ruby-grape / grape / 30216088388

97%

push

github

Remove request-time mutable state from Array and custom-type coercers (#2817)

* Remove request-time mutable state from Array/custom coercers

Two coercers created or mutated state at request time on instances that
are shared across requests (and cached in Types::CoercerCache):

- ArrayCoercer memoized @elem_coercer with ||= inside #call, so the
  first request to hit a shared instance wrote a new ivar (and could
  seed the unsynchronized DryTypes cache). Build it eagerly in
  initialize instead; rename the now-unused @subtype accordingly.
  SetCoercer inherits the eager build via super.

- CustomTypeCoercer#collection_symbolizer called map! on whatever the
  user's coerce_with method returned. A frozen return raised FrozenError,
  which CoerceValidator swallowed as a spurious "is invalid" 400; the
  input could also be the user's own object. dup before map! avoids the
  mutation and, unlike map, keeps a Set a Set.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Freeze coercers at construction and synchronize Grape::Util::Cache

Extends the validator freeze contract to the whole coercion layer,
naming the mechanism as Grape::Util::FreezeOnNew — extend into a class
whose instances are shared across requests and new returns a frozen
instance. A future request-time lazy ivar write raises FrozenError in
the first spec run instead of being a latent race. The module wraps new,
never initialize, so the freeze lands after the entire initialize chain
(SetCoercer assigns ivars after super); extending a hierarchy base
covers its subclasses via singleton-class inheritance.

- Extended into DryTypeCoercer (covers Primitive/Array/Set),
  CustomTypeCoercer (+ collection subclass), MultipleTypeCoercer
  (internal @type_coercers also frozen) and VariantCollectionCoercer.
  Validators::Base's hand-written new/super.freeze and
  ContractScopeValidator's end-of-initialize freeze now use the same
  module. DeepFreeze's obsolete "coercers memoize lazily" note up... (continued)

1167 of 1258 branches covered (92.77%)

Branch coverage included in aggregate %.

3799 of 3866 relevant lines covered (98.27%)

25083.71 hits per line