You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
It turns out that root endpoints were struggling with the prior patch
matching algorithm. We didn't notice this previously because we always
had at least one level of nesting inside the initial path declaration:
```ruby
json_api :api do
namespace :v1 do
get '/' => 'root_endpoint#index'
# ...
end
end
```
Since there is no `/api` route everything works just great. Things in
`v1` properly match `/api/*` including `/api/v1`. However, we now have
some endpoints which need to break away from the existing public API
wrapper. To support this they need to shift the routes to:
```ruby
namespace :api do
json_api :v1 do
get '/' => 'root_endpoint#index'
# ...
end
# .. more stuff
end
```
This causes the wild card matcher to be `/api/v1/*` which excludes a
match on `/api/v1`. We don't want the wild card to be `/api/v1*` as that
would improperly match something like `/api/v1-old`. Thus we need to
check both the actual base path and the nested wild card. However, it
turns out that using `Pathname` was the wrong choice.
While these _are_ "relative paths" the choice of `Pathname` was the
incorrect abstraction wrapper to use. The `Pathname` class is really
meant for _file system_ paths. While it has nice support for things like
`join` it is a poor choice for URI relative paths. This was discovered
when trying to find a good way to adjust the wild card. Too much was
attempting to touch the underlying server file system making this
extremely prone to info leak and general misconceptions on how things
behave.
Looking at the available URI wrappers they also have problems when
working only with partial / relative paths. Instead it turns out that
the simple old school string comparison is not only _fast_ but it is
also the simplest solution. To ensure we don't end up with something
like `/api/v1//` for the nested path we use the `normalize_path` helper.
This ensures consistent formatting and will strip off any trailing
separators.
0 commit comments