ruby-grape / grape / 42261138475

100%

master: 100%

Pull #3055

github

Keep grape.allowed_methods from leaking into the next app's env

When a path has no route for the request's method, the router answers
through the allowed-methods route and sets env['grape.allowed_methods']
so the endpoint knows to answer 405 (or auto-OPTIONS) instead of running
a route block. The key was never removed. Rack::Cascade moves on from a
405 to its next app with the same env, so when that app was another
Grape API, its endpoint found the key and answered 405 as well, even for
a route that matched the method:

    Rack::Cascade.new([
      Class.new(Grape::API) { get('/items') { 'index' } },
      Class.new(Grape::API) { post('/items') { 'create' } }
    ])
    # POST /items -> 405, from the second API

The allowed-methods route now goes through its own
process_allowed_methods_route, which publishes the key for as long as
the route runs and deletes it in an ensure. The endpoint and the header
versioner, which read it, both run inside that call. process_route
loses its include_allow_header keyword.

Found while triaging #1534.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

1529 of 1529 branches covered (100.0%)

Branch coverage included in aggregate %.

7 of 7 new or added lines in 1 file covered. (100.0%)

4567 of 4567 relevant lines covered (100.0%)

30878.53 hits per line