Class: Otto::RouteHandlers::HandlerFactory

Inherits:
Object
  • Object
show all
Defined in:
lib/otto/route_handlers/factory.rb

Overview

Factory for creating appropriate handlers based on route definitions

Class Method Summary collapse

Class Method Details

.apply_handler_wrappers(handler, route_definition, otto_instance) ⇒ Object

Compose registered wrappers outermost-first. Built innermost-out so reverse_each yields a final order of: w1(w2(…(RouteAuthWrapper(base)))).



60
61
62
63
64
65
66
67
68
69
70
71
72
73
 
# File 'lib/otto/route_handlers/factory.rb', line 60

def self.apply_handler_wrappers(handler, route_definition, otto_instance)
  wrappers = otto_instance&.handler_wrappers
  return handler if wrappers.nil? || wrappers.empty?

  wrappers.reverse_each do |factory|
    wrapped = factory.call(route_definition, handler)
    unless wrapped.respond_to?(:call)
      raise TypeError,
            "handler wrapper must return an object responding to :call, got #{wrapped.class}"
    end
    handler = wrapped
  end
  handler
end

.create_handler(route_definition, otto_instance = nil) ⇒ BaseHandler

Create a handler for the given route definition

Parameters:

  • route_definition (Otto::RouteDefinition) —

    The route definition

  • otto_instance (Otto) (defaults to: nil) —

    The Otto instance for configuration access

Returns:



17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
 
# File 'lib/otto/route_handlers/factory.rb', line 17

def self.create_handler(route_definition, otto_instance = nil)
  # Create base handler based on route kind
  handler_class = case route_definition.kind
                  when :logic then LogicClassHandler
                  when :instance then InstanceMethodHandler
                  when :class then ClassMethodHandler
                  when :lambda then LambdaHandler
                  else
                    raise ArgumentError, "Unknown handler kind: #{route_definition.kind}"
                  end

  handler = handler_class.new(route_definition, otto_instance)

  # Always wrap with RouteAuthWrapper to ensure env['otto.strategy_result'] is set
  # - Routes WITH auth requirement: Enforces authentication
  # - Routes WITHOUT auth requirement: Sets anonymous StrategyResult
  if otto_instance&.auth_config
    handler = Otto::Security::Authentication::RouteAuthWrapper.new(
      handler,
      route_definition,
      otto_instance.auth_config,
      otto_instance.security_config
    )
  end

  # Enforce CSRF at the handler layer, where `csrf=exempt` is visible
  # (the global CSRFMiddleware runs ahead of route matching and cannot
  # honor per-route exemption — issue #186). Wrapped OUTSIDE
  # RouteAuthWrapper so a forged unsafe request is rejected before any
  # authentication work runs. Only added when protection is enabled.
  if otto_instance&.security_config&.csrf_enabled?
    handler = Otto::Security::CSRFEnforcementWrapper.new(
      handler,
      route_definition,
      otto_instance.security_config
    )
  end

  apply_handler_wrappers(handler, route_definition, otto_instance)
end