec.rb 0000664 0000000 0000000 00000002141 15167207754 0023724 0 ustar 00root root 0000000 0000000 require_relative "../spec_helper" describe "environments plugin" do before do app app.plugin :environments, :development end it "adds environment accessor for getting/setting the environment" do app.environment.must_equal :development app.environment = :test app.environment.must_equal :test app.plugin :environments, :production app.environment.must_equal :production end it "adds predicates for testing the environment" do app.development?.must_equal true app.test?.must_equal false app.production?.must_equal false end it "adds configure method which yields if no arguments are given or an environment matches" do a = [] app.configure{a << 1} app.configure(:development){|ap| a << ap} app.configure(:test, :production){a << 2} a.must_equal [1, app] end it "defaults environment to RACK_ENV" do with_rack_env('test') do app(:environments){} end app.test?.must_equal true app.development?.must_equal false app(:environments){} app.test?.must_equal false app.development?.must_equal true end end jeremyevans-roda-4f30bb3/spec/plugin/erb_h_spec.rb 0000664 0000000 0000000 00000001626 15167207754 0022263 0 ustar 00root root 0000000 0000000 require_relative "../spec_helper" begin require 'erb/escape' rescue LoadError #warn "erb/escape not installed, skipping erb_h plugin test" else describe "erb_h plugin" do it "adds h method for html escaping" do app(:erb_h) do |r| h("