Padrino

Padrino 0.18.0 release

· Nathan Esquenazi ruby update

Padrino 0.18.0 is out. It fixes a long list of bugs in the generators and the database rake tasks, makes generated apps safer by default, and adds rake db:dump. It also removes four generator components (the Ohm, MiniRecord and Dynamoid ORMs and Less) whose projects no longer work with current gems, so read the breaking changes below before you upgrade.

Thanks to @achiurizo for his work on this release, and to @ssut, @mistergibson, @Quintasan, @postmodern and @scockram for the reports behind several of these changes. The full list is in CHANGES.rdoc.

Highlights

  • rake db:dump (sq:dump, ar:dump) dumps a Postgres, MySQL or SQLite database to tmp/<env>_dump.sql, or to FILE=. It runs pg_dump, mysqldump or sqlite3, which must be on your PATH.
  • Database tasks that work:
    • rake db:create creates a missing Postgres or MySQL database on Active Record 7.1 and later, instead of reporting it as existing.
    • sq:create and sq:drop no longer need the createdb and mysql command-line clients.
    • The Sequel migrate tasks run in a project with no migrations yet.
  • Safer generated apps:
    • The session cookie is Secure in production.
    • The session secret comes from SESSION_SECRET when it is set.
    • Apps that set Sinatra's host_authorization (Sinatra 4.1 or later) now get that check.
  • Generators:
    • Re-running padrino g component keeps the files you edited.
    • Field modifiers work in any order (email:string:uniq:index).
    • Sequel references fields become indexed foreign keys.
    • Mongoid models get valid field types.
    • Invalid names and options print a message and exit 1, instead of a backtrace.
  • The admin uses Bootstrap 3.4.1 (was 3.1.0), and its erb and slim list pages get the right menu classes.
  • Fixes in the running app:
    • Editing an ActiveSupport::Concern no longer breaks reloading until a restart.
    • Apps mounted under a sub-path serve shared assets.
    • A malformed URL gets a 404 instead of a 500.
    • Sending an email no longer changes how erb templates escape elsewhere in the process.
    • WEBrick shuts down cleanly on TERM.

Breaking changes

  • Removed generator components: the Ohm, MiniRecord and Dynamoid ORMs and the Less stylesheet engine. Projects generated with them no longer work with current gems. 0.18 doesn't change how existing apps run, but padrino g model, g migration, g admin and g admin_page exit with an error in projects that use one of these ORMs.
  • rake ar:create and ar:drop exit non-zero when a database can't be created or dropped, as Rails does. Scripts that ignored those errors now stop there.
  • SqlHelpers.create_db and drop_db take the app's Sequel connection options (create_db(Sequel::Model.db.opts, charset, collation)), if your Rakefile calls them directly.
  • Apps mounted under a sub-path serve files from the shared public/ under their prefix when their own public/<app> doesn't have them. Such a file answers before the app's routes: with public/robots.txt, an app mounted at /blog serves that file for /blog/robots.txt instead of its own get '/robots.txt'.
  • host_authorization: an app that sets set :host_authorization, permitted_hosts: [...] now answers 403 for other hosts. Apps that don't set it are unchanged.
  • Inflections without ActiveSupport: singularize keeps words like status, address and analysis intact. Nested routes with parent: :status use params[:status_id] (was :statu_id).

Upgrading from 0.17

  1. In your Gemfile, set gem 'padrino', '~> 0.18.0', then run bundle update padrino. If your Gemfile lists the padrino-* gems instead of padrino, set each one's version and name them: bundle update padrino-core padrino-helpers ....

  2. If your project uses Ohm, MiniRecord, Dynamoid or Less, switch it first, and answer yes when asked:

    • The ORM: padrino g component --orm=activerecord (MiniRecord models are Active Record models), --orm=sequel or --orm=mongoid.
    • Less: padrino g component --stylesheet=sass (or scss, tailwind).

  3. After switching, remove what the old component left behind:

    • Gemfile: the old gems (mini_record; rack-less, less and therubyracer; Ohm's or Dynamoid's gems). Then run bundle install.
    • Rakefile: PadrinoTasks.use(:minirecord). The switch already added the new ORM's line.
    • MiniRecord: ActiveRecord::Base.auto_upgrade! in config/boot.rb.
    • Leaving Active Record: use ConnectionPoolManagement in each app, and lib/connection_pool_management_middleware.rb.
    • Less: register LessInitializer in app/app.rb, and config/initializers/less.rb.

    Then port your models to the new ORM.

  4. If a script runs rake ar:create or ar:drop and expects it to carry on after an error, handle the non-zero exit.

  5. If an app is mounted under a sub-path, check that no file in the shared public/ has the same path as one of its routes. If no other app needs the file, rename or remove it. Otherwise, give the app a public folder of its own that isn't public/<app>:

    • for example, create blog/public with a .keep file, so git keeps it;
    • move the app's files from public/blog into it;
    • add set :public_folder, File.join(__dir__, 'public') to the app.

    The folder must exist.

  6. If an app sets host_authorization, make sure permitted_hosts lists every host it is served on.

    • The port doesn't matter.
    • Behind a proxy that sends X-Forwarded-Host (or Forwarded: host=), both that host and the Host the proxy sends must be listed, or have the proxy pass the original Host.
    • Rack::Test requests use example.org, so add it in the test environment, or the app's tests get 403.

  7. In projects without ActiveSupport, check nested routes whose parent ends in -s, -ss or -sis, and the url(...) calls that pass its id. Projects that load ActiveSupport, including every project with a generated admin, are unaffected.

  8. Generated files are yours, so existing projects keep their old defaults. To adopt the new ones:

    • Session cookie: change set :sessions, same_site: :lax to set :sessions, same_site: :lax, secure: Padrino.env == :production in every app, including admin/app.rb. The apps share one cookie, and an app without it rewrites the cookie without Secure. Production then sends the cookie only over HTTPS: served over plain HTTP, logins and form posts fail. Behind a proxy that terminates TLS, have it send X-Forwarded-Proto: https.
    • Session secret: in config/apps.rb, use set :session_secret, ENV.fetch('SESSION_SECRET') { '<your current secret>' }. SESSION_SECRET must be 64 characters or more (padrino rake secret prints one). An empty or shorter value makes every request fail with a 500.
    • Admin: to move to Bootstrap 3.4.1, generate an admin in a scratch project and copy public/admin/stylesheets/bootstrap.css, application.css and public/admin/javascripts/bootstrap/* together. Carry over any changes you made to application.css; Font Awesome moved into it. Bootstrap 3.4.1 sanitizes HTML in tooltips and popovers.
    • Smaller fixes in generated files, if they apply to your project:
      • cucumber.yml: use --tags 'not @wip', and drop --strict on cucumber 12.
      • Bacon: add Bacon.summary_on_exit after the boot line in test/test_config.rb, so a failing suite exits non-zero.
      • Sequel on Postgres or MySQL: add test: false to the Sequel.connect calls in config/database.rb, so rake sq:create can create a missing database.
      • Mongoid 9: add Time.zone_default ||= Time.find_zone!('UTC') to config/database.rb.

  9. Run your test suite and boot the app.

Ruby 2.7.8 or later, Sinatra 4 and Rack 3 are still required, as in 0.17.

comments powered by Disqus

Type to search the guides.