Skip to content

actionpack: type HttpAuthentication Basic, Digest and Token controller methods - #1098

Merged
github-actions[bot] merged 1 commit into
ruby:mainfrom
apiology:type-actioncontroller-http-authentication
Oct 15, 2026
Merged

github-actions[bot] merged 1 commit into
ruby:mainfrom
apiology:type-actioncontroller-http-authentication

Conversation

@apiology

Copy link
Copy Markdown
Contributor

Claude: This PR was written by Claude Code on behalf of @apiology.

Problem:

Rails documents authenticate_with_http_token as: "Returns the return value of login_procedure if a token is found. Returns nil if no token is found." The RBS declares the block and the method as -> boolish, so the documented pattern loses the user's type:

class AuthController < ActionController::Base
  def show
    authenticate_with_http_token { |token, options| token.length + options.size }&.succ
  end
end
[error] Type `top` does not have method `succ`
│ Diagnostic ID: Ruby::NoMethod

The Basic and Digest controller methods are all untyped in actionpack-generated.rbs, and in 7.2 their blocks receive no parameters.

Solution: In 7.2 and 8.1, hand-type Token, Basic and Digest in actioncontroller.rbs, removing the matching generated declarations as 8.1 already does for Token:

  • Token and Basic make the block's return a type parameter, like Thread::Mutex#synchronize: authenticate_with_* returns T?, and the or-request forms return T | String.
  • The request_*_authentication methods return String, since they end in render.
  • Basic's name and password and Digest's username are String?, because Rails passes nil for a malformed header.

Tests in 7.2/_test and 8.1/_test fail before this change and pass after.

References: http_authentication.rb v8.1.4, rendering.rb v8.1.4

🤖 Generated with Claude Code

https://claude.ai/code/session_01EhUSLUimEYJyCZv8NdQGKb

…r methods

The Token methods return the block value (or nil without a token), and the
request_*_authentication methods return the rendered body. Basic and Digest
replace the generated untyped signatures, which declared zero-argument blocks
in 7.2.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EhUSLUimEYJyCZv8NdQGKb
@apiology
apiology marked this pull request as ready for review October 14, 2026 19:16
@github-actions

Copy link
Copy Markdown

@apiology Thanks for your contribution!

Please follow the instructions below for each change.
See also: https://github.com/ruby/gem_rbs_collection/blob/main/docs/CONTRIBUTING.md

Available commands

You can use the following commands by commenting on this PR.

  • /merge: Merge this PR if CI passes

actionpack

You changed RBS files for an existing gem.
You need to get approval from the reviewers of this gem.

@ksss, @tk0miya, please review this pull request.
If this change is acceptable, please make a review comment including APPROVE from here.
Screen Shot 2024-03-19 at 14 13 36

After that, the PR author or the reviewers can merge this PR.
Just comment /merge to merge this PR.

@ksss ksss left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

APPROVE

@github-actions

Copy link
Copy Markdown

Thanks for your review, @ksss!

@apiology, @ksss This PR is ready to be merged.
Just comment /merge to merge this PR.

@apiology

Copy link
Copy Markdown
Contributor Author

/merge

@github-actions
github-actions Bot merged commit 37e2e1c into ruby:main Oct 15, 2026
8 checks passed
apiology added a commit to iftheshoefritz/solargraph-rails that referenced this pull request Oct 16, 2026
* Let FORCE_UPDATE drop skips on RBS-typed definition entries

The update path never removed a skip when the pin came from RBS, so
entries such as File#sum stayed skipped after their types matched.
Keep the guard only for entries skipped by removed_in/added_in, where
an RBS pin can outlive the Rails version the method exists in.

Drops the now-stale skips found by FORCE_UPDATE across the CI matrix.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EhUSLUimEYJyCZv8NdQGKb

* Type HTTP authentication controller methods

Bump the pinned gem_rbs_collection revision from c26eeb2 to 37e2e1c,
which adds ruby/gem_rbs_collection#1098: HttpAuthentication Basic,
Digest and Token types for actionpack 7.2 and 8.1.

Rails 7.0 and 7.1 resolve actionpack's 6.0 RBS, which lacks them, so
load annotations with the same signatures only when the app's
actionpack is older than 7.2 (or Solargraph is too old to read gem
RBS). Regenerate actioncontroller.yml with FORCE_UPDATE.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EhUSLUimEYJyCZv8NdQGKb

* Scope authenticate_with_http_token skips to Rails

On Solargraph 0.57.0 and 0.58.2, #authenticate_with_http_token stays
undefined on Rails 7.0 and 7.1, where actionpack 6.0 RBS wins over the
annotation, but is typed on Rails 7.2 and 8.0. FORCE_UPDATE now scopes
those skips to Rails 7.0 and 7.1.

Drop the unused block parameters from the HTTP authentication
annotations for Naming/BlockForwarding; anonymous block forwarding is
a syntax error on Ruby 3.0, which Rails 7.0 and 7.1 run on in CI.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EhUSLUimEYJyCZv8NdQGKb

* Type http_basic_authenticate_with options keys

Raw Hash says nothing about contents. options is a keyword rest
parameter, so its keys are Symbols; the RBS collection types the
values as untyped (**untyped options).

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EhUSLUimEYJyCZv8NdQGKb

* Scope pre-7.2 annotations to Rails, not actionpack

Rails gems share one version number, and ActiveRecord needs the same
pre-7.2 split as actionpack: the RBS collection types
Persistence::ClassMethods#create and ActiveRecord::Base.create! only
from activerecord 7.2 on.  Rename actionpack_before_7_2 to
rails_before_7_2, check railties for it, and move those two
annotations there so they no longer load on Rails 7.2 and later.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EhUSLUimEYJyCZv8NdQGKb

* Exclude rails_before_7_2 annotations like their source

The ActiveRecord annotations moved from active_record.rb keep its
compact class style and named block parameters, so RuboCop needs the
same todo exclusions for their new file.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EhUSLUimEYJyCZv8NdQGKb

* Explain rails_before_7_2 in a README

Replace the two per-file header comments, which described the
directory rather than their files, with one README.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EhUSLUimEYJyCZv8NdQGKb

* Point VERSION_SCOPED_ANNOTATIONS at its README

The constant's comment restated annotations/README.md. Keep the shape
there and move the Solargraph-before-0.53 note into the README. Add
the missing @return tags on gem_rbs_supported? and
gem_version_satisfies?.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EhUSLUimEYJyCZv8NdQGKb

* Scope pre-7.2 annotations by activesupport

Apps can use ActiveRecord or ActionPack without railties, and then the
rails_before_7_2 annotations never loaded, leaving Rails 7.0/7.1 apps
untyped.  Check activesupport instead, which every Rails gem depends on
at its own version, and load the annotations when it is not loaded:
they type what the 7.2 RBS types, so loading is the safe side when the
Rails version is unknown.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EhUSLUimEYJyCZv8NdQGKb

* Expect String from request_http_token_authentication

The entry expected void and was skipped on every version, so it tested
nothing.  The RBS collection and the rails_before_7_2 annotations type
it as String.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EhUSLUimEYJyCZv8NdQGKb

* Unskip request_http_token_authentication

CI finds it present and String on every Solargraph and Rails version
in the matrix.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EhUSLUimEYJyCZv8NdQGKb

---------

Co-authored-by: Claude Opus 5.5 (1M context) <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants