Merge pull request rails#53270 from joshuay03/fix-only-except-validation-with-string-values

[Fix rails#53269] `:only` and `:except` validation incorrectly handles string values

Author: byroot

actionpack/lib/action_dispatch/routing/mapper.rb

@@ -1268,7 +1268,7 @@ def singleton?; false; end
 
           private
             def invalid_only_except_options(options, valid_actions)
-              options.values_at(:only, :except).flatten.compact.uniq - valid_actions
+              options.values_at(:only, :except).flatten.compact.uniq.map(&:to_sym) - valid_actions
             end
         end
 

actionpack/test/controller/resources_test.rb

@@ -816,6 +816,17 @@ def test_resource_has_only_show_action
     end
   end
 
+  def test_resource_has_only_show_action_with_string_value
+    with_routing do |set|
+      set.draw do
+        resources :products, only: "show"
+      end
+
+      assert_resource_allowed_routes("products", {}, { id: "1" }, :show, [:index, :new, :create, :edit, :update, :destroy])
+      assert_resource_allowed_routes("products", { format: "xml" }, { id: "1" }, :show, [:index, :new, :create, :edit, :update, :destroy])
+    end
+  end
+
   def test_singleton_resource_has_only_show_action
     with_routing do |set|
       set.draw do
@@ -827,6 +838,17 @@ def test_singleton_resource_has_only_show_action
     end
   end
 
+  def test_singleton_resource_has_only_show_action_with_string_value
+    with_routing do |set|
+      set.draw do
+        resource :account, only: "show"
+      end
+
+      assert_singleton_resource_allowed_routes("accounts", {}, :show, [:index, :new, :create, :edit, :update, :destroy])
+      assert_singleton_resource_allowed_routes("accounts", { format: "xml" }, :show, [:index, :new, :create, :edit, :update, :destroy])
+    end
+  end
+
   def test_resource_does_not_have_destroy_action
     with_routing do |set|
       set.draw do
@@ -1113,7 +1135,7 @@ def test_invalid_only_option_for_resources
     assert_raise(ArgumentError, match: expected_message) do
       with_routing do |set|
         set.draw do
-          resources :products, only: [:foo, :bar]
+          resources :products, only: [:foo, "bar"]
         end
       end
     end
@@ -1124,7 +1146,7 @@ def test_invalid_only_option_for_singleton_resource
     assert_raise(ArgumentError, match: expected_message) do
       with_routing do |set|
         set.draw do
-          resource :products, only: [:foo, :bar]
+          resource :products, only: [:foo, "bar"]
         end
       end
     end