ruby-grape / grape / 32219576460

97%

push

github

Remove http_digest (#2849)

Nothing it could reach has existed since 2.0.0. #2361 removed
Rack::Auth::Digest and Grape's :http_digest strategy after Rack 3 dropped
digest authentication, but Grape::Middleware::Auth::DSL#http_digest survived
and kept recording its settings, so an API declaring it still booted --
and then raised Grape::Exceptions::UnknownAuthStrategy on the first request,
from inside the middleware build, as an uncaught exception rather than a
response. A misconfiguration only visible in production.

The 4.0 UPGRADING notes still used `auth :http_digest, realm: 'API', opaque:
'secret'` as a worked example of a supported call, so the documentation
pointed at it too. That section is rewritten, and the removal documented.

Removing the sugar rather than validating the strategy when `auth` is called:
#auth deliberately records whatever it is given and resolves the strategy when
the middleware is built, which is what lets an application register its own.
That contract is specified -- validating early breaks it, and would break
registering a strategy after the API class is defined. `auth :http_digest`
therefore still works for anyone who registered one; only the sugar is gone,
along with the two defaults it supplied (realm 'API Authorization', opaque
'secret'), which UPGRADING spells out.

The DSL specs used :http_digest as their example label for #auth itself. They
now use a neutral :custom, which keeps the distinction the specs are actually
about: #auth records a label, the strategy behind it is looked up later.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

1211 of 1301 branches covered (93.08%)

Branch coverage included in aggregate %.

3828 of 3895 relevant lines covered (98.28%)

26981.89 hits per line